Privacy Policy — How w388 Handles Your Personal Data

w388 ("we," "us," "our," or "the Company") operates the online casino and sports betting platform accessible at w388.im (the "Platform"). This Privacy Policy sets out in clear and transparent terms how w388 collects, processes, stores, and protects the personal data of every individual who visits, registers on, or interacts with the w388 Platform — including players based across Karachi, Lahore, Islamabad, Faisalabad, and throughout Pakistan.

We understand that handing over personal information to an online gaming platform requires a significant degree of trust. That trust is something w388 takes seriously. We do not sell your data. We do not share it with advertisers. We collect only what we genuinely need to operate a safe, licensed, and legally compliant platform — and we handle it with the level of care that every w388 player deserves.

This Privacy Policy applies to all personal data collected through the w388 website, mobile-optimised browser interface, live chat support system, email communications, and any promotional campaigns run by w388. It should be read together with our Terms & Conditions and Responsible Gaming policy, both of which form part of the broader legal framework governing your use of w388.

w388 collects personal data through several channels, including account registration forms, payment processing flows, identity verification procedures, customer support interactions, and automated technical systems. The categories of personal data we collect are as follows:

w388 does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, or health data, except where a player voluntarily discloses information relating to a gambling-related health concern through our responsible gaming tools — in which case such data is handled with the highest level of confidentiality and used solely to provide the player with appropriate support.

w388 uses your personal data only for the purposes it was collected and only to the extent reasonably necessary to fulfil those purposes. The following table summarises our primary processing activities:

w388 does not use your personal data to send unsolicited marketing communications without your explicit consent. Where you have opted in to receiving promotional updates from w388 — including news about PSL cricket betting offers, slot game launches, or deposit bonus campaigns — you may withdraw that consent at any time by updating your notification preferences in your w388 account dashboard or by contacting our support team.

w388 processes personal data on the following legal bases, in accordance with internationally recognised data protection standards:

• Contractual necessity: Processing required to fulfil our obligations under the account Terms & Conditions, including operating your account, processing financial transactions, and providing customer support.
• Legal obligation: Processing required to comply with our international gaming licence conditions, anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and any lawful request from regulatory or law enforcement authorities.
• Legitimate interests: Processing carried out in the genuine interest of w388 or our players — including fraud prevention, platform security, responsible gaming monitoring, and improving our services — where those interests are not overridden by your privacy rights.
• Consent: Where w388 processes data based on your consent — such as sending optional promotional communications — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

w388 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data with external parties only in the following strictly defined circumstances:

• Identity verification providers: We share identity and document data with our KYC verification partners who carry out age and identity checks on behalf of w388. These partners are contractually bound to handle data securely and use it only for the purpose of verification.
• Payment processing partners: Financial data is shared with Pakistani payment networks including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK solely to process deposits and withdrawals. Card transactions are handled by PCI-DSS certified gateway partners.
• Fraud prevention and AML services: We share relevant transactional and identity data with fraud detection and anti-money laundering screening services to protect the integrity of the w388 platform.
• Regulatory and law enforcement authorities: w388 will disclose personal data to licensing authorities, regulators, or law enforcement agencies where required by law, valid court order, or the conditions of our gaming licence — without prior notice to the player where legally prohibited.
• Game content providers: Aggregated, anonymised usage data (not personally identifiable) may be shared with our casino game studio partners for the purposes of improving game performance and RTP reporting.
• Cloud infrastructure and IT service providers: Technical data is processed by w388's hosting and cloud infrastructure providers under data processing agreements that require them to maintain equivalent levels of data security.

All third parties with whom w388 shares personal data are subject to data processing agreements that prohibit them from using your data for any purpose beyond what is necessary to perform their specific service.

w388 uses cookies and similar tracking technologies to operate the platform effectively, maintain your session, and understand how players interact with our site. The following types of cookies are used on w388.im:

• Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, security tokens, and load balancing identifiers. These cannot be disabled without breaking core functionality.
• Functional cookies: Store your preferences such as display language, default sports market, and responsible gaming reminder settings so you do not need to re-enter them on each visit.
• Analytics cookies: Used by w388's internal analytics systems to understand aggregate player behaviour — such as which sports markets are most visited, which slot games generate the most sessions, and how players navigate between sections. This data is anonymised before analysis.
• Security cookies: Used to detect suspicious login patterns, unusual session activity, and potential fraud indicators. These operate silently in the background to protect your w388 account.

You may manage your cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in or using core platform features. For functional and analytics cookies, your preference can be updated at any time without affecting your ability to use w388.

w388 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, and to comply with our legal and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the full duration of your w388 account and for a minimum of 5 years following account closure, in line with standard AML and gaming licence record-keeping requirements.
• KYC and identity documents: Retained for a minimum of 5 years following the completion of verification, or longer if required by our licensing authority or applicable law.
• Financial transaction records: Retained for 7 years in line with standard financial record-keeping obligations applicable to licensed gaming operators.
• Customer support communications: Retained for 3 years from the date of the interaction, or longer if the communication relates to an unresolved dispute or ongoing investigation.
• Technical and usage data: Retained in aggregated, anonymised form indefinitely for platform improvement purposes. Personally identifiable technical logs are deleted after 12 months.
• Responsible gaming records: Self-exclusion and problem gambling intervention records are retained indefinitely to prevent re-registration and to protect players who have previously requested exclusion.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with w388's internal data disposal procedures.

w388 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our key security measures include:

• Encryption in transit: All data transmitted between your device and the w388 platform is encrypted using TLS 1.3 (Transport Layer Security). Our site runs exclusively over HTTPS.
• Encryption at rest: Sensitive personal and financial data stored in w388's databases is encrypted at rest using AES-256 encryption standards.
• Access controls: Access to player personal data within w388's internal systems is strictly limited to personnel who require it to perform their job function. All internal access is logged and audited regularly.
• Two-factor authentication: w388 offers optional two-factor authentication (2FA) for player accounts. We strongly encourage all Pakistani players to enable 2FA via their account security settings for an added layer of protection.
• Regular penetration testing: Our platform undergoes regular independent penetration testing and security audits by certified third-party cybersecurity firms to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach affecting your personal data, w388 will notify you and the relevant regulatory authority within the timeframe required by applicable law, and take immediate remediation action.

As a w388 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team via live chat or at the email address listed in the footer of this page:

• Right of access: You may request a copy of the personal data w388 holds about you at any time. We will respond to verified access requests within 30 days.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to erasure: You may request that w388 delete your personal data where it is no longer necessary for the purpose it was collected, subject to overriding retention obligations under our gaming licence and AML requirements.
• Right to restrict processing: You may request that w388 limit the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to data portability: You may request a structured, machine-readable copy of the personal data you have provided to w388, where processing is based on consent or contractual necessity.
• Right to object: You may object to w388 processing your personal data on the basis of legitimate interests, including profiling for personalisation purposes.
• Right to withdraw consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

w388 will not charge a fee for handling data rights requests in ordinary circumstances. Where requests are manifestly unfounded or excessive, w388 reserves the right to charge a reasonable administrative fee or decline to act on the request, with written notice explaining the decision.

The w388 platform is strictly for adults aged 21 years and above. w388 does not knowingly collect, process, or retain personal data from individuals under the age of 21. If we become aware that personal data has been submitted by a person under 21, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a person under the age of 21 may have registered on w388 using personal information that includes yours or your child's data, please contact our support team immediately. We will investigate and take appropriate action without delay.

As an internationally licensed online gaming operator, w388 may transfer personal data to, and process it in, countries outside of Pakistan. This may occur when data is processed by our cloud infrastructure providers, KYC verification partners, or payment gateway services operating from other jurisdictions.

Where such transfers occur, w388 takes appropriate steps to ensure that your personal data receives a level of protection equivalent to that applied within Pakistan, including through the use of contractual safeguards with our international service providers that impose binding data protection obligations consistent with internationally recognised standards.

By registering on w388 and accepting these policies, you consent to the transfer of your personal data to w388's international service partners under the safeguards described in this section.

w388 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, new legal requirements, enhancements to our platform, or feedback from players and regulators. When material changes are made, we will notify registered players via the platform's notification system or by email to the address registered on your account, at a minimum of 7 days before the changes take effect where practicable.

The "Last Updated" date at the top of this policy will be revised on each update. We recommend that you review this Privacy Policy periodically to stay informed of how w388 protects your data. Continued use of the w388 platform after a policy update constitutes acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data w388 holds about you, please contact our support team through any of the following channels:

• Live Chat: Available 24/7 directly within the w388 platform — the fastest way to reach our support team for urgent privacy concerns.
• Email: You can reach our data enquiries team at [email protected] — please include "Privacy Request" in the subject line along with your registered username so we can locate your account quickly.

w388 aims to acknowledge all privacy-related enquiries within 24 hours and to provide a full written response within 30 days of receiving a verified request. For complex data access or erasure requests, this period may be extended to 60 days with written notice to the player.