How We Handle Your Data
We process personal data only where we have a lawful basis to do so. Here is a plain-English summary of our six core privacy commitments before you read the full policy detail below.
Introduction
This Privacy Policy ("Policy") is published by 2888rs ("we", "us", "our") and applies to all users ("you", "your") of the 2888rs platform accessible at https://2888rs.cam ("Platform"). It describes how we collect, use, store, share and protect your personal data in connection with your use of the Platform.
We are committed to handling personal data responsibly and transparently. This Policy is written in plain, professional English and is intended to be clearly understood. It should be read alongside our Terms & Conditions, which govern the use of the Platform more broadly. Where any conflict exists between this Policy and the Terms & Conditions on privacy matters, this Policy shall prevail.
The Platform is an English-language informational and gaming service targeting Pakistani users in cities including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. We process data for users located in Pakistan and internationally where our service is accessed.
Pakistan Privacy Notice: Pakistan's data protection landscape is evolving. The Personal Data Protection Bill and related regulatory developments may affect how your data rights are exercised locally. This Policy is not a substitute for legal advice under Pakistani law. Users are encouraged to review applicable data protection legislation in their own jurisdiction.
Definitions
The following definitions apply throughout this Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data. |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction. |
| "Data Controller" | 2888rs, which determines the purposes and means of processing personal data collected through the Platform. |
| "Data Processor" | Any third-party service provider that processes personal data on behalf of 2888rs under a binding data processing agreement. |
| "Consent" | A freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for a specified purpose. |
| "KYC" | Know Your Customer — identity and document verification procedures required for regulatory compliance and account activation. |
| "Cookie" | A small data file placed on your device by the Platform for functional, analytical or preference-recording purposes. |
| "Data Breach" | A security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. |
Data We Collect
We collect personal data across several categories depending on how you interact with the Platform. The categories and examples of data within each are as follows:
| Category | Examples of Data Collected |
|---|---|
| Identity Data | Full legal name, date of birth, nationality, gender, government-issued ID number (CNIC, passport or driver's licence number). |
| Contact Data | Email address, registered mobile number, residential address including city (e.g., Karachi, Lahore, Islamabad). |
| Account Data | Username, encrypted password, account preferences, communication history with support, session logs. |
| Financial Data | Deposit and withdrawal transaction records, payment method references (masked card numbers, account identifiers for methods such as Easypaisa, JazzCash or Raast — for context only, not implying endorsement), account balances. |
| KYC Documentation | Copies of government-issued photo ID, proof of address documents, source of funds documentation where required. |
| Technical Data | IP address, device type and identifiers, browser type and version, operating system, referring URLs, time zone setting, session duration. |
| Usage Data | Pages visited, features used, betting and gaming activity records, search queries within the Platform, click patterns. |
| Communications Data | Records of live chat interactions, support ticket content, email correspondence, feedback and survey responses. |
Special Category Data: We do not intentionally collect special category data (e.g., health, ethnicity, religious beliefs) unless it is volunteered by you in the context of a responsible gambling or self-exclusion request, where it is used solely to provide the support you have requested.
How We Collect Your Data
We collect personal data through the following channels:
- Direct interactions: Data you provide when registering an account, completing KYC, submitting support requests, responding to surveys or contacting us by any means.
- Automated technologies: Technical and usage data collected automatically when you access the Platform, including through cookies, server logs and analytics tools.
- Third-party verification providers: Identity and fraud-check data received from KYC and anti-money laundering service providers as part of our regulatory compliance obligations.
- Payment processors: Transaction confirmation data and payment method reference identifiers received from payment processing partners in connection with deposits and withdrawals.
- Publicly available sources: Where permitted by applicable law, data from public records or databases used to verify identity, assess fraud risk or comply with sanctions-screening obligations.
Lawful Basis for Processing
We process personal data only where we have a valid lawful basis to do so. The lawful basis we rely on for different processing activities is set out below:
| Processing Activity | Lawful Basis |
|---|---|
| Account registration and management | Performance of a contract — necessary to create and maintain your account. |
| KYC identity verification | Legal obligation — required by anti-money laundering and gaming regulatory frameworks. |
| Processing deposits and withdrawals | Performance of a contract — necessary to execute financial transactions you have initiated. |
| Responsible gambling monitoring | Legal obligation and legitimate interests — to identify and support at-risk users. |
| Fraud prevention and security | Legitimate interests — protecting the Platform and users from fraudulent activity. |
| Platform analytics and performance | Legitimate interests — improving service quality, subject to your cookie preferences. |
| Marketing communications | Consent — only where you have opted in to receive promotional communications. |
| Legal claims and regulatory reporting | Legal obligation and legitimate interests — compliance with applicable law. |
Data Processing Purposes
We use the personal data we collect for the following purposes:
- To create, verify and manage your registered account, including enforcing eligibility requirements such as the 18+ age restriction or the higher minimum required by the applicable operator or license jurisdiction.
- To process deposits, withdrawals and other financial transactions associated with your account.
- To conduct KYC identity verification and anti-money laundering checks as required by applicable regulatory obligations.
- To detect, investigate and prevent fraudulent transactions, account abuse, money laundering and other prohibited conduct.
- To provide customer support, including responding to queries, complaints and data rights requests.
- To personalise your experience on the Platform based on your usage preferences and account history.
- To send you service communications — such as account notifications, transaction confirmations and security alerts — that are necessary for the operation of your account.
- To send you marketing and promotional communications where you have provided consent and have not subsequently withdrawn it.
- To monitor for responsible gambling indicators and, where relevant, to apply protective measures including account restrictions or referrals to support resources.
- To analyse Platform usage patterns and technical performance for the purpose of improving service quality and user experience.
- To comply with our legal, regulatory and reporting obligations in applicable jurisdictions.
Sharing Your Data
We do not sell, rent or commercially trade your personal data. We share personal data with third parties only in the limited circumstances set out below, and only to the minimum extent necessary for each specific purpose:
- KYC and identity verification providers: Third-party services used to verify your identity documents and conduct fraud and sanctions checks as part of our compliance obligations.
- Payment processing partners: Financial and payment technology providers used to execute deposit and withdrawal transactions. These providers receive only the data necessary to process the specific transaction.
- IT and infrastructure providers: Cloud hosting, data storage, security and technical support providers engaged under binding data processing agreements that prohibit secondary use of your data.
- Analytics providers: Platform performance analytics services that process anonymised or pseudonymised technical and usage data to help us understand how the Platform is used. No individually identifiable data is shared for analytical profiling.
- Regulatory authorities and law enforcement: Where we are legally required to do so, or where disclosure is necessary to prevent or detect crime, we may share personal data with competent regulatory authorities, law enforcement agencies or courts.
- Professional advisers: Solicitors, accountants and auditors under confidentiality obligations where access is necessary in connection with legal proceedings, regulatory compliance or financial reporting.
Payment Provider Clarification: References to payment methods including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah reflect familiar options in Pakistan's payments landscape. Sharing of data with payment processors relates only to specific transaction processing. It does not constitute an endorsement of gambling by those institutions, nor does it imply any formal partnership or affiliation.
Data Retention
We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. The following indicative retention periods apply:
| Data Category | Indicative Retention Period |
|---|---|
| Account & Identity Data | Duration of active account plus 5 years following account closure, unless a longer period is required by applicable law. |
| KYC Documentation | Duration of active account plus 5 years following account closure, in line with standard AML regulatory retention requirements. |
| Transaction Records | 5 years from the date of each transaction, or longer if required by financial regulation or ongoing legal proceedings. |
| Communications & Support Data | 3 years from the date of the interaction, unless relevant to an unresolved dispute or regulatory inquiry. |
| Technical & Usage Data | 13 months from collection, after which it is anonymised or deleted. |
| Marketing Consent Records | Until consent is withdrawn plus 2 years to evidence prior consent in the event of a complaint. |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised and aggregated data may be retained indefinitely for statistical and research purposes.
Data Security
We implement appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include:
- AES-256 encryption for personal data stored at rest within our systems.
- TLS/HTTPS encryption for all data transmitted between your device and our servers.
- Role-based access controls ensuring that personal data is accessible only to staff members with a legitimate operational need.
- Multi-factor authentication requirements for staff accessing systems containing personal data.
- Regular internal security assessments, vulnerability scanning and penetration testing of Platform infrastructure.
- Incident response procedures designed to detect, contain and remediate data breaches promptly.
- Contractual data security obligations imposed on all third-party service providers who process personal data on our behalf.
You are responsible for maintaining the security of your account credentials. Use a strong, unique password for your 2888rs account and do not share it with anyone. If you believe your account has been compromised, contact the support team immediately via Live Chat or the Help Centre within your account.
Important: Do not send identity documents, passwords or sensitive financial information by email. Use the secure HTTPS verification portal within your account for all document submissions. We will never ask for your password by email or live chat.
Cookies & Tracking Technologies
The Platform uses cookies and similar tracking technologies to operate correctly, remember your preferences and understand how the Platform is used. The categories of cookies used are as follows:
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Essential for the Platform to function — session management, security tokens, login state. Cannot be disabled without breaking core functionality. | No — applied automatically |
| Functional / Preference | Remember your language, display preferences and responsible gambling settings between sessions. | No — based on legitimate interest |
| Analytical | Aggregate, anonymised data on how users interact with the Platform — page visits, session duration, error rates. Used solely to improve service quality. | Yes — consent required |
We do not use third-party advertising cookies, behavioural targeting cookies or cross-site tracking pixels that profile you for commercial resale. You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform.
Your Data Rights
Subject to applicable law and certain regulatory exceptions, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 15 of this Policy. We will respond to valid requests within 30 calendar days.
Note on Regulatory Exceptions: Certain rights may be limited or overridden where we are required by law to retain personal data — for example, KYC records required under anti-money laundering regulation. Where we cannot fulfil a deletion request in full, we will explain the reason clearly in our response.
Minors & Age Restrictions
The Platform is strictly for adults. We do not knowingly collect personal data from any person under the age of 18, or under the higher minimum age required by the applicable operator or license jurisdiction. The Platform is not directed at, and is not intended to be used by, minors.
Age verification is a mandatory part of the KYC process. Where we discover that personal data has been collected from a minor — whether through failure of age verification or misrepresentation — we will delete that data as promptly as possible, close the associated account and, where relevant, report the matter to appropriate regulatory authorities.
If you are a parent or guardian and believe that a minor in your care has registered on the Platform and provided personal data without your knowledge, please contact us immediately using the details in Section 15.
International Data Transfers
In the course of providing the Platform and its associated services, your personal data may be transferred to and processed in countries other than Pakistan. This may occur where our servers, KYC providers, payment processors or analytics partners are located in different jurisdictions.
Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect the data to a standard equivalent to or greater than the protections described in this Policy. These safeguards may include:
- Standard contractual clauses or equivalent data transfer mechanisms between 2888rs and the receiving entity.
- Binding corporate rules where the transfer is within a group of companies subject to shared data governance standards.
- Adequacy decisions or equivalent legal instruments where the destination country provides an adequate level of data protection.
You may request further information about the specific safeguards applied to international transfers of your personal data by contacting us using the details in Section 15.
Policy Amendments
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory guidance or Platform functionality. When we make material changes, we will notify registered users via their registered email address or by posting a prominent notice on the Platform prior to the changes taking effect.
The effective date at the top of this Policy indicates when the current version was last reviewed and confirmed. Your continued use of the Platform following the effective date of any amended Policy constitutes your acknowledgement of the changes. We encourage you to review this Policy periodically to remain informed about how we protect your data.
Contact Us
For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact us using the following details. We aim to respond to all data rights requests and privacy enquiries within 30 calendar days of receiving a valid request.
Do not send identity documents or sensitive personal information by email. Use the secure HTTPS verification portal within your account for all document submissions. Email communications should be limited to general privacy enquiries and data rights requests.
Your Data, Your Rights
Now that you have reviewed our Privacy Policy, explore the rest of the 2888rs platform. Read our full Terms & Conditions, check our Responsible Gambling guidance, or head back to the homepage.
18+ only, or the higher minimum required by the operator/license jurisdiction. Local laws may restrict gambling. Play responsibly.