Privacy Policy — 89ef

1. Introduction

1.1 This Privacy Policy ("Policy") is published by the operator of the 89ef platform ("89ef", "Operator", "we", "us" or "our"), accessible at https://89ef.cam. It describes how we collect, use, store, share and protect personal data relating to users of the platform ("you", "User" or "Data Subject").

1.2 We process personal data in accordance with the data protection laws and regulations applicable in the jurisdiction in which we are licensed. By registering an account or using our Services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

1.3 This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference.

1.4 If you have any questions regarding this Policy or how we handle your data, please contact us using the details set out in Section 16.

2. Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, financial details, IP address and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, retrieval, use, disclosure, erasure or destruction.
• "Data Controller" means 89ef, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of the Data Controller under a binding data processing agreement.
• "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or financial data requiring heightened protection.
• "Cookies" means small text files placed on your device by the platform to facilitate session management, analytics and personalisation.
• "Services" has the same meaning as defined in the Terms & Conditions.

3. Personal Data We Collect

3.1 The categories of Personal Data we collect depend on your interaction with the 89ef platform. The table below summarises the primary data categories:

3.2 We do not knowingly collect Personal Data from individuals under the age of 18, or the higher minimum age required by the Operator's licence jurisdiction. Where we discover that Personal Data has been collected from an underage individual, we will take steps to delete that data promptly.

4. How We Collect Your Data

We collect Personal Data through the following means:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey.
• Automated collection: When you browse or interact with the platform, we collect Technical Data automatically via cookies, web beacons, server logs and similar tracking technologies.
• Third-party sources: We may receive Personal Data from identity verification service providers, fraud prevention databases, payment processing partners and, where applicable, publicly available sources — for the purposes of KYC compliance and fraud prevention only.
• Responsible gambling monitoring: Betting and gaming behaviour data is collected automatically to support our responsible gambling obligations, including identifying patterns that may indicate problem gambling.

5. Purposes of Data Processing

5.1 We process your Personal Data for the following purposes:

• Account management: Registration, authentication, account maintenance and security.
• Service delivery: Processing deposits, settling bets, paying winnings and delivering casino and sports betting services.
• KYC and compliance: Verifying your identity and age, conducting anti-money laundering (AML) and counter-terrorist financing (CTF) checks, and complying with licence conditions.
• Responsible gambling: Monitoring play patterns, enforcing deposit/loss/time limits, processing self-exclusion requests and fulfilling safer gambling obligations.
• Fraud prevention and security: Detecting, investigating and preventing fraudulent activity, multi-accounting and terms-of-service violations.
• Customer support: Handling queries, complaints and disputes submitted via chat, email or support ticket.
• Marketing and personalisation: Sending promotional communications and personalising your experience — subject to your marketing preferences and opt-out rights.
• Legal and regulatory obligations: Retaining records as required by our licence conditions, applicable law and tax obligations.
• Platform improvement: Analysing usage data in aggregate to improve platform performance, user experience and game offerings.

6. Legal Basis for Processing

6.1 Where the data protection laws of our licensing jurisdiction require us to identify a legal basis for processing, we rely on the following:

• Contractual necessity: Processing required to perform our contract with you (account management, service delivery, payments).
• Legal obligation: Processing required to comply with AML/CTF regulations, licence conditions, tax law and court orders.
• Legitimate interests: Processing for fraud prevention, platform security and aggregate analytics, where these interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where we have obtained your explicit consent. You may withdraw consent at any time.

7. Data Sharing & Third-Party Disclosure

7.1 89ef does not sell your Personal Data. We may share Personal Data with the following categories of third parties only to the extent necessary:

• Identity verification and KYC providers: Third-party services that assist in verifying identity documents and screening against sanctions and PEP databases.
• Payment processors: Entities that facilitate deposits and withdrawals. Payment method names such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are referenced contextually; actual data sharing with payment processors is governed by separate processing agreements and is limited to transaction data required to complete the payment. These references do not imply any endorsement of gambling by the named providers.
• Fraud prevention and AML platforms: Industry-shared databases and third-party fraud detection services used to identify suspicious activity.
• Game and platform technology partners: Software providers and infrastructure partners who host games or provide platform components under data processing agreements that bind them to strict confidentiality and security standards.
• Regulatory and law enforcement authorities: We will disclose Personal Data to competent authorities where required to do so by law, court order, regulatory instruction or licence condition.
• Professional advisers: Lawyers, auditors and accountants who require access to data to provide professional services, subject to professional confidentiality obligations.

7.2 All third-party Data Processors engaged by 89ef are bound by contractual obligations that require them to process data only on our documented instructions, maintain appropriate security measures, and not disclose data to additional parties without our authorisation.

8. International Data Transfers

8.1 Personal Data may be transferred to, stored in or processed in countries outside your country of residence, including countries where the Operator's infrastructure partners or technology providers are located.

8.2 Where such transfers occur, we take steps to ensure that appropriate safeguards are in place — including contractual data transfer mechanisms or adequacy decisions recognised by the relevant data protection authority — to protect your Personal Data to a standard equivalent to that required in our licensing jurisdiction.

9. Data Retention

9.1 We retain Personal Data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any applicable legal, regulatory, accounting or reporting requirements.

9.2 As a guide, the following retention periods typically apply — actual periods are determined by our licence conditions and applicable law:

• Account and transaction records: Retained for a minimum of five (5) years from account closure, as required for AML compliance.
• KYC documents: Retained for the period required by the Operator's AML/CTF obligations, typically five (5) years post-relationship termination.
• Responsible gambling records: Retained for the duration required to demonstrate compliance with safer gambling obligations.
• Marketing data: Retained until you withdraw consent or opt out of marketing, after which it is removed from active marketing lists within a reasonable timeframe.
• Technical and log data: Typically retained for up to twelve (12) months for security and troubleshooting purposes.

9.3 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised.

10. Cookies & Tracking Technologies

10.1 89ef uses cookies and similar technologies (including web beacons and local storage) to operate the platform, maintain your session, detect fraud, and analyse usage patterns.

10.2 The categories of cookies we use include:

• Strictly necessary cookies: Required for basic platform functionality (session management, authentication, fraud prevention). These cannot be disabled.
• Analytics cookies: Used to understand how users interact with the platform in aggregate, helping us improve performance and navigation. These are used only with your consent where required.
• Preference cookies: Store your language, display and responsible gambling settings between sessions.
• Marketing cookies: Used where you have consented to receive personalised promotions. You may opt out at any time via your account preferences.

10.3 You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may affect platform functionality.

11. Your Data Rights

11.1 Subject to applicable law and the data protection framework of our licensing jurisdiction, you may have the following rights in relation to your Personal Data:

11.2 To exercise any of the above rights, please contact us at the address provided in Section 16. We will respond within the timeframe required by applicable law — typically within thirty (30) days of receipt of a verifiable request.

11.3 Please note that certain rights may be restricted where compliance with a legal obligation requires us to retain or process data, or where the data is necessary to defend a legal claim.

12. Children's Privacy

12.1 The 89ef platform is strictly intended for adults aged 18 or over — or the higher minimum age required by the Operator's licence jurisdiction. We do not knowingly collect, process or retain Personal Data from individuals below the applicable minimum age.

12.2 If a parent or legal guardian believes that a minor has provided us with Personal Data, they should contact us immediately at the details in Section 16. Upon confirmation, we will take prompt steps to delete the relevant data and close any associated account.

13. Security Measures

13.1 We implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include, but are not limited to:

• SSL/TLS encryption for all data in transit between client and server;
• Encryption at rest for sensitive data including KYC documents and financial records;
• Role-based access controls limiting data access to personnel with a documented operational need;
• Multi-factor authentication requirements for platform administration systems;
• Regular security assessments, penetration testing and vulnerability scanning;
• Incident response procedures for identifying, containing and reporting data breaches.

13.2 In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected Data Subjects, in accordance with applicable law.

14. Third-Party Links

14.1 The 89ef platform may contain references to or integrations with third-party services such as game providers. This Policy does not cover the data practices of third-party providers. We encourage you to read the privacy policies of any third-party services you interact with independently of the 89ef platform.

14.2 89ef is not responsible for the content, privacy practices or data security of any third-party website or service accessed via the platform.

15. Updates to This Privacy Policy

15.1 We may update this Privacy Policy periodically to reflect changes in our data processing activities, applicable law, or regulatory requirements. The "Last Reviewed" date at the top of this document will be updated accordingly.

15.2 Where changes are material, we will notify active Account Holders via email or a prominent notice on the platform at least seven (7) calendar days before the updated Policy takes effect.

15.3 Continued use of the platform following the effective date of an updated Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you should close your account before the effective date.

16. Contact & Complaints

16.1 If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the 89ef Data Protection team. Support is provided in English and Urdu, with responses targeted within 30 calendar days for data rights requests and within 24 hours on business days for general support queries.

16.2 If you are not satisfied with our response to a data rights request or privacy complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to your situation.