Privacy Policy for qr98

qr98 ("the Platform", "we", "us", "our") is committed to protecting and respecting the privacy of every individual who interacts with our platform. This Privacy Policy ("Policy") sets out the basis on which personal data collected from you — or that you provide to us — will be processed by qr98. Please read the following carefully to understand our practices regarding your personal data.

This Policy covers all services offered under the qr98 brand, including sports betting on PSL cricket, international cricket, football, and UFC; live casino games; slot titles; e-sports betting markets; and the Caishen Fishing arcade. It applies regardless of whether you access qr98 from Karachi, Lahore, Islamabad, Faisalabad, or any other location.

This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming policy, both of which form part of the overall agreement between you and qr98.

For the purposes of applicable data protection legislation, qr98 is the data controller in respect of all personal data collected through the qr98 platform. As data controller, qr98 determines the purposes and means by which your personal data is processed.

qr98 operates under an international gaming licence and maintains data processing practices consistent with the requirements of that licence. Our data protection contact can be reached via the live chat support function available 24/7 on the qr98 website, or by emailing [email protected].

Where qr98 engages third-party processors — such as payment gateways, KYC verification providers, or game studios — those processors act under qr98's instructions and are bound by data processing agreements that restrict the use of your data to only what is necessary to provide the relevant service.

qr98 collects personal data from you through a number of channels, including the account registration process, deposit and withdrawal transactions, KYC verification submissions, live chat interactions, and your ongoing use of the platform. The categories of data we collect include:

qr98 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request, in which case such information is treated with the highest level of confidentiality.

qr98 uses the personal data collected for the following specific purposes:

• Account Management: Creating, maintaining, and securing your qr98 player account, including login authentication and session management.
• Identity & Age Verification: Confirming that all qr98 players are at least 21 years of age and that the identity details provided during registration are accurate, as required by our international gaming licence.
• Payment Processing: Facilitating PKR deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, and processing withdrawal requests back to your registered payment method.
• Gaming Services Delivery: Providing access to sports betting, live casino, slot games, e-sports markets, and the Caishen Fishing arcade, and ensuring your gaming activity is recorded accurately for settlement and dispute resolution purposes.
• Regulatory Compliance: Meeting KYC (Know Your Customer) and AML (Anti-Money Laundering) obligations under qr98's licensing terms, including transaction monitoring and suspicious activity reporting where required.
• Responsible Gaming: Monitoring gaming patterns to identify potentially problematic behaviour, applying responsible gaming limits you have set, and administering self-exclusion requests promptly and accurately.
• Customer Support: Responding to your enquiries, resolving disputes relating to bet settlements, deposit or withdrawal issues, and technical platform problems.
• Marketing Communications: Sending promotional offers, PSL cricket bonus notifications, slot tournament invitations, and personalised offers — only where you have explicitly opted in to receive such communications.
• Fraud Prevention & Security: Detecting and investigating suspected bonus abuse, multi-accounting, payment fraud, and other prohibited conduct as described in the qr98 Terms & Conditions.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the qr98 user experience, site performance, and product offering.

qr98 processes your personal data on one or more of the following legal bases, depending on the specific processing activity in question:

• Contractual Necessity: Processing your identity data, financial data, and gaming activity data is necessary to perform the contract between you and qr98 — specifically, to provide the gaming services you have registered to use, and to process your PKR deposits and withdrawals.
• Legal Obligation: Processing your KYC documents and transaction records is required for qr98 to comply with the AML and KYC obligations imposed by its international gaming licence. These obligations apply regardless of your consent and cannot be waived.
• Legitimate Interests: qr98 processes technical data, session logs, and communication records on the basis of its legitimate interest in preventing fraud, maintaining platform security, and improving its services. This processing does not override your fundamental privacy rights.
• Consent: Marketing communications and non-essential analytics cookies are processed solely on the basis of your explicit, freely given consent. You may withdraw this consent at any time without affecting any other aspect of your qr98 account.

qr98 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. Your data may be shared in the following specific and limited circumstances only:

• Payment Processors: Financial data is shared with JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank solely to facilitate your PKR deposit and withdrawal transactions. Each payment provider is subject to its own privacy policy and applicable Pakistani financial regulation.
• KYC & Fraud Prevention Providers: Identity documents may be shared with licensed third-party identity verification services to confirm your age and identity. These providers process your data strictly as instructed by qr98.
• Game Studios & Technology Providers: Game studios such as Pragmatic Play, Evolution Gaming, Habanero, and PG Soft receive limited technical data necessary to deliver their games on the qr98 platform. No personally identifiable financial data is shared with game studios.
• Regulatory & Law Enforcement Authorities: Where qr98 is required by law, court order, or regulatory instruction to disclose personal data — including for AML reporting purposes — qr98 will comply with such requirements. qr98 will notify you of such disclosure where legally permissible to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of qr98's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights in relation to it prior to completion.

All third parties with whom qr98 shares personal data are required to maintain appropriate technical and organisational security measures and to use your data only for the specific purposes for which it was shared.

qr98 uses cookies and similar tracking technologies on its website to enable core functionality, measure platform performance, and — where you have consented — to personalise your experience. The following categories of cookies are used on qr98:

• Strictly Necessary Cookies: These cookies are essential for the qr98 website to function. They manage your login session, maintain your PKR wallet balance display, and enable the secure operation of the cashier. These cookies cannot be disabled without significantly impairing your ability to use qr98.
• Performance & Analytics Cookies: These cookies collect anonymised data about how players navigate the qr98 platform — which games are most visited, how long sessions last, and where technical errors occur. This data is used solely to improve the platform. These cookies are only set with your consent.
• Functionality Cookies: These cookies remember your preferences — such as your preferred game lobby view, language setting, and responsible gaming limit display — to personalise your qr98 experience across sessions.
• Marketing Cookies: Where you have opted in to marketing communications, these cookies help qr98 present relevant promotional content — for example, PSL cricket betting offers during the Pakistan Super League season. These cookies are not used to track your activity on third-party websites.

qr98 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following retention periods apply:

• Active Account Data: Personal data associated with an active qr98 account is retained for the lifetime of the account and for a period of five (5) years following account closure, in accordance with AML record-keeping requirements.
• KYC Documents: Identity verification documents — including CNIC copies and passport scans — are retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Transaction Records: PKR deposit and withdrawal transaction records, including JazzCash, EasyPaisa, and bank transfer records, are retained for a minimum of five (5) years.
• Gaming Activity Logs: Bet placement, settlement, and session records are retained for five (5) years for regulatory compliance and dispute resolution purposes.
• Customer Support Communications: Live chat transcripts and email correspondence are retained for two (2) years from the date of the last interaction.
• Marketing Consent Records: Records of your marketing opt-in or opt-out status are retained for the duration of your account and for two (2) years following account closure.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in a manner that prevents re-identification.

As a qr98 player, you hold the following rights in respect of the personal data we hold about you. These rights may be exercised by contacting qr98 support via live chat or by emailing [email protected]:

• Right of Access: You may request a copy of all personal data qr98 holds about you. We will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data qr98 holds about you is inaccurate or incomplete, you have the right to request its correction. Account details such as contact number and email address can also be updated directly within your qr98 account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing. Please note that this right is subject to overriding legal obligations, including our AML record-keeping requirements, which may require us to retain certain data even after account closure.
• Right to Restriction: You may request that qr98 restricts the processing of your personal data in certain circumstances — for example, while a correction request is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that qr98 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on qr98's legitimate interests. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent — such as marketing communications or non-essential analytics cookies — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

qr98 takes the security of your personal data seriously and has implemented appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Encryption: All data transmitted between your device and the qr98 platform is protected using TLS 1.2 or higher. Sensitive data at rest — including KYC documents and payment references — is encrypted using AES-256.
• Access Controls: Access to personal data within qr98's systems is restricted on a strict need-to-know basis. Only authorised personnel with a legitimate operational need can access specific categories of player data.
• Two-Factor Authentication: qr98 offers two-factor authentication (2FA) for player accounts to add an additional layer of protection beyond username and password. Players are strongly encouraged to enable 2FA from their account security settings.
• Regular Security Audits: qr98 conducts periodic security reviews of its platform infrastructure, including penetration testing and vulnerability assessments, to identify and remediate potential security weaknesses.
• Incident Response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, qr98 will notify you and the relevant regulatory authority in accordance with applicable notification obligations.

While qr98 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is completely secure. You are responsible for maintaining the confidentiality of your qr98 account credentials and for notifying us immediately if you suspect unauthorised access to your account.

qr98 enforces a strict minimum age requirement of 21 years for all account registrations and gaming activity on the platform. The qr98 platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21.

If qr98 becomes aware that personal data has been collected from an individual under the age of 21, the account will be immediately suspended, all collected data will be reviewed, and steps will be taken to delete that data to the extent permissible by applicable law. Any deposits made by underage individuals will be returned where reasonably possible, and any associated winnings will be forfeited.

The qr98 website may contain references to third-party services such as payment providers (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) and game studios. Where the qr98 platform interfaces with third-party services, those services operate under their own privacy policies and terms of use.

qr98 is not responsible for the privacy practices of third-party services and does not endorse or make any representations about the privacy standards of third-party providers beyond what is required under our data processing agreements with them. We encourage you to review the privacy policies of any third-party services you interact with in connection with your qr98 account.

qr98 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, qr98 will:

• Update the "Effective Date" and "Last Reviewed" date at the top of this page.
• Publish an on-site notification informing registered players of the update where the changes are significant.
• Where changes affect how we process data based on consent, seek fresh consent from affected players before the new processing begins.

Your continued use of the qr98 platform following any update to this Privacy Policy constitutes your acknowledgement of the revised policy. If you do not agree with any change to this policy, you must cease using the qr98 platform and contact support to arrange account closure.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way qr98 processes your personal data, please contact our data protection team through the following channels:

• Live Chat: Available 24/7 directly on the qr98 website. This is the fastest route to reach our support and data protection team.
• Email: [email protected] — for data subject access requests, rectification requests, or erasure requests. Please include "Privacy Request" in the subject line.

qr98 is committed to responding to all data-related enquiries in a timely, transparent, and professional manner. We will acknowledge your request within 5 business days and aim to resolve all privacy matters within 30 days of receipt.