e333 Privacy Policy — How We Protect Your Personal Data on Pakistan's Premier Gaming Platform

1 Who We Are (Data Controller)

e333 is the data controller responsible for the personal information collected through the e333.today platform and all associated services. As data controller, e333 determines the purposes for which and the means by which your personal data is processed. e333 operates in accordance with internationally recognised data protection principles and the privacy requirements imposed under its applicable gaming licence obligations.

e333 is Pakistan's premier online gaming platform, offering sports betting, live casino, slots, e-sports, and casual games including Ludo Quick — all tailored specifically for Pakistani players and processed in Pakistani Rupees (PKR). All queries regarding this Privacy Policy and your personal data should be directed to our support team at [email protected].

2 Personal Data We Collect

e333 collects personal data across several categories, depending on the nature of your interaction with the platform:

2.1 Identity & Contact Data

• Full legal name (as it appears on your Pakistani CNIC, passport, or driving licence);
• Date of birth (required for age verification — all users must be 21 or older);
• Pakistani mobile number (used as your primary account identifier and for SMS notifications);
• Email address (if provided during registration or contact);
• Residential address (may be required during KYC verification);
• CNIC number and/or copies of identity documents (KYC purposes only).

2.2 Financial & Payment Data

• JazzCash account number or registered mobile number;
• EasyPaisa account number or registered mobile number;
• Bank account details (HBL, UBL, Meezan Bank, or other verified Pakistani banks) where bank transfer is used;
• Debit/credit card details (Visa/Mastercard) where card payment is used — card data is tokenised and not stored in full by e333;
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method references.

2.3 Gaming & Behavioural Data

• Wager history: sport, event, market, stake amount, odds, and settlement outcome;
• Casino game history: game titles played, bet amounts, outcomes, session durations;
• Slot play history: games accessed, spin values, win/loss records;
• Responsible gaming tool usage: deposit limits set, session timers activated, cooling-off periods taken;
• Login timestamps, session durations, and device identifiers.

2.4 Technical & Device Data

• IP address at time of login and during active sessions;
• Device type, operating system, and browser version;
• Mobile network operator (e.g., Jazz, Zong, Telenor, Ufone);
• Screen resolution and language settings;
• Cookie identifiers and session tokens (see Section 9).

2.5 Communications Data

• Live chat transcripts between you and e333 support agents;
• Email correspondence with [email protected];
• Survey responses and feedback submissions;
• Complaint and dispute records.

3 How We Collect Your Data

e333 collects personal data through the following channels and mechanisms:

• Direct provision by you: Data you enter during account registration, the KYC verification process, payment transactions, live chat conversations, email communications, and any forms or surveys completed on the platform.
• Automated technical collection: Data collected automatically through your use of the platform, including IP addresses, device identifiers, session data, and cookie information (see Section 9).
• Payment processing partners: Transaction confirmation data received from JazzCash, EasyPaisa, and banking partners when processing deposits and withdrawals. e333 receives only confirmation data — full payment credentials are processed directly by the respective payment provider.
• Identity verification services: Where applicable, data received from third-party KYC verification providers engaged to confirm identity and age in compliance with gaming licence requirements.
• Publicly available sources: In limited circumstances, publicly available information may be referenced to verify identity details provided during KYC — for example, cross-referencing CNIC data with publicly available verification tools.

4 How We Use Your Personal Data

e333 processes your personal data for the following specific purposes. Each purpose is supported by a lawful basis as described in Section 5:

5 Legal Basis for Processing

e333 processes your personal data only where a valid lawful basis exists. The primary lawful bases relied upon by e333 are:

• Contract performance: Processing necessary to provide the gaming services you have contracted for — including account management, bet settlement, payment processing, and customer support.
• Legal obligation: Processing required to comply with applicable laws and gaming licence conditions — including anti-money laundering (AML) obligations, age verification requirements, and responsible gaming monitoring duties.
• Legitimate interests: Processing carried out for e333's legitimate operational interests where those interests are not overridden by your data protection rights. This includes fraud detection, platform security, and platform analytics. e333 always balances its legitimate interests against the potential impact on users before relying on this basis.
• Consent: Where processing is not required for contract performance or legal compliance, e333 will seek your explicit consent — for example, for marketing communications and certain optional cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Third Parties

e333 does not sell your personal data to third parties. Your data is never traded, rented, or monetised. e333 shares personal data only in the following limited and controlled circumstances:

6.1 Payment Processing Partners

Deposit and withdrawal transactions are processed by our payment partners — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Visa/Mastercard acquiring partners. These providers receive only the data necessary to process your specific transaction. They are bound by their own data protection obligations and are not permitted to use your data for any purpose other than processing your e333 transactions.

6.2 Identity Verification Providers

Where KYC verification is required, e333 may share identity data with licensed identity verification service providers. These providers process your documents solely for the purpose of verifying your identity and age in compliance with gaming licence requirements. They are contractually prohibited from retaining or using your data for any other purpose.

6.3 Gaming Software Providers

e333's casino and slot games are powered by certified third-party gaming software providers. These providers receive technical session data necessary to deliver game functionality. They do not receive your personal identity, financial, or contact data.

6.4 Regulatory and Legal Disclosures

e333 may be required to disclose personal data to regulatory authorities, gaming licence supervisory bodies, law enforcement agencies, or courts where required by applicable law, a valid legal order, or gaming licence compliance obligations. e333 will only disclose the minimum data required to satisfy the specific legal requirement.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of e333's assets, personal data held by e333 may be transferred to the successor entity. Users will be notified of any such transfer and the successor entity will be required to honour the commitments made in this Privacy Policy.

7 Data Security

e333 implements technical and organisational security measures proportionate to the risk presented by the data we process. Key security measures in place include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and e333 servers is encrypted using the same standard used by Pakistani banks for online banking.
• Password hashing: Account passwords are stored using industry-standard cryptographic hashing algorithms. e333 never stores passwords in plaintext and cannot retrieve your password — only reset it.
• Segregated data storage: Player financial data is stored in systems segregated from operational and marketing databases, with strict access controls applied at every layer.
• Access controls: Access to personal data within e333's systems is restricted to personnel with a documented operational need. Access is logged and audited.
• Two-Factor Authentication (2FA): Available to all e333 account holders and strongly recommended. Adds a critical additional security layer to account login.
• Intrusion detection systems: e333's infrastructure is monitored continuously for unauthorised access attempts, with automated alerts and incident response procedures in place.
• Regular security audits: e333's systems and data handling practices are subject to periodic internal and third-party security reviews.

8 Data Retention

e333 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or gaming licence obligations. Key retention periods are:

• Account and identity data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years following the date of each transaction, as required under applicable AML obligations.
• Gaming history records: Retained for the duration of your active account plus a minimum of three (3) years following account closure, for dispute resolution and responsible gaming monitoring purposes.
• Customer support communications: Retained for a minimum of two (2) years following the date of the communication, for dispute resolution purposes.
• Marketing consent records: Retained until consent is withdrawn, plus a reasonable period to maintain evidence of the consent having been given.
• Technical and device data: Retained in identifiable form for up to twelve (12) months, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data must be retained for regulatory purposes beyond what would otherwise be required, e333 limits the processing of such data to the specific regulatory requirement only.

9 Cookies & Tracking Technologies

e333 uses cookies and similar tracking technologies to operate and improve the platform. The categories of cookies used by e333 are as follows:

9.1 Strictly Necessary Cookies

These cookies are essential for the e333 platform to function. They enable core features including account login sessions, payment processing flows, and security functions. These cookies cannot be disabled without severely impairing platform functionality. No consent is required for strictly necessary cookies.

9.2 Functional Cookies

These cookies remember your preferences — such as language settings, preferred game lobby view, and notification preferences — so you do not have to reconfigure them on each visit. These cookies improve your experience but are not essential to platform operation.

9.3 Analytics Cookies

e333 uses analytics cookies to understand how users interact with the platform — which pages are visited most frequently, where users encounter difficulties, and how game lobby navigation flows perform. This data is used in aggregated, anonymised form to improve the platform. These cookies require your consent.

9.4 Managing Cookies

You can manage cookie preferences through the cookie consent manager accessible at the bottom of the e333 homepage, or through your browser's cookie settings. Please note that disabling functional or analytics cookies will not affect your ability to use the core gaming services on e333 but may result in a reduced experience.

10 Your Data Protection Rights

As a user of e333's services, you have the following rights in relation to your personal data. These rights may be exercised by contacting e333's support team via live chat or at [email protected]:

• Right of Access: You have the right to request a copy of the personal data e333 holds about you. e333 will respond to access requests within 30 days of receipt of a valid request.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held by e333. For identity data corrections, supporting documentation may be required.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where there is no overriding legitimate basis for continued processing. Note that data required to be retained under legal or regulatory obligations cannot be deleted until the applicable retention period expires.
• Right to Restrict Processing: You may request that e333 restrict processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract performance and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests. e333 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights Related to Automated Decision-Making: e333 does not make solely automated decisions that produce legal or similarly significant effects on users, without human oversight.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

11 Children's Privacy — Strict 21+ Requirement

e333 implements age verification procedures at the point of registration and may require documentary proof of age (CNIC, passport, or driving licence) before activating a new account or processing any withdrawal. If you are a parent or guardian and believe your child has registered an account on e333, please contact our support team immediately via live chat or at [email protected].

e333 does not direct any marketing communications, promotional content, or platform features at individuals under the age of 21. If we identify that marketing communications have been received by an under-21 user as a result of age misrepresentation at registration, those communications will be ceased and the account will be closed immediately.

12 Marketing Communications

e333 may send you marketing communications about promotions, bonuses, new games, and platform updates — but only where you have provided explicit consent to receive such communications at the point of registration or subsequently through your account preferences.

Marketing communications from e333 are delivered via the following channels, subject to your consent preferences:

• SMS: Promotional messages sent to your registered Pakistani mobile number via your network operator (Jazz, Zong, Telenor, Ufone, or Warid);
• Email: Promotional emails sent to your registered email address, where provided;
• On-platform notifications: Promotional banners and notification alerts displayed within your e333 account dashboard when you are logged in.

You may withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in your e333 account settings;
• Replying STOP to any SMS marketing message received from e333;
• Contacting e333 support via live chat and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect your ability to continue using e333's gaming services, and e333 will continue to send you transactional communications necessary for account management — such as deposit confirmations, withdrawal notifications, and security alerts — regardless of your marketing consent status, as these are necessary for contract performance.

13 Third-Party Links

The e333 platform may contain references to third-party services — for example, payment provider interfaces accessed during deposit and withdrawal flows. Once you leave the e333 platform and access a third-party interface, you are subject to that third party's own privacy policy and data handling practices. e333 is not responsible for the privacy practices of third-party services.

e333 recommends that you review the privacy policies of any third-party service you access in connection with your use of e333 — particularly the privacy notices of JazzCash, EasyPaisa, and your banking provider, which will govern the handling of your payment data on their respective platforms.

14 International Data Transfers

As an internationally licensed gaming platform, e333 may process or store some personal data on servers or through service providers located outside Pakistan. Where personal data is transferred internationally, e333 ensures that appropriate safeguards are in place to protect that data to a standard at least equivalent to the protections described in this Privacy Policy.

Safeguards used for international transfers may include:

• Standard contractual clauses requiring the recipient to process data to an equivalent standard of protection;
• Data processing agreements with third-party providers that impose binding confidentiality and security obligations;
• Transfers to jurisdictions that maintain recognised adequate data protection standards under applicable frameworks.

You may request further information about the specific safeguards in place for any particular international transfer by contacting e333's support team at [email protected].

15 Updates to This Privacy Policy

e333 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable legal requirements, or gaming licence obligations. The "Effective Date" at the top of this page indicates when the current version of the Policy came into force.

Where changes to this Privacy Policy are material — meaning they significantly affect how we collect, use, or share your personal data, or meaningfully affect your rights — e333 will notify registered users at least seven (7) days in advance of the changes taking effect. Notification will be provided via your registered mobile number (SMS) or registered email address, as applicable.

Non-material changes — such as corrections to typographical errors, structural reorganisation without substantive change, or updates to contact details — may be made without advance notice. Continued use of the e333 platform following the publication of an updated Privacy Policy constitutes acknowledgement of the updated Policy.

The most current version of the e333 Privacy Policy will always be accessible at e333.today/privacy-policy. We encourage you to review this page periodically so that you remain informed about how e333 handles your personal data.

16 Contact Us — Data & Privacy Enquiries

For any enquiries, requests, or complaints relating to your personal data or this Privacy Policy, please contact e333 through the following channels:

• Live Chat: Available 24/7 directly on the e333 platform. Select "Privacy & Data" as your enquiry type. Average response time: 3–5 minutes. Our support agents assist in both Urdu and English.
• Email: [email protected] — Please include "Privacy Request" in the subject line. e333 targets a response time of one business day for privacy-related enquiries and will acknowledge all data subject access requests within 72 hours of receipt.

e333 is committed to resolving all data protection concerns promptly and transparently. Where a complaint cannot be resolved through direct engagement with e333's support team, you may have the right to escalate your complaint to the relevant data protection supervisory authority or to the dispute resolution mechanism specified under e333's gaming licence.