com888 Privacy Policy —
Your Data, Handled with Respect

This Privacy Policy ("Policy") describes how com888 ("com888", "We", "Us", "Our") collects, uses, stores, and protects the personal information of users ("Player", "User", "You") who access or use the com888 online gaming platform, available at com888.games, including all associated games, PKR payment services, promotional tools, and customer support channels.

This Policy applies to all personal data collected through: the com888 registration process; the use of any game, live casino table, or jackpot slot on the platform; PKR deposit and withdrawal transactions; communications with com888 support; participation in promotional offers; and any other interaction you have with the com888 platform or its representatives.

By registering a com888 account, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not create a com888 account or use the platform.

com888 collects personal data through two channels: information you provide directly, and information collected automatically during your use of the platform.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

• Device Information: Device type (Android/iOS/desktop), operating system version, browser type and version, screen resolution
• Network Information: IP address, approximate geolocation derived from IP, mobile network operator (e.g., Jazz, Telenor, Zong)
• Usage Data: Pages visited, games played, session duration, bet amounts in PKR, game outcomes, feature interactions
• Technical Logs: Error logs, performance metrics, authentication events (login times, failed login attempts)
• Cookie and Tracking Data: Session identifiers, preference cookies, analytics identifiers (see Section 6)

com888 uses the personal data collected for the following purposes:

• Account Management: Creating and maintaining your com888 account, verifying your identity, processing login authentication, and enabling account recovery
• Service Delivery: Providing access to the game lobby, processing PKR deposits and withdrawals, crediting winnings to your account, and calculating bonus eligibility
• Age Verification & KYC Compliance: Confirming that you meet the 18+ age requirement, verifying your identity for withdrawal processing, and fulfilling anti-money laundering (AML) obligations
• Platform Security: Detecting and preventing fraudulent activity, identifying duplicate accounts, monitoring for unusual betting patterns that may indicate account compromise, and investigating reported security incidents
• Responsible Gaming: Monitoring for signs of problematic gambling behaviour, enforcing self-imposed deposit limits, processing cool-off and self-exclusion requests, and flagging accounts that may benefit from intervention
• Customer Support: Responding to your queries, resolving complaints, and maintaining records of support interactions for quality assurance
• Platform Improvement: Analysing aggregated, anonymised usage data to identify performance issues, improve game loading times, and develop features most relevant to Pakistani players
• Marketing Communications: Sending promotional emails and SMS messages about com888 bonuses, new game launches, and special events — but only where you have given explicit consent, and always with a clear unsubscribe mechanism
• Legal Compliance: Fulfilling obligations under applicable financial regulations, responding to lawful requests from regulatory authorities, and maintaining records required by law

com888 processes your personal data on the following legal grounds:

• Contractual Necessity: Processing required to fulfil the com888 Terms & Conditions you accepted at registration — including account creation, game access, PKR payments, and bonus delivery
• Legal Obligation: Processing required to comply with applicable financial regulations, age verification requirements, anti-money laundering laws, and lawful requests from competent authorities
• Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and improving the com888 service — where these interests do not override your fundamental privacy rights
• Consent: Processing for marketing communications and optional analytics — where you have given explicit, informed consent that can be withdrawn at any time without affecting your ability to use the com888 platform

com888 does not sell or rent your personal data. We share data with third parties only in the following limited and controlled circumstances:

• Payment Processors: Easypaisa, JazzCash, HBL, UBL, and other PKR payment partners receive the minimum data required to process your transactions. These partners operate under their own privacy policies and comply with applicable financial data regulations.
• Game Software Providers: Third-party game studios whose titles appear in the com888 lobby may receive anonymised gameplay data (e.g., bet counts, RTP verification data) for certification compliance purposes. They do not receive your personal identity information.
• Identity Verification Services: During KYC, com888 may use a third-party identity verification service to confirm CNIC authenticity. These services are contractually bound to process data solely for the verification purpose and not to retain or repurpose it.
• Fraud Prevention Partners: com888 may share device fingerprint and IP data with specialist fraud prevention services to identify and block accounts engaged in collusion, bonus abuse, or money laundering.
• Regulatory Authorities: com888 will disclose personal data to competent regulatory or law enforcement authorities where required by applicable law, a valid court order, or a legally binding regulatory request.
• Business Transfers: In the event of a merger, acquisition, or sale of com888 business assets, your personal data may be transferred to the acquiring entity as part of the transaction — subject to the same privacy protections described in this Policy.

com888 uses cookies and similar tracking technologies to operate the platform correctly, maintain your session, and improve user experience. The cookies we use fall into the following categories:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in while you navigate between pages, and security tokens that protect against cross-site request forgery (CSRF) attacks. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Store your preferences — for example, your preferred game category, language setting (English), and whether you have acknowledged the responsible gaming notification. These improve your experience but are not required for the platform to operate.
• Analytics Cookies: Collect anonymised data about how players use the com888 platform — which pages are visited most, where players experience friction, and how the mobile experience differs from desktop. This data is aggregated and cannot be traced back to an individual player. Analytics cookies are only placed with your consent.

You can manage cookie preferences through your browser settings at any time. Disabling strictly necessary cookies may affect your ability to use certain com888 features, including maintaining a logged-in session across pages.

com888 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following indicative retention periods apply:

• Active Account Data: Retained for the full duration of your com888 account lifetime, plus a minimum of five years following account closure to satisfy financial compliance and anti-money laundering record-keeping obligations
• PKR Transaction Records: Retained for a minimum of five years from the date of each transaction in accordance with financial record-keeping requirements
• Identity & KYC Documents: Retained for a minimum of five years from the date of submission or from account closure, whichever is later
• Support Communications: Retained for three years from the date of the communication to support complaint resolution and service improvement
• Analytics Data: Anonymised analytics data may be retained indefinitely in aggregated form. Data that can be attributed to an individual session is deleted after 24 months
• Marketing Consent Records: Retained for the full period that your marketing consent is active, plus three years following withdrawal of consent

com888 implements a multi-layer security architecture to protect your personal data against unauthorised access, disclosure, alteration, and loss. Our key security measures include:

• Transport Encryption: All data in transit is protected by TLS 1.3 with 256-bit encryption. Connections that cannot negotiate TLS 1.2 or higher are refused.
• Storage Encryption: Sensitive data fields — including CNIC numbers and payment references — are encrypted at rest using AES-256 before being written to database storage.
• Access Controls: com888 systems operate on a strict least-privilege model. Staff members access only the data necessary for their specific role. Administrative access to production data requires multi-factor authentication.
• Password Security: com888 account passwords are hashed using a modern, salted hashing algorithm. com888 staff cannot see your password in plain text. We strongly recommend using a unique password for your com888 account.
• Penetration Testing: com888 commissions independent security penetration tests on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: com888 maintains a documented security incident response plan. In the event of a confirmed data breach affecting your personal information, we will notify you within 72 hours.

As a com888 player, you have the following rights regarding your personal data. All requests can be submitted by emailing [email protected] with "Data Rights Request" in the subject line. com888 will respond within 30 days.

• Right of Access: You may request a copy of the personal data com888 holds about you, including what categories of data we hold, for what purpose, and how long we intend to retain it.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data in your com888 account. For most data fields, you can update this directly through your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (for consent-based processing), or where processing is unlawful. Note that legal retention obligations may prevent immediate deletion of certain data categories.
• Right to Restriction: You may request that com888 restrict processing of your data (i.e., store it but not actively use it) while a rectification or objection request is being evaluated.
• Right to Object: You may object to processing carried out on the basis of com888's legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time by clicking "Unsubscribe" in any com888 marketing email or by emailing [email protected].
• Right to Data Portability: You may request your personal data in a structured, machine-readable format to transfer to another service provider where technically feasible.

The com888 platform is strictly intended for adults aged 18 years and above. com888 does not knowingly collect personal data from individuals under the age of 18. If you are under 18, you must not register a com888 account, make any deposit, or place any bet on the platform.

If com888 becomes aware that personal data has been collected from a player who is under 18, we will immediately close the relevant account, delete the associated personal data, and return any deposited PKR funds in accordance with our underage gambling policy.

If you believe that a person under 18 has registered a com888 account, please contact us immediately at [email protected]. We take underage gambling extremely seriously and will investigate all reports promptly.

com888 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, new regulatory requirements, or improvements to our platform. The "Last updated" date at the top of this Policy will always reflect the most recent revision.

Where a change is material — for example, a change to the categories of data we collect, the parties we share data with, or your rights regarding your data — com888 will notify registered players by email at least 14 days before the change takes effect. For minor updates (such as clarifications or formatting corrections), com888 may update the Policy without individual notification.

Continued use of the com888 platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you should close your com888 account prior to the effective date.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a potential privacy concern, please contact the com888 support team. Our English-language team is available 24 hours a day, 7 days a week.

For formal data rights requests, please email [email protected] with the subject line "Privacy Request — [Your Account Username]". Please include a brief description of your request and the data categories it relates to. com888 will acknowledge your request within 24 hours and respond in full within 30 calendar days.