qr98 Privacy Policy

qr98 ("we", "us", "our" or "the Platform") operates the online gambling and casino information platform accessible at qr98.cam. This Privacy Policy ("Policy") sets out the basis on which personal data collected from users ("you", "User" or "Player") of the Platform is processed, stored and protected by qr98.

We recognise that privacy is important to our users across Pakistan — from Karachi and Lahore to Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. Users of this platform submit personal data including identification documents such as CNIC or passport details, payment-related information, and communications records when using qr98's services. We treat all personal data with the seriousness it deserves and we are committed to transparency about how that data is used.

This Policy should be read alongside the qr98 Terms & Conditions, which are published at qr98.cam/terms-conditions. Where any inconsistency exists between this Policy and the Terms & Conditions in respect of personal data matters, this Policy shall prevail.

The following defined terms apply throughout this Privacy Policy:

qr98 collects Personal Data that is necessary to operate the Platform, verify user identities, process transactions and comply with applicable legal and regulatory obligations. The categories of Personal Data we collect include the following:

3.1 Registration Data. When you create an account on qr98, we collect:

• Full legal name as it appears on your government-issued identification;
• Date of birth (for age verification purposes);
• Residential address, including city (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar) and postal code;
• Email address and account username;
• Contact telephone number;
• Account password (stored in encrypted, hashed format — never in plain text).

3.2 KYC Verification Data. To comply with identity verification requirements, we may collect:

• Scanned copies or photographs of your Computerised National Identity Card (CNIC) issued by NADRA, or a valid passport;
• Proof of address documents such as utility bills or bank statements issued within the preceding 90 days;
• Selfie images or liveness-check video for facial comparison against submitted identity documents;
• Payment method ownership documentation where required by the operator's compliance team.

3.3 Financial & Transaction Data. When you deposit, withdraw or engage in any financial transaction via the Platform, we collect:

• Transaction amounts, dates and associated reference numbers;
• Payment method type (e.g., bank transfer, mobile wallet) and identifiers necessary to process the transaction — references to payment channels such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are informational context only and do not imply those providers support gambling;
• Account balance history and wagering activity records, maintained for AML compliance and dispute resolution purposes.

3.4 Technical & Usage Data. Automatically collected when you use the Platform:

• IP address and approximate geolocation derived from it;
• Browser type, version and operating system;
• Device type, screen resolution and hardware identifiers;
• Pages visited, session duration, click paths and feature interactions;
• Referring URL and exit page data.

3.5 Communications Data. When you contact qr98 support via Live Chat, email or the Help Centre:

• Content of your messages and support tickets;
• Chat transcripts and email correspondence retained for quality assurance and dispute resolution;
• Response times and resolution records.

Personal Data is collected through the following channels and mechanisms:

qr98 processes Personal Data only for the purposes described in this Policy and only to the extent necessary for those purposes. The specific purposes for which your data is used are as follows:

• Account Creation and Management: To register, authenticate and administer your qr98 account, including processing login requests and maintaining account security;
• Identity and Age Verification (KYC): To verify that you meet the minimum age requirement of 18 years (or higher as required by the applicable jurisdiction) and that the information you have provided is accurate and genuine;
• Transaction Processing: To process deposits, withdrawals and account balance operations accurately and securely;
• Fraud Prevention and Security: To detect, investigate and prevent fraudulent activity, money laundering, multiple account abuse, bonus misuse and other forms of prohibited conduct as described in the Terms & Conditions;
• Regulatory Compliance: To fulfil obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF) and Know Your Customer (KYC) regulations as required by the operator's licensing jurisdiction;
• Customer Support: To respond to enquiries, complaints and support requests submitted via Live Chat, email or the Help Centre;
• Platform Improvement: To analyse usage patterns and technical performance in order to improve the Platform's functionality, design and content;
• Responsible Gambling: To monitor betting behaviour for indicators of problem gambling and to facilitate the application of voluntary or mandatory responsible gambling tools including deposit limits, self-exclusion and session controls;
• Legal Proceedings: To exercise or defend legal rights, comply with court orders, regulatory investigations or lawful requests from competent authorities.

qr98 will not process your Personal Data for purposes incompatible with those stated above without obtaining your prior explicit consent or where otherwise required by law.

qr98 processes Personal Data on the following legal bases, applied according to the nature and purpose of each processing activity:

• Contractual Necessity: Processing is necessary to perform the contract between qr98 and the User — specifically, to provide the Platform's services including account operation, transaction processing and customer support;
• Legal Obligation: Processing is required to comply with applicable legal obligations including KYC regulations, AML legislation and licensing conditions imposed by the operator's regulatory authority;
• Legitimate Interests: Processing is necessary for the legitimate interests of qr98, including fraud prevention, security monitoring, platform improvement and responsible gambling oversight, provided those interests are not overridden by the fundamental rights and freedoms of data subjects;
• Consent: Where processing is based on your freely given consent — for example, in relation to optional marketing communications — you retain the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

qr98 does not sell, rent or trade your Personal Data to third parties for their own commercial purposes. Personal Data is shared only in the following limited circumstances:

• Data Processors: Service providers engaged by qr98 to process data on our behalf, including KYC verification vendors, payment service providers, cloud infrastructure operators and customer support platform providers. All Data Processors are required to process data only on qr98's instructions and are subject to confidentiality and data protection obligations;
• Regulatory and Legal Authorities: Where qr98 is required to disclose Personal Data in response to a lawful request from a competent regulatory body, law enforcement authority or court of competent jurisdiction;
• Fraud Prevention and AML: Personal Data may be shared with fraud prevention agencies, financial intelligence bodies or industry-standard AML databases to the extent required to fulfil regulatory obligations;
• Business Transfers: In the event of a merger, acquisition, asset sale or restructuring of the qr98 business, Personal Data held by qr98 may be transferred to the acquiring entity, subject to equivalent data protection commitments;
• Professional Advisers: Legal counsel, auditors and other professional advisers engaged by qr98, subject to professional confidentiality obligations.

qr98 retains Personal Data for no longer than is necessary for the purposes for which it was collected, subject to any applicable legal retention obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of the account's active status and for a minimum period following account closure as required by the operator's licensing authority for AML and KYC compliance purposes;
• Transaction Records: Financial transaction records and associated KYC documentation are typically retained for a minimum of five (5) years following the date of the transaction, in accordance with standard AML record-keeping requirements. Actual retention periods are determined by the applicable regulatory framework;
• Support Communications: Chat transcripts and support correspondence are retained for a period sufficient to resolve disputes and for quality assurance, generally not exceeding three (3) years from the date of the interaction unless a dispute or legal proceeding requires longer retention;
• Technical Logs: Server logs, IP records and session data are retained for a shorter period determined by operational security requirements, typically not exceeding twelve (12) months;
• Self-Exclusion Records: Where a User has applied for self-exclusion, a record of that exclusion is retained for a period sufficient to prevent re-registration during the exclusion window, and may be retained indefinitely in the case of permanent exclusion.

At the expiry of applicable retention periods, Personal Data is securely deleted or anonymised in a manner that prevents its recovery or reconstruction.

qr98 implements a range of technical and organisational security measures designed to protect Personal Data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include:

• Transport Layer Security (TLS/HTTPS): All data transmitted between your device and qr98's servers is encrypted using industry-standard HTTPS/TLS protocols. You should verify the presence of the HTTPS indicator in your browser before submitting any personal information;
• Password Hashing: Account passwords are stored using strong, salted cryptographic hashing algorithms. qr98 does not store passwords in recoverable plain-text format;
• Access Controls: Access to personal data held in qr98's systems is restricted on a need-to-know basis. Personnel with access to personal data are subject to confidentiality obligations;
• Infrastructure Security: qr98's servers and data storage infrastructure are maintained with appropriate physical and logical access controls, including firewalls, intrusion detection systems and regular security assessments;
• Secure Document Upload: KYC documents must be submitted exclusively through the Platform's official HTTPS verification portal. Transmission of sensitive identity documents through unsecured channels is not supported or endorsed by qr98.

qr98 uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences and analyse usage patterns. A cookie is a small text file placed on your device when you visit the Platform. The following categories of cookies are used:

You may configure your browser settings to refuse non-essential cookies or to alert you before a cookie is placed. Please note that disabling essential cookies may impair the functionality of the Platform, including the ability to log in and access your account. Detailed cookie management guidance is available in your browser's help documentation.

Subject to applicable data protection legislation and any overriding legal obligations, you have the following rights in respect of your Personal Data held by qr98:

To exercise any of the above rights, please contact the qr98 support team via Live Chat or by emailing [email protected] (this address is displayed as plain text only and is not a clickable link). qr98 will respond to verified requests within a reasonable timeframe, generally not exceeding 30 days from receipt of a valid and complete request.

qr98 may request proof of identity before processing a data rights request to ensure that Personal Data is not disclosed to or modified by an unauthorised party. Where a request is refused, qr98 will provide written reasons and will advise you of your right to escalate the matter to the relevant supervisory authority.

The qr98 Platform is strictly restricted to individuals aged 18 years or above, or such higher minimum age as may be required by the operator's license jurisdiction. qr98 does not knowingly collect, process or retain Personal Data from individuals under the applicable minimum age.

Age verification is conducted as part of the KYC process, and accounts where the registered User is found to be below the minimum age will be immediately closed. Any funds held in such accounts will be handled in accordance with the operator's applicable policies and may not be returned where they were deposited by or on behalf of a minor.

If you become aware that a minor has registered an account on qr98 or submitted Personal Data to the Platform, please contact our support team immediately via Live Chat or at [email protected] so that appropriate action can be taken without delay.

qr98 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or the Platform's features and services. The current version of this Policy is always available at qr98.cam/privacy-policy and is identified by its version number and "Last Revised" date shown at the top of this page.

Where material changes are made to this Policy — for example, changes that affect the purposes for which your data is processed, the categories of third parties with whom data is shared, or your data rights — qr98 will notify registered Users via their registered email address with reasonable advance notice before the changes take effect. Your continued use of the Platform following the effective date of any revision constitutes your acknowledgement of and agreement to the updated Policy.

Minor amendments — such as corrections of typographical errors, clarifications that do not alter the substance of the Policy, or updates required to reflect new applicable laws — may be implemented without advance individual notification.

If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your Personal Data by qr98, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the Help Centre on the Platform. Suitable for general queries and urgent data concerns. English and Urdu support available.
• Email: [email protected] — this address is displayed as plain text only and is not a clickable mailto link. Please include your registered username and a clear description of your query.
• Help Centre: The Platform's knowledge base contains detailed guidance on account management, data settings and privacy controls.

When submitting a data rights request or privacy complaint, please include sufficient identifying information to enable us to verify your identity and locate your records. qr98 aims to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 calendar days.