bat77 Privacy Policy — How We Protect Your Personal Data

1 Data Controller

1.1 bat77 is the data controller in respect of personal data collected and processed through the bat77 platform. As data controller, bat77 determines the purposes and means of processing your personal data and bears primary responsibility for ensuring that processing activities comply with applicable data protection obligations under bat77's international gaming licence framework.

1.2 bat77 has appointed a designated Data Protection Contact who is responsible for overseeing data protection compliance within the organisation and serving as the primary point of contact for data subject rights requests. Contact details for the Data Protection Contact are provided in Section 14 of this Policy.

2 Personal Data We Collect

bat77 collects personal data from Pakistani Account Holders and platform users in the following categories:

2.1 Registration & Identity Data

• Full legal name as per government-issued identity documents;
• Date of birth and age verification information;
• Pakistani mobile number (Zong, Jazz, Telenor, Ufone, Warid);
• Email address;
• Residential address in Pakistan;
• Username and encrypted password hash;
• Account security settings including 2FA configuration.

2.2 Identity Verification (KYC) Data

• Copy of National Identity Card (CNIC) or other government-issued identity document;
• Proof of address documentation;
• Proof of payment method ownership (e.g., JazzCash or EasyPaisa account confirmation);
• Facial recognition or liveness check data where applicable to the verification process.

2.3 Financial & Transaction Data

• Deposit and withdrawal transaction amounts, dates, and payment method identifiers;
• JazzCash and EasyPaisa mobile wallet identifiers used for transactions;
• HBL, UBL, and Meezan Bank account details used for bank transfer transactions;
• Betting history, game play records, and account balance history;
• Bonus and promotional credit history.

2.4 Technical & Usage Data

• IP address and geolocation data;
• Device type, operating system, and browser type;
• Session timestamps and duration data;
• Pages visited and features accessed on the bat77 platform;
• Error logs and technical performance data.

2.5 Communications Data

• Content of support communications submitted via email;
• Records of responsible gaming tool activations and settings changes;
• Records of marketing preference elections and opt-out requests.

3 Purposes of Processing

bat77 processes personal data for the following specific purposes:

4 Legal Basis for Processing

4.1 Contract Performance: The majority of bat77's core data processing activities — account creation, payment processing, bet settlement, and customer support — are necessary for the performance of the contract between bat77 and the Account Holder constituted by acceptance of the bat77 Terms and Conditions.

4.2 Legal Obligation: bat77 is required under the conditions of its international gaming licence to conduct identity verification (KYC), maintain Anti-Money Laundering (AML) transaction monitoring, and enforce responsible gaming obligations. Processing undertaken for these purposes is carried out on the basis of legal obligation compliance.

4.3 Legitimate Interest: bat77 processes certain categories of data — including technical usage data and fraud detection signals — on the basis of its legitimate interest in maintaining the security, integrity, and quality of the bat77 platform and protecting its players and its business from harm.

4.4 Consent: bat77 sends marketing communications only to Account Holders who have explicitly opted in to receiving them. Consent for marketing is freely given, specific, and revocable at any time by adjusting notification preferences within your bat77 account settings.

5 Data Sharing & Third Parties

5.1 bat77 does not sell personal data to third parties. bat77 shares personal data with the following categories of third-party recipients only to the extent strictly necessary for the stated purpose:

• Payment Service Providers — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment processors receive transaction data necessary to process deposits and withdrawals;
• Identity Verification Providers — KYC and age verification service providers receive identity document images and personal data for verification processing, under binding data processing agreements;
• Game Content Studios — Third-party game providers (e.g., Pragmatic Play, PG Soft) receive anonymised or pseudonymised session and bet data required for game integrity, jackpot processing, and RTP calculation;
• Regulatory Authorities — bat77's gaming licence authority and applicable financial intelligence units may receive account and transaction data pursuant to regulatory reporting obligations;
• Law Enforcement — bat77 will disclose personal data to law enforcement agencies in response to lawful requests or court orders, without prior notice to the Account Holder where required by law;
• Technical Infrastructure Providers — Cloud hosting, CDN, and IT security service providers who process data on bat77's behalf under binding data processing agreements with appropriate technical and organisational security measures.

5.2 All third parties with whom bat77 shares personal data are subject to contractual data protection obligations and are prohibited from using bat77 player data for their own commercial purposes beyond the scope of their engagement with bat77.

6 Data Retention

6.1 bat77 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to longer retention periods required by law or licence obligations. The following indicative retention periods apply:

• Active Account Data — Retained for the duration of the Account Holder relationship and for a minimum of 5 years following account closure, in compliance with AML and licence record-keeping requirements;
• Transaction Records — Retained for a minimum of 5 years from the date of each transaction;
• KYC Documents — Retained for a minimum of 5 years following the end of the Account Holder relationship;
• Support Communications — Retained for 2 years from the date of the relevant communication;
• Technical & Log Data — Retained for 12 months for security and fraud detection purposes;
• Marketing Preference Records — Retained for the duration of the Account Holder relationship and for 2 years thereafter.

6.2 Upon the expiry of applicable retention periods, bat77 permanently and securely deletes or anonymises personal data in accordance with industry-standard data destruction procedures.

7 Security Measures

7.1 bat77 applies the following technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption for all data in transit between user devices and bat77 servers;
• AES-256 encryption for sensitive data at rest, including KYC documents and payment identifiers;
• Password hashing using industry-standard cryptographic algorithms — bat77 does not store plain-text passwords;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication for all bat77 internal system access;
• Regular third-party penetration testing and vulnerability scanning of bat77 platform infrastructure;
• Intrusion detection systems and 24/7 security monitoring;
• Documented incident response procedures including regulatory breach notification protocols.

8 Cookies & Tracking Technologies

8.1 bat77 uses cookies and similar tracking technologies on the bat77 platform. Cookies are small text files stored on your device that enable bat77 to recognise your browser, maintain your login session, and analyse platform usage. The following categories of cookies are used by bat77:

8.2 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair or prevent your use of the bat77 platform. Disabling analytics or marketing cookies will not affect your ability to use bat77 core services.

9 Your Data Subject Rights

9.1 Subject to applicable law and bat77's licence obligations, bat77 Account Holders hold the following rights in respect of their personal data. Rights requests should be submitted to bat77 support via email. bat77 will respond to all data rights requests within 30 days.

• Right of Access — You may request a copy of all personal data bat77 holds about you, along with information about how it is processed;
• Right to Rectification — You may request correction of inaccurate or incomplete personal data held by bat77;
• Right to Erasure — You may request deletion of your personal data, subject to bat77's legal obligation to retain certain records under its gaming licence and AML obligations;
• Right to Restrict Processing — You may request that bat77 restrict processing of your personal data in defined circumstances;
• Right to Object — You may object to processing based on legitimate interest, including for direct marketing purposes;
• Right to Data Portability — You may request your personal data in a structured, machine-readable format where technically feasible;
• Right to Withdraw Consent — Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

9.2 bat77 may be required to verify your identity before processing a data rights request. This verification is undertaken to protect against fraudulent data access requests by third parties who do not hold an entitlement to the data requested.

10 Marketing Communications

10.1 bat77 sends promotional communications — including bonus offers, PSL betting promotions, new game announcements, and platform updates — only to Account Holders who have explicitly opted in to receiving marketing communications at the time of registration or subsequently through their account notification preferences.

10.2 bat77 marketing communications are delivered via email and SMS to your registered bat77 contact details. bat77 does not send WhatsApp marketing messages without explicit opt-in consent.

10.3 You may unsubscribe from bat77 marketing communications at any time by: (a) updating your notification preferences within your bat77 account settings, or (b) contacting bat77 support via the email address in Section 14. Unsubscription requests are processed within 10 business days.

10.4 Withdrawal of marketing consent does not affect bat77's ability to send you transactional communications that are necessary for the operation of your account — such as deposit confirmations, withdrawal notifications, security alerts, and responsible gaming notifications.

11 Minors

11.1 The bat77 platform is strictly restricted to individuals aged 21 years and above. bat77 does not knowingly collect or process personal data from individuals under the age of 21.

11.2 Where bat77 discovers that personal data has been submitted by an individual under 21 years of age — whether through misrepresentation at registration or otherwise — bat77 will immediately suspend the relevant account, delete the collected data to the extent permitted by applicable law, and return any deposits to the deposit payment method, subject to verification of ownership.

11.3 Parents and guardians who believe that a minor has accessed the bat77 platform and submitted personal data are encouraged to contact bat77 support immediately via the email address in Section 14.

12 International Data Transfers

12.1 The nature of bat77's technical infrastructure means that personal data may be processed in countries outside Pakistan, including countries in which bat77's gaming licence authority is domiciled and countries in which bat77's cloud hosting and technical service providers operate.

12.2 Where personal data is transferred outside Pakistan, bat77 takes appropriate steps to ensure that the transfer is subject to adequate safeguards, including contractual data processing agreements that impose obligations on the recipient equivalent to those that apply to bat77 under its licence framework.

12.3 bat77 does not transfer personal data to countries or organisations that cannot demonstrate an adequate level of data protection for the categories of data transferred.

13 Changes to This Privacy Policy

13.1 bat77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, bat77's licensing obligations, data processing practices, or the services offered on the bat77 platform.

13.2 Where material changes are made to this Policy — meaning changes that significantly affect how bat77 processes your personal data — bat77 will provide notice to Account Holders via the email address registered to their bat77 account, with a minimum of 14 days' notice before the change takes effect.

13.3 The most current version of this Privacy Policy is always available at bat77.pro/privacy-policy, with the effective date and version number displayed at the top of the document. Account Holders are encouraged to review this Policy periodically.

14 Contact & Data Rights Requests

14.1 For all privacy-related enquiries, data subject rights requests, or to raise a concern about bat77's data processing practices, please contact the bat77 Data Protection Contact via the email address displayed in the footer of this page.

14.2 Please include in your communication: (a) your full name as registered on your bat77 account; (b) your registered email address or Pakistani mobile number; (c) the nature of your enquiry or request; and (d) any relevant supporting information. bat77 will acknowledge your request within 5 business days and provide a substantive response within 30 days.