s98com Privacy Policy — How We Protect Your Data in Pakistan

This Privacy Policy is issued by s98com, the operator of the online gaming platform accessible at s98com.ws. All references to "s98com", "we", "us", or "our" in this document refer to the same entity.

s98com operates a range of real-money gaming services for players in Pakistan including casino games, live dealer tables, cricket betting, and related promotional services. All gaming activity on the platform is conducted in Pakistani Rupees (PKR), and all supported payment channels — Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and Visa/Mastercard — are integrated directly within the platform.

As the operator of these services, s98com is the data controller responsible for all personal data collected through account registration, gameplay, payment processing, and customer support interactions. This means s98com determines the purposes and means by which your personal data is used.

s98com collects personal data through several channels: your account registration form, your use of the platform (including gameplay and payment activity), your communications with our support team, and — with your permission — from your device when you access the platform.

s98com does not collect sensitive personal data such as health information, religious beliefs, or political opinions unless directly relevant to a responsible gaming referral made by you, in which case it is handled with heightened confidentiality.

s98com processes personal data only for specific, legitimate purposes. Every data processing activity has a defined reason and a defined legal basis. Below are the primary purposes for which your data is used:

• Account creation and management: Your name, contact details, and login credentials are necessary to create and maintain your s98com account. Without these, the service cannot be provided.
• Age verification and KYC: s98com is required to verify that all players are 18 or older before they can deposit or withdraw real money. Identity data is used exclusively for this purpose and is not repurposed for marketing or profiling.
• Payment processing: Financial data is used to process deposits and withdrawals in PKR through the supported channels. s98com does not retain full payment card details — these are held by certified payment intermediaries.
• Delivering gaming services: Gaming data — your session history, bets, and balance — is necessary to run the games correctly and ensure accurate account records.
• Fraud and security: Technical data including IP addresses and device identifiers is used to detect unusual activity, prevent unauthorised account access, and identify potential bonus abuse or multi-account violations.
• Responsible gaming tools: Gaming behaviour data is monitored to support responsible gaming programmes. This may include identifying unusual patterns that could indicate problem gambling, so that appropriate support tools can be offered.
• Customer support: Communications data from support interactions is retained to ensure consistency in resolving your queries and to maintain a record of any commitments made by s98com to you.
• Promotional communications (with consent): Contact data and preferences are used to send you bonus offers, game launch notifications, and VIP Club updates — but only if you have opted in to receive these.
• Legal compliance: Financial transaction records are retained in compliance with applicable financial regulations and may be reviewed in response to lawful requests from regulatory or law enforcement bodies.

s98com processes personal data on the following legal grounds, depending on the type of processing involved:

• Contractual necessity: Processing required to fulfil the contract with you — running your account, processing payments, delivering gaming services. This is the primary basis for most data processing at s98com.
• Legal obligation: Processing required to comply with applicable laws, including financial record-keeping requirements and age verification obligations.
• Legitimate interests: Processing carried out for the legitimate interests of s98com where these do not override your rights — including fraud prevention, security monitoring, and platform improvement based on anonymised usage data.
• Consent: Processing carried out with your explicit consent — specifically, sending promotional communications. You can withdraw consent at any time without affecting your ability to use the platform.

Data security is not an afterthought at s98com — it is a core operational requirement. The following technical and organisational measures are in place to protect personal data held by the platform:

• Encryption in transit: All data transmitted between your device and s98com's servers is encrypted using TLS (Transport Layer Security). This applies to all platform pages, payment flows, and API communications.
• Encryption at rest: Personal and financial data stored on s98com's infrastructure is encrypted at the database level. Access to decrypted data is restricted to authorised personnel only.
• Payment data isolation: Full card numbers, mobile wallet PINs, and bank account details are never stored on s98com's own servers. Payment processing is handled entirely by certified PCI-DSS compliant intermediaries.
• Access controls: Internal access to player data is restricted on a need-to-know basis. Staff with access to personal data are subject to confidentiality obligations and regular security training.
• Account security tools: Two-factor authentication (2FA) is available for all s98com accounts and is strongly recommended. Login attempt limits and suspicious activity alerts are active on all accounts.
• Regular security reviews: s98com's technical infrastructure undergoes periodic security assessments to identify and address vulnerabilities before they can be exploited.

In the unlikely event of a data breach that could affect your rights, s98com will notify affected players directly and take immediate steps to contain and investigate the incident.

s98com does not sell your personal data to any third party. Data is shared only in the specific circumstances described below, and in each case, only the minimum data necessary is disclosed:

• Payment service providers: Easypaisa, JazzCash, NayaPay, SadaPay, banking partners for IBFT, and Visa/Mastercard processing networks receive transaction data necessary to process your deposits and withdrawals in PKR. These providers operate under their own privacy policies and security standards.
• Game software providers: Third-party game developers whose titles appear in the s98com lobby may receive anonymised session data for quality assurance purposes. They do not receive personally identifiable information without a separate agreement.
• KYC and identity verification services: Where age or identity verification is required before a withdrawal, data may be shared with certified third-party verification providers operating under strict data processing agreements with s98com.
• Fraud prevention services: Technical data may be shared with fraud detection partners to identify and block suspicious activity. These partners are contractually prohibited from using the data for any other purpose.
• Regulatory and law enforcement bodies: s98com will disclose personal data to regulators, courts, or law enforcement agencies where required by law or where there is reasonable suspicion of criminal activity including money laundering.
• Professional advisers: Legal, accounting, or auditing firms engaged by s98com may access data on a strictly confidential basis in connection with their professional services.

All third parties with whom s98com shares personal data are required to maintain appropriate technical and organisational security measures and to process data only for the specific purposes for which it was shared.

s98com uses cookies and similar tracking technologies to make the platform work correctly, remember your preferences, and — with your consent — understand how players use the service so we can improve it over time.

You can manage your cookie preferences at any time through your browser settings. Disabling essential cookies will prevent the platform from functioning correctly. Disabling functional or analytics cookies will not affect your ability to play or make transactions on s98com.

As an s98com member, you have the following rights regarding the personal data held about you. These rights can be exercised at any time by contacting support@s98com.ws with your account details and a clear description of your request.

All rights requests submitted to s98com are processed within 30 calendar days of receipt. In complex cases this may be extended by a further 30 days, in which case you will be notified. There is no charge for exercising any of these rights.

s98com's gaming services are strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.

Age verification is performed as part of the account registration process and again before any withdrawal is processed. If s98com discovers that an account has been created by a person under 18, the account will be immediately suspended, all funds returned to the original deposit source, and the account permanently closed. Any bonus funds credited to such an account will be forfeited.

Parents and guardians are encouraged to use device-level parental controls and to discuss the risks of online gambling with young people. If you believe a minor has registered on s98com using false information, please contact support@s98com.ws immediately.

s98com retains personal data only for as long as it is needed. Retention periods are determined by the purpose of the data and applicable legal requirements:

• Active account data (name, contact, login, gaming history): Retained for the duration of your active s98com membership plus a period of up to 6 years after account closure to meet financial record-keeping obligations.
• Financial transaction records (deposits, withdrawals, bonus history in PKR): Retained for a minimum of 6 years from the date of each transaction, as required by applicable financial regulation.
• KYC and identity verification documents: Retained for up to 5 years from the date of verification, or longer if required by law enforcement or regulatory order.
• Customer support communications: Retained for 3 years from the last interaction, then deleted unless the correspondence forms part of an ongoing dispute.
• Marketing consent records: Retained for the duration of your membership plus 3 years to provide evidence of consent or withdrawal of consent.
• Technical and access logs: Retained for up to 12 months for security and fraud investigation purposes, then automatically deleted.

When data is no longer required and no legal retention obligation applies, it is securely deleted or anonymised so that it can no longer be linked to your identity.

s98com may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law, or improvements to our services. The current version will always be available at s98com.ws/privacy-policy with a "Last Updated" date at the top.

For material changes — those that meaningfully affect how your data is collected, used, or shared — s98com will provide at least 14 days' advance notice via email to your registered address and through a prominent notification on the platform before the changes take effect.

If you continue to use s98com after a policy update date, this constitutes acceptance of the revised policy. If you do not accept the changes, you should stop using the platform and request account closure before the effective date.

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or wish to raise a concern about how s98com has handled your personal data, please contact us through the following channels:

• Email: support@s98com.ws — for all data-related requests and formal privacy complaints.
• Live Chat: Available 24/7 through your logged-in account dashboard for general enquiries.
• FAQ: The s98com FAQ page at /faq covers the most common questions about account data, payments, and security.

s98com aims to respond to all privacy requests within 5 working days and to resolve formal complaints within 28 calendar days. For complex cases requiring extended investigation, you will receive a progress update within 5 working days of your initial submission.

If you are not satisfied with s98com's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. s98com will cooperate fully with any regulatory investigation.