qr98 Privacy Policy

1 Who We Are

qr98 is an online gaming platform operating at qr98.net, offering cricket betting, live dealer casino games, high-RTP slot games, fishing games, and related services to adult players in Pakistan and other eligible territories. qr98 is licensed and regulated under international gaming regulations applicable to its operating jurisdiction.

For the purposes of data protection law, qr98 acts as the data controller for personal data collected through the qr98 platform. This means qr98 determines the purposes and means by which your personal data is processed. Where qr98 engages third-party service providers to process data on its behalf (for example, payment processors or KYC verification providers), those parties act as data processors under qr98's instruction and are bound by contractual data protection obligations.

If you have any questions about this Policy or about how qr98 handles your personal data, you may contact our support team directly at [email protected]. We are available via live chat 24/7 and aim to respond to email queries within 4 hours.

2 Data We Collect

qr98 collects the following categories of personal data from users of the platform. We collect only what is necessary and proportionate to the purposes described in this Policy:

3 How We Collect Your Data

qr98 collects personal data through the following channels:

• Direct submission at registration — when you create a qr98 account, you provide identity and contact data directly through the registration form.
• KYC document uploads — when you submit identity verification documents (CNIC, passport, or other government-issued ID) to complete the Know Your Customer process.
• Transaction activity — financial data is generated automatically when you make deposits or initiate withdrawals through JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank.
• Platform usage — technical and gaming activity data is recorded automatically by qr98's servers as you interact with the platform, including when you place bets, play slots, or access live casino games.
• Support interactions — when you contact qr98 through live chat or email, the content of those communications is stored for quality assurance and dispute resolution purposes.
• Cookies and similar technologies — qr98 uses cookies and local storage to maintain your session, recognise returning devices, and gather anonymised platform analytics. See Section 8 for full cookie details.

4 How We Use Your Data

qr98 uses the personal data it collects for the following clearly defined purposes:

• Account creation and management — to register your qr98 account, verify your identity, maintain your account settings, and enable you to access all platform features securely.
• Payment processing — to process PKR deposits and withdrawals through your chosen payment method (JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank) accurately and securely.
• Regulatory and legal compliance — to fulfil obligations under applicable AML (Anti-Money Laundering) regulations, KYC requirements, and any requests from competent regulatory or law enforcement authorities.
• Responsible gaming — to monitor gaming activity patterns and identify players who may be exhibiting signs of problem gambling behaviour, enabling qr98 to offer appropriate support tools such as deposit limits, cooling-off periods, or self-exclusion.
• Fraud prevention and platform security — to detect, investigate, and prevent fraudulent activity, account compromise, bonus abuse, collusion, and other security threats to the qr98 platform and its users.
• Customer support — to respond to your queries, resolve complaints, and maintain records of support interactions for quality assurance purposes.
• Platform improvement — to analyse aggregated, anonymised usage data to improve the performance, stability, and user experience of the qr98 platform.
• Promotional communications — where you have given explicit consent, to send you information about new games, promotions, and bonus offers. You may withdraw consent at any time by contacting [email protected].

5 Legal Basis for Processing

qr98 processes your personal data only where there is a lawful basis to do so. The legal bases we rely on are as follows:

• Performance of a contract — processing your identity, contact, and financial data is necessary to provide you with the services described in the qr98 Terms & Conditions. Without this processing, we cannot operate your account or process your transactions.
• Legal obligation — qr98 is required by applicable AML, KYC, and gaming regulatory frameworks to collect, verify, and retain certain categories of personal data. This processing is mandatory and cannot be opted out of.
• Legitimate interests — qr98 processes technical and gaming activity data to protect the security and integrity of the platform, prevent fraud, and improve its services. We have assessed that our legitimate interests are not overridden by your privacy rights in these cases.
• Consent — where qr98 sends promotional communications or uses non-essential cookies, we rely on your explicit consent. You have the right to withdraw consent at any time, and doing so will not affect the lawfulness of processing that took place before withdrawal.

6 Data Sharing & Disclosure

qr98 does not sell or rent your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

• Payment processors — your financial data is shared with the relevant payment processor (JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank) to execute deposit and withdrawal transactions. These processors handle data under their own privacy policies and applicable Pakistani financial regulations.
• KYC verification providers — your identity documents may be shared with third-party identity verification services engaged by qr98 to carry out automated or manual KYC checks in accordance with AML obligations.
• IT and hosting providers — qr98 uses third-party infrastructure and cloud hosting providers to operate the platform. These providers act as data processors under contractual data protection agreements with qr98 and are not permitted to use your data for their own purposes.
• Regulatory and law enforcement authorities — qr98 will disclose personal data to competent regulatory bodies, tax authorities, or law enforcement agencies where legally required to do so, or where qr98 reasonably believes that disclosure is necessary to prevent or investigate criminal activity.
• Business transfers — in the event that qr98 undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer via your registered email address in advance.

7 Data Retention

qr98 retains personal data for as long as is necessary to fulfil the purposes set out in this Policy, to maintain your active account, and to comply with applicable legal and regulatory obligations. The following general retention periods apply:

• Account data — retained for the duration of your active account plus a minimum of 5 years following account closure, in line with AML regulatory record-keeping requirements.
• Transaction and financial records — retained for a minimum of 5 years from the date of each transaction, as required under applicable financial regulations.
• KYC verification documents — retained for the duration of your account and for 5 years following account closure. After this period, documents are securely destroyed.
• Gaming activity logs — retained for 3 years from the date of each session for the purposes of game integrity, responsible gaming monitoring, and dispute resolution.
• Support communications — retained for 2 years from the date of each interaction for quality assurance and dispute resolution purposes.
• Technical and log data — IP address logs and session data are retained for up to 12 months and then automatically deleted or anonymised.

Where retention beyond these periods is required by a specific legal obligation or ongoing regulatory investigation, qr98 will retain the relevant data until that obligation is discharged. Upon the expiry of applicable retention periods, data is securely deleted or irreversibly anonymised.

8 Cookies & Tracking Technologies

qr98 uses cookies — small text files placed on your device — and similar local storage technologies to operate the platform securely and efficiently. The following categories of cookies are used on qr98.net:

• Strictly necessary cookies — essential for the platform to function. They enable session management, authentication, and security features. These cookies cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies — used to collect anonymised data about how players navigate and use the qr98 platform, which pages are most visited, and where technical errors occur. This data is used solely to improve platform performance and is not linked to any individual user profile.
• Functional cookies — used to remember your preferences, such as your preferred language or display settings, so that they are applied automatically on subsequent visits.

qr98 does not use third-party advertising cookies, social media tracking pixels, or any cross-site tracking technologies on qr98.net. You will not see targeted advertisements based on your qr98 activity on other websites.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in or using platform features that require an authenticated session. Disabling performance or functional cookies will not affect your ability to use the platform but may result in a less personalised experience.

9 Data Security

qr98 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and qr98's servers. You can verify this by checking for "https" and the padlock symbol in your browser's address bar when visiting qr98.net.
• Password hashing — qr98 never stores your account password in plain text. Passwords are stored using industry-standard one-way cryptographic hashing algorithms.
• Two-factor authentication (2FA) — qr98 supports 2FA for account login via your registered Pakistani mobile number, providing an additional layer of protection against unauthorised access.
• Access controls — access to personal data within qr98's systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data required to perform their specific job functions.
• Regular security audits — qr98 conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities in its platform and infrastructure.
• Incident response procedures — qr98 maintains documented data breach response procedures. In the event of a breach that poses a risk to your rights, qr98 will notify affected users within the timeframe required by applicable law.

Whilst qr98 takes all reasonable steps to secure your personal data, no internet-based platform can guarantee absolute security. You also play an important role in protecting your account: keep your qr98 login credentials confidential, use a strong and unique password, enable 2FA, and contact [email protected] immediately if you suspect unauthorised access to your account.

10 Your Data Rights

As a qr98 account holder, you hold the following rights in relation to your personal data. To exercise any of these rights, contact the qr98 support team at [email protected] with your registered account details and a description of your request. qr98 will respond within 7 business days.

• Right of Access — you have the right to request a copy of all personal data qr98 holds about you, along with information about how it is used and with whom it is shared.
• Right to Rectification — if any personal data qr98 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Note that corrections to KYC-verified identity data may require re-submission of verification documents.
• Right to Erasure — you may request deletion of your personal data. This right is subject to override where retention is required by applicable law (such as AML record-keeping obligations) or where data is required to resolve an outstanding dispute or complete a pending transaction.
• Right to Restriction — you may request that qr98 restricts the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested.
• Right to Data Portability — you may request a copy of your personal data in a structured, machine-readable format to transfer to another service provider where technically feasible.
• Right to Object — you have the right to object to processing based on qr98's legitimate interests. qr98 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent — where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

11 Children & Minors

qr98 services are strictly restricted to adults aged 21 years and above. qr98 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the qr98 account registration process, and qr98 reserves the right to request additional documentary proof of age at any stage of the account lifecycle.

If qr98 becomes aware that personal data has been collected from a person under the age of 21 — whether through a false declaration at registration or any other means — qr98 will immediately suspend the relevant account, delete all associated personal data, and return any deposited funds to the originating payment method following verification.

12 Third-Party Links

The qr98 platform may, from time to time, contain references to third-party services such as payment providers. While qr98 takes care in selecting its service partners, qr98 has no control over the privacy practices of third-party websites or applications and is not responsible for their content or privacy policies.

When you are redirected to a third-party platform — such as your JazzCash or EasyPaisa app to complete a payment — you are subject to that platform's own privacy policy and terms of use. We encourage you to review the privacy policies of any third-party services you use in connection with your qr98 account.

13 Updates to This Policy

qr98 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The most current version of this Policy will always be accessible at qr98.net/privacy-policy. The effective date at the top of this document will be updated each time a new version is published.

Where updates are material — for example, changes to the categories of data we collect, the purposes for which we use it, or the third parties with whom it is shared — qr98 will notify registered users via email to the address on file with their account. For minor or administrative updates, notification will be provided solely through the updated Policy document on the platform.

Your continued use of the qr98 platform after any update to this Policy constitutes your acceptance of the revised version. If you do not accept the revised Policy, you must discontinue use of the platform and may request account closure by contacting [email protected].

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to qr98's data processing practices, please contact us through any of the following channels:

• Email: [email protected] — for formal data rights requests, privacy complaints, and policy queries. We aim to respond within 4 hours and to resolve all privacy matters within 7 business days.
• Live Chat: Available 24/7 on qr98.net — for general privacy questions and account-related data queries.

qr98's support team operates in Pakistan Standard Time (PKT, UTC+5). When contacting us about a data privacy matter, please include your registered account mobile number and a clear description of your query to help us assist you as quickly as possible. Do not send copies of sensitive identity documents (CNIC, passport) via live chat — use encrypted email and our team will guide you through the secure document submission process.