ef888 Privacy Policy

This Privacy Policy ("Policy") is published by ef888 and governs the collection, processing, storage, and disclosure of personal data relating to individuals ("Players", "Users", or "you") who access or use the ef888 online casino and sports betting platform available at ef888.one and any associated mobile interfaces or sub-domains (collectively, the "Platform").

ef888 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy has been prepared with Pakistani players in mind — including players in Karachi, Lahore, Islamabad, Faisalabad, and all other cities across Pakistan — and complies with ef888's obligations under the international licensing standards applicable to its operations.

This Policy should be read together with the ef888 Terms and Conditions, available at ef888.one/terms-conditions. In the event of any conflict between this Policy and the Terms and Conditions with respect to privacy matters, this Policy shall prevail.

For the purposes of this Policy, ef888 acts as the data controller in respect of personal data collected from registered players and website visitors. As data controller, ef888 determines the purposes for which personal data is collected and the means by which it is processed.

ef888 operates the Platform under international gaming licensing standards. The data controller's designated contact for all privacy-related enquiries, data subject requests, and complaints is the ef888 Data Protection Team, reachable via the contact details set out in Section 15 of this Policy.

Where ef888 engages third-party service providers to process personal data on its behalf — including payment processors, KYC verification providers, game software providers, and customer support systems — those third parties act as data processors under documented contractual arrangements that require them to handle personal data only in accordance with ef888's instructions and applicable data protection obligations.

ef888 collects personal data across several categories depending on the nature of your interaction with the Platform. The categories of data collected are as follows:

• Full legal name as it appears on your CNIC or passport.
• Date of birth — collected for the purpose of verifying compliance with the ef888 21+ age requirement.
• Residential address, including city and postcode (e.g., Karachi, Lahore, Islamabad, Faisalabad).
• Email address used to create your ef888 account.
• Pakistani mobile number (03XX format) registered to your account.
• Username and encrypted password associated with your ef888 Login credentials.
• Gender (optional, where provided during registration).

• CNIC number and a copy of your CNIC (front and back), or a copy of your valid passport.
• Utility bill or bank statement submitted as proof of residential address, where required.
• Selfie photograph taken for the purpose of facial verification against your identity document, where required by the KYC process.
• Source of funds documentation, where required by ef888's anti-money laundering procedures for high-value account activity.

• JazzCash or EasyPaisa mobile wallet account numbers associated with deposit and withdrawal transactions.
• HBL, UBL, or Meezan Bank account details (IBAN or account number) where provided for bank transfer transactions.
• Visa or Mastercard details as processed via ef888's PCI-DSS compliant payment processor — ef888 does not store full card numbers on its own servers.
• Deposit and withdrawal transaction history, including amounts in PKR, timestamps, and transaction reference numbers.
• Account balance history and net win/loss records.

• Records of all wagers placed on casino games, live casino tables, and sports betting markets, including game names, stake amounts, bet outcomes, and timestamps.
• Session duration records and login timestamps for each ef888 Login session.
• Responsible gaming settings and tool activations, including deposit limits, cooling-off periods, and self-exclusion records.
• Bonus and promotion claim records.

• IP address at the time of each ef888 Login and each session.
• Device type, operating system version, and browser type and version.
• Referring URL and pages visited within the ef888 Platform.
• Cookie identifiers and session tokens as described in Section 9.
• Geographic location data derived from IP address (city/region level).

• Content of live chat conversations, emails, and support ticket submissions between you and the ef888 support team.
• Records of any self-exclusion or responsible gaming requests submitted to ef888.
• Marketing communication preferences, including opt-in and opt-out records for promotional emails and SMS notifications.

ef888 collects personal data through the following channels and mechanisms:

• Directly from you during the account registration process, the ef888 Login process, deposit and withdrawal submissions, KYC document uploads, customer support interactions, and the completion of any forms or surveys on the Platform.
• Automatically via the Platform's technical systems, including server logs, session management cookies, analytics tools, and device fingerprinting technologies. This data collection occurs whenever you access or use the ef888 Platform, regardless of whether you are logged in.
• From third-party identity verification providers engaged by ef888 to perform KYC checks. These providers may supplement the information you provide with data from credit reference agencies, government document verification systems, or anti-fraud databases.
• From payment processors including JazzCash, EasyPaisa, and bank transfer partners, in the form of transaction confirmation data, payment status updates, and (where applicable) anti-fraud signals.
• From game software providers in the form of game session logs, RNG outcome records, and jackpot event data, which are used for dispute resolution, game audit, and regulatory reporting purposes.

ef888 processes personal data for the following purposes, each supported by one or more lawful bases:

Where ef888 relies on legitimate interests as the legal basis for processing, ef888 has conducted a balancing assessment and determined that the processing is necessary for ef888's legitimate business purposes and does not override the fundamental rights and freedoms of the Players concerned. Players who wish to object to processing carried out on legitimate interests grounds may do so as described in Section 10.

ef888 does not sell personal data to third parties. ef888 shares personal data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

ef888 shares transaction-related personal data with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa/Mastercard acquiring banks, and USDT processing partners strictly as required to execute deposit and withdrawal transactions. Payment processors operate under their own privacy policies and are contractually required to handle your data securely.

ef888 shares identity and KYC documentation data with third-party verification providers engaged to carry out age verification, document authentication, and anti-fraud screening as part of the ef888 account verification process. These providers are contractually bound to use this data solely for the verification services they provide to ef888.

Game software providers (including Evolution Gaming, Pragmatic Play, and Microgaming, among others) may receive session and account reference data — typically a pseudonymous player identifier rather than personally identifying information — in order to deliver game sessions, manage jackpot systems, and provide game audit logs for regulatory purposes.

ef888 is required to disclose personal data to regulatory bodies, law enforcement agencies, tax authorities, and courts where required or permitted by applicable law. Such disclosures may include transaction records, player identity data, and account activity logs where required for the investigation of financial crime, tax compliance, or regulatory audit.

In the event of a merger, acquisition, sale of assets, or other corporate restructuring involving ef888, player personal data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and the privacy practices of the acquiring entity in advance of the transfer taking effect.

ef888 retains personal data for the periods set out below, after which data is securely deleted or anonymised unless a longer retention period is required by applicable law or regulatory obligation:

Following the expiry of the applicable retention period, ef888 will securely delete personal data in accordance with its data disposal procedures, or render it irreversibly anonymised such that it can no longer be attributed to any identifiable individual.

ef888 implements a range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, and destruction. These measures include but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between players' devices and the ef888 Platform servers — including the ef888 Login session, the payment cashier, and all API communications.
• Encryption at rest for sensitive stored data including identity documents, CNIC numbers, and payment account references, using AES-256 encryption.
• PCI-DSS compliance for all credit and debit card payment processing. ef888 does not store full card numbers on its own infrastructure.
• Multi-factor authentication for ef888 staff access to systems containing personal data. Player accounts optionally support two-factor authentication (2FA) via SMS OTP.
• Role-based access controls limiting internal staff access to personal data to those employees and contractors who require it for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security firms to identify and remediate security weaknesses.
• Intrusion detection and monitoring systems that flag and alert on anomalous access patterns to ef888 Platform infrastructure.

Notwithstanding the above measures, no information security system is completely impenetrable. ef888 cannot guarantee the absolute security of data transmitted over the internet. Players are advised to take their own precautions — including enabling 2FA on their ef888 Login, using strong and unique passwords, and protecting their devices from unauthorised access.

ef888 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device by the ef888 website when you visit. Cookies allow ef888 to recognise your browser, maintain your ef888 Login session, and personalise your experience.

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that maintain your ef888 Login state and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without preventing core Platform functionality.
• Functional Cookies: Remember your preferences and settings — such as your preferred language, responsible gaming display settings, and cashier currency preferences — to personalise your experience across sessions.
• Analytics Cookies: Collect aggregated and anonymised data about how players use the ef888 Platform — which pages are visited most frequently, which game categories attract the highest engagement, and where players encounter friction in the deposit or withdrawal flow. This data is used to improve Platform design and performance.
• Marketing Cookies: Where you have given consent, marketing cookies allow ef888 to deliver promotional messages tailored to your gaming activity and preferences. You may withdraw marketing cookie consent at any time via your browser settings or account preferences.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair or prevent access to the ef888 Platform. ef888 does not use cookies to collect personally identifiable information beyond what is required for the purposes listed above.

Registered ef888 players and website visitors hold the following rights in relation to their personal data processed by ef888. To exercise any of these rights, please contact the ef888 Data Protection Team as described in Section 15:

• Right of Access: You have the right to request a copy of the personal data ef888 holds about you, together with information about how that data is being used. ef888 will respond to access requests within 30 days.
• Right to Rectification: Where personal data held by ef888 is inaccurate or incomplete, you have the right to request correction or completion of that data.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you have the right to request the deletion of personal data ef888 holds about you. This right is not absolute — ef888 may be required to retain data to comply with legal obligations, including AML and regulatory reporting requirements.
• Right to Restriction of Processing: You have the right to request that ef888 restrict the processing of your personal data in specified circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Where processing is carried out on the basis of ef888's legitimate interests, you have the right to object to such processing. ef888 will cease the processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

The ef888 Platform is strictly intended for individuals aged 21 years and above. ef888 does not knowingly collect personal data from individuals under the age of 21. The ef888 registration process requires all applicants to confirm their date of birth and to submit to age verification before their account is activated for real-money gaming.

If ef888 becomes aware that personal data has been submitted by or on behalf of an individual under the age of 21, that account will be immediately suspended, all associated transactions will be reviewed, and the personal data will be deleted in accordance with ef888's data disposal procedures — subject to any legal retention obligations applicable to transactions that may have been completed prior to detection.

Parents or guardians who believe that a minor may have registered on the ef888 Platform using false information are encouraged to contact ef888 support immediately. ef888 will investigate all such reports promptly and take appropriate action. For further guidance on protecting minors from online gambling, please visit the ef888 Responsible Gaming page.

As an internationally licensed online gaming platform, ef888 may transfer personal data to countries outside of Pakistan where its licensed partners — including game software providers, payment processors, and identity verification services — are based. Such countries may have data protection laws that differ from those applicable in Pakistan.

Where personal data is transferred internationally, ef888 ensures that appropriate safeguards are in place to protect the transferred data. Such safeguards may include:

• Standard contractual clauses approved by recognised data protection authorities, incorporated into agreements with the recipient party.
• Transfers to countries that have been determined by relevant regulatory bodies to provide an adequate level of data protection.
• Binding corporate rules or equivalent frameworks where applicable to transfers within corporate group structures.

Players may request further information about the specific safeguards in place for international transfers of their personal data by contacting the ef888 Data Protection Team as described in Section 15.

The ef888 Platform may contain references to or links to third-party websites or services — for example, links to game provider pages for game rules, or to responsible gaming resources. This Privacy Policy applies only to the ef888 Platform and does not extend to any third-party websites or services that may be linked from ef888.one.

ef888 is not responsible for the privacy practices of any third-party website or service. Players who access third-party websites through links on the ef888 Platform are encouraged to review the privacy policies of those third parties independently before submitting any personal data to them.

ef888 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable data protection law, regulatory requirements, Platform functionality, or ef888's data processing practices. Material changes to this Policy will be communicated to registered players via email to their registered address and/or via a prominent notice on the ef888 Platform, at least 14 days before the changes take effect.

The version number and effective date at the top of this Policy indicate the current version. Players are encouraged to review this Policy periodically. The most current version of this Policy is always available at ef888.one/privacy-policy. Your continued use of the ef888 Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

For all privacy-related enquiries, data subject access requests, or complaints regarding ef888's handling of personal data, please contact the ef888 Data Protection Team using the following details:

• Live Chat: Available 24/7 via the ef888 Platform. Select "Privacy / Data Request" as the subject of your enquiry.
• Email: [email protected] — please include "Privacy Policy Request" in the subject line. This is displayed as plain text and is not a clickable link.

ef888 will acknowledge all written data-related correspondence within two business days and will provide a substantive response within 30 days of receiving a verifiable request. Where the complexity or volume of a request requires additional time, ef888 will notify the Player of the extension and provide a revised response date.

Players who are not satisfied with ef888's response to a privacy complaint have the right to lodge a complaint with the relevant data protection supervisory authority. ef888 will cooperate fully with any investigation conducted by a competent supervisory authority in connection with player complaints.

This Privacy Policy was last reviewed and updated on 1 January 2026. © 2026 ef888. All rights reserved.