28x777 Privacy Policy

This Privacy Policy ("Policy") describes how 28x777 ("we", "us", "our", "the Platform") collects, uses, discloses, stores, protects and processes personal data relating to individuals ("you", "your", "User") who access or use the 28x777 platform accessible at https://28x777.cam and any related subdomains, mobile applications or associated services (collectively, "the Platform").

This Policy is incorporated by reference into and forms part of the 28x777 Terms & Conditions. By registering an Account, using the Platform or accessing any of its features, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

We are committed to processing personal data lawfully, fairly and transparently. This Policy is written in plain, accessible English and is intended to give you a clear and complete picture of how your information is managed on 28x777.

The following terms are used throughout this Policy with the meanings set out below:

• "Account" — a registered user profile on the 28x777 Platform.
• "CNIC" — Computerised National Identity Card, the primary national identity document issued to Pakistani nationals.
• "Cookie" — a small data file placed on your device by a website to store session information, preferences or analytics data.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For users of the 28x777 Platform, the Data Controller is the operator of 28x777 as further described in Section 3.
• "Data Processor" — any entity that processes personal data on behalf of the Data Controller under a contractual arrangement.
• "KYC" — Know Your Customer; the identity, age and address verification process applicable to registered users.
• "Personal Data" — any information that relates to an identified or identifiable natural person, including name, date of birth, email address, device identifiers, financial data and identity documents.
• "Processing" — any operation performed on personal data, including collection, recording, storage, alteration, retrieval, disclosure, transmission, restriction, erasure or destruction.
• "Special Category Data" — personal data that reveals racial or ethnic origin, political opinions, religious beliefs, health data, biometric data or data concerning a natural person's sex life or sexual orientation. 28x777 does not seek to collect or process Special Category Data as part of standard account operations.

The Data Controller for personal data processed through the 28x777 Platform is the operator of 28x777, operating under the licensing and corporate structure applicable to this Platform. Details of the Data Controller's registered address, licensing authority and applicable data protection registration (where required) are available through the Platform's operator information pages.

28x777 does not claim to be registered as a data controller in Pakistan, nor does it operate under the supervision of any Pakistani data protection authority. Users in Pakistan access the Platform subject to the Platform's operator's applicable data protection regime and governing jurisdiction, and should understand this when submitting personal data.

We collect personal data through several distinct channels and at different stages of your interaction with the Platform. The categories of data collected are set out below:

4.1 Registration Data

When you create an Account on 28x777, we collect:

• Full legal name
• Date of birth (for age verification purposes)
• Email address
• Residential address (city, street, postal code, country)
• Username and encrypted password
• Phone number (where required for account security or two-factor authentication)

4.2 Identity Verification (KYC) Data

To comply with age verification and anti-money laundering obligations, we may collect:

• Copy of a government-issued identity document — for Pakistani users, this is typically a valid CNIC or passport
• Proof of residential address (utility bill, bank statement or similar official document)
• Facial image or liveness check photograph (to confirm identity document ownership)
• Payment method ownership confirmation documentation where applicable

4.3 Financial Data

When you make deposits or withdrawals, we collect and process:

• Payment method identifiers (e.g., partial card numbers, mobile wallet references such as Easypaisa or JazzCash account identifiers, bank account details for methods like HBL, UBL, Meezan Bank or Bank Alfalah transfers)
• Transaction amounts, dates and currency information
• Deposit and withdrawal history

We do not store full unmasked payment card numbers. Payment processing is handled through third-party payment processors operating under applicable Payment Card Industry (PCI) standards and their own privacy obligations.

4.4 Usage & Technical Data

Automatically collected when you interact with the Platform:

4.5 Voluntary Submissions

Any data you voluntarily submit through support tickets, feedback forms, promotional opt-ins or survey responses. You are never required to submit more information than is necessary for the specific purpose stated at the point of collection.

Where applicable data protection law requires a lawful basis for processing personal data, 28x777 relies on one or more of the following legal bases for each processing activity:

• Contractual Necessity: Processing required to perform the contract between you and 28x777 — including account registration, deposits, withdrawals, KYC and gameplay facilitation.
• Legal Obligation: Processing required to comply with applicable legal requirements, including anti-money laundering (AML) obligations, age verification mandates and regulatory reporting duties imposed by the Platform's licensing authority.
• Legitimate Interests: Processing conducted on the basis of 28x777's legitimate business interests — such as fraud prevention, security monitoring, responsible gambling compliance and internal analytics — where those interests are not overridden by your privacy rights.
• Consent: Where we rely on your consent for a specific processing activity (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

28x777 uses the personal data collected for the following specific and disclosed purposes:

• Account Management: Creating, maintaining and securing your registered Account; processing password resets and account queries.
• Identity & Age Verification: Confirming that you meet the minimum age requirement (18+, or higher where required by the operator's licensing jurisdiction) and that your identity is genuine, in compliance with KYC obligations.
• Payment Processing: Facilitating deposits and withdrawals through the Platform's supported payment channels. Transaction data is retained as required for AML compliance and financial record-keeping.
• Responsible Gambling Monitoring: Analysing gameplay and session patterns to detect indicators of problem gambling behaviour and to support the effective operation of responsible gambling tools such as deposit limits, loss limits and self-exclusion.
• Fraud & Security: Detecting and preventing fraud, multi-accounting, money laundering, identity theft and other prohibited conduct as defined in our Terms & Conditions.
• Customer Support: Responding to support enquiries, resolving disputes and maintaining records of support interactions.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve Platform performance, game selection, user interface and overall experience.
• Legal & Regulatory Compliance: Meeting obligations imposed by the Platform's applicable licensing authority, including record-keeping, reporting and audit requirements.
• Marketing Communications (with consent): Sending promotional offers, bonus notifications and Platform updates where you have opted in. You may opt out at any time.

28x777 does not sell, rent or trade your personal data to third parties for commercial purposes. We share personal data only in the following limited and specific circumstances:

• Payment Processors: Financial data is shared with our authorised payment processing partners (which may include third-party processors handling local payment methods) solely for the purpose of executing and reconciling transactions. Each processor is contractually bound to handle your data only as directed and in compliance with applicable law.
• KYC & Identity Verification Providers: Identity documents and verification data are shared with third-party KYC and age verification service providers engaged to perform identity checks on our behalf. These providers are contractually prohibited from using your data for any purpose other than verification.
• Licensing Regulators: We may be required to share transaction records, account data and correspondence with our licensing authority or a regulated dispute resolution service in connection with a complaint, audit or regulatory review.
• Law Enforcement & Legal Process: Where required by applicable law, court order, or government authority — including in the jurisdiction of our licensing authority — we may disclose personal data to relevant authorities without prior notice to you.
• Anti-Fraud Networks: Where permitted by law, we may share data with third-party fraud prevention agencies or shared blacklist databases to detect and prevent fraudulent account activity across the industry.
• Corporate Transactions: In the event of a merger, acquisition or asset sale involving 28x777, your data may be transferred to the successor entity. You will be notified of any such change that materially affects this Policy.

All third parties with whom personal data is shared are required to have appropriate data protection safeguards in place and to process your data only for the purposes for which it was shared.

Given the international nature of the 28x777 Platform, your personal data may be transferred to and processed in countries other than your country of residence — including countries that may not provide the same level of data protection as your home jurisdiction.

When personal data is transferred outside its country of origin, 28x777 takes steps to ensure that appropriate safeguards are in place, which may include contractual clauses, data processing agreements or reliance on adequacy decisions, as applicable to the relevant transfer.

Users in Pakistan should be aware that their personal data — including CNIC or passport copies submitted for KYC — may be processed on servers located outside Pakistan. By using the Platform and submitting personal data, you acknowledge and accept this international transfer of data.

28x777 uses cookies and similar technologies (including web beacons, pixel tags and local storage objects) to operate and improve the Platform. The types of cookies we use are described below:

You can manage or restrict cookies through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform, including logging in and managing your Account.

28x777 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory and accounting obligations.

• Active Account Data: Retained for the duration of your Account relationship with 28x777 and for a defined period following Account closure, in accordance with the operator's data retention schedule.
• KYC & Identity Documents: Retained for the minimum period required by the Platform's licensing authority's AML rules — typically five (5) years from the date of last transaction or account closure, whichever is later.
• Financial Transaction Records: Retained for the period required by applicable financial regulations — typically five (5) years, which may be extended where an ongoing investigation or legal proceeding is active.
• Support Communications: Retained for a period sufficient to address any follow-up queries or disputes — typically two (2) to three (3) years.
• Technical & Analytics Data: Aggregated or anonymised where possible after a period of twelve (12) to twenty-four (24) months.

Where data is no longer required for any retention purpose, it is securely deleted or anonymised in accordance with our data destruction procedures.

Subject to applicable data protection law and the conditions specified under that law, you may hold the following rights with respect to your personal data held by 28x777. The availability of each right may depend on the jurisdiction in which our data processing occurs and the specific circumstances of your request.

To exercise any of the above rights, please contact our Data Protection team via the support channels listed in Section 16. We aim to respond to all data rights requests within thirty (30) calendar days. Complex or multiple requests may take longer, in which case we will notify you of the extended timeframe.

The 28x777 Platform is strictly intended for adults. We do not knowingly collect personal data from individuals under the age of 18, or under the higher minimum age required by the Platform's applicable licensing jurisdiction. Age verification is a core part of our registration and KYC process.

If we discover or receive credible notification that personal data has been collected from an individual below the minimum permitted age, we will take immediate steps to delete that data and close the associated Account. Any funds deposited by an underage user will be handled in accordance with our Terms & Conditions and applicable law.

28x777 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration or destruction. These include:

• Transport Encryption: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security), enforced via HTTPS across the entire Platform.
• Data Encryption at Rest: Sensitive personal data — including identity documents and financial records — is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Access is logged, monitored and reviewed.
• Two-Factor Authentication (2FA): Available to all users for Account login security. We strongly recommend enabling 2FA to protect your Account.
• Penetration Testing: Our infrastructure undergoes periodic security assessments to identify and address vulnerabilities.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and relevant authorities in accordance with applicable obligations.

While we take extensive steps to protect your data, no system can guarantee absolute security. You also have a role in protecting your account — please use a strong, unique password, enable 2FA and never share your login credentials with others.

We serve a significant number of users from cities across Pakistan — including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar — and we take our responsibilities to Pakistani users seriously.

When Pakistani users submit KYC documentation, they may be sharing sensitive national identity information, including CNIC data. We treat this information with the highest standard of care. CNIC data is used solely for identity verification purposes and is never shared for commercial or marketing purposes.

Payment references familiar to Pakistani users — such as Easypaisa, JazzCash, Raast and bank transfers via institutions like HBL, UBL, Meezan Bank and Bank Alfalah — may be relevant to the payment data we process. Financial data processed in connection with these payment channels is handled in accordance with the applicable payment processor's privacy obligations and our own data handling standards.

Pakistan's regulatory landscape around data protection and online gambling continues to evolve. This Policy reflects our current data handling practices. Where Pakistani law imposes specific obligations on Platform operators, we will endeavour to comply to the extent applicable to our operations.

28x777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law or Platform operations. When material changes are made, we will notify registered users via email or a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy indicates the most recent revision date. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and request Account closure as described in our Terms & Conditions.

If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact our support team through any of the following channels:

• Live Chat: Available 24/7 from within the Platform for general and account-related queries.
• Help Centre: Self-service knowledge base available from the main Platform navigation.
• Email (plain text — not a clickable link): [email protected]

For formal data subject rights requests (access, erasure, rectification, portability, objection), please submit your request in writing via email with the subject line "Data Rights Request" and include your Account username and a brief description of your request. We will acknowledge receipt within 5 business days and provide a substantive response within 30 calendar days.

If you are dissatisfied with our response to a privacy complaint, you may have the right to escalate the matter to the relevant supervisory authority in the Platform's licensing jurisdiction. Details of the applicable authority are available on request.

This Privacy Policy was last reviewed and updated in January 2026.