c888 Privacy Policy
— How We Protect Your
Personal Data

c888, accessible at c888.lol, is the data controller responsible for the personal data of all registered Players and website visitors. As data controller, c888 determines the purposes and means by which personal data is processed.

c888 operates under international gaming licensing oversight. In connection with its gaming licence obligations, c888 is subject to data protection requirements that are, at minimum, aligned with globally recognised privacy standards including principles drawn from the General Data Protection Regulation (GDPR) framework and equivalent international standards.

For all data protection enquiries, rights requests, and complaints, please contact c888's dedicated privacy team at [email protected] with the subject line "Privacy Request — [Your Account Username]." Responses to formal privacy requests are provided within 30 calendar days of receipt.

c888 collects the following categories of personal data in connection with the operation of the c888 platform and the provision of services to Pakistani players:

Special category data: c888 does not intentionally collect sensitive personal data such as health information, racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is provided in CNIC documents for mandatory identity verification purposes.

c888 collects personal data through the following means:

• Direct collection — Registration: When you create a c888 Account, you provide identity data, contact data, and account credentials directly through the registration form.
• Direct collection — KYC: When you submit identity documents (CNIC, photograph) for verification purposes, c888 collects and processes this data to fulfil its licensing obligations.
• Direct collection — Transactions: When you deposit or withdraw funds using JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or USDT, financial transaction data is generated and collected by c888 and its payment processing partners.
• Direct collection — Support interactions: When you contact c888 via live chat or email, your communications and any personal data contained within them are collected and retained for support and quality assurance purposes.
• Automated collection — Technical data: When you visit c888.lol or use the c888 platform, technical data including IP address, device information, and browser data is automatically collected via server logs and cookies.
• Automated collection — Usage data: c888's platform analytics systems automatically collect data about how you interact with the platform — which pages you visit, which games you play, how long your sessions last, and what features you use. This data is used to improve the platform and monitor for responsible gaming indicators.
• Third-party sources: c888 may receive data about you from third-party sources including payment processors, fraud prevention services, and gaming industry shared exclusion databases, where permitted by applicable law.

c888 uses your personal data for the following specific purposes:

c888 processes personal data on the following legal bases, consistent with internationally recognised data protection frameworks:

• Contract performance: Processing necessary to provide you with the c888 services you have contracted for, including Account management, game access, and payment processing.
• Legal obligation: Processing required by c888's gaming licence conditions, AML/CFT regulations, KYC requirements, and other applicable legal obligations — including mandatory data retention for regulatory audit purposes.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, support quality, and platform improvement — where c888's legitimate interests in operating a safe, compliant platform are not overridden by your privacy interests.
• Consent: Where processing is based on consent (primarily marketing communications), you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
• Vital interests: In exceptional circumstances, c888 may process personal data where necessary to protect a person's vital interests — for example, where a player has indicated a welfare emergency in a support communication.

c888 does not sell your personal data to third parties under any circumstances. c888 shares personal data only in the following limited and controlled circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT processing partners receive the minimum financial data necessary to execute your requested transaction. These parties act as independent data controllers for their own operations.
• Identity verification providers: Third-party KYC and AML compliance service providers may receive identity documents and data to assist c888 in meeting its verification obligations. These providers operate under strict data processing agreements with c888.
• Game software providers: c888's game studio partners (including but not limited to Evolution Gaming, Pragmatic Play, SA Gaming) may receive technical session data necessary to deliver their games through the c888 platform. Game providers do not receive your identity or financial data.
• Fraud prevention services: c888 may share technical identifiers and transaction data with specialised fraud prevention platforms to detect and prevent fraudulent activity on the c888 platform.
• Responsible gaming databases: Where required by licensing conditions, c888 may share limited data with responsible gaming and self-exclusion schemes to enforce exclusion requests.
• Regulatory and law enforcement authorities: c888 is legally obligated to disclose personal data to gaming regulatory authorities, financial intelligence units, and law enforcement agencies where required by applicable law, court order, or gaming licence conditions. c888 will, where legally permitted, notify the affected Player before making such a disclosure.
• Group companies: c888 may share data within its corporate group to the extent necessary for group-level compliance, fraud prevention, and platform operations, subject to the same data protection standards applied to c888 directly.

c888 operates on an international platform and may transfer your personal data to, and process it in, countries outside of Pakistan. This occurs in connection with the use of cloud hosting infrastructure, game software providers, payment processors, and other service providers who may be located in various jurisdictions.

Where personal data is transferred internationally, c888 ensures that appropriate safeguards are in place to protect your data, including:

• Transfers to jurisdictions recognised as providing an adequate level of data protection by applicable international standards;
• Use of standard contractual clauses or equivalent contractual protections in agreements with international data processors;
• Adherence by receiving parties to the data protection requirements of c888's international gaming licence.

Players who wish to obtain further information about the safeguards applicable to specific international transfers may contact c888 at [email protected].

c888 retains personal data for the periods set out below, or for longer periods where required by applicable law, licensing obligations, or ongoing legal proceedings:

• Active Account data: Retained for the duration of your active c888 Account relationship and for a minimum of 5 years following Account closure, as required by c888's gaming licence AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of 5 years following Account closure or last transaction, in accordance with AML/CFT legal requirements.
• Financial transaction records: Retained for a minimum of 5 years following each transaction, as required by applicable financial record-keeping obligations.
• Support and communications records: Retained for 3 years following the closure of each support interaction, unless the matter is subject to an ongoing dispute or regulatory investigation.
• Marketing preferences and consent records: Retained for 3 years following withdrawal of consent or last interaction.
• Technical and usage logs: Retained for 12 months in standard operational logs; longer periods may apply where data is required for security investigations or regulatory purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymisation is not practicable, data is deleted using industry-standard secure deletion methods.

c888 uses cookies and similar tracking technologies to operate and improve the c888 platform. The following categories of cookies are used:

Most modern browsers allow you to control cookies through browser settings. Disabling strictly necessary cookies will impair your ability to use c888. For other cookie categories, you may manage preferences without affecting core platform functionality. Continued use of c888 following the display of the cookie consent notice constitutes acceptance of c888's cookie usage as described in this Policy.

As a c888 Player and a data subject, you have the following rights in relation to your personal data held by c888. To exercise any of these rights, please contact c888 at [email protected] with the subject "Privacy Rights Request." c888 will respond within 30 calendar days.

• Right of Access: You have the right to request a copy of all personal data that c888 holds about you, together with information about how it is being processed. This is commonly known as a Subject Access Request (SAR).
• Right to Rectification: You have the right to request that c888 correct any personal data that is inaccurate or incomplete. For basic Account data, you may make updates directly through your c888 Account settings without needing to contact support.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected. Note that this right is subject to overriding legal obligations: c888 is required by its licensing conditions and AML law to retain certain data for minimum periods regardless of an erasure request.
• Right to Restriction of Processing: You have the right to request that c888 restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on consent or contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where c888's legal basis is legitimate interests. Where you object, c888 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

The c888 platform is strictly intended for adults aged 21 years and above. c888 does not knowingly collect personal data from individuals under the age of 21. Any Account found to have been registered by a person under 21 will be immediately closed, all data will be handled in accordance with applicable law, and any funds associated with the Account will be processed in accordance with c888's licensing obligations regarding underage access.

c888's CNIC-based KYC process is the primary mechanism by which age verification is enforced. CNIC documents issued by the National Database and Registration Authority (NADRA) of Pakistan contain date of birth information that is verified against the stated age of the Account holder at registration. Where any discrepancy is identified, the Account is suspended pending investigation.

If a parent or guardian becomes aware that their minor child has provided personal data to c888 or has attempted to register an Account, they should contact c888 immediately at [email protected]. c888 will take immediate action to close any such Account and delete the associated data, to the extent permitted by regulatory requirements.

c888 employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• AES-256 encryption at rest: All personal data stored in c888's databases is encrypted using AES-256 encryption. This applies to identity data, financial records, and account credentials.
• TLS 1.3 encryption in transit: All data transmitted between your device and the c888 platform is encrypted using TLS 1.3, the current industry-standard transport encryption protocol. The c888.lol domain operates exclusively on HTTPS.
• Access controls: Access to systems containing personal data is restricted to authorised c888 personnel with a legitimate operational need. Access is granted on a principle of least privilege and is subject to multi-factor authentication requirements. All access is logged and regularly audited.
• Password hashing: Account passwords are processed through a one-way cryptographic hash function before storage. c888 does not store or have access to plain-text passwords.
• Network security: c888's infrastructure is protected by firewalls, intrusion detection systems, and regular penetration testing conducted by independent security specialists.
• Data breach response: c888 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to Player rights, c888 will notify affected Players and relevant regulatory authorities within the timeframes required by applicable law and licensing conditions.

While c888 implements robust security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your c888 Account credentials and for notifying c888 immediately if you suspect any unauthorised access to your Account.

The c888 platform may contain references or links to third-party services — including payment processors such as JazzCash and EasyPaisa, game providers, and licensing authority resources. This Privacy Policy applies exclusively to personal data collected and processed by c888 through the c888.lol platform.

c888 is not responsible for the privacy practices of any third-party services, websites, or platforms. When you interact with a third-party service — even in connection with a c888 transaction — that third party's own privacy policy governs the processing of your personal data by that service. c888 recommends that you review the privacy policies of all third-party services you interact with in connection with your c888 Account.

In particular, please note that:

• JazzCash and EasyPaisa are independent services operated by their respective owners, and their privacy policies govern how they handle your mobile wallet data;
• HBL, UBL, and Meezan Bank operate under their own privacy frameworks as regulated Pakistani financial institutions;
• Game software providers operate their game servers in accordance with their own data protection agreements with c888, as described in Section 6.

c888 reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, licensing requirements, platform operations, or data processing practices. The most current version of this Policy will always be published at c888.lol/privacy-policy with the effective date clearly stated at the top of the document.

Where amendments are material — meaning they significantly change how c888 processes your personal data or affect your privacy rights — c888 will provide advance notice to registered Players via the mobile number or email address associated with their Account. A minimum notice period of 14 days will be provided before material changes take effect, during which Players who do not accept the revised Policy may request Account closure.

Where amendments are minor, administrative, or required to reflect non-material operational changes, they may take effect upon publication without advance individual notice. The "Version" and "Effective Date" fields at the top of this Policy are updated with each revision. We encourage Players to review this Policy periodically to remain informed of how c888 handles their personal data.

Your continued use of the c888 platform following the effective date of any revision constitutes acceptance of the revised Privacy Policy. If at any point you do not agree with this Policy, you should cease using the c888 platform and may request account closure by contacting c888 support.

c888 is committed to handling all privacy concerns transparently and promptly. If you have a question, concern, or formal complaint about how c888 handles your personal data, please contact c888's privacy team through the following channels:

• Email: [email protected] — use subject line "Privacy Request — [Your Account Username]" for all formal privacy communications. Responses within 30 calendar days.
• Live Chat: Available 24/7 on the c888 platform for general privacy queries. Agent hours in Pakistan Standard Time (PKT): 8:00 AM – 2:00 AM.

c888 encourages Players to contact c888 directly in the first instance to resolve any privacy concern informally before escalating. In the majority of cases, c888 can address privacy concerns quickly and satisfactorily through direct communication.

If you are not satisfied with c888's response to your privacy complaint, you have the right to escalate your complaint to c888's licensing authority's data protection oversight function or to the relevant supervisory authority in your jurisdiction. Information about the applicable supervisory authority is available from c888's compliance team upon request.