sp786 Privacy Policy –
How We Protect Your Personal Data

1.1 This Privacy Policy is issued by sp786 ("sp786", "we", "us", "our") and applies to all personal data collected from individuals who access the sp786 website at sp786.net, create an account with sp786, use any service offered through the sp786 platform, or communicate with sp786 through any channel including live chat, email, or web forms.

1.2 This Policy sets out the legal basis on which we collect your personal data, the purposes for which we process it, the categories of third parties with whom we share it, the safeguards we apply when transferring data internationally, the periods for which we retain data, and the rights you hold as a data subject.

1.3 sp786 is committed to processing all personal data in compliance with applicable international data protection law. We review and update this Policy on a regular basis to reflect changes in our practices, technology, applicable law, and regulatory guidance.

2.1 For the purposes of applicable data protection law, sp786 is the data controller responsible for the personal data of all registered users and website visitors. As the data controller, sp786 determines the purposes and means of processing your personal data and is accountable for ensuring that such processing is lawful, fair, and transparent.

2.2 sp786 operates under an applicable international online gaming licence and is subject to the data protection and privacy requirements imposed by that regulatory framework, in addition to any requirements of applicable general data protection law.

2.3 Where sp786 engages third-party service providers to process personal data on its behalf — for example, payment processors, identity verification providers, and analytics platforms — those parties act as data processors. sp786 executes data processing agreements with all such processors to ensure that your data is handled in accordance with this Policy and applicable law.

sp786 collects personal data through the following channels and in the following categories:

3.1 Data You Provide Directly

• Registration data: full legal name, date of birth, gender, Pakistani CNIC number or equivalent government-issued identity document number, email address, mobile number, and residential address
• KYC verification documents: scanned copies or photographs of identity documents (e.g., Pakistani CNIC, passport), proof of address documents, and proof of payment method ownership
• Financial data: details of your selected payment method(s) — for example, your JazzCash or EasyPaisa registered mobile number, or the last four digits of a registered bank card. sp786 does not store full card numbers; these are handled directly by our PCI-DSS compliant payment processors.
• Communications: the content of any messages you send to sp786 via live chat, email ([email protected]), or any other contact channel
• Preferences: responsible gaming limit settings, communication preferences, and account configuration choices you make within the sp786 platform

3.2 Data Collected Automatically

• Device and access data: IP address, device type, operating system, browser type and version, mobile carrier (e.g., Jazz, Zong, Telenor), screen resolution, and referring URL
• Usage data: pages visited, games played, sessions initiated, wagering history, login timestamps, session duration, and in-platform navigation patterns
• Cookie and tracking data: as described in Section 9 of this Policy
• Geolocation data: approximate geographic location derived from IP address, used for regulatory compliance and jurisdictional access control

3.3 Data from Third Parties

• Identity verification providers: confirmation of identity, age, and document authenticity from third-party KYC verification services
• Payment processors: transaction status data, payment success or failure notifications, and fraud risk scores from our payment processing partners
• Anti-fraud and AML screening services: risk assessment data from sanctions list screening and fraud prevention databases

The following table sets out the primary purposes for which sp786 processes your personal data and the corresponding legal basis for each processing activity:

sp786 does not use your personal data for automated individual decision-making that produces legal or similarly significant effects, except where this is required as part of a regulatory or fraud-prevention obligation. Where such automated processing occurs, you have the right to request human review of the relevant decision.

sp786 processes personal data on the following legal bases under applicable data protection law:

• Contract Performance: Processing that is necessary to create, maintain, and operate your sp786 account and to provide the services you have requested — including account administration, payment processing, and customer support.
• Legal Obligation: Processing that is required to comply with applicable law — including KYC identity verification, AML transaction monitoring, responsible gaming requirements, and regulatory reporting obligations imposed by sp786's licensing jurisdiction.
• Legitimate Interests: Processing for sp786's legitimate business interests — including fraud prevention, platform security, usage analytics for product improvement, and direct marketing to existing customers — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — principally for marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6.1 sp786 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Period. This is a firm commitment that sp786 will not compromise on.

6.2 Service Providers (Data Processors). sp786 shares personal data with carefully selected third-party service providers who process data on our behalf and under our documented instruction. These include:

• Payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and card scheme processors) — for the purpose of processing deposits and withdrawals
• KYC and identity verification service providers — for age and identity verification
• AML and sanctions screening services — for anti-money laundering compliance
• Cloud hosting and infrastructure providers — for secure platform hosting and data storage
• Customer support platform providers — for live chat and ticketing functionality
• Platform analytics providers — for aggregated, anonymised usage analytics

All service providers are subject to binding data processing agreements that require them to implement appropriate technical and organisational security measures, process data only in accordance with sp786's documented instructions, and refrain from using sp786 user data for any purpose other than the contracted service.

6.3 Regulatory and Law Enforcement Disclosure. sp786 may be required to disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, or courts where required by law or valid legal process. Where legally permitted, sp786 will notify affected users of such disclosure requests before complying.

6.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or substantially all of sp786's business assets, personal data held by sp786 may be transferred to the successor entity as part of the transaction. sp786 will notify users of any such transfer and the successor entity will be bound by this Privacy Policy.

7.1 sp786 operates internationally and may transfer personal data to and store personal data in countries outside Pakistan, including countries where data protection laws may differ from those in Pakistan. Where such transfers occur, sp786 implements appropriate safeguards to ensure that your personal data receives a level of protection consistent with this Policy and applicable international data protection standards.

7.2 Appropriate safeguards for international data transfers employed by sp786 include: contractual clauses imposing data protection obligations on the receiving party; transfer to jurisdictions that provide an adequate level of data protection by applicable determination; and binding corporate rules where transfers occur within the sp786 corporate group.

7.3 Where sp786 transfers personal data to payment processors in connection with JazzCash, EasyPaisa, or Pakistani bank transfers, those transfers are governed by the data processing agreements in place with those processors and by the applicable regulatory frameworks governing licensed financial service providers in Pakistan.

8.1 sp786 retains personal data only for as long as is necessary to fulfil the specific purpose for which it was collected, or for as long as required by applicable law. The following general retention periods apply:

• Account and registration data: retained for the duration of your account relationship with sp786, plus a minimum of 5 years following account closure, as required by applicable AML and gaming regulatory retention obligations
• KYC documents: retained for a minimum of 5 years following the end of the account relationship, in accordance with applicable AML record-keeping requirements
• Transaction records: retained for a minimum of 5 years following the date of each transaction
• Communications data (support interactions): retained for 2 years following closure of the relevant support interaction
• Usage and analytics data: retained in anonymised or aggregated form indefinitely; identifiable usage data retained for 12 months following generation
• Marketing consent records: retained for 3 years following withdrawal of consent, as evidence that consent was properly obtained and withdrawn

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard data destruction procedures. sp786 maintains documented records of all data deletion activities.

9.1 sp786 uses cookies and similar tracking technologies (including web beacons, local storage objects, and session identifiers) on the sp786 platform. Your use of the sp786 platform constitutes your consent to the use of cookies as described in this section.

9.2 Categories of Cookies Used by sp786:

• Strictly Necessary Cookies: These cookies are essential to the operation of the sp786 platform. They maintain your login session, store your account preferences during a session, and enable core platform functionality. These cookies cannot be disabled without impairing your ability to use the sp786 platform.
• Functional Cookies: These cookies remember your personalisation choices — such as your preferred language, game display settings, and responsible gaming limit configurations — so that you do not need to re-enter them on each visit.
• Analytics Cookies: These cookies collect aggregated, anonymised data about how users navigate the sp786 platform — including which pages are visited most frequently, where users navigate from, and how long sessions last. This data is used solely to improve the sp786 platform experience.
• Security Cookies: These cookies support sp786's fraud prevention and platform security systems by detecting unusual session behaviour that may indicate unauthorised account access.

9.3 You may control the use of non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling functional cookies may impair aspects of the sp786 user experience. sp786 does not currently use third-party advertising cookies or cross-site behavioural tracking cookies.

10.1 The sp786 platform is strictly intended for adults aged 21 years and over. sp786 does not knowingly collect, process, or retain personal data from individuals under the age of 21. If sp786 becomes aware that personal data has been collected from an individual who is under 21 years of age, that data will be deleted immediately and the relevant account will be closed.

10.2 If you are a parent or guardian and believe that your child may have registered with or provided personal data to sp786, please contact our support team immediately at [email protected]. sp786 will investigate all such reports and take appropriate action within 2 business days of receipt.

11.1 sp786 implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your browser or app and the sp786 servers
• AES-256 encryption for all personal data stored at rest on sp786 servers
• Strict role-based access controls limiting internal access to personal data to authorised sp786 personnel on a documented need-to-know basis
• Comprehensive audit logging of all access to personal data records, reviewed regularly by sp786's security team
• Regular penetration testing and vulnerability assessment of the sp786 platform infrastructure
• Two-factor authentication available on all sp786 user accounts and mandatory for all sp786 staff accounts with access to user personal data
• Formal data breach response procedures with defined notification timelines for affected users and applicable regulatory authorities

11.2 While sp786 employs industry-standard security measures, no internet-based platform can guarantee absolute security against all threats. You are encouraged to protect your sp786 account by using a strong, unique password and enabling two-factor authentication. You must notify sp786 immediately if you suspect any unauthorised access to your account.

12.1 The sp786 platform may contain links to or integrations with third-party websites, services, or platforms. This Privacy Policy applies solely to personal data collected and processed by sp786. sp786 is not responsible for the privacy practices, data handling policies, or content of any third-party website or service linked to or from the sp786 platform.

12.2 sp786 recommends that you review the privacy policy of any third-party website or service you navigate to from the sp786 platform before providing any personal information to that third party. sp786 has no control over third-party data practices and accepts no liability for how third parties handle your personal information.

13.1 sp786 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or platform functionality. Any amendments will be published on the sp786 website with an updated effective date.

13.2 Where amendments are material — meaning they significantly affect how sp786 processes your personal data or reduce your data protection rights — sp786 will provide advance notice via the email address registered to your account at least 14 days before the amended Policy takes effect.

13.3 Your continued use of the sp786 platform following publication of an amended Privacy Policy constitutes your acceptance of the amended Policy. If you do not agree with any amendment, you should discontinue use of sp786 and contact our support team to close your account and request deletion of your personal data.

14.1 Exercising Your Rights. To exercise any of your data subject rights described in this Policy, or to ask any question about how sp786 handles your personal data, please contact the sp786 Privacy Team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line
• Live Chat: Available 24 hours a day, 7 days a week via the sp786 platform

14.2 Response Timelines. sp786 will acknowledge all privacy requests within 5 business days and will provide a substantive response within 30 calendar days of receiving a verified request. Where a request is particularly complex or where sp786 is handling a high volume of requests, this period may be extended by a further 30 days, of which sp786 will notify you.

14.3 Complaints. If you are not satisfied with sp786's response to a privacy request or with any aspect of sp786's data handling practices, you have the right to lodge a complaint with the competent supervisory authority in the jurisdiction where you are based, or with the supervisory authority of sp786's licensing jurisdiction. sp786 will cooperate fully with any investigation conducted by a competent supervisory authority.