m998 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how m998 ("m998", "we", "us", "our") — the operator of the online gaming platform accessible at https://m998.bio and its associated mobile applications (collectively, the "Platform") — collects, uses, stores, and protects personal data relating to registered players, visitors, and prospective users ("you", "your").

m998 takes its obligations under applicable data protection legislation seriously. This Policy has been drafted to meet the standards of internationally recognised data protection frameworks, including principles derived from the General Data Protection Regulation (GDPR), as well as applicable Pakistani data protection guidelines. Where local requirements differ from international frameworks, m998 applies the standard that provides the greater protection to the individual.

By registering an account on the Platform, making a deposit, or otherwise using any feature of the m998 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not accept this Policy, you must not use the Platform.

2. Personal Data We Collect

m998 collects personal data from you directly (when you provide it to us) and automatically (when you use the Platform). The categories of personal data we collect are set out below.

2.1 Data You Provide to Us

• Identity Data: Full legal name, date of birth, nationality, gender, and copies of identity documents (CNIC, passport, or government-issued photo ID) submitted during account registration and KYC (Know Your Customer) verification.
• Contact Data: Email address, Pakistani mobile number (required for JazzCash and EasyPaisa transactions), and residential address.
• Financial Data: Payment method details, PKR transaction records, deposit and withdrawal history, and bank account information (where bank transfer is used via HBL, UBL, or Meezan Bank).
• Account Data: Username, account preferences, responsible gaming settings, communication preferences, and support correspondence.
• Verification Data: Source-of-funds declarations and any additional documentation provided for enhanced due diligence purposes.

2.2 Data Collected Automatically

• Usage Data: Pages visited, games played, bets placed, session duration, login timestamps, and navigation paths within the Platform.
• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Location Data: Approximate geographic location derived from IP address, used for fraud prevention and regulatory compliance purposes. m998 does not collect precise GPS location data.
• Cookie Data: Data collected via cookies, web beacons, and similar tracking technologies as described in Section 8 of this Policy.

3. How We Use Your Personal Data

m998 uses your personal data only for the purposes for which it was collected. The table below sets out the primary purposes for which we process your data and the corresponding legal basis for each purpose.

4. Legal Basis for Processing

4.1 Contract Performance. The majority of our data processing is necessary for the performance of the contract between you and m998 — specifically, to provide you with access to the Platform, process your bets and PKR transactions, and manage your account.

4.2 Legal Obligation. We are required by applicable law to collect and retain certain categories of personal data, including identity documents for KYC purposes, transaction records for AML compliance, and responsible gaming records. We cannot waive these obligations even if you request it.

4.3 Legitimate Interests. Where m998 relies on legitimate interests as the legal basis for processing, we have carried out a balancing assessment to confirm that our interests do not override your fundamental rights and freedoms. This includes fraud prevention, platform security, and analytics used to improve the player experience.

4.4 Consent. Where we process your data on the basis of consent — such as for marketing communications or non-essential cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal. You may withdraw consent via your account settings or by contacting support.

5. Data Sharing & Third Parties

m998 does not sell, rent, or trade your personal data to any third party. We may share your personal data with the following categories of recipients where strictly necessary:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the financial and identity data required to process your PKR deposits and withdrawals. These institutions are subject to their own privacy policies and regulatory frameworks.
• Identity Verification Providers: Third-party KYC and age-verification service providers who assist m998 in verifying the identity and age of new account holders.
• Fraud Prevention Services: Specialist fraud and AML screening providers who analyse transaction data to protect the Platform and its players from financial crime.
• Gaming Software Providers: Third-party game suppliers whose platforms are integrated into m998 may receive limited usage data necessary for the delivery of their games. These providers operate under data processing agreements with m998.
• Regulatory and Law Enforcement Authorities: m998 will disclose personal data to relevant authorities where required to do so by applicable law, court order, or regulatory direction. We will notify you of such disclosure where we are legally permitted to do so.
• Professional Advisers: Legal counsel, auditors, and compliance consultants who are subject to professional confidentiality obligations.

6. Data Retention

6.1 Active Accounts. For the duration that your m998 account remains active, we retain all personal data necessary to operate your account, process transactions, and fulfil our legal obligations.

6.2 Post-Closure Retention. Following account closure, m998 is legally required to retain certain categories of personal data for the periods specified below:

• Identity and KYC documentation: minimum 5 years from the date of account closure, in accordance with applicable AML regulations.
• Financial transaction records: minimum 5 years from the date of each transaction.
• Responsible gaming records: minimum 5 years, to support self-exclusion enforcement and regulatory audits.
• Customer support correspondence: 3 years from the date of the last interaction.

6.3 Marketing Data. Where you have consented to marketing communications, your contact data used for this purpose will be retained until you withdraw your consent or request erasure, after which it will be removed from our marketing lists within 30 days.

6.4 Deletion. Once retention periods have elapsed and there is no other lawful basis for continued retention, your personal data will be securely deleted or irreversibly anonymised.

7. Data Security

7.1 Technical Measures. m998 employs a range of technical security measures to protect your personal data, including: SSL/TLS encryption for all data transmitted between your device and the m998 Platform; AES-256 encryption for data at rest; multi-factor authentication options for account access; and regular penetration testing of our infrastructure.

7.2 Organisational Measures. Access to your personal data within the m998 organisation is restricted on a strict need-to-know basis. All staff and contractors with access to personal data are subject to confidentiality obligations and receive regular data protection training.

7.3 Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, m998 will notify you without undue delay and in accordance with applicable legal requirements, providing details of the nature of the breach and the steps we are taking to address it.

7.4 Your Responsibility. You are responsible for maintaining the security of your m998 account credentials. m998 strongly recommends using a unique, strong password and enabling two-factor authentication where available. Do not share your login details with any third party.

8. Cookies & Tracking Technologies

m998 uses cookies and similar tracking technologies on the Platform to enhance your gaming experience, analyse Platform usage, and — where you have consented — deliver relevant promotional content.

8.1 Essential Cookies. These cookies are strictly necessary for the Platform to function. They enable core features such as account login, session management, and security verification. You cannot opt out of essential cookies without disabling Platform functionality.

8.2 Analytics Cookies. We use analytics cookies to understand how players navigate the Platform — for example, which games are most popular, where players encounter difficulties, and how session behaviour varies by device type. This data is used in aggregate and anonymised form to improve the Platform. These cookies require your consent.

8.3 Preference Cookies. These cookies remember your Platform preferences — such as language settings, odds format, and responsible gaming tool configurations — so that you do not need to re-enter them each session.

8.4 Marketing Cookies. Where you have consented, marketing cookies allow m998 to show you relevant promotional content related to our games and offers. You may withdraw this consent at any time via your account settings or your browser's cookie management tools.

9. Minors & Age Restriction

The m998 Platform is strictly an adult service. We do not knowingly collect personal data from any person under the age of 21. By registering an account, you represent and warrant that you are 21 years of age or older.

Where m998 discovers or has reasonable grounds to believe that personal data has been collected from an individual under the age of 21, we will immediately suspend the account, delete the relevant personal data as far as our legal obligations permit, and notify the appropriate regulatory authority where required.

We urge all account holders to ensure that minors cannot access their m998 account or use any device on which their m998 account is logged in. If you believe a minor has accessed your account or the Platform, please contact our support team immediately.

10. Exercising Your Data Rights

You may exercise any of the data rights described in this Policy at any time by contacting the m998 support team via 24/7 live chat or by emailing us at the address shown in the site footer. To protect your privacy, all data rights requests will require identity verification before we can act on them.

10.1 Response Timeframes. m998 will acknowledge receipt of your data rights request within 72 hours and will respond substantively within 30 calendar days. Where a request is particularly complex or numerous, we may extend this period by a further 60 days; we will notify you of any such extension within the initial 30-day period.

10.2 Refusals. In limited circumstances m998 may be unable to fulfil a data rights request — for example, where doing so would conflict with a legal obligation to retain certain data (such as AML transaction records) or where the request is manifestly unfounded or excessive. In such cases we will explain our reasons in writing.

10.3 Complaints. If you are not satisfied with m998's handling of your personal data or our response to a data rights request, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. m998 encourages you to contact us first so that we have an opportunity to resolve your concern directly.

11. International Data Transfers

m998 operates internationally and your personal data may be processed in countries outside Pakistan. Where personal data is transferred to countries that do not provide an equivalent level of data protection to that in your home jurisdiction, m998 will implement appropriate safeguards, which may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Data processing agreements incorporating binding data protection obligations on the recipient;
• Transfers to recipients in countries deemed adequate for data protection purposes by applicable regulatory determinations.

Details of the safeguards applied to any specific international transfer may be requested by contacting the m998 support team.

12. Changes to This Privacy Policy

m998 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or regulatory guidance. Where changes are material, we will notify registered players by email and by a prominent notice on the Platform at least 14 days before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or m998's data processing practices, please contact our Data Protection team via 24/7 live chat within the Platform. You may also reach us by email — our support address is displayed in the footer of this website.

When contacting us about a data protection matter, please include your full name, registered email address, and a clear description of your query or request so that we can assist you as efficiently as possible.