Privacy Policy – masti365 Pakistan Online Casino Data Protection

This Privacy Policy is issued by masti365 ("we", "us", "our", "the Platform"). masti365 is an online casino and sports betting platform operating at masti365.biz, serving players in Pakistan. For the purposes of this policy, masti365 is the data controller — meaning we are responsible for deciding how and why your personal data is processed.

This Privacy Policy applies to all personal data collected through:

• The masti365 website at masti365.biz and any related pages or subdomains.
• Any account registration, login, or verification process carried out on or through the platform.
• Deposits, withdrawals, and any other financial transactions processed via the masti365 wallet.
• Customer support interactions via live chat, WhatsApp, Telegram, or email.
• Any promotional campaigns, surveys, or competitions run by masti365.

By registering an account with masti365 or using any part of our platform, you acknowledge that you have read and understood this Privacy Policy. If you are not comfortable with how masti365 handles your data as described here, you should not register an account.

masti365 collects personal data in three main ways: data you provide directly when you register or use the platform, data generated automatically as you use our services, and data obtained from trusted third parties for verification and fraud prevention purposes.

Data You Provide Directly:

• Full legal name as it appears on your CNIC or passport.
• Date of birth, used to verify that you meet the minimum age requirement of 18 years.
• Residential address in Pakistan.
• Pakistani mobile phone number used as your primary contact and login identifier.
• Email address for account notifications and correspondence.
• CNIC number and document images submitted during identity verification (KYC).
• Payment information — mobile wallet details (Easypaisa, JazzCash, NayaPay, SadaPay), bank account IBAN for IBFT transfers, or masked Visa/Mastercard card information.
• Communications you send to masti365 support via any channel.

Data Collected Automatically:

• Device information including device type, operating system version, and browser type.
• IP address and approximate geographic location derived from your IP.
• Session data including login times, session duration, and pages or games visited.
• Betting and gaming activity — games played, bets placed, bet amounts, and outcomes.
• Transaction history — deposits, withdrawals, bonus claims, and wallet balance changes.
• Cookie and tracking data as described in Section 5 of this policy.

Data from Third Parties:

• Identity verification results from our KYC/AML service providers, confirming or flagging the accuracy of documents you have submitted.
• Fraud screening results from payment security services that detect unusual financial patterns.
• Responsible gaming data from third-party self-exclusion registries, where applicable.

The table below sets out the specific purposes for which masti365 uses the personal data it collects, along with the type of data involved in each case.

masti365 will not use your data for any purpose not listed above without first informing you and, where required by law, obtaining your explicit consent.

masti365 processes your personal data under one or more of the following legal bases depending on the specific processing activity:

• Contractual Necessity: Processing your account data, payments, and gaming activity is necessary to fulfil the contractual relationship you entered into when you registered a masti365 account and accepted the Terms and Conditions.
• Legal Obligation: Identity verification, transaction record-keeping, and certain fraud prevention measures are required by applicable anti-money laundering (AML) laws and our licensing obligations. masti365 cannot waive these requirements even if requested to do so.
• Legitimate Interests: masti365 has a legitimate interest in preventing fraud, improving its platform, and maintaining the security of player accounts. Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental privacy rights.
• Consent: Where we send you marketing communications or use non-essential cookies, we do so only with your explicit consent. You may withdraw this consent at any time without affecting any other aspect of your account.

masti365 uses cookies and similar tracking technologies to operate the platform, remember your preferences, detect fraud, and understand how players use the site. Here is what each category of cookie does:

• Strictly Necessary Cookies: These are essential for the platform to function. They keep you logged in during a session, maintain your wallet state, and ensure bet placements are processed correctly. These cookies cannot be disabled without breaking the platform.
• Functional Cookies: These remember your preferences — such as language settings, preferred games, and display options — so you don't have to reset them every time you visit masti365.
• Analytics Cookies: These help masti365 understand which features are used most, where players spend their time, and where the platform experience could be improved. Analytics data is aggregated and does not identify individual players.
• Security Cookies: Used to detect and prevent fraudulent activity, including unusual login patterns, device fingerprinting for multi-account detection, and session security verification.
• Marketing Cookies (Opt-In Only): With your consent, masti365 may use cookies to personalise promotional content shown to you on the platform. You can withdraw consent for these cookies at any time through your account settings.

masti365 does not sell your personal data. We do share data with carefully selected third parties where it is necessary to provide our services or comply with legal obligations. All third-party data sharing is governed by enforceable confidentiality and data processing agreements.

• Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking partners, and Visa/Mastercard network processors receive the transaction data needed to execute your deposits and withdrawals. They process this data under their own privacy policies and applicable financial regulations.
• Identity Verification Providers: Third-party KYC and AML service providers receive document images and personal details submitted during the verification process. These providers are contractually required to use your data only for the purpose of verifying your identity for masti365 and for no other purpose.
• Fraud Prevention Services: Cybersecurity and fraud detection partners may receive IP addresses, device identifiers, and transaction patterns to identify and prevent fraudulent activity. Sharing this data protects all masti365 players.
• Game Providers: For certain live casino and third-party game integrations, relevant session data is shared with the game provider to run the game. This data does not include your CNIC, payment details, or contact information.
• Regulatory and Law Enforcement Authorities: masti365 will disclose personal data to government authorities, regulators, or law enforcement agencies when required to do so by law or valid legal process. We will notify you of such disclosures where permitted by law.

Beyond the categories above, masti365 does not share your personal data with any other third party without your explicit consent.

masti365 applies industry-standard technical and organisational measures to protect your personal data from unauthorised access, accidental loss, disclosure, alteration, or destruction. The key security measures in place include:

• 256-bit AES Encryption at Rest: All personal data stored in masti365 databases is encrypted. Even in the event of unauthorised database access, your data cannot be read without the encryption key.
• TLS 1.3 Encryption in Transit: All data transmitted between your device and masti365 servers is encrypted using the latest Transport Layer Security standard. This prevents interception of your data in transit.
• Access Controls: Access to personal data within masti365 is restricted to authorised employees who require it to perform specific job functions. All access is logged and subject to regular audit.
• Two-Factor Authentication (2FA): masti365 offers optional 2FA for player accounts, adding an extra layer of protection beyond your password alone.
• Regular Security Audits: masti365 undergoes periodic third-party penetration testing and security reviews. Identified vulnerabilities are remediated on a priority basis.
• Secure Payment Handling: Full payment card numbers are never stored on masti365 systems. Card transactions are processed via PCI-DSS compliant payment gateways.

masti365 does not keep your personal data for longer than is necessary for the purpose for which it was collected, or longer than required by law. The following retention periods apply:

• Active Account Data: Personal data associated with an active masti365 account is retained for the duration of the account relationship.
• Identity and KYC Documents: Retained for a minimum of 5 years after account closure, as required by anti-money laundering regulations.
• Financial Transaction Records: Retained for a minimum of 5 years following each transaction, in compliance with applicable financial record-keeping laws.
• Support Communications: Retained for 3 years after the resolution of the relevant enquiry or complaint.
• Gaming and Betting Activity Logs: Retained for 3 years following account closure, for dispute resolution and responsible gaming monitoring purposes.
• Marketing Consent Records: Retained until you withdraw consent, plus a further 1 year for record-keeping.

When the applicable retention period expires, masti365 will securely delete or anonymise the relevant data. Anonymised data — from which no individual can be identified — may be retained indefinitely for statistical analysis and platform improvement purposes.

As a masti365 player, you have the following rights over your personal data. These rights can be exercised by contacting the masti365 Data Team at support@masti365.biz with the subject line "Data Rights Request".

masti365 will not charge a fee for handling data rights requests. We may ask you to verify your identity before processing a request to protect against fraudulent attempts to access another player's data.

masti365 is strictly for adults aged 18 and over. The platform does not knowingly collect personal data from anyone under the age of 18. If masti365 becomes aware that a player account has been registered by a person under 18, that account will be immediately closed and all personal data associated with it will be deleted, except where retention is required by law.

Parents or guardians who believe that a minor has registered a masti365 account should contact the support team immediately at support@masti365.biz. masti365 will investigate and act promptly. We also recommend using parental control software on devices shared with children to prevent access to online gambling platforms.

masti365 may send you promotional offers, bonus notifications, and platform updates by SMS, email, or in-app notification. The following rules apply to all marketing communications:

• We will only send you marketing messages if you have opted in at the time of registration or subsequently updated your preferences in your account settings.
• You can opt out of marketing communications at any time by updating your notification preferences in your masti365 account settings, by clicking the unsubscribe link in any marketing email, or by contacting support directly.
• Opting out of marketing communications does not affect transactional notifications — you will still receive messages about deposits, withdrawals, account security, and other essential account activity.
• masti365 does not share your contact details with third parties for their own marketing purposes.

masti365 may update this Privacy Policy from time to time to reflect changes in how we process data, changes in applicable laws, or improvements to our platform and services. The following process applies whenever this policy is updated:

• The "Last Updated" date at the top of this page will be revised to reflect the date of the most recent change.
• For material changes that significantly affect your rights or how your data is used, masti365 will notify you via email or on-screen notification before the updated policy takes effect.
• Minor corrections, clarifications, or non-material updates may be made without direct notification, though the updated policy will always be accessible on this page.
• Continued use of the masti365 platform after a policy update takes effect constitutes your acceptance of the revised policy. If you do not accept a material change, you have the right to close your account before the change takes effect.

We recommend reviewing this Privacy Policy periodically to stay informed about how masti365 protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way masti365 handles your personal data, please get in touch using one of the following channels:

• Email: support@masti365.biz — use the subject line "Privacy Enquiry" or "Data Rights Request" for fastest routing to the relevant team.
• Live Chat: Available 24/7 via the masti365 platform. For data rights requests, we may ask you to follow up by email so we have a written record.
• WhatsApp / Telegram: Available via the contact details listed on the FAQ page. Suitable for general privacy queries — formal data rights requests should be submitted by email.

masti365 is committed to responding to all privacy-related enquiries within 5 business days, and to completing formal data rights requests within 30 calendar days of identity verification.