q98 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by q98 ("q98", "we", "us", "our") and applies to all personal data collected from individuals ("you", "Player", "User") who visit the q98 website at https://q98.im, register an account, use any q98 gaming or betting services, contact q98 customer support, or otherwise interact with q98's digital platform and services (collectively, the "Services").

q98 is committed to protecting the personal data of Pakistani players and all other users of the platform in accordance with internationally recognised data protection standards, including principles aligned with the General Data Protection Regulation (GDPR) as a benchmark of best practice, and applicable data protection obligations under q98's operating licence framework.

By creating a q98 account or using the Services, you acknowledge that you have read and understood this Privacy Policy and consent to the data processing activities described herein to the extent such consent is the applicable legal basis. Where processing is carried out on a different legal basis (such as contractual necessity or legal obligation), your consent is not required but you are entitled to be informed of the processing — which this Policy achieves.

2 Data Controller

q98 acts as the data controller in respect of all personal data collected from players through the q98 platform. As data controller, q98 determines the purposes for which personal data is collected and the manner in which it is processed. Where q98 engages third-party service providers to process personal data on its behalf (such as payment processors, KYC verification providers, and game software suppliers), those providers act as data processors under instructions from q98 and are contractually bound by data protection obligations consistent with this Policy.

For all data protection enquiries, requests to exercise data subject rights, or complaints relating to q98's data processing activities, players may contact q98 through the channels described in Section 14 of this Policy.

3 Personal Data We Collect

q98 collects only the personal data that is necessary for the specific purposes described in Section 5. The categories of personal data q98 collects from Pakistani players include the following:

3.1 Registration Data

• Full legal name as it appears on your CNIC
• Date of birth (used for mandatory 21+ age verification)
• Pakistani residential address
• Valid Pakistani mobile number (used for account security and communications)
• Email address (used for account communications and transaction notifications)
• Username and encrypted password hash (your plain-text password is never stored)

3.2 Identity Verification (KYC) Data

• Copy of Pakistani Computerised National Identity Card (CNIC) — front and back
• Proof of address documentation where required (utility bill, bank statement)
• Source of funds documentation for large withdrawal requests
• Payment method ownership verification documentation (for linked JazzCash, EasyPaisa, or bank account)

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction records in PKR, including transaction timestamps
• Payment method reference identifiers (JazzCash account number, EasyPaisa number, bank account details) — full financial account credentials are never stored by q98; they are processed by licensed payment processors
• Bonus credit and wagering history
• Account balance history

3.4 Gaming and Betting Activity Data

• Game session records, including game type, session duration, bet amounts, and outcomes
• Sports betting records, including markets selected, odds accepted, stakes, and settlement outcomes
• Responsible gaming tool settings (deposit limits, session timers, self-exclusion status)

3.5 Technical and Device Data

• IP address and approximate geolocation (city-level, not precise GPS coordinates)
• Device type, operating system, and browser type
• Session timestamps and platform navigation data
• Cookies and similar tracking technologies (described in Section 8)

3.6 Customer Support Data

• Records of all communications with q98 customer support, including live chat transcripts and email correspondence
• Details of complaints, disputes, or responsible gaming requests submitted through support channels

4 How We Collect Your Data

q98 collects personal data through the following means:

• Directly from you: When you complete account registration, submit KYC documentation, make a deposit or withdrawal request, contact customer support, or update your account settings
• Automatically during platform use: Technical and device data is collected automatically when you access the q98 website or gaming platform, through server logs, cookies, and similar technologies
• From payment processors: Transaction confirmation data and payment status information is received from q98's licensed payment processing partners (JazzCash, EasyPaisa, and banking partners) when you make deposits or withdrawals
• From KYC verification providers: Where q98 uses third-party identity verification services to assist with CNIC validation or document authentication, q98 may receive verification status information from those providers
• From fraud prevention services: q98 may receive risk signals from licensed fraud prevention and anti-money laundering screening services in connection with account and transaction monitoring

5 Purposes of Processing & Legal Basis

The table below sets out the purposes for which q98 processes personal data and the legal basis applicable to each processing activity:

6 Data Sharing and Disclosure

q98 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. q98 shares personal data only in the following limited circumstances:

6.1 Service Providers (Data Processors)

q98 engages carefully selected third-party service providers who process personal data on q98's behalf under binding data processing agreements. These include payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank infrastructure partners), KYC and identity verification providers, licensed game software suppliers, fraud prevention and AML screening services, IT infrastructure and hosting providers, and customer support platform providers. Each provider is restricted to processing data only as instructed by q98 and for no other purpose.

6.2 Regulatory and Legal Disclosure

q98 may disclose personal data to gaming regulators, financial regulators, law enforcement authorities, or courts where such disclosure is required by applicable law, regulatory obligation, court order, or legally binding government demand. Where legally permitted, q98 will notify you of such requests before disclosure. q98 cooperates fully with law enforcement investigations involving fraud, money laundering, or other criminal activity connected to player accounts.

6.3 Business Transfers

In the event that q98 undergoes a business restructure, merger, acquisition, or sale of assets, player personal data may be transferred as part of that transaction. Where such a transfer occurs, the successor entity will be bound by the terms of this Privacy Policy in respect of previously collected data, and players will be notified of any material changes to data handling that may result from the transaction.

6.4 Game Providers — Limited Data Sharing

Third-party game software providers whose games are available on q98 may receive limited session data (such as anonymous player identifiers, session timestamps, and bet amounts) necessary for game functionality and technical support. These providers do not receive your name, CNIC, contact details, or full financial data. KYC identity documents are never shared with game providers.

7 International Data Transfers

As an internationally operated platform, q98 and some of its service providers may process personal data in countries outside of Pakistan. Where personal data is transferred internationally, q98 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

Safeguards used for international transfers include: contractual clauses incorporating GDPR-standard data protection obligations; transfer to countries with recognised adequate data protection frameworks; and binding data processing agreements imposing q98-equivalent security and processing standards on all international data processors.

8 Cookies and Tracking Technologies

q98 uses cookies and similar tracking technologies on its website and gaming platform. These technologies help q98 operate the platform securely, remember your preferences, analyse how the platform is used, and detect fraudulent or unusual activity.

8.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function, including session authentication, security tokens, and load balancing. These cannot be disabled without breaking platform functionality.
• Functional Cookies: Remember your preferences such as language settings and responsible gaming tool configurations between sessions.
• Analytics Cookies: Collect anonymised data about how players navigate the platform, which games are most popular, and where technical issues occur. This data is used to improve platform performance.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent account activity, including device fingerprinting components used in conjunction with q98's fraud prevention systems.

8.2 Managing Cookies

You can manage non-essential cookies through your browser settings or the q98 cookie preference centre accessible from the platform footer. Note that disabling strictly necessary cookies will prevent you from accessing the q98 platform. Disabling analytics or functional cookies may affect your user experience but will not prevent you from using the platform's core gaming and betting features.

9 Data Retention Periods

q98 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The table below summarises q98's standard data retention periods:

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or irreversibly anonymised so that it can no longer be attributed to an identified or identifiable individual. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and platform improvement purposes.

10 Your Data Subject Rights

As a data subject, you hold the following rights in respect of your personal data processed by q98. These rights are available to all q98 players, including Pakistani players, under internationally recognised data protection standards:

To exercise any of the above rights, contact q98 support through live chat or the support email address in Section 14. q98 will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. In complex cases, this period may be extended by up to a further 60 days, with notification provided to you. Requests are fulfilled free of charge unless they are manifestly unfounded or excessive.

11 Security Measures

q98 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and q98 is encrypted using TLS 1.2 or higher with 256-bit encryption keys
• Encryption at rest: Sensitive data fields including financial data and identity documents are encrypted at rest using industry-standard symmetric encryption
• Access controls: Access to personal data within q98's internal systems is restricted on a strict need-to-know basis using role-based access controls, with access logs maintained and reviewed
• Password security: Player passwords are stored only as cryptographic hashes — q98 never stores your plain-text password and cannot retrieve it; only password reset is possible
• KYC data isolation: Identity documents are stored in a segregated environment with access controls independent from the main gaming platform
• Fraud detection systems: Real-time transaction monitoring and device fingerprinting systems detect and flag unusual account activity for review
• Security testing: q98's platform undergoes periodic security assessments and penetration testing by qualified security professionals

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, q98 will notify you without undue delay and will take immediate steps to contain and remediate the breach in accordance with applicable data breach notification obligations.

12 Minors and Age Restriction

q98 employs mandatory age verification controls during account registration, including collection of date of birth and, for withdrawal-eligible accounts, KYC verification using CNIC which confirms age independently. Where q98 identifies or has reason to believe that an account has been registered by a person under 21 years of age, that account will be closed immediately, gaming activity will be voided, and any deposited funds will be returned to the source payment method.

Any data collected from an account subsequently identified as belonging to a minor will be deleted as soon as reasonably practicable following account closure, subject only to any retention that is strictly required by applicable law.

13 Changes to This Privacy Policy

q98 reserves the right to update or amend this Privacy Policy at any time. Where amendments are material — meaning they meaningfully affect how your personal data is used or your rights as a data subject — q98 will provide advance notice of at least 14 days via email to your registered address and/or a prominent notice on the q98 platform before the changes take effect.

For non-material amendments, such as corrections, clarifications, or updates required for immediate legal compliance, q98 may update this Policy with shorter notice. The effective date displayed at the top of this Policy will always reflect when the current version came into force.

Where an amendment to this Policy requires your fresh consent for a new processing activity, q98 will obtain that consent explicitly before commencing the new processing. Your continued use of q98 Services following a Policy update constitutes acknowledgement of the updated Policy in respect of processing activities already described in prior versions.

14 Contact & Complaints

For all data protection enquiries, requests to exercise data subject rights, or concerns about q98's data processing practices, please contact q98 through the following channels:

• Live Chat: Available 24/7 through your q98 account dashboard — average first response under 2 minutes
• Support Email: [email protected] — responses within 24 hours for general privacy queries; within 4 hours for urgent security or breach-related matters

When contacting q98 about a data protection matter, please identify yourself as the account holder and specify the nature of your request (e.g., "data access request", "erasure request", "marketing opt-out") so that your query can be routed to the appropriate team promptly.

If you are not satisfied with q98's response to your data protection concern, you have the right to raise a complaint with the relevant supervisory authority or data protection regulator applicable under q98's licensing jurisdiction. q98 will cooperate fully with any such regulatory investigation.