he88 Privacy Policy

he88 ("we," "us," "our") is the operator of the online casino and sports betting platform accessible at he88.im. he88 operates under an international gaming licence and provides cricket betting, live dealer casino games, slot games, crash games, and related services to players in Pakistan and other permitted jurisdictions.

For the purposes of this Privacy Policy, he88 acts as the data controller in respect of the personal data of registered players. This means that he88 determines the purposes for which personal data is collected and the manner in which it is processed.

If you have any questions about how he88 handles your personal data, or if you wish to exercise any of your data rights as described in this policy, you may contact us at any time using the details provided in Section 15.

he88 collects the following categories of personal data from players during registration, account use, and KYC verification processes:

Identity Data:

• Full legal name as it appears on a government-issued ID
• Date of birth (used to verify the 21+ age requirement)
• Nationality and country of residence
• CNIC, passport number, or other government-issued identification document details submitted during KYC

Contact Data:

• Email address registered to the he88 account
• Mobile phone number (used for account verification and security alerts)
• Residential address as provided during KYC verification

Financial Data:

• JazzCash, EasyPaisa, or SadaPay mobile wallet account numbers used for deposits and withdrawals
• Bank account details (HBL, UBL, Meezan Bank) where bank transfer is selected as a payment method
• USDT TRC20 wallet addresses where applicable
• Transaction history, deposit amounts, withdrawal amounts, and associated timestamps

Technical Data:

• IP address at time of registration and subsequent logins
• Device type, browser type, and operating system
• Session timestamps and duration
• Geolocation data derived from IP address

Gameplay Data:

• Betting history across all game types including cricket, slots, crash, and live dealer games
• Bonus claims, wagering activity, and promotional participation records
• Responsible gaming tool settings and usage patterns

Communications Data:

• Records of live chat support interactions
• Email correspondence with the he88 support team
• Feedback and complaint submissions

he88 collects personal data through the following channels and methods:

• Direct submission: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, contacting support, or updating your account profile.
• Automated collection: Technical data collected automatically when you access the he88 platform, including IP address, device identifiers, browser type, and session activity logs recorded by our servers.
• Cookies and similar technologies: Data collected through cookies, web beacons, and local storage as described in Section 7 of this policy.
• Third-party verification providers: Identity and address verification data returned to he88 by licensed KYC verification service providers used to satisfy our regulatory obligations.
• Payment processors: Transaction confirmation data, payment method identifiers, and fraud screening flags returned by JazzCash, EasyPaisa, SadaPay, and our banking partners in connection with deposit and withdrawal processing.
• Fraud detection systems: Behavioural and technical signals processed by our fraud detection systems, which analyse gameplay and transaction patterns to identify suspicious activity.

he88 uses personal data for the following purposes. The specific legal basis applicable to each purpose is identified in Section 5.

he88 does not use automated profiling or automated decision-making that produces legal or similarly significant effects on players without a human review step available on request.

he88 processes personal data under the following legal bases:

• Contractual necessity: Processing required to fulfil the agreement between he88 and the player — including account registration, payment processing, and delivery of gaming services.
• Legal obligation: Processing required to comply with AML (Anti-Money Laundering) regulations, KYC requirements, and any reporting obligations under he88's international gaming licence.
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where these interests are not overridden by the player's privacy rights.
• Consent: Processing for marketing communications, promotional emails, and non-essential cookies — carried out only where the player has given explicit, freely given, informed consent. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

he88 does not sell personal data. We share personal data with third parties only in the following limited circumstances:

• Payment processors: JazzCash, EasyPaisa, SadaPay, HBL, UBL, and Meezan Bank receive the minimum necessary transaction and identity data required to process deposits and withdrawals on your behalf. These parties operate under their own data protection obligations.
• KYC verification providers: Licensed third-party identity verification service providers receive copies of submitted KYC documents for the purpose of confirming identity and age. These providers are contractually bound to use your data solely for the verification service.
• Fraud and security service providers: Technical and behavioural data is shared with fraud detection systems operated on behalf of he88 to protect the platform and its players from unauthorised access, bonus abuse, and financial crime.
• Game content providers: Where you play live dealer games powered by licensed studios such as Ezugi, certain gameplay session data is processed by those providers' servers in order to deliver the live stream and record game outcomes. These providers hold their own gaming licences and are bound by data handling agreements with he88.
• Regulatory and law enforcement authorities: he88 will disclose personal data to regulators, tax authorities, gaming licence oversight bodies, or law enforcement agencies where required to do so by law or valid legal process. he88 will inform you of such disclosures where permitted to do so.
• Professional advisers: Legal advisers, auditors, and compliance consultants may access personal data on a strictly need-to-know basis subject to confidentiality obligations.

he88 uses cookies and similar tracking technologies on the platform to ensure functionality, maintain session security, and analyse platform performance. Cookies are small text files stored on your device by your browser when you visit the site.

he88 uses the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These include session management cookies that keep you logged in during your visit, CSRF protection tokens, and load balancing cookies. These cannot be disabled without breaking platform functionality.
• Functional cookies: Remember your preferences such as language settings, game lobby layout preferences, and responsible gaming reminder intervals. These improve your experience but are not strictly required.
• Analytics cookies: Used to collect aggregated, anonymised information about how players navigate the platform — including which pages are most visited and where users encounter errors. This data is used solely to improve platform performance.
• Security cookies: Used by our fraud detection systems to identify and flag unusual login behaviour, such as access from a new device or location not previously associated with your account.

On your first visit to he88.im, you will be presented with a cookie consent banner where you can accept or decline non-essential cookies. Strictly necessary cookies and security cookies are applied without consent as they are required for the platform to operate safely. You may also manage cookie preferences at any time through your browser settings.

he88 retains personal data for as long as is necessary for the purposes for which it was collected, subject to any overriding regulatory obligations. The following retention periods apply:

Following the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised. Anonymised aggregated data may be retained for statistical and platform improvement purposes without restriction.

he88 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Specific security measures in place include:

• SSL/TLS encryption for all data in transit between player devices and he88 servers.
• Encryption of sensitive personal and financial data at rest using industry-standard encryption protocols.
• Role-based access controls ensuring that only authorised he88 personnel with a demonstrable operational need can access player data.
• Multi-factor authentication required for all internal staff accessing production systems containing player data.
• Regular security audits and penetration testing conducted by independent third-party security specialists.
• Automated monitoring for unusual access patterns, with incident response procedures in place for potential data breaches.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, he88 will notify affected players without undue delay and will cooperate fully with any applicable regulatory notification requirements.

As a player on the he88 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, contact the he88 support team via live chat or at [email protected]. he88 will respond to all valid data rights requests within 30 calendar days.

• Right of Access: You have the right to request a copy of the personal data he88 holds about you, along with information on how it is used and with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. Certain data corrections may require re-submission of KYC documentation.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that this right is limited where retention is required by regulatory or legal obligation — for example, AML record-keeping requirements override erasure requests for financial transaction data.
• Right to Restriction: You may request that he88 restrict processing of your data in certain circumstances, such as where you contest the accuracy of the data or object to processing based on legitimate interests, pending resolution of that objection.
• Right to Data Portability: Where processing is based on your consent or contract performance and is carried out by automated means, you may request a structured, machine-readable copy of the personal data you provided to he88.
• Right to Object: You have the right to object to processing based on he88's legitimate interests, including profiling for responsible gaming monitoring purposes. he88 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

If he88 becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately closed, all associated balances and bonuses will be voided, and the personal data of the underage individual will be securely deleted to the extent not required by applicable regulatory retention obligations.

If you have reason to believe that a minor may have registered an account on he88 using false age information, please contact us immediately at [email protected] so that we may take appropriate action promptly.

he88 operates under an international gaming licence and uses technology infrastructure and service providers located in multiple jurisdictions. As a result, your personal data may be transferred to, and processed in, countries outside Pakistan.

Where personal data is transferred internationally, he88 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this policy. Safeguards used include:

• Data processing agreements with all third-party processors containing binding data protection obligations.
• Transfers to jurisdictions with adequate data protection frameworks recognised under international standards.
• Standard contractual clauses incorporated into agreements with processors in jurisdictions without a recognised adequacy determination.

By registering an account on he88, you acknowledge that your personal data may be transferred internationally as described in this section, subject to the safeguards outlined above.

The he88 platform may contain references or links to third-party services, including licensed game studios such as Ezugi. This Privacy Policy applies solely to personal data collected and processed by he88 directly. It does not govern the data practices of any third-party service providers, game studios, or payment processors, each of which operates under its own privacy policy.

he88 is not responsible for the privacy practices of third-party services and encourages players to review the privacy policies of any third-party providers whose services they access in connection with their he88 account. he88 selects third-party partners that demonstrate an adequate commitment to data protection, but cannot guarantee the data practices of external parties beyond what is contractually agreed.

he88 reserves the right to update or amend this Privacy Policy at any time. Material changes — such as changes to the categories of data collected, the purposes for which it is processed, or the third parties with whom it is shared — will be communicated to registered players via the email address on their account, or through a prominent notice displayed on the he88 platform.

The "Last Updated" date at the top of this document will be revised each time a new version is published. Where required by applicable law, he88 will seek fresh consent for any material changes to processing activities that were previously based on consent. Your continued use of the he88 platform following publication of an updated Privacy Policy constitutes your acknowledgement of the revised version. If you do not agree with any changes made, you may request voluntary account closure as described in the Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way he88 handles your personal data, please contact our support team through any of the following channels:

• Live Chat: Available 24/7 directly within the he88 platform — the fastest way to reach us for urgent privacy concerns.
• Email: [email protected] — for formal data rights requests, please include your registered account email and a description of your request. he88 aims to acknowledge all privacy-related email enquiries within 48 hours and to respond substantively within 30 calendar days.

he88 takes privacy complaints seriously. If you are not satisfied with our response to a privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority or to the dispute resolution body designated under our gaming licence.