877but Privacy Policy — How We Collect, Use, and Protect Your Personal Information

This Privacy Policy ("Policy") is issued by 877but ("877but", "we", "us", "our") and describes how we collect, use, store, share, and protect personal information relating to individuals ("you", "the User", "the Player") who access or use the 877but website and gaming platform available at 877but.org.

877but is committed to protecting the privacy of all persons who interact with our platform. This Policy is designed to be clear, transparent, and easy to understand so that you know exactly what happens to your personal information when you use our services. We recognise that trust is essential to the relationship between a gaming platform and its players, and we treat data privacy as a core element of that trust — not a compliance formality.

This Policy should be read in conjunction with the 877but Terms and Conditions and Responsible Gaming Policy. By using the 877but platform in any capacity, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein.

877but operates as the data controller in respect of personal data collected through the 877but platform. As data controller, 877but determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is lawful, fair, and transparent.

877but operates under an international gaming licence issued by the relevant licencing authority. Our licencing obligations impose specific requirements on the collection, retention, and protection of player data, and this Policy reflects those obligations in addition to general data protection principles.

For all data protection enquiries, access requests, or complaints, you may contact the 877but data protection team at the email address provided in Section 14 of this Policy. Please note that the email address is provided as plain text and should not be treated as a clickable link.

877but collects personal data from you in the following categories, depending on how you interact with our platform:

877but does not collect sensitive personal data such as biometric data (other than the face-match component of KYC where required by our licence obligations), health data, political opinions, religious beliefs, or racial or ethnic origin data.

Where 877but requires you to submit documentation for identity verification purposes, such documents are handled with the highest level of care and are stored only for as long as required by our licencing obligations and applicable law.

877but uses the personal data we collect for the following purposes:

• Account Registration and Management: To create and maintain your 877but account, verify your identity, process your login credentials, and personalise your experience on the platform;
• Service Delivery: To process your deposits and withdrawals in PKR via JazzCash, EasyPaisa, and bank channels, settle your bets and casino game outcomes, credit bonuses, and provide all gaming services available on the 877but platform;
• Legal and Regulatory Compliance: To comply with our obligations under the international gaming licence under which 877but operates, including age verification, KYC, anti-money laundering (AML) checks, and reporting obligations to the licensing authority;
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, account takeovers, bonus abuse, money laundering, and other prohibited conduct on the 877but platform;
• Responsible Gaming: To monitor gaming patterns for signs of problematic behaviour, enforce self-exclusion requests, implement deposit limits and loss caps set by you, and fulfil our responsible gaming obligations;
• Customer Support: To respond to your enquiries, resolve complaints, process disputes, and maintain records of communications with you;
• Platform Improvement: To analyse aggregated, anonymised usage data that helps us improve the 877but platform, fix bugs, and develop new features relevant to Pakistani players;
• Marketing Communications: To send you relevant promotional offers and platform updates, where you have provided consent or where it is in our legitimate interest to do so — you may opt out of marketing communications at any time from within your account settings.

877but does not use your personal data for automated decision-making that produces legal or similarly significant effects, except where expressly required for fraud detection or responsible gaming obligations. In such cases, you have the right to request human review of any automated decision that affects your account.

877but processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to fulfil our contractual obligations to you under the 877but Terms and Conditions — including operating your account, processing transactions, and delivering gaming services;
• Legal Obligation: Processing is required to comply with applicable laws and our gaming licence obligations, including AML checks, KYC verification, age verification, and regulatory reporting;
• Legitimate Interests: Processing is necessary for purposes of our legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving our services — provided such interests are not overridden by your fundamental rights and freedoms;
• Consent: Where processing is based on your consent — such as for direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

877but does not sell, rent, or trade your personal data to any third party for their own commercial use. We share your personal data only in the following limited circumstances:

• Payment Processors: JazzCash, EasyPaisa, and banking partners receive the minimum financial data necessary to process your deposits and withdrawals. These providers are bound by their own privacy policies and applicable financial regulations;
• Identity Verification Providers: Third-party KYC and document verification services receive the identity documents you submit for the purpose of verifying your identity and age. These providers are contractually bound to use your data only for the verification purpose;
• Gaming Software Providers: Game content providers who supply casino games, slots, and sports betting software to the 877but platform may receive anonymised or pseudonymised game session data for technical and auditing purposes;
• Regulatory Authorities: 877but's licensing authority and relevant law enforcement or government bodies may receive data where required by law, court order, or our licensing obligations. 877but will notify you of such disclosures where legally permissible to do so;
• Professional Advisers: Legal advisers, auditors, and compliance consultants engaged by 877but may access personal data where strictly necessary for their professional engagement, subject to professional confidentiality obligations;
• Fraud and AML Screening Services: 877but may use third-party screening databases to check player details against known fraud, sanctions, and money laundering lists as required by our licence obligations.

The 877but platform uses cookies and similar tracking technologies to enhance your experience, maintain your logged-in session, and gather analytics data that helps us improve the platform. The following categories of cookies are used:

You may manage non-essential cookie preferences through your browser settings. Please note that disabling cookies may affect your ability to use certain features of the 877but platform, including maintaining a logged-in session.

877but implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS 1.3 encryption on all data in transit between your device and 877but's servers — the same standard used by Pakistan's major commercial banks;
• Encryption at rest for all sensitive personal data and financial records stored on 877but's servers;
• Password hashing using bcrypt with individual salt values — 877but never stores passwords in readable form;
• Access controls that restrict access to personal data to authorised 877but personnel who require it for their specific role — on a strict need-to-know basis;
• Regular security audits conducted by independent third-party security specialists to identify and remediate vulnerabilities in the 877but platform;
• Two-factor authentication (2FA) available to all 877but account holders — we strongly recommend all players enable this feature to add a second layer of protection to their account.

While 877but takes all reasonable precautions, no method of data transmission over the internet or electronic storage is 100% secure. 877but cannot guarantee the absolute security of your data but commits to responding promptly and transparently to any security incident that occurs.

877but retains personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by our licensing obligations and applicable law. The following general retention standards apply:

• Active account data is retained for the duration of your relationship with 877but plus the applicable post-closure retention period required by our licence;
• Financial transaction records including deposits, withdrawals, and bet history are retained for a minimum of five (5) years following the transaction date, as required by AML regulations applicable to our gaming licence;
• Identity verification documents (CNIC, passport, proof of payment method) are retained for the duration of your account plus a minimum of five (5) years following account closure, or for such longer period as required by applicable law;
• Customer support communications are retained for a period of three (3) years following the closure of the relevant support ticket;
• Technical data including IP addresses and session logs is retained for a maximum of twelve (12) months from the date of collection, after which it is anonymised or deleted;
• Marketing preferences are retained until you opt out of marketing communications or request deletion of your account, whichever is earlier.

When the applicable retention period expires, personal data is securely deleted from 877but's systems using industry-standard deletion methods, or permanently anonymised such that it can no longer be associated with you as an individual.

You hold the following rights in respect of the personal data 877but holds about you. These rights are genuine and enforceable — 877but will respond to all valid rights requests within a reasonable timeframe.