Privacy Policy — r678 Platform

This Privacy Policy ("Policy") sets out how r678 ("r678", "the Platform", "we", "us", "our") collects, uses, stores, discloses and protects personal data provided by or collected about individuals ("User", "Player", "you", "your") who access or use the r678 online gaming platform available at https://r678.cam, including any associated web applications and mobile interfaces.

r678 is designed as an English-language platform serving Pakistani users and is committed to handling personal data with integrity, professionalism and transparency. This Policy applies to all personal data processed in connection with account registration, gaming activity, customer support, identity verification, marketing preferences and any other interaction with the Platform.

By accessing the Platform, registering an account, or submitting any personal information to r678, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data. Examples include your full name, email address, CNIC number, IP address and account activity records.
• "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, deletion or any other form of handling.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For users of this Platform, r678 is the Data Controller.
• "Data Processor" — A third party that processes personal data on behalf of the Data Controller, under a binding data processing agreement.
• "KYC Data" — Identity and verification documents collected as part of the Know Your Customer process, including CNIC copies, passport scans, proof of address and selfie/liveness-check data.
• "Cookies" — Small text files placed on your device by the Platform to facilitate functionality, performance measurement and user experience improvement.
• "Special Category Data" — Particularly sensitive personal data such as health information, which r678 does not intentionally collect, except where required by responsible gambling regulatory obligations.

For the purposes of applicable data protection law, the Data Controller responsible for your personal data is r678, operated under its international licensing jurisdiction. Contact details for data protection matters are provided in Section 18 (Contact Us) of this Policy.

r678 processes personal data in its capacity as both a Data Controller (for data it determines the purposes of) and in some instances as a Data Processor (where processing is conducted strictly on behalf of and under the instruction of the operator licensing entity). Where this distinction is material to your rights, we will communicate it clearly.

r678 may collect and process the following categories of personal data:

r678 does not intentionally collect Special Category Data (such as health, political or religious information) except where voluntarily disclosed in the context of a responsible gambling support request, in which case it is processed strictly to provide the requested assistance.

Personal data is collected through the following means:

• Direct provision by you — Information you submit during account registration, KYC verification, deposit and withdrawal forms, support requests, responsible gambling tool activations and any other interaction with the Platform.
• Automated technical collection — Data collected automatically when you access or browse the Platform, including IP addresses, cookie data, device fingerprints, session logs and usage analytics.
• Third-party service providers — Data received from identity verification partners (for KYC/AML), payment processors, fraud detection services and sports data providers, where such sharing is necessary for Platform operations.
• Regulatory and compliance sources — In limited circumstances, data may be cross-referenced against sanctions lists, politically exposed person (PEP) databases or other compliance-required data sources as part of AML obligations.

r678 processes your personal data for the following specific and documented purposes:

• Account Management: Creating, maintaining and managing your registered player account, including authentication and security.
• Identity Verification (KYC): Confirming your identity and age to comply with applicable regulatory obligations and prevent underage gambling.
• Anti-Money Laundering (AML) Compliance: Monitoring transactions for suspicious activity patterns and fulfilling mandatory regulatory reporting obligations.
• Payment Processing: Facilitating deposits and withdrawals, verifying payment method ownership and reconciling transactions. References to familiar Pakistani payment infrastructure (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah) are context only and do not imply those providers endorse or support gambling.
• Gaming Services: Delivering casino games, live dealer tables, sports betting markets and all associated platform features.
• Responsible Gambling: Administering deposit limits, loss limits, session timers, self-exclusion tools and any other player protection measures you activate or that we apply proactively.
• Fraud Prevention and Security: Detecting and preventing cheating, collusion, bonus abuse, account takeover and any other fraudulent or harmful activity.
• Customer Support: Responding to your queries, resolving disputes, processing complaints and delivering service improvements.
• Platform Improvement: Analysing usage patterns, testing features, measuring performance and improving the overall user experience — including mobile performance for players across Karachi, Lahore, Islamabad and beyond.
• Marketing Communications (where consented): Sending promotional offers, bonus notifications and platform updates to players who have opted in. You may withdraw consent at any time.
• Legal and Regulatory Compliance: Fulfilling obligations under applicable laws, responding to lawful requests from regulatory authorities and maintaining records as required.

Under applicable data protection law, r678 processes personal data on the following legal grounds:

• Contractual necessity — Processing required to fulfil the contract between r678 and you as a registered player, including account management, payment processing and gaming services.
• Legal obligation — Processing required to comply with applicable legal and regulatory obligations, including KYC/AML requirements, age verification and regulatory reporting.
• Legitimate interests — Processing necessary for r678's legitimate business interests, including fraud prevention, security operations, responsible gambling monitoring and platform improvement, provided such interests are not overridden by your rights and interests.
• Consent — Where required, processing based on your freely given, specific and informed consent — for example, in relation to marketing communications. You may withdraw consent at any time without affecting prior processing.

r678 does not sell, rent or trade your personal data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and under appropriate data protection obligations:

• KYC / Identity Verification Partners: Third-party providers that conduct document verification, facial recognition and liveness checks as part of the KYC process. These providers operate under binding data processing agreements.
• Payment Processors: Financial service providers and payment gateway operators necessary to process your deposits and withdrawals. Only the minimum data required for the transaction is shared.
• Game and Technology Providers: Licensed game studios and technology platform providers that deliver the casino games, live dealer streams and sports betting infrastructure. Game providers may receive limited session or game-history data necessary for game delivery.
• Fraud and Security Services: Specialist third-party providers assisting with fraud detection, device fingerprinting and account security monitoring.
• Regulatory Authorities: Where required by law, r678 may disclose personal data to licensing authorities, law enforcement agencies or financial intelligence units in response to lawful requests or mandatory reporting obligations.
• Professional Advisers: Legal counsel, auditors and compliance consultants acting under professional confidentiality obligations, where access to personal data is necessary for their mandated scope.

r678 operates under international licensing and may engage service providers located in multiple jurisdictions. As a result, your personal data may be transferred to, stored in and processed in countries outside Pakistan.

Where personal data is transferred internationally, r678 takes reasonable steps to ensure that appropriate protections are in place, which may include contractual safeguards (such as standard contractual clauses), technical security measures and due diligence on the data protection practices of recipient organisations.

By using the r678 Platform, you acknowledge and consent to the international transfer of your personal data as described in this Policy.

r678 retains personal data only for as long as is necessary to fulfil the purposes set out in this Policy, or as required by applicable legal and regulatory obligations. Specific retention considerations include:

• Active account data is retained for the duration of your account relationship with r678 and for a defined period thereafter as required by law.
• KYC and AML documentation is retained for the period required by the applicable licensing jurisdiction's AML regulations, which typically ranges from five to seven years following the end of the account relationship.
• Transaction records are retained in accordance with financial record-keeping requirements under the applicable regulatory framework.
• Communications and support records are retained for a period sufficient to address any complaint, dispute or regulatory query that may arise.
• Marketing preference records are retained to evidence consent and opt-out status for the duration required to demonstrate compliance.

When personal data is no longer required for the purposes for which it was collected, and no longer necessary to comply with applicable legal obligations, it will be securely deleted or anonymised in accordance with our internal data lifecycle procedures.

r678 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your browser or app and our servers.
• Encryption at rest for sensitive data stored in our systems, including financial and identity data.
• Role-based access controls ensuring that personal data is accessible only to staff and systems with a legitimate operational need.
• Regular security assessments and vulnerability testing of Platform infrastructure.
• Secure HTTPS-only document submission portals for KYC materials — documents must never be sent through unsecured channels.
• Monitoring systems for detecting and responding to potential data security incidents.

While r678 takes security seriously, no internet transmission or electronic storage system is guaranteed to be 100% secure. We cannot provide an absolute guarantee of data security but commit to prompt and transparent communication in the event of any material security incident affecting your data.

r678 uses cookies and similar tracking technologies to deliver, maintain and improve the Platform experience. The following categories of cookies may be used:

You can control and manage cookie settings through your web browser's built-in privacy controls. Disabling certain cookie types may affect the functionality of the Platform. r678 does not use cookies to build profiles sold to third-party advertisers.

Identity verification data collected as part of the KYC process — including CNIC copies, passport images, proof of address documents and biometric liveness-check data — is subject to heightened handling standards:

• KYC documents are processed exclusively through r678's official secure HTTPS verification portal. Under no circumstances should documents be submitted via WhatsApp, unsecured email, unverified chat or any third-party channel.
• KYC data is shared only with authorised identity verification service providers bound by appropriate contractual data protection terms, and with regulatory authorities where legally required.
• Biometric data (if collected as part of a liveness-check process) is processed solely for the purpose of identity verification and is not retained beyond what is necessary for that purpose.
• KYC records are retained for the period required by the applicable AML regulatory framework — typically five to seven years after the end of the account relationship.

The r678 Platform is strictly for adults aged 18 years or older, or the higher minimum age required by the applicable operator/licence jurisdiction. r678 does not knowingly collect, process or retain personal data from individuals under the minimum age threshold.

If r678 becomes aware that an Account has been registered by or on behalf of a minor, or that personal data of a minor has been submitted, the Account will be immediately suspended, any associated data will be handled in accordance with applicable regulatory requirements, and the relevant matter will be escalated as appropriate.

Parents or guardians who believe that their child has submitted personal data to r678 should contact our support team immediately at the address provided in Section 18.

Subject to applicable data protection law, you hold the following rights in relation to your personal data processed by r678. To exercise any of these rights, please contact us using the details in Section 18.

If you have concerns about how r678 handles your personal data, we encourage you to contact us in the first instance using the details in Section 18 so that we may address the matter directly. We will acknowledge receipt of privacy complaints promptly and aim to provide a substantive response within a reasonable timeframe.

If you remain dissatisfied with r678's response to a privacy complaint, you may have the right to lodge a complaint with the data protection supervisory authority in the jurisdiction applicable to the operator's licence. Contact details for any such authority will be provided upon request.

r678 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law or platform operations. Where changes are material, we will take reasonable steps to notify registered Players — for example, by displaying a prominent notice on the Platform or by sending a notification to your registered email address.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. The "Last Reviewed" date at the top of this page indicates when the Policy was most recently amended.

We recommend reviewing this Policy periodically to remain informed about how we protect your information.

For any queries, requests or concerns relating to this Privacy Policy or the processing of your personal data by r678, please contact our support and data team through the following channels:

We are committed to handling all privacy and data protection matters with care, professionalism and transparency.