e2bat Privacy Policy — How We Collect, Use & Protect Your Personal Information

e2bat ("the Platform", "we", "us", "our") operates the online gaming and sports betting platform available at e2bat.cam. As a platform that serves over two million registered users — across Karachi, Lahore, Islamabad, Faisalabad, and beyond — e2bat handles substantial volumes of personal data in the course of providing its services. This Privacy Policy sets out the standards and practices that govern how that data is handled.

e2bat takes its data protection obligations seriously. This is not merely a matter of legal compliance — it is a reflection of the trust that Pakistani players place in the platform when they register an account, link a JazzCash or EasyPaisa wallet, or provide CNIC documentation for identity verification. That trust demands transparency, and this Privacy Policy is how e2bat delivers it.

This Privacy Policy should be read together with the e2bat Terms & Conditions, which govern your use of the platform more broadly. In the event of any conflict between the two documents on a data-specific matter, this Privacy Policy prevails.

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, any data that can be used, alone or in combination with other data, to identify a specific individual.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means e2bat, which determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third party that processes personal data on behalf of e2bat, subject to the instructions and oversight of e2bat as Data Controller.
• "User" means any individual who accesses, registers on, or uses the e2bat platform in any capacity.
• "KYC Data" means identity verification documentation collected from users during the Know Your Customer process, including CNIC copies, selfie images, and proof of address where requested.
• "Cookies" means small text files placed on a user's device by the e2bat platform for the purposes described in Section 7 of this policy.

e2bat collects personal data through several distinct channels — registration, platform use, payment processing, customer support interactions, and technical systems. The categories of data collected are described below.

When you create an e2bat account, we collect the following:

• Full legal name as it appears on your CNIC
• Pakistani mobile number (used as primary account identifier and for OTP authentication)
• Date of birth (for mandatory 21+ age verification)
• CNIC number
• Chosen username and encrypted password
• City of residence (for localisation and support routing purposes)

To comply with our international gaming licence obligations and anti-money laundering requirements, e2bat conducts mandatory KYC verification. This process involves collection of:

• Scanned or photographed copy of your CNIC (front and back)
• Selfie photograph for liveness verification and identity matching
• Proof of payment method (where payment method verification is triggered)
• Proof of address documentation (where required by our compliance procedures)

• JazzCash and EasyPaisa account numbers associated with deposit and withdrawal transactions
• HBL, UBL, or Meezan Bank account details where bank transfer methods are used
• Transaction amounts, timestamps, and reference numbers for all deposits, withdrawals, and bonus credits
• Betting and gaming activity records, including stakes, game selections, and outcomes

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session timestamps, page navigation paths, and feature interaction logs
• Login and logout records including timestamps and access method

When you contact e2bat via live chat or any other supported communication channel, we retain records of the interaction, including the subject matter, any supporting documentation you provide, and the resolution outcome. These records are used to maintain service quality and to fulfil our compliance obligations.

e2bat uses personal data collected from users for the following purposes. We process data only for stated purposes and do not repurpose data for uses not described here without obtaining fresh consent or establishing a new legal basis.

• Account Creation and Management: Registration data is used to create and maintain your e2bat account, authenticate your identity on login, and personalise your platform experience.
• Identity Verification and Age Confirmation: KYC data is used to verify that you are who you say you are and that you are aged 21 or above — a non-negotiable requirement for access to e2bat services.
• Payment Processing: Financial data is used to process deposits and withdrawals through JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and card payment channels. Transaction records are retained for dispute resolution and financial auditing purposes.
• Regulatory Compliance and AML Obligations: e2bat's international gaming licence requires it to maintain records of user identities, transaction histories, and betting activity for specified periods. This data is processed and retained to satisfy these obligations.
• Fraud Prevention and Security: Technical data, login records, and transaction patterns are analysed by e2bat's fraud prevention systems to detect and respond to suspicious account activity, bonus abuse, and unauthorised access.
• Responsible Gaming Monitoring: Gaming activity data is used to power e2bat's responsible gaming monitoring systems, which identify behavioural patterns potentially indicative of problem gambling and trigger safeguarding interventions where appropriate.
• Customer Support: Support interaction records are used to resolve queries, manage disputes, and maintain service quality standards.
• Platform Improvement: Aggregated and anonymised usage data is used to understand how users interact with e2bat and to inform product development decisions. This data is not linked to individual user identities in analytical processes.
• Promotional Communications: Where you have consented to receive promotional communications from e2bat, your contact details may be used to send you information about offers, bonuses, and platform updates. You may withdraw this consent at any time via the notification settings in your account dashboard.

e2bat relies on the following legal bases to process personal data lawfully:

• Contractual Necessity: Processing of registration data, KYC data, and financial transaction data is necessary for the performance of the contract between e2bat and the user — namely, the provision of gaming and payment services as set out in the Terms & Conditions.
• Legal Obligation: Processing of identity documentation, transaction records, and gaming history is required by e2bat's international gaming licence obligations, anti-money laundering regulations, and other applicable legal frameworks.
• Legitimate Interests: Processing of technical data and session records for fraud prevention, security, and platform performance monitoring is carried out on the basis of e2bat's legitimate interests, balanced against user privacy rights.
• Consent: Processing of personal data for direct marketing and promotional communications is carried out on the basis of consent, freely given by the user at registration or subsequently via account settings. Consent may be withdrawn at any time without affecting the validity of processing carried out prior to withdrawal.

e2bat does not sell, rent, or trade personal data to third parties for commercial marketing purposes. Personal data is shared only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

Financial transaction data is shared with the payment processors used to execute deposits and withdrawals — including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard network operators. These processors receive only the data necessary to process the specific transaction and are contractually bound to handle it in accordance with applicable data protection standards.

KYC documentation is processed by third-party identity verification service providers engaged by e2bat to conduct CNIC-based verification checks. These providers act as data processors under contract with e2bat and are not permitted to use KYC data for any purpose other than verification on e2bat's behalf.

e2bat will disclose personal data to the gaming regulatory authority under which it holds its international licence, to law enforcement agencies, or to other competent authorities where it is legally required to do so — for example, in connection with a lawful investigation, court order, or regulatory audit. e2bat will, where legally permitted, notify the affected user of such disclosure.

e2bat participates in industry fraud prevention data sharing arrangements. Where an e2bat account is determined to have been operated fraudulently or in breach of these Terms, relevant identifying information may be shared with other licensed gaming operators or fraud prevention consortia to prevent the same individual from exploiting multiple platforms.

e2bat may share personal data with its legal advisers, auditors, and other professional service providers where necessary for the conduct of their professional duties, subject to appropriate confidentiality obligations.

e2bat uses cookies and similar tracking technologies on its platform. The following categories of cookies are used:

Users may manage optional cookie preferences through the cookie settings panel accessible within their e2bat account. Disabling optional cookies does not affect access to core platform features, though some personalisation functions may be affected. Essential and security cookies cannot be disabled as they are required for the secure operation of your account.

e2bat retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the mandatory retention periods imposed by applicable regulatory frameworks. The following retention periods apply as general guidelines:

• Account Registration Data: Retained for the duration of the account relationship and for a minimum of five years following account closure, in accordance with e2bat's anti-money laundering obligations and gaming licence requirements.
• KYC Documentation: Retained for a minimum of five years from the date of verification, or for such longer period as required by the applicable regulatory framework. KYC documents are stored in secure, access-controlled systems with restricted staff access.
• Financial Transaction Records: Retained for a minimum of five years from the date of each transaction, in accordance with financial record-keeping obligations under e2bat's gaming licence and applicable AML frameworks.
• Gaming Activity Records: Retained for the duration of the account relationship plus five years, to support dispute resolution, regulatory audits, and responsible gaming monitoring obligations.
• Customer Support Records: Retained for three years from the date of the interaction, or for longer periods where the interaction relates to an unresolved dispute or regulatory matter.
• Technical and Session Data: Retained for twelve months from the date of collection for security and fraud prevention purposes, after which data is aggregated and anonymised for analytical use.

Following the expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be linked to any individual user.

e2bat implements a multi-layered security architecture designed to protect personal data against unauthorised access, accidental loss, disclosure, or destruction. The following technical and organisational measures are in place:

• Transport Layer Security: All connections to the e2bat platform are secured using 256-bit SSL/TLS encryption, preventing interception of data in transit between your device and e2bat's servers.
• At-Rest Encryption: Personal data stored in e2bat's databases — including KYC documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within e2bat's systems is governed by role-based access controls. Only staff members with a demonstrable need to access specific categories of data are granted access, and all internal data access is logged and monitored.
• Two-Factor Authentication: e2bat supports and encourages the use of two-factor authentication via Pakistani mobile OTP for all registered accounts. Staff accounts with access to user data systems require two-factor authentication without exception.
• Penetration Testing and Security Audits: e2bat's platform infrastructure undergoes regular independent penetration testing and annual security audits conducted by accredited third-party security firms.
• Incident Response: e2bat maintains a documented data breach incident response procedure. In the event of a data security incident that poses a risk to user privacy, affected users will be notified in accordance with applicable legal requirements and e2bat's incident response protocol.

While e2bat implements industry-standard security measures, no data transmission or storage system is entirely immune to risk. Users are encouraged to maintain strong, unique passwords, enable two-factor authentication, and report any suspected unauthorised account access to e2bat support immediately.

All registered e2bat users hold the following rights in relation to their personal data. To exercise any of these rights, please contact e2bat via live chat within your logged-in account. e2bat will respond to verified data rights requests within thirty (30) days.

• Right of Access: You may request a copy of all personal data held by e2bat in relation to your account. e2bat will provide this in a structured, commonly used format within 30 days of receipt of a verified request.
• Right to Rectification: Where personal data held by e2bat is inaccurate or incomplete, you have the right to request that it be corrected. Account profile data can be updated directly via the account settings panel; corrections to KYC data require submission of updated documentation.
• Right to Erasure: Subject to regulatory retention obligations (which may require e2bat to retain certain data regardless of erasure requests), you may request deletion of your personal data. Erasure requests submitted in connection with account closure will be processed following the expiry of mandatory retention periods.
• Right to Restrict Processing: In certain circumstances, you may request that e2bat restrict its processing of your personal data — for example, where you contest the accuracy of data currently held and while verification is in progress.
• Right to Data Portability: You may request that personal data you have provided to e2bat — where processed by automated means and on the basis of your consent or a contract — be provided to you in a portable format, or transferred directly to another controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of e2bat's legitimate interests. e2bat will assess the objection and either cease the processing or provide compelling legitimate grounds for its continuation.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time via the notification and privacy settings within your account dashboard. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

e2bat implements mandatory CNIC-based age verification for all new account registrations. This verification process is designed to prevent access by underage individuals before any gaming or financial services are made available. Where e2bat identifies or has reasonable grounds to suspect that a registered account is operated by a person under 21, the account will be suspended immediately, all balances will be withheld pending investigation, and any personal data collected from the underage individual will be securely deleted in accordance with applicable child data protection requirements.

Parents and guardians who believe their child may have accessed e2bat are encouraged to contact e2bat support immediately via live chat. e2bat will take all necessary steps to investigate and remediate the situation, including account closure and data deletion.

e2bat's server infrastructure and some of its third-party service providers are located in jurisdictions outside Pakistan. Where personal data is transferred internationally — including to jurisdictions where the data protection framework may differ from that of Pakistan — e2bat ensures that appropriate safeguards are in place to protect your data at a standard consistent with this Privacy Policy.

Safeguards applied to international data transfers include:

• Contractual data processing agreements with all third-party processors that bind them to data protection standards consistent with this Privacy Policy.
• Restriction of data sharing to processors located in jurisdictions with recognised adequate data protection frameworks, or processors who have committed to equivalent standards through binding corporate rules or equivalent mechanisms.
• Technical measures — including encryption in transit and at rest — applied to all data regardless of where it is processed or stored.

By registering an e2bat account and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Pakistan for the purposes described in this policy, subject to the safeguards described above.

e2bat reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they significantly affect the rights of users or the manner in which their personal data is processed — e2bat will notify registered users via the in-account notification system or by SMS to the registered mobile number, with a minimum of fourteen (14) days' notice before the revised policy takes effect.

Non-material amendments — such as corrections of typographical errors, clarifications that do not alter the substantive meaning of any provision, or administrative updates reflecting changes in e2bat's operational structure — may take effect immediately without prior notice to individual users.

The "Effective" date displayed at the top of this page and in the table of contents reflects the date on which the most recent version of this Privacy Policy came into force. Users are encouraged to review this policy periodically. Continued use of the e2bat platform following the effective date of any revised policy constitutes acceptance of the changes.

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which e2bat processes your personal data, please contact the e2bat Data Privacy team through the following channel:

• Live Chat Support: Available 24/7 via the support widget within your logged-in e2bat account. Live chat is the recommended channel for account-specific data queries, as it allows us to verify your identity before discussing account information.
• Email Contact: General privacy enquiries may be directed to [email protected]. Please note that sensitive account data should not be shared via email — account-specific data requests should be submitted through in-account live chat only.

e2bat aims to acknowledge all privacy-related contacts within two business days and to provide a substantive response within thirty (30) days. Where a request is complex or involves multiple data categories, the response period may be extended by a further thirty days with notification to the user.