a177 Privacy Policy — How We Collect, Use & Protect Your Data

This Privacy Policy ("Policy") describes how a177 ("a177", "we", "us", or "our") collects, processes, stores, and protects the personal data of individuals who access or use the a177 online gaming and sports betting platform, available at a177.bid ("the Platform").

This Policy applies to all personal data collected in connection with:

• The registration and management of a Member account on a177.
• The use of any product, game, betting market, or service available through the Platform.
• Any communication between you and a177, including customer support interactions.
• The processing of financial transactions, including deposits and withdrawals in PKR via JazzCash, EasyPaisa, bank transfer, or other supported payment methods.
• The use of a177's website, including anonymous browsing activity.

This Policy should be read in conjunction with a177's Terms & Conditions and Responsible Gaming Policy, which together form the full framework of agreements between a177 and its Members.

a177 is the data controller in respect of all personal data collected and processed in connection with the Platform. As data controller, a177 determines the purposes for which personal data is processed and the means by which that processing is carried out.

a177 operates under an international online gaming license that imposes binding data protection obligations on the Platform, including minimum security standards, defined retention periods, and mandatory data subject rights provisions. These obligations are reflected throughout this Policy.

Where a177 engages third-party service providers who process personal data on a177's behalf — for example, payment processing providers, identity verification partners, or game software providers — those parties act as data processors under contractual terms that require them to process data only in accordance with a177's documented instructions and to implement appropriate security measures. a177 remains responsible for the lawful processing of your data in such arrangements.

a177 collects the following categories of personal data from Members and platform visitors:

a177 does not collect sensitive personal data such as health information, religious beliefs, or political opinions except where expressly required by applicable law or regulation, and in no such case for commercial purposes.

a177 collects personal data through the following channels:

• Direct provision by you: Information you enter directly into the Platform during registration, KYC verification, payment transactions, support requests, or any other form of voluntary interaction with a177.
• Automated technical collection: Technical and usage data collected automatically as you browse and use the Platform, including via cookies, session tracking technology, and server logs. See Section 10 for full details on cookies.
• Payment provider transmission: Financial data transmitted to a177 by payment processing partners — including JazzCash, EasyPaisa, and participating banks — in connection with deposit and withdrawal transactions processed on your behalf.
• Identity verification partners: Verification data returned by third-party KYC service providers who verify your identity documents and confirm the authenticity of your CNIC on a177's behalf.
• Fraud detection systems: Risk assessment data generated by a177's and its partners' anti-fraud and anti-money laundering systems in connection with your account activity.

a177 processes your personal data only for purposes that have a defined and lawful basis. The table below sets out the primary processing purposes and the legal basis for each:

Where a177 relies on legitimate interest as a lawful basis for processing, a177 has conducted a balancing assessment to confirm that such processing does not override your fundamental privacy rights, and that the processing is necessary and proportionate to the interest pursued.

a177 does not sell, rent, or trade your personal data to any third party for that party's own commercial purposes. a177 shares personal data with third parties only in the following defined circumstances:

• Payment Processors: Financial data necessary to execute your deposit or withdrawal is shared with the relevant payment service provider — such as JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Allied Bank, or cryptocurrency processing partners. These parties receive only the data required to complete the specific transaction.
• Identity Verification Partners: Your identity documents and selfie are shared with a177's KYC verification partner solely for the purpose of verifying your identity and age in compliance with a177's licensing obligations.
• Game Software Providers: Transaction-level gameplay data (session identifiers, wager amounts, game results) is shared with third-party game providers in the technical process of operating their games on the a177 Platform. Game providers do not receive your contact details or financial account information.
• Anti-Fraud and Compliance Services: Anonymised or pseudonymised technical and behavioural data may be shared with fraud detection and anti-money laundering service providers for the purpose of identifying suspicious patterns that may indicate fraudulent or criminal activity.
• Regulatory and Law Enforcement Authorities: a177 will disclose personal data to competent regulatory authorities, law enforcement bodies, or courts of competent jurisdiction where required to do so by a valid legal obligation, court order, or regulatory direction, and without prior notice to you where permitted or required by law.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of a177's business, personal data held about Members may be transferred to the acquiring entity as part of that transaction, subject to the acquirer's agreement to honour this Privacy Policy in respect of such data.

a177's Platform is operated under an international gaming license, and elements of a177's technical infrastructure — including server hosting, game provision systems, and payment processing — may involve the transfer and processing of personal data in jurisdictions outside Pakistan.

When personal data is transferred outside Pakistan in connection with a177's operations, a177 ensures that such transfers are carried out in compliance with applicable data protection requirements. Specifically, a177 implements the following safeguards:

• Standard contractual data processing clauses with all third-party processors that receive personal data from a177.
• Binding instructions to processors that limit the use of transferred data to the specific purpose for which it was transferred.
• Technical security requirements equivalent to those applied to data held within a177's primary infrastructure.

By creating an a177 account and using the Platform, you acknowledge that your personal data may be processed in international jurisdictions as part of a177's operation under its international gaming license.

a177 retains personal data for as long as is necessary to fulfil the purposes set out in this Policy, subject to the following retention principles:

• Active Account Data: Personal data associated with an active a177 account is retained throughout the period of the Member's active use of the Platform and for a defined period following account closure, in order to meet anti-money laundering regulatory retention obligations and to respond to any queries or disputes arising from the account.
• KYC and Identity Documentation: Identity documents provided for KYC verification are retained for the period required by a177's international gaming license — typically five (5) years from the date of account closure — to satisfy AML compliance obligations.
• Financial Transaction Records: Records of all deposits, withdrawals, and on-platform financial transactions are retained for a minimum of five (5) years from the date of each transaction, consistent with financial record-keeping obligations under a177's license.
• Correspondence Records: Customer support conversations and email correspondence are retained for three (3) years from the date of the interaction, or longer if the correspondence relates to an unresolved dispute or complaint.
• Technical and Usage Data: Server logs, IP address records, and session data are retained for a period of twelve (12) months from the date of collection for security and fraud prevention purposes, after which they are deleted or anonymised.

At the expiry of the applicable retention period, personal data is either permanently deleted from a177's systems or anonymised such that it can no longer be associated with an identifiable individual. a177 reviews its data retention schedules periodically and updates them as required by changes in licensing obligations or applicable law.

a177 implements a multi-layered security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. The technical and organisational security measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or mobile device and a177's servers is encrypted using industry-standard Transport Layer Security. The padlock icon in your browser address bar confirms an active encrypted connection on every visit to a177.
• Encrypted Data Storage: Personal data — including identity documents, financial records, and account credentials — is stored in encrypted form in a177's database infrastructure. Passwords are never stored in plain text; they are processed using one-way cryptographic hashing before storage.
• Access Control: Access to personal data within a177's operational systems is restricted on a strict need-to-know basis. Staff and contractors who require access to Member data for legitimate operational purposes are subject to confidentiality obligations and access audit logging.
• Two-Factor Authentication: a177 provides SMS-based two-factor authentication for all Member accounts. Members are strongly encouraged to enable 2FA to add a second layer of protection to their a177 login.
• Fraud and Anomaly Detection: a177 operates automated monitoring systems that flag unusual login activity, suspicious transaction patterns, and access from unexpected locations or devices, triggering review or temporary suspension as appropriate.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data security incident that may affect Members' personal data, a177 will notify affected Members and relevant authorities in accordance with its obligations under applicable law and its international gaming license.

a177 uses cookies and similar tracking technologies on the Platform to enable core functionality, improve your user experience, and gather analytics data about Platform usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They maintain your logged-in session, remember your language preference, and ensure security features operate as intended. These cookies cannot be disabled without preventing you from using the Platform.
• Functional Cookies: These cookies remember your preferences and settings — for example, your preferred game view, responsible gaming limit configurations, and notification settings — so that these do not need to be re-entered on each visit.
• Analytics Cookies: These cookies collect anonymised data about how visitors use the Platform — which pages are visited most, how long sessions last, and which features are most frequently used. This data helps a177 identify areas for improvement. Analytics data does not identify individual users.
• Security and Fraud Detection Cookies: These cookies assist in identifying and preventing fraudulent activity, unauthorised account access, and bot traffic on the Platform.

a177 does not use third-party advertising cookies or cross-site tracking cookies that build marketing profiles of your behaviour across other websites. Your a177 browsing activity is not shared with advertising networks.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing your a177 account and using Platform features.

As a person whose personal data is processed by a177, you hold the following rights in respect of your data. These rights are enforceable and a177 has established a process for handling data rights requests within defined timeframes:

To exercise any of these rights, submit your request to a177's support team via live chat in your account dashboard or via the email address listed in the footer of this page. a177 will acknowledge your request within 48 hours and respond substantively within 30 days. Requests may be subject to identity verification before a177 discloses or modifies personal data.

a177 requires all Members to confirm that they are 21 or older at the time of registration and performs CNIC-based identity and age verification as part of the KYC process prior to processing any withdrawal. Where a177 has reasonable grounds to believe that a Member may be under 21 — including on the basis of information disclosed in communications, inconsistencies in provided data, or third-party reports — a177 will immediately suspend the account and initiate an age verification review.

If it is confirmed that personal data has been collected from an individual under 21, a177 will delete all such data from its systems without delay and return any deposited funds to the payment source from which they originated.

If you are a parent or guardian and you believe that an individual under 21 in your care has registered an account on a177, please contact a177's support team via live chat immediately so that the account can be closed and the situation resolved appropriately.

a177 may send promotional communications — including information about bonuses, promotions, new game launches, PSL-related betting offers, and other a177 marketing content — to Members who have opted in to receive such communications at the time of registration or subsequently via their account preferences.

Participation in a177's marketing communications is entirely optional. Opting out of marketing communications has no effect on your access to a177's core Platform services. You may opt out at any time by:

• Updating your communication preferences in the Notifications section of your a177 account settings.
• Clicking the unsubscribe link included in any promotional email sent by a177.
• Contacting a177's support team via live chat and requesting removal from all marketing communications lists.

a177 will process opt-out requests within five business days. After opting out, you will continue to receive service communications from a177 that are essential for the operation of your account — for example, security alerts, transaction confirmations, KYC verification requests, and important account notices. These communications are not promotional in nature and cannot be opted out of while your account is active.

a177 reserves the right to update this Privacy Policy at any time. Changes may be made to reflect changes in a177's data processing activities, new or amended obligations under a177's international gaming license, changes in applicable privacy law, or improvements to a177's data protection practices.

Where material changes are made to this Policy — meaning changes that significantly affect how a177 uses your personal data or your rights in relation to it — a177 will notify registered Members by email to their registered address and/or by a prominent notice displayed on the Platform. The notification will describe the nature of the changes and the date on which they take effect.

Minor clarifications, formatting changes, and corrections that do not affect the substantive meaning of the Policy may be made without direct notification. The effective date displayed at the top of this Policy will always reflect the date of the most recent revision. You are encouraged to review this Policy periodically to stay informed of how a177 handles your personal data.

Your continued use of the a177 Platform following the notification of any material Policy revision constitutes your acknowledgement and acceptance of the revised Policy. If you do not accept the revised Policy, you should contact a177 to close your account.

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or have a concern about how a177 has handled your personal data, please contact a177's Data Protection team through one of the following channels:

• Live Chat: Available 24/7 from within your a177 account dashboard. The fastest way to reach the a177 team for any account-related or privacy-related query, including data access requests.
• Email: Contact details are listed in the footer of this page. Data rights requests and formal privacy complaints sent by email are acknowledged within 48 hours and responded to substantively within 30 days.

When submitting a data rights request or privacy complaint, please include your registered account username, the specific right you wish to exercise or the nature of your complaint, and any relevant dates or reference numbers. This will allow a177's team to locate your records and handle your request efficiently.

If a177 is unable to resolve your privacy complaint to your satisfaction through its internal process, you have the right to escalate the complaint to the data protection supervisory authority of a177's licensing jurisdiction. a177 will provide the relevant contact details upon request if you reach this stage of the escalation process.