92bar Privacy Policy — How We Handle Your Personal Data

92bar is an online sports betting and casino platform operating at 92bar.biz and serving players in Pakistan. This Privacy Policy applies to all personal information collected through the 92bar website, mobile browser experience and all services provided through the platform, including account registration, deposits, withdrawals, sports betting, live casino games, promotions and customer support interactions.

When you register an account, deposit funds, place a bet or contact our support team, you are providing personal data to 92bar. This policy explains your rights in relation to that data and our obligations to you as the person responsible for it.

This policy should be read alongside the 92bar Terms and Conditions and the Responsible Gaming Policy. Together these three documents form the complete framework governing your relationship with 92bar.

92bar collects personal data in three ways: information you provide directly during registration and account use, information collected automatically as you use the platform, and information received from third-party payment processors and identity verification services.

Information you provide directly:

Information collected automatically:

• Device information: Device type, operating system version, browser type and version, screen resolution.
• Connection data: IP address, approximate geographic location (city level), internet service provider.
• Session data: Pages visited, time spent on the platform, login and logout timestamps, game sessions opened.
• Betting and game activity: Bets placed, games played, stake amounts, win/loss records and bonus usage. This data is required for account operation, dispute resolution and responsible gaming monitoring.
• Cookie and tracking data: See Section 7 for full cookie details.

Information received from third parties:

• Payment confirmation data from Easypaisa, JazzCash, NayaPay, SadaPay and other payment processors — sufficient to match your transaction to your account.
• Identity verification results from CNIC verification services used to confirm age and identity before withdrawals above the threshold are processed.

Every use of your personal data at 92bar has a specific, documented purpose. We do not use data collected for one purpose to carry out a different purpose without informing you and, where required, obtaining fresh consent. The full list of processing purposes is:

When we rely on legitimate interest as a legal basis, we have carried out a balancing test to ensure that our interest does not override your privacy rights. You may object to processing based on legitimate interest — see Section 10 for your rights.

92bar processes personal data only where we have a valid legal basis to do so. The four bases we rely on are:

• Contract performance: Most of the personal data processing at 92bar — account management, payment processing, bet settlement — is necessary to fulfil our contractual obligations to you. Without this processing your account cannot function.
• Legal obligation: Certain processing is required by law. Identity verification, transaction record-keeping and responsible gaming monitoring are obligations imposed on 92bar by applicable regulations. We cannot opt out of this processing and neither can you, though we will always be transparent about it.
• Legitimate interest: Some processing — principally fraud prevention, security monitoring and anonymous platform analytics — is conducted on the basis of 92bar's legitimate interest in operating a safe and sustainable platform. This processing does not require your consent, but you have the right to object to it.
• Consent: Marketing communications are sent only to players who have given explicit consent. Consent can be withdrawn at any time from your account settings or by contacting support. Withdrawing marketing consent does not affect your ability to use 92bar or the legal validity of any processing carried out before you withdrew consent.

92bar does not sell your personal data to any third party for commercial purposes. Data is shared with third parties only in the following specific circumstances:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank partners and card networks receive the transaction data necessary to process your deposits and withdrawals. They operate under their own privacy policies and are responsible for data processed through their systems.
• Identity verification providers: Certified KYC (Know Your Customer) providers may process your CNIC and verification selfie to confirm your identity. These providers are contractually bound to use your data only for the verification purpose and to delete it after the retention period agreed with 92bar.
• IT and infrastructure providers: Cloud hosting, data storage and platform infrastructure partners access 92bar data as part of providing their services. All such providers operate under data processing agreements that restrict their use of your data to the service being provided.
• Regulatory and law enforcement: 92bar will share data with financial intelligence units, regulators or law enforcement agencies when required to do so by a valid legal request. We will notify you of such requests where we are legally permitted to do so.
• Anti-fraud networks: Anonymised or pseudonymised fraud signals may be shared with industry fraud prevention networks to protect all players on the platform.

Financial data requires a higher standard of care than general personal data, and 92bar treats it accordingly. The specific rules governing financial data at 92bar are:

• Card data: 92bar does not store full card numbers, CVV codes or card expiry dates on its servers. Card payment processing is handled entirely by the payment gateway provider. 92bar receives only a tokenised reference that allows future transactions without exposing full card details.
• Mobile wallet data: Easypaisa and JazzCash wallet numbers associated with your account are stored in encrypted form. They are used only to process deposits and withdrawals you initiate — not for any other purpose.
• IBFT account details: Bank account numbers provided for IBFT withdrawals are stored securely and used only for the withdrawal transaction you request. They are not shared with any third party other than your own bank for the purpose of processing the transfer.
• Transaction history: A complete record of all deposits, withdrawals, bets and game results is retained for the period required by applicable anti-money laundering regulations. You can access your own transaction history at any time from within your 92bar account.
• Third-party payment data: 92bar does not have access to your Easypaisa or JazzCash account balance, transaction history with other merchants or any other data held by your payment provider beyond the specific transaction data shared with us for the purpose of processing your 92bar deposit or withdrawal.

92bar uses cookies and similar tracking technologies on 92bar.biz to ensure the platform functions correctly, to protect your account security and to understand how players use the site so we can improve it. We use four categories of cookies:

Cookies set by 92bar are first-party only — we do not place third-party advertising cookies or allow external ad networks to track you across other websites through 92bar. You can control cookie preferences from your browser settings, though disabling essential cookies will prevent the 92bar platform from operating correctly.

92bar takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, loss, alteration or disclosure. These measures are reviewed regularly and updated in response to emerging threats.

Technical security measures in place at 92bar:

• Transport encryption: All data transmitted between your device and 92bar servers is encrypted using TLS 1.3, the current industry standard for secure web communications.
• Encryption at rest: Sensitive personal data — including CNIC details, payment references and identity documents — is stored in encrypted form on 92bar infrastructure.
• Access controls: Personal data access is restricted on a need-to-know basis. 92bar staff can only access player data where their role specifically requires it, and all access is logged and audited.
• Penetration testing: 92bar infrastructure is subject to regular independent penetration testing. Identified vulnerabilities are addressed on a risk-prioritised basis.
• Two-factor authentication: Available on all player accounts and mandatory for all internal staff accounts with access to production systems.

In the event of a data breach: If a security incident occurs that is likely to affect your personal data, 92bar will notify you via your registered email address within 72 hours of becoming aware of the incident, describing what happened, what data was affected and the steps being taken to address it.

92bar does not retain personal data for longer than is necessary for the purpose for which it was collected, subject to any legally mandated minimum retention periods. The following retention schedule applies to key categories of personal data:

When the applicable retention period expires, personal data is securely deleted from 92bar systems and any third-party processors that hold it on 92bar's behalf. Deletion is logged for audit purposes.

As a 92bar player, you have the following rights in relation to your personal data. These rights can be exercised by emailing support@92bar.biz or using the relevant feature in your account settings. We will respond to requests within 30 days.

92bar does not knowingly collect or process personal data from any person under the age of 18. Our registration process requires confirmation of age, and accounts flagged for potential underage access are suspended immediately and reviewed by our compliance team.

If a parent or guardian believes that a minor has registered an account with 92bar or provided personal data to 92bar without their knowledge, please contact us immediately at support@92bar.biz. We will investigate and, where confirmed, immediately close the account, delete all associated personal data and arrange a full refund of any deposits made.

92bar takes underage gambling and underage data processing with the utmost seriousness. We invest in age-verification technology and operational processes specifically to prevent both from occurring.

92bar reviews this Privacy Policy at least every six months and updates it when our data practices change, when we add new services that require new processing, or when applicable law changes. The "Last Updated" date at the top of this page reflects the most recent revision.

Where a change is material — meaning it significantly affects how your personal data is used or your rights in relation to it — we will notify you directly via your registered email or mobile number at least 14 days before the change takes effect. You will have the opportunity to review the change and, if you do not agree with it, to close your account.

Non-material changes — clarifications of existing language, corrections of typographical errors, changes to contact details — may be made without prior individual notification. In all cases, the current version of this Privacy Policy on 92bar.biz is the authoritative one.

If you have any questions about this Privacy Policy, the personal data 92bar holds about you, or how to exercise your data rights, please contact us through any of the following channels:

• Email: support@92bar.biz — subject line: "Privacy Query" or "Data Rights Request"
• Live Chat: Available 24/7 from within your 92bar account dashboard. Responses within 5 minutes around the clock.
• Language: You may contact us in either Urdu or English. Our support team handles both equally.
• Response time: Privacy queries via email receive a substantive response within 48 hours. Data rights requests (access, deletion, etc.) receive an initial acknowledgment within 48 hours and a full response within 30 calendar days.

If you are not satisfied with our response to a privacy query or data rights request, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.