Privacy Policy – sand77

1. About This Policy

This Privacy Policy ("Policy") applies to all personal data processed by sand77 ("sand77", "we", "us", "our") in connection with the sand77 Platform, accessible at sand77.lat, including the website, any associated mobile-optimised interfaces, and all products and services offered therethrough — including cricket betting, live casino, slots, and crash games.

This Policy should be read alongside the sand77 Terms & Conditions and Responsible Gaming Policy. By registering an account or using the sand77 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not use the sand77 Platform.

sand77 acts as the data controller in respect of all personal data collected through the Platform. We process personal data in accordance with applicable data protection legislation and our obligations under our international operating licence.

2. Personal Data We Collect

sand77 collects the following categories of personal data from or about you:

Category	Examples
Identity Data	Full name, CNIC number, date of birth, nationality, CNIC photograph, selfie for liveness verification
Contact Data	Mobile phone number (03xx format), email address where provided
Account Data	Username, hashed password, account creation date, account status
Financial Data	JazzCash or Easypaisa mobile wallet identifier, bank account details, deposit and withdrawal history, transaction amounts in PKR
Transaction Data	Bet history, game session records, bonus usage, wagering records
Technical Data	IP address, device type, browser type and version, operating system, session timestamps, geolocation (country/city level)
Usage Data	Pages visited, products accessed, time spent on platform, clickstream data
Communications Data	Customer support chat transcripts, SMS messages exchanged with sand77's automated systems
Responsible Gaming Data	Self-imposed limits, cooling-off records, self-exclusion status, responsible gaming tool usage

sand77 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data except where specifically required for responsible gaming obligations (for example, noting a player's self-disclosed problem gambling history in connection with a self-exclusion request).

3. How We Collect Your Data

sand77 collects personal data through the following means:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or set responsible gaming limits, you directly provide personal data to sand77.
• Automated technical collection: When you access or use the sand77 Platform, technical data including your IP address, device fingerprint, browser characteristics, and session data is automatically collected through server logs and similar technologies.
• Payment processors: When you deposit or withdraw via JazzCash, Easypaisa, a bank, or a card network, sand77 receives transaction confirmation data from the relevant payment processor. sand77 does not store full card numbers or full wallet credentials — only masked references sufficient for transaction reconciliation.
• Third-party identity verification: KYC verification may involve a third-party identity verification provider who processes your CNIC data and liveness check on sand77's behalf under a data processing agreement.
• Cookies and tracking technologies: As described in Section 9 below.

4. How We Use Your Personal Data

sand77 uses personal data for the following purposes:

• To create, maintain, and administer your sand77 account and verify your identity.
• To process deposits, withdrawals, and bet settlements in PKR.
• To provide and improve sand77's products and services, including cricket betting markets, live casino, slots, and crash games.
• To conduct identity verification (KYC) and ongoing due diligence as required by our operating licence.
• To detect, investigate, and prevent fraud, money laundering, multiple-account abuse, and other prohibited conduct.
• To administer responsible gaming tools — deposit limits, session timers, self-exclusion — and to monitor for indicators of problematic gaming behaviour.
• To communicate with you regarding your account, including transaction notifications, security alerts, and support responses, via SMS to your registered Pakistani mobile number.
• To comply with applicable legal and regulatory obligations.
• To analyse Platform usage patterns and improve user experience on mobile and desktop interfaces.

sand77 does not sell your personal data to third parties. sand77 does not use your personal data for unsolicited third-party marketing.

5. Legal Basis for Processing

sand77 processes personal data on the following legal bases:

• Contract performance: Processing necessary to create and maintain your account, process transactions, and deliver the products and services you have requested.
• Legal obligation: Processing required by sand77's operating licence, anti-money laundering obligations, KYC requirements, and other applicable regulatory requirements.
• Legitimate interests: Processing for fraud prevention, security, responsible gaming monitoring, and platform improvement, where such interests are not overridden by your data protection rights.
• Consent: Where sand77 relies on consent as the legal basis for processing (for example, for optional marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.

6. Data Sharing & Disclosure

sand77 may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment processors: JazzCash, Easypaisa, and banking partners, for the purpose of processing deposits and withdrawals. These entities act as independent data controllers in respect of their own payment processing activities.
• KYC and identity verification providers: Third-party identity verification service providers who process CNIC and liveness data on sand77's behalf under a binding data processing agreement.
• Fraud prevention and AML screening services: Third-party providers who assist sand77 in detecting fraud, money laundering, and prohibited account activity.
• Regulatory and law enforcement authorities: Where sand77 is legally required to disclose data to a regulator, law enforcement agency, or court of competent jurisdiction.
• IT and infrastructure service providers: Cloud hosting, database, and infrastructure providers who process data on sand77's behalf under data processing agreements that require them to maintain appropriate security standards.

sand77 does not share personal data with advertising networks, data brokers, or third-party marketers.

7. International Data Transfers

sand77 operates under an international gaming licence and its infrastructure may involve data processing by service providers located outside Pakistan. Where personal data is transferred to recipients in other jurisdictions, sand77 implements appropriate safeguards, which may include standard contractual clauses, data processing agreements, or reliance on adequacy decisions, to ensure that transferred data receives a level of protection consistent with applicable data protection standards.

By registering an account and using the sand77 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Pakistan for the purposes set out in this Policy.

8. Data Retention

sand77 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for the duration of your account relationship and for such additional period as may be required by legal, regulatory, or licence obligations. As a general principle:

• Account and identity data is retained for a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction records are retained for a minimum of 5 years following the date of each transaction.
• Responsible gaming records, including self-exclusion history, are retained for the duration required by sand77's responsible gaming obligations and operating licence.
• Customer support communications are retained for up to 3 years from the date of the interaction.
• Technical and usage data may be retained in anonymised or aggregated form indefinitely for analytical purposes.

When retention periods expire, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

9. Cookies & Tracking Technologies

sand77 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for core Platform functionality — session management, login state, security tokens. These cannot be disabled without affecting Platform functionality.
• Performance cookies: Collect anonymised data on how users navigate the Platform to help sand77 identify and fix technical issues and improve usability.
• Functional cookies: Remember your preferences such as language settings and game display options across sessions.

sand77 does not use third-party advertising or tracking cookies that transmit your data to external advertising networks. You may control cookie settings through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the Platform.

10. Data Security

sand77 implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of all data in transit using TLS (Transport Layer Security) protocols.
• Encryption of sensitive data at rest, including account credentials (stored as salted cryptographic hashes) and financial data.
• Access controls restricting internal access to personal data on a need-to-know basis, with access logging.
• Regular security assessments and penetration testing of Platform infrastructure.
• SMS-based two-factor authentication (2FA) available to all Players to protect their sand77 accounts.

Notwithstanding these measures, no internet-based system can guarantee absolute security. In the event of a data security incident that affects your personal data, sand77 will notify affected Players and relevant authorities in accordance with applicable legal requirements. You can assist in protecting your account by using a strong, unique password and enabling 2FA in your sand77 account settings.

11. Your Data Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data held by sand77:

• Right of access: The right to request a copy of the personal data sand77 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data in certain circumstances — subject to sand77's legal and regulatory retention obligations.
• Right to restriction: The right to request that sand77 restrict the processing of your data in certain circumstances.
• Right to object: The right to object to processing based on legitimate interests in certain circumstances.
• Right to data portability: The right to receive your personal data in a structured, machine-readable format in certain circumstances.

To exercise any of these rights, contact sand77 support at the contact details in Section 14. sand77 will respond to valid data subject requests within 30 calendar days. Note that exercising certain rights — particularly erasure — may result in account closure where the relevant data is necessary for the operation of your account or to meet regulatory obligations.

12. Minors

The sand77 Platform is strictly 18+ only. sand77 does not knowingly collect or process personal data from individuals under the age of 18. If sand77 becomes aware that a person under 18 has registered an account, the account will be immediately closed, all related personal data will be deleted to the extent permitted by applicable law, and any deposits held will be returned via the registered payment method. If you have reason to believe that a minor has registered on sand77, please contact support immediately.

13. Changes to This Policy

sand77 reserves the right to update this Privacy Policy at any time. Material changes will be communicated to registered Players via SMS to the mobile number on their account with a minimum of 7 days' notice before the changes take effect, except where changes are required immediately by law or regulatory instruction. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Continued use of the Platform following the effective date of any change constitutes acceptance of the revised Policy.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or sand77's handling of your personal data, please contact the sand77 Data team:

Email: [email protected]

sand77 customer support operates 24 hours a day, 7 days a week. Live chat is available within your account after logging in and is typically the fastest channel for account-specific privacy queries.