Privacy Policy — h2game

This Privacy Policy ("Policy") describes how h2game ("we", "us", "our"), the operator of the online gaming information and entertainment platform located at https://h2game.cam ("the Platform"), collects, uses, stores, shares and protects the personal data of its users ("you", "your") in connection with your use of the Platform and its associated services.

h2game is committed to handling your personal data responsibly, transparently and in accordance with applicable data protection legislation. This Policy should be read alongside our Terms and Conditions and our Responsible Gambling Policy, both of which are incorporated by reference. By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein, to the extent that consent is the applicable legal basis for processing.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, email address, IP address, device identifiers, payment details and location data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, alteration, retrieval, use, disclosure, erasure or destruction.
• "Data Controller" means h2game, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of h2game under a binding data processing agreement.
• "Consent" means a freely given, specific, informed and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification process required to confirm that users are who they claim to be and meet the minimum age requirement.
• "Cookies" means small text files placed on your device by the Platform to support session management, functionality and analytics.
• "Sensitive Data" means categories of Personal Data that warrant heightened protection, including identity document numbers (such as CNIC), financial account information and data relating to health or problem gambling indicators.

h2game collects the minimum personal data necessary to deliver its services, comply with legal obligations and maintain the security and integrity of the Platform. The categories of data we collect are set out in the table below.

h2game collects personal data through the following channels:

• Directly from you: when you register an Account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey or claim a promotion.
• Automatically: when you browse the Platform, our servers and cookies automatically record technical data such as your IP address, browser type, device identifiers and pages visited.
• From third-party processors: KYC and identity verification providers may return identity match scores, document authenticity results and watchlist screening outcomes to us. Payment processors return transaction status confirmations.
• From fraud and security tools: device fingerprinting and fraud detection services may supply risk scores and flag suspicious activity patterns associated with your device or session.
• From publicly available sources: we may cross-reference public records or sanctions lists as part of AML and responsible gambling compliance obligations.

h2game processes your personal data only where a valid legal basis exists. The primary legal bases we rely on are:

• Contractual necessity: Processing your registration data, financial data and Account activity records is necessary to deliver the services you have contracted with us for under our Terms and Conditions.
• Legal obligation: KYC verification, AML screening and certain record-keeping requirements are mandatory under applicable laws and our operating licence conditions. We cannot waive these obligations.
• Legitimate interests: We process technical and behavioural data to protect the security and integrity of the Platform, prevent fraud, identify problem gambling indicators and improve our services — provided these interests are not overridden by your fundamental privacy rights.
• Consent: We rely on your consent for sending marketing communications by email, SMS or push notification. You may withdraw this consent at any time without affecting our right to process data on other legal bases.

The personal data we collect is used for the following purposes:

• Creating and managing your Account, including verifying your identity and age before granting access to real-money gaming features;
• Processing deposits and withdrawals through your selected payment method and maintaining accurate transaction records;
• Complying with KYC, AML, counter-terrorist financing (CTF) and responsible gambling obligations imposed by our operating licence conditions and applicable law;
• Detecting, investigating and preventing fraud, cheating, collusion, money laundering and other prohibited conduct;
• Delivering customer support via live chat, email and other channels — including Urdu-language assistance where requested by Pakistani users;
• Sending you account-related communications — including transaction confirmations, security alerts and policy updates — that are necessary for the provision of our services;
• Sending you promotional communications about bonuses, new game releases, PSL/T20 cricket betting markets and special offers, where you have provided your consent to receive such communications;
• Personalising your experience on the Platform based on your game preferences and activity history;
• Monitoring your gambling behaviour for signs of problem gambling and, where appropriate, proactively reaching out to offer responsible gambling resources or tools such as deposit limits, loss limits or self-exclusion;
• Analysing Platform performance, identifying technical errors and improving the user experience for players across Pakistan — including users in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar.

h2game does not sell, rent or trade your personal data. We share your data only with the categories of third party listed below, and only to the extent strictly necessary for the stated purpose. All third-party processors are bound by data processing agreements that require them to maintain confidentiality and handle your data securely.

• Payment processors: We share transaction details with the payment infrastructure providers that facilitate your deposits and withdrawals. These providers process your data under their own privacy policies and applicable financial regulation.
• KYC and identity verification providers: We share identity document data with specialist KYC vendors to verify your age, identity and, where required, source of funds. These vendors return a verification result to us and are prohibited from using your data for any other purpose.
• Fraud detection and security services: Device fingerprinting, IP reputation and behavioural analytics tools receive technical session data to assess fraud risk in real time.
• Responsible gambling service providers: Where you voluntarily opt into a self-exclusion programme administered by a third-party responsible gambling service, limited account-identifying data may be shared to enrol and enforce your exclusion.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, financial intelligence units or regulatory bodies where we are required to do so by law, a valid court order or a lawful regulatory demand — without prior notice to you where the law prohibits such notice.
• Corporate successors: In the event of a merger, acquisition or sale of substantially all of h2game's assets, your personal data may be transferred to the acquiring entity, which will be required to honour the terms of this Policy.

The Platform uses cookies and similar tracking technologies to provide you with a functional, secure and personalised experience. Below is a summary of the types of cookies we use:

You can control or delete cookies through your browser settings at any time. Disabling strictly necessary cookies will impair your ability to use the Platform. Disabling functional cookies may cause your preferences to reset between sessions. Disabling analytics cookies has no effect on your Platform experience.

h2game retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and our licence obligations. The general retention periods we apply are as follows:

• Account data: Retained for the duration of your active Account, plus a minimum of five (5) years from the date your Account is closed — in line with standard AML record-keeping requirements.
• KYC / identity documents: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later. This period may be extended if required by a regulatory investigation or legal proceeding.
• Financial transaction records: Retained for a minimum of five (5) years in accordance with financial record-keeping obligations applicable to licensed gaming operators.
• Customer support communications: Retained for three (3) years from the date of the last communication, for dispute resolution and quality assurance purposes.
• Marketing preference records: Retained for three (3) years from the date of your last consent update or opt-out action.
• Technical / log data: Retained for up to twelve (12) months for security monitoring and fraud detection purposes, after which it is anonymised or deleted.

Once the applicable retention period expires, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where deletion is not technically feasible within normal operational systems, data is isolated and protected until deletion can be carried out securely.

h2game operates on a global infrastructure, and some of its service providers — including KYC vendors, cloud hosting providers and fraud detection services — may be located in countries outside Pakistan. Where your personal data is transferred internationally, h2game ensures that adequate safeguards are in place, including:

• Standard contractual clauses or equivalent data transfer mechanisms approved under applicable data protection frameworks;
• Due diligence assessments of recipient countries' data protection standards;
• Binding data processing agreements requiring recipients to apply equivalent security and confidentiality standards;
• Where applicable, adequacy decisions confirming that the destination jurisdiction provides an equivalent level of protection.

By using the Platform, you acknowledge that your personal data may be processed in countries outside Pakistan. h2game takes all reasonable steps to ensure that such transfers are conducted lawfully and that your data receives an equivalent level of protection to that which it would receive within your home jurisdiction.

Subject to applicable data protection law and the legal bases on which we process your data, you may hold some or all of the following rights in relation to your personal data:

• Right of Access: You have the right to request a copy of the personal data h2game holds about you, together with information about how it is processed.
• Right to Rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to our legal retention obligations — we cannot erase data we are required by law to keep.
• Right to Restriction of Processing: You may ask us to restrict the processing of your data in certain circumstances — for example, while we verify the accuracy of data you have contested.
• Right to Data Portability: Where processing is based on your consent or a contract and is carried out by automated means, you may request that we provide your data in a structured, commonly used and machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests or the processing is necessary for the establishment, exercise or defence of legal claims.
• Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to Lodge a Complaint: If you believe we have processed your data unlawfully, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

The Platform is strictly prohibited to persons under the age of 18, or the higher minimum age required by the operator or applicable licence jurisdiction. h2game does not knowingly collect or process personal data relating to individuals under this age threshold.

If h2game identifies — through KYC verification, behavioural analysis or any other means — that a User is or may be under the minimum eligible age, we will immediately suspend the Account, freeze any associated balance, conduct an age verification review and, if the suspicion is confirmed, permanently close the Account and return deposits in accordance with applicable law and our Terms and Conditions.

If you are a parent or guardian and believe that a minor has registered an Account or provided personal data to h2game without your knowledge, please contact us immediately at [email protected] and we will take prompt corrective action, including deletion of the minor's data.

h2game implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and our servers is protected using TLS (Transport Layer Security) encryption.
• Encryption at rest: Personal data and identity documents stored on our servers are encrypted using AES-256 or equivalent standards.
• Password security: User passwords are hashed using a strong one-way hashing algorithm. We never store passwords in plain text. h2game staff will never ask you for your password.
• Access controls: Access to personal data within h2game is restricted on a need-to-know basis. Staff with access to sensitive data are subject to background checks and regular security training.
• Intrusion detection: We operate continuous monitoring of our infrastructure for anomalous access patterns, unauthorised login attempts and data exfiltration signals.
• Incident response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, h2game will notify affected users and, where required, the relevant supervisory authority, in accordance with applicable notification timelines.

While h2game takes all reasonable precautions, no method of internet transmission or electronic storage is completely secure. You are responsible for keeping your Account credentials confidential and notifying us promptly if you suspect your Account has been accessed without your authorisation.

The Platform may contain references to third-party services — such as responsible gambling support organisations or payment providers — for informational context. Where any such references include navigable links, those links will direct you to external websites operated by third parties whose privacy practices are entirely independent of h2game.

h2game has no control over, and accepts no responsibility for, the content, privacy policies or practices of any third-party website. We encourage you to read the privacy policy of every website you visit. The inclusion of a reference to a third-party service on this Platform does not constitute an endorsement, approval or recommendation of that service by h2game.

h2game reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our operating licence requirements. The "Last Updated" date at the top of this page will always reflect when the most recent revision was made.

Where changes are material — for example, where we introduce a new category of data collection, a new purpose for processing, or a new category of third-party recipient — we will provide reasonable advance notice. This may take the form of a prominent notice on the Platform, an email to your registered address, or both. Where the change requires fresh consent, we will ask you to provide it before the change takes effect.

Your continued use of the Platform after an updated Policy has been posted constitutes your acknowledgement of the changes. If you do not accept the updated Policy, you must cease using the Platform and, if applicable, close your Account before the updated Policy takes effect.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a potential data breach or privacy concern, please contact our data protection team using the details below. All privacy enquiries are treated with high priority and handled confidentially.

• Email: [email protected] — please include "Privacy" or "Data Request" in the subject line and provide your registered email address so we can locate your Account. We aim to respond to all data rights requests within 30 calendar days.
• Live Chat: Available 24/7 via the Platform's live chat feature for general privacy queries. For formal data rights requests, email is preferred as it provides a written record for both parties.
• Language support: Our support team can assist Pakistani users in English and Urdu. For formal legal correspondence, English is the governing language of this Policy.