LilBet Privacy Policy — How We Handle Your Personal Data

1 Who We Are

LilBet is the online gaming platform operating at lilbet.bio, offering casino games, live dealer tables, fishing games, and sports betting to members in Pakistan. In this Privacy Policy, "LilBet", "we", "our", and "us" refer to the company that owns and operates this platform.

LilBet acts as the data controller for the personal information it collects from members. This means we are responsible for deciding how and why your personal data is processed, and for ensuring that processing is lawful, fair, and transparent.

If you have any question about this policy or about how your data is handled at any point, you can reach our data team at support@lilbet.bio. We take privacy questions seriously and aim to respond within 48 hours.

2 Data We Collect

LilBet collects personal data in three main ways: information you provide directly, information generated automatically when you use the platform, and information received from third parties such as payment providers and identity verification services.

LilBet does not collect or store full payment card numbers. Card processing is handled by our licensed payment processors, who are PCI-DSS compliant.

3 How We Use Your Data

LilBet uses personal data only for specific, legitimate purposes. We do not process data in ways that are incompatible with the purpose for which it was collected. The main purposes for which we use your data are:

3.1 Account Management

Your identity and contact data is used to create and maintain your LilBet account, authenticate your login, and communicate with you about your account — including security alerts, withdrawal confirmations, and balance notifications.

3.2 Payment Processing

Financial data and transaction records are used to process deposits, verify payment sources, execute withdrawal requests, and maintain accurate account balances. This data is also used to detect and prevent fraudulent payment activity.

3.3 Identity Verification (KYC)

Identity data — including your CNIC and payment method details — is used to fulfil LilBet's legal obligation to verify the identity of members before processing withdrawals. This is a regulatory requirement, not optional.

3.4 Responsible Gaming

Usage and transaction data is analysed to identify patterns that may indicate problem gaming behaviour — for example, a sudden increase in deposit frequency or late-night play patterns inconsistent with a member's history. This analysis is used to decide whether to proactively reach out to a member with responsible gaming resources.

3.5 Promotions and VIP Programme

Transaction and usage data is used to calculate cashback amounts, determine VIP tier eligibility, award referral bonuses, and personalise promotional offers. Promotional communications are only sent to members who have not opted out of marketing.

3.6 Platform Improvement

Aggregated, anonymised usage data helps LilBet understand how members interact with the platform — which games are most popular, where members encounter difficulties, and how the platform performs on different devices and connections common in Pakistan. This data is not linked to individual member identities.

3.7 Legal and Regulatory Compliance

LilBet processes data as required by its gaming licence obligations, anti-money laundering (AML) regulations, and any requests from law enforcement or regulatory bodies with legal authority to require disclosure.

4 Legal Basis for Processing

Every type of data processing at LilBet is carried out under one of the following legal bases:

• Contract: Processing necessary to provide the service you have registered for — account management, payment processing, and game access.
• Legal Obligation: Processing required by law — KYC identity verification, AML transaction monitoring, and responses to regulatory requests.
• Legitimate Interest: Processing that serves LilBet's legitimate business interests in a way that does not override your privacy rights — fraud detection, platform security, and aggregated analytics.
• Consent: Processing that you have specifically agreed to — marketing communications, optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5 Data Sharing

LilBet shares personal data only with the specific categories of third party listed below, and only to the extent necessary to fulfil the stated purpose. We do not share data beyond what is required.

5.1 Payment Processors

When you make a deposit or request a withdrawal, relevant financial data is shared with your chosen payment provider — Easypaisa, JazzCash, NayaPay, SadaPay, your bank, or your card processor. Each provider processes your data under their own privacy policies and is independently responsible for securing that data.

5.2 KYC / Identity Verification Service

Your identity documents — CNIC scan and any supporting documents — are shared with LilBet's licensed KYC service provider for verification. The provider confirms the result to LilBet but retains documents only for as long as required by their own regulatory obligations.

5.3 Game Providers

Live dealer game studios and RNG game providers receive a session token that identifies your active game session. They do not receive your name, CNIC, payment details, or full account information. Game providers use session tokens solely to deliver the game and record the round outcome.

5.4 Analytics Providers

LilBet uses analytics tools to understand platform usage. These tools receive anonymised, aggregated data — never individually identifiable information such as your name or CNIC. Analytics data is used to improve the platform and is not shared with advertisers.

5.5 Legal Authorities

LilBet will disclose personal data to law enforcement, regulatory bodies, or courts when required to do so by applicable law. We do not voluntarily share data with government bodies beyond what is legally required.

6 Data Retention

LilBet retains personal data for as long as it is needed for the purpose it was collected, subject to the minimum retention periods required by law. Below are the key retention periods for the main data categories:

• Account and Identity Data: Retained for the duration of your account plus 5 years after account closure, to satisfy regulatory requirements relating to gambling and financial services.
• Transaction Records: Retained for 7 years from the date of the transaction, in line with standard financial record-keeping requirements.
• KYC Documents: Retained for 5 years from the date of verification or account closure, whichever is later.
• Support Communications: Retained for 3 years from the date of the interaction, to allow reference in case of subsequent disputes.
• Game Session Logs: Retained for 2 years. Detailed session replay data is held for 90 days and then replaced by summary logs only.
• Marketing Preferences: Retained for the duration of your account. Opt-out records are retained permanently to prevent accidental re-enrolment in marketing.
• Technical / Server Logs: Retained for 12 months then automatically deleted.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to an individual. Physical documents — if any — are securely shredded.

7 Security Measures

LilBet takes the security of your personal data seriously. The following technical and organisational measures are in place to protect data against unauthorised access, loss, disclosure, or alteration:

• TLS/SSL Encryption: All data transmitted between your device and LilBet's servers is encrypted using industry-standard TLS encryption. The padlock icon in your browser confirms this is active.
• Encrypted Data Storage: Sensitive data at rest — including identity documents and financial details — is encrypted in storage using AES-256 or equivalent.
• Access Controls: Personal data is accessible only to LilBet staff who require it to perform their specific role. Access is controlled by role-based permissions and requires authentication.
• Two-Factor Authentication: Staff accessing systems containing personal data are required to use two-factor authentication. Members are also encouraged to enable 2FA on their accounts.
• Regular Security Audits: LilBet conducts periodic security audits and penetration tests to identify and address vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a data breach affecting member information, LilBet will notify affected members and relevant regulatory bodies within the timeframes required by applicable law.

8 Cookies & Tracking Technologies

LilBet uses cookies and similar tracking technologies to make the platform work properly, to remember your preferences, and to understand how members use the site so we can improve it. Below is a breakdown of the cookie categories in use.

You can also manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent the platform from functioning correctly.

9 Marketing Communications

LilBet sends promotional communications — including bonus offers, tournament invitations, and VIP programme updates — to members who have opted in to marketing. You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link at the bottom of any LilBet promotional email.
• Updating your notification preferences in your LilBet account settings.
• Contacting support at support@lilbet.bio and requesting removal from the marketing list.

Opting out of marketing does not affect transactional communications — you will still receive messages about your account activity, security alerts, KYC requests, and withdrawal confirmations regardless of your marketing preference.

LilBet sends SMS notifications to your registered Pakistani mobile number for important account events — login from a new device, withdrawal processed, large deposit received. SMS for account security purposes cannot be opted out of while your account is active.

10 Children's Privacy

LilBet does not knowingly collect personal data from individuals under the age of 18. The platform is strictly for adults. During registration, you confirm that you are 18 or older. If LilBet discovers that a minor has registered, the account is immediately closed, data is deleted (except where retention is legally required), and any deposited funds are returned to the verified payment source.

If you are a parent or guardian and believe that a minor in your care has registered a LilBet account, please contact us immediately at support@lilbet.bio. We take these reports seriously and act on them without delay.

11 Your Data Rights in Detail

As a LilBet member, you hold the following rights over your personal data. To exercise any of these rights, contact us at support@lilbet.bio with your registered mobile number or email address for verification purposes. We will respond within 30 days.

12 International Data Transfers

Some of LilBet's service providers — including our KYC verification partner and live dealer game studio providers — are based outside Pakistan. When your data is transferred to these providers, LilBet ensures appropriate safeguards are in place to protect your information to a standard at least equivalent to this Privacy Policy.

These safeguards include contractual clauses that require the recipient to process your data only for the purposes specified, to maintain appropriate security measures, and to comply with requests to exercise your data rights. LilBet does not transfer personal data to providers in countries with materially lower data protection standards without such contractual protections in place.

13 Changes to This Privacy Policy

LilBet reviews this Privacy Policy regularly and may update it to reflect changes in how we process data, changes in applicable law, or improvements to our practices. The "Last Updated" date at the top of this page reflects when changes were most recently made.

For changes that materially affect how we use your personal data — for example, if we were to start sharing data with a new category of third party or extend our retention periods — we will notify you via email to your registered address and display an in-platform notification at least 14 days before the change takes effect. For minor clarifications, a silent update to this page is sufficient.

Continuing to use LilBet after the effective date of a material change constitutes your acknowledgement that you have been informed of the change. If you disagree with a material change to this policy, you may close your account before the change takes effect.

14 Contact & Complaints

For any privacy-related question, data subject request, or complaint, please contact LilBet's data team:

• Email: support@lilbet.bio — please include "Privacy Request" in the subject line. We respond within 48 hours for general enquiries and within 30 days for formal data subject requests.
• Live Chat: Available 24/7 through the platform for general privacy questions.
• Account Manager (Gold/Platinum VIP): Your dedicated account manager can forward formal privacy requests to the data team on your behalf.

If you are not satisfied with how LilBet has handled a privacy concern after raising it with us directly, you have the right to escalate your complaint to the relevant regulatory authority or to the gaming regulator that issued LilBet's operating licence. Details of the appropriate regulator are available on request.