Privacy Policy

This Privacy Policy ("Policy") is issued by the operator of the HM88 online gaming platform, accessible at https://hm88.cam ("Platform", "we", "us", "our"). It sets out how we collect, use, store, share and protect personal data belonging to users of the Platform ("User", "you", "your"), in compliance with applicable data-protection and privacy laws.

By registering an account, accessing the Platform or using any of its Services, you acknowledge that you have read and understood this Policy and that you consent to the processing of your personal data as described herein. This Policy forms part of and should be read together with our Terms & Conditions.

If you do not agree with this Policy, you must not use the Platform. If you have questions about how we handle your personal data, please refer to the Contact section at the end of this document.

In this Policy, the following terms carry the meanings defined below:

The Data Controller for personal data processed through the HM88 Platform is the Operator of the Platform. The Operator holds an international gaming licence and operates in accordance with the data-protection requirements of its licence jurisdiction.

Where the Operator engages third-party service providers to process data on its behalf — such as payment processors, KYC verification vendors or game content providers — those parties act as Data Processors under appropriate contractual data-processing agreements that restrict the use of your data to the purposes specified by the Operator.

For all data-related enquiries, requests to exercise your rights, or concerns about how your personal data is handled, please contact the Operator's support team using the details provided in Section 15 (Contact Us) of this Policy.

HM88 collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from third parties such as KYC verification providers and payment processors. The categories of data we collect include:

4.1 Registration & Identity Data

• Full legal name, date of birth and residential address.
• Email address and, where provided, a phone number.
• Username and encrypted password.
• Nationality and, where required for KYC, government-issued identification documents (e.g., CNIC, passport, driving licence).
• Source-of-funds documentation where required by AML procedures.

4.2 Financial & Transaction Data

• Deposit and withdrawal amounts, dates and payment method references.
• Account balance history and transaction logs.
• Payment method identifiers (e.g., partial card numbers, mobile-wallet references such as those associated with Easypaisa or JazzCash — used as transaction references only, not implying institutional partnerships).

4.3 Gaming & Betting Activity Data

• Bet history, game play logs, win/loss records and session durations.
• Responsible-gambling tool settings (deposit limits, self-exclusion status).
• Bonus activation, wagering progress and promotional participation history.

4.4 Technical & Device Data

• IP address, browser type and version, operating system and device type.
• Cookie identifiers and session tokens.
• Pages visited, features used, time spent and click-path data.
• Geolocation data (country/region level) derived from IP address.

4.5 Communication Data

• Records of Live Chat conversations and support ticket exchanges with our team.
• Email correspondence with the Operator.
• Records of marketing communication preferences and unsubscribe requests.

The Operator processes your personal data on one or more of the following lawful bases, depending on the specific processing activity:

We use the personal data we collect for the following purposes, always within the scope of the applicable legal basis identified in Section 5:

• Account Management: Creating and maintaining your HM88 account, processing logins and managing account settings.
• Transaction Processing: Executing deposits and withdrawals in PKR, maintaining balance records and resolving payment disputes.
• Identity Verification (KYC): Verifying your age, identity and, where required, your source of funds in compliance with the Operator's AML and licence obligations.
• Service Delivery: Providing access to sports-betting markets (including Pakistan cricket, PSL and ICC events), casino games, live dealer tables and platform features.
• Customer Support: Responding to support queries submitted via Live Chat or email, including queries related to account access, payments and responsible-gambling tools.
• Responsible Gambling: Monitoring account activity to identify potential problem-gambling patterns, applying self-exclusion settings and enforcing deposit and loss limits you have set.
• Fraud & Security: Detecting and preventing fraud, multi-accounting, bonus abuse, money laundering and other prohibited conduct as defined in our Terms & Conditions.
• Platform Improvement: Analysing anonymised usage data to improve platform performance, fix technical issues and enhance the user experience on mobile and desktop.
• Marketing (Consent Only): Sending promotional offers, bonus notifications and news about new games or features — only where you have given explicit consent and only until you withdraw that consent.
• Legal Compliance: Meeting reporting, record-keeping and audit obligations under the Operator's licence jurisdiction.

HM88 does not sell, rent or trade your personal data to any third party for their own commercial or marketing purposes. We may share your data with the following categories of recipients, strictly for the purposes outlined in this Policy:

• Payment Service Providers: To process deposits and withdrawals. These include payment gateway operators and financial intermediaries. Payment brand references (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah) are used as familiar transaction-reference terms for Pakistani users — they do not imply formal data-sharing agreements with those institutions.
• KYC & Identity Verification Vendors: To verify your identity, age and documentation in compliance with AML obligations.
• Game Content Providers: Anonymised or pseudonymised session data may be shared with third-party game studios and live-dealer providers to ensure game integrity and technical compatibility.
• Regulatory & Law-Enforcement Authorities: Where we are legally required to disclose information by court order, regulatory demand or applicable law — including AML reporting obligations.
• Group Companies & Successors: In the event of a merger, acquisition or transfer of the Platform's business, user data may be transferred to a successor entity subject to equivalent privacy protections.
• Fraud Prevention Services: To detect and prevent fraudulent activity, we may cross-reference account data with industry-shared fraud databases.

We retain your personal data only for as long as is necessary for the purposes for which it was collected and to meet our legal, regulatory and contractual obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of your account and for a minimum period thereafter as required by the Operator's licence obligations (typically five years following account closure).
• KYC & AML Records: Retained for the period required by the applicable anti-money-laundering legislation in the Operator's licence jurisdiction, commonly a minimum of five years.
• Transaction Records: Deposit, withdrawal and betting history is retained in accordance with financial-record-keeping requirements under the Operator's licence.
• Support Communications: Live Chat logs and email correspondence are retained for a reasonable period to enable dispute resolution and quality assurance.
• Marketing Data: Retained until you withdraw consent for marketing communications, after which your data will be removed from active marketing lists (though may be retained in suppression lists to honour opt-out preferences).

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data-destruction procedures.

The Operator takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, alteration, disclosure or destruction. These measures include, but are not limited to:

• TLS/SSL Encryption: All data transmitted between your browser and the HM88 Platform is encrypted using industry-standard Transport Layer Security (TLS).
• Access Controls: Strict role-based access controls limit which staff can access personal data, based on job function and necessity.
• Password Hashing: User passwords are stored as salted cryptographic hashes — plain-text passwords are never stored or accessible to Operator staff.
• Vulnerability Management: The Platform undergoes periodic security assessments. Critical vulnerabilities are patched on a priority basis.
• Incident Response: We maintain documented procedures for identifying, containing and notifying affected parties of data-security incidents within the timeframes required by applicable law.

HM88 uses cookies and similar tracking technologies (including session tokens, local storage and pixel tags) to provide, secure and improve the Platform. The following categories of cookies are used:

You can manage or delete cookies at any time through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in or use core Platform features. For analytics and marketing cookies, you may withdraw consent at any time without affecting your account functionality.

Subject to applicable data-protection law, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team using the details in Section 15. We will respond within a reasonable timeframe and in accordance with applicable legal requirements:

The HM88 Platform is strictly intended for adults aged 18 and over — or the higher minimum age required by the laws of the User's jurisdiction or the Operator's licence jurisdiction. We do not knowingly collect, store or process personal data from individuals under the applicable minimum age.

If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account. If you believe a minor has provided us with personal data, please contact our support team immediately.

As an internationally operated platform, HM88 may transfer your personal data to, and store it in, countries outside your country of residence. These countries may not offer the same level of data-protection law as your home jurisdiction.

Where we transfer personal data internationally, we ensure that appropriate safeguards are in place — such as standard contractual clauses approved by relevant data-protection authorities, binding corporate rules or equivalent transfer mechanisms — to ensure your data receives a level of protection consistent with this Policy.

The Operator reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated via a notice on the Platform or by email to registered users. The "Last Updated" date at the top of this page will reflect the date of the most recent revision.

Your continued use of the Platform following publication of an amended Policy constitutes your acceptance of the updated terms. If you disagree with any material change, you should cease using the Platform and may request account closure.

For all privacy-related enquiries, requests to exercise your data rights, or concerns about how your personal data is processed, please contact the HM88 support team through any of the following channels:

• Live Chat: Available 24/7 directly through the Platform. This is the fastest channel for urgent queries.
• Help Centre: Accessible through the Platform's support section for guided self-service and ticket submission.
• Email: [email protected] (displayed as plain text — not a clickable link).

Our support team operates in English with Urdu assistance available on request. We aim to respond to all privacy requests within a reasonable period. Complex requests, particularly formal data-access or erasure requests, may take longer to process fully.