fly33 Privacy Policy — How We Protect Your Data

Who We Are

fly33 is the trading name of the entity that operates the online gaming and sports betting platform accessible at fly33.bio ("the Platform"). fly33 holds an international gaming licence under which it is authorised to provide online casino, sportsbook, and related gaming services to eligible players. fly33 is the data controller in respect of personal data collected from Players and visitors to the Platform.

For all data protection enquiries, Players may contact fly33 via the support address set out in Section 16 of this Policy. fly33 is committed to responding to all data-related enquiries within a reasonable timeframe and no later than 30 days from receipt of a request.

Scope of This Privacy Policy

This Privacy Policy applies to:

• All individuals who register a Player Account on the fly33 Platform;
• All visitors to fly33.bio who have not registered an Account, to the extent data is collected from such visitors (e.g., through cookies or analytics tools);
• All individuals who contact fly33's customer support team, whether via live chat, email, or any other channel;
• All individuals whose personal data fly33 receives in connection with a Player's account, such as beneficiaries named in responsible gaming requests.

This Policy does not apply to third-party websites, applications, or services that may be accessible through links on the fly33 Platform. fly33 is not responsible for the privacy practices of any such third parties, and Players are encouraged to review the privacy policies of any external services they use in connection with their fly33 experience.

Personal Data We Collect

fly33 collects the following categories of personal data from Players and Platform visitors:

fly33 does not collect sensitive categories of personal data (such as medical history, ethnic or racial origin, religious beliefs, or political opinions) unless this is strictly necessary in a specific responsible gaming context and you have provided explicit consent for such collection.

How We Collect Your Data

fly33 collects personal data through the following means:

• Direct provision: Information you provide when registering your fly33 Account, completing the KYC process, making deposits or withdrawal requests, updating your account profile, or contacting fly33 support;
• Automated collection: Technical and usage data collected automatically by fly33's Platform infrastructure, including cookies, session logging, and analytics tools, as further detailed in Section 7;
• Third-party sources: Fraud prevention and identity verification data received from licensed third-party KYC and anti-money laundering service providers, as permitted by fly33's licensing obligations;
• Payment processors: Transaction confirmation and status data from payment processing partners including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, solely to facilitate and verify your transactions on the fly33 Platform.

Purposes for Which We Process Your Data

fly33 processes your personal data for the following specific, documented purposes:

1. Account registration and management: Creating and maintaining your fly33 Player Account, including verifying your identity and eligibility to use the Platform;
2. Age and identity verification (KYC): Complying with fly33's legal and licensing obligations to verify that all Players are aged 21 or above and are who they claim to be;
3. Payment processing: Processing deposits and withdrawals in PKR via your chosen payment method (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, USDT TRC20, or SadaPay);
4. Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, multiple account registration, and other prohibited conduct;
5. Responsible gaming monitoring: Identifying patterns of play that may indicate problem gambling behaviour and triggering appropriate responsible gaming interventions in compliance with fly33's licensing obligations;
6. Customer support: Responding to your queries, complaints, and account management requests;
7. Legal and regulatory compliance: Meeting fly33's obligations under its international gaming licence, including record-keeping, reporting, and audit requirements;
8. Platform improvement: Analysing aggregated, anonymised usage data to improve the fly33 gaming experience, fix technical issues, and develop new features;
9. Marketing communications: Sending you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications — subject to the terms in Section 13.

Legal Basis for Processing

fly33 processes your personal data under the following legal bases:

• Contractual necessity: Processing that is necessary to fulfil fly33's obligations to you under the fly33 Terms & Conditions — including account management, payment processing, and customer support — is processed on the basis of contractual necessity;
• Legal obligation: Processing required by fly33's gaming licence conditions, anti-money laundering obligations, and age verification requirements is processed on the basis of legal obligation;
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, and aggregate analytics is carried out on the basis of fly33's legitimate interests in operating a secure and compliant gaming platform, provided those interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications, optional personalisation features, and any non-essential cookie categories is based on your freely given, informed consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

Cookies & Tracking Technologies

fly33 uses cookies and similar tracking technologies on its Platform. Cookies are small data files stored on your device by your browser that allow fly33's systems to recognise your device and maintain session continuity across the Platform.

fly33 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function correctly, including maintaining your login session, preserving game state, and securing transactions. These cannot be disabled without breaking core fly33 functionality;
• Performance Cookies: Collect anonymised data about how Players use fly33, including which pages are visited most frequently and where technical errors occur. This data helps fly33 improve Platform performance;
• Functionality Cookies: Remember your preferences such as language settings, preferred bet sizes, and lobby display options to personalise your fly33 experience;
• Analytical Cookies: Used to analyse aggregate Platform usage patterns to support fly33's product development decisions. Processed on a pseudonymised basis wherever possible.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may impair the functionality of the fly33 Platform.

Sharing Your Data with Third Parties

fly33 does not sell your personal data to any third party. fly33 shares personal data with the following categories of third parties where necessary and proportionate:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 network operators receive payment instruction data solely for the purpose of processing your deposits and withdrawals;
• KYC and identity verification providers: Licensed third-party services that assist fly33 in verifying the identity, age, and risk profile of Players as required by fly33's gaming licence;
• Game content providers: Software studios whose games are hosted on the fly33 Platform receive session and bet data necessary to operate the relevant game and calculate RTP statistics;
• Fraud and security services: Specialist fraud detection providers that analyse transaction and behavioural patterns to protect fly33 and its Players from financial crime and abuse;
• Regulatory and licensing authorities: fly33's licensing authority and, where legally required, law enforcement agencies, financial intelligence units, or courts may receive data in response to lawful requests or as required by fly33's licensing conditions;
• Professional advisers: Legal, accounting, and audit professionals engaged by fly33 who are subject to professional duties of confidentiality.

All third-party data processors engaged by fly33 are subject to written data processing agreements that restrict their use of your data to purposes specified by fly33 and require them to implement appropriate technical and organisational security measures.

International Data Transfers

As an internationally licensed gaming platform, fly33 may transfer your personal data to service providers and processors located outside Pakistan. Such transfers occur when fly33's payment processors, KYC providers, or game content suppliers operate from infrastructure based in other jurisdictions.

Where fly33 transfers personal data internationally, it does so only where appropriate safeguards are in place to ensure that your data is afforded a level of protection materially equivalent to that described in this Privacy Policy. These safeguards include contractual data protection clauses that bind recipient parties to fly33's data protection standards.

fly33 does not transfer your personal data to countries or territories that fly33's data protection assessment identifies as presenting materially elevated risks to data subject rights without first implementing enhanced contractual or technical safeguards.

Data Retention

fly33 retains your personal data only for as long as is necessary for the purposes described in this Privacy Policy, and in any event no longer than required by applicable legal and licensing obligations. The key retention periods applicable to fly33 Player data are as follows:

Upon expiry of the applicable retention period, fly33 will securely delete or permanently anonymise your personal data such that it can no longer be linked to you as an individual. Where anonymisation rather than deletion is applied, the resulting data may be retained indefinitely for statistical and research purposes without further notice to you.

Your Data Rights

As a fly33 Player whose personal data is processed by fly33, you have the following rights in relation to your personal data, subject to applicable legal limitations and exceptions:

• Right of Access: You have the right to request a copy of all personal data fly33 holds about you, together with information about how that data is processed. fly33 will provide this within 30 days of receiving a valid access request;
• Right to Rectification: You have the right to request that fly33 corrects any inaccurate or incomplete personal data it holds about you. You may also update certain account details directly within your fly33 account settings;
• Right to Erasure: In certain circumstances — particularly where fly33 no longer has a legal basis for processing your data — you may request deletion of your personal data. This right is subject to overriding legal, licensing, and anti-money laundering retention obligations that may require fly33 to retain certain data regardless of your request;
• Right to Restriction: You may request that fly33 suspend processing of your personal data in certain circumstances, such as while a dispute about data accuracy is being resolved;
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that fly33 provide your personal data in a structured, commonly used, machine-readable format;
• Right to Object: You have the right to object to processing of your personal data that is based on fly33's legitimate interests. fly33 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent: Where processing is based on your consent (such as for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the above rights, please contact fly33 at the address provided in Section 16. fly33 may need to verify your identity before processing a data rights request, and will respond within 30 days. In complex cases, fly33 may extend this period by a further 60 days, in which case fly33 will notify you of the extension and the reasons for it within the initial 30-day period.

Children's Privacy — 21+ Policy

The fly33 Platform is strictly intended for adults aged 21 years and above. fly33 does not knowingly collect personal data from individuals under the age of 21, and no part of the fly33 Platform is directed at or designed for minors.

If fly33 becomes aware that it has collected personal data from an individual who is under 21 years of age, it will take immediate steps to:

• Suspend the associated fly33 Account;
• Retain only the minimal data necessary to process any pending transactions and close the account;
• Permanently delete all other personal data collected from the minor as promptly as is technically feasible;
• Refund any real-money balance to the original deposit source.

If you believe that fly33 may have inadvertently collected personal data from a minor, please contact fly33 immediately at the support address in Section 16. Parents and guardians who are concerned about a minor's access to the fly33 Platform are encouraged to use parental control software and to review our Responsible Gaming resources.

Marketing Communications

fly33 may send you promotional offers, bonus notifications, new game announcements, and other marketing communications relating to the fly33 Platform, subject to the following conditions:

• fly33 will only send you marketing communications where you have explicitly opted in to receive them, either during account registration or through your account preferences settings;
• Marketing communications will be sent to your registered email address and/or Pakistani mobile number via SMS, as applicable based on your consent preferences;
• You may opt out of all fly33 marketing communications at any time by: (i) clicking the unsubscribe link in any marketing email; (ii) updating your notification preferences in your fly33 account settings; or (iii) contacting fly33 support and requesting removal from all marketing lists;
• Opting out of marketing communications does not affect transactional communications — fly33 will continue to send you account-related notifications (deposit confirmations, withdrawal updates, security alerts) regardless of your marketing preferences, as these are necessary for account management.

Security Measures

fly33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure:

• Transport Layer Security: All data transmitted between your device and fly33's servers is encrypted using 256-bit SSL/TLS protocols, the same standard used by international banking institutions;
• Encryption at Rest: Personal data stored in fly33's databases is encrypted at rest to protect against unauthorised access even in the event of a server-level compromise;
• Access Controls: fly33 employee access to personal data is strictly role-based and limited to the minimum access required for each team member's specific function. All internal access is logged and subject to regular audit;
• Password Security: fly33 does not store player passwords in plaintext. Passwords are hashed using bcrypt with appropriate computational cost parameters;
• Two-Factor Authentication: fly33 offers 2FA to all Players and applies mandatory 2FA internally for all staff access to systems containing personal data;
• Penetration Testing: fly33's Platform undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited;
• Incident Response: fly33 maintains a documented data breach response plan that includes detection, containment, assessment, notification, and post-incident review procedures.

While fly33 takes all reasonable steps to protect your personal data, no online system can be guaranteed to be completely secure. Players are also responsible for the security of their own devices and fly33 Login credentials — fly33 recommends enabling 2FA and using a strong, unique password for your fly33 account.

Updates to This Privacy Policy

fly33 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws and regulations, or the features available on the fly33 Platform. The effective date shown at the top of this Policy will be updated whenever a new version is published.

Where changes to the Privacy Policy are material — meaning they significantly affect your rights or the way fly33 uses your personal data — fly33 will notify registered Players via email to the address on file at least seven (7) days before the changes take effect. For non-material updates (such as clarifications, typographical corrections, or formatting changes), fly33 may update the Policy without advance notice.

Your continued use of the fly33 Platform following the effective date of any Privacy Policy update constitutes your acknowledgement of the updated Policy. If you do not agree with any update to this Privacy Policy, you should discontinue use of the fly33 Platform and close your account. The most current version of this Policy will always be available at fly33.bio/privacy-policy.

Contact Us — Data Protection Enquiries

For all enquiries, requests, or complaints relating to this Privacy Policy or fly33's processing of your personal data, please contact fly33 using the following details:

• Email: [email protected] — for data rights requests, please include "Privacy Request" in the subject line
• Live Chat: Available from within your fly33 account, 24 hours a day, 7 days a week
• Response Commitment: fly33 commits to acknowledging all privacy enquiries within 48 hours and providing a substantive response within 30 calendar days

When submitting a data rights request, please provide sufficient information to allow fly33 to identify your account, including your registered email address or Pakistani mobile number and a clear description of the specific right you wish to exercise. fly33 may request additional verification of your identity before fulfilling any data subject request in order to protect your data against unauthorised third-party access.