c77 Privacy Policy

c77 (referred to in this Policy as "c77", "we", "us", or "our") is the operator of the online gaming platform accessible at c77.lol, including all associated sub-pages, the sports betting section, c77 Casino, slot games, and the PKR wallet service.

c77 operates under an internationally recognised online gaming licence and functions as the data controller in respect of personal data collected from users of the c77 Platform. As data controller, c77 determines the purposes for which and the means by which personal data is processed.

This Privacy Policy applies to all users of the c77 Platform — including registered account holders, visitors who browse without registering, and individuals who contact c77 support. It covers all personal data processing activities conducted by c77 in connection with the Platform.

c77 collects the following categories of personal data from users of the Platform. The specific data collected in each category depends on how you interact with c77 and the services you use.

Special Category Data. c77 does not intentionally collect special category personal data (such as health data, religious beliefs, or political opinions) from users. If you disclose such data voluntarily in a support communication, it will be processed only to the extent necessary to resolve your enquiry and will not be retained beyond that purpose.

c77 collects personal data through the following mechanisms:

• Direct provision by you: When you register a c77 account, complete the KYC verification process, make a deposit or withdrawal, place a bet, activate a bonus, or contact c77 support — you provide data directly.
• Automated collection: When you access the c77 Platform, technical data (IP address, device information, session data, click-stream data) is collected automatically through server logs, cookies, and similar tracking technologies.
• Payment processors: When you transact via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, or USDT TRC20, our payment processing partners provide c77 with transaction confirmation data, including reference numbers and amounts, necessary to credit or debit your PKR Wallet.
• Anti-fraud and verification services: c77 uses third-party identity verification and anti-fraud services that may provide supplemental data about users for the purposes of KYC compliance and fraud prevention.
• Publicly available sources: In limited circumstances, c77 may verify identity information against publicly available records as part of its KYC or enhanced due diligence procedures.

c77 processes personal data only where a valid legal basis exists for doing so. The following table sets out the primary purposes for which c77 processes your personal data and the corresponding legal basis for each:

c77 does not sell your personal data. We share your data only in the following strictly defined circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, and USDT processing partners receive the minimum data necessary to execute your deposit or withdrawal instruction.
• Identity verification providers: Third-party KYC and age verification services receive identity data (name, CNIC, date of birth) to verify your eligibility to use the c77 Platform in compliance with our licence obligations.
• Anti-fraud networks: c77 participates in industry anti-fraud and responsible gaming information-sharing networks. Where required to prevent serious fraud or money laundering, limited account and transaction data may be shared with other licensed operators through these networks.
• Technology and hosting providers: c77's cloud hosting, database, and infrastructure providers may process personal data as data processors acting under strict contractual data processing agreements that prohibit use of your data for their own purposes.
• Regulatory and law enforcement authorities: c77 will disclose personal data to regulators, tax authorities, financial intelligence units, and law enforcement agencies where legally required to do so under our gaming licence or applicable law.
• Legal advisers: c77's legal counsel may access personal data in connection with a dispute, litigation, or regulatory investigation where such access is necessary and proportionate.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of c77's business, personal data may be transferred to the successor entity, subject to equivalent data protection obligations being imposed on the recipient.

c77 operates globally and some of our service providers — including cloud infrastructure, payment processing, and anti-fraud technology partners — are located in jurisdictions outside Pakistan. When your personal data is transferred to a recipient in another country, c77 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under our gaming licence.

Appropriate safeguards for international transfers may include:

• Standard contractual clauses approved by recognised data protection authorities
• Binding corporate rules where the recipient is part of a corporate group
• Transfers to countries that have been assessed as providing an adequate level of data protection
• Certification schemes and codes of conduct providing equivalent protection

Details of the specific safeguards applied to international transfers of your personal data are available on request from our data privacy team at support [at] c77.lol.

The c77 Platform uses cookies and similar tracking technologies to provide a functional, personalised, and secure user experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the operation of the c77 Platform — including maintaining your login session, preserving your PKR Wallet state, and enabling secure authentication. These cookies cannot be disabled without significantly impairing Platform functionality.
• Performance and analytics cookies: Used to collect anonymous aggregate statistics about how users interact with the c77 Platform — which pages are visited most, where users spend the most time, and what features are used. This data helps c77 improve the Platform. No personally identifiable information is included in these analytics.
• Functional cookies: Store user preferences such as language settings, last-used game category, and responsible gaming tool configurations, so that your c77 experience is consistent across sessions.
• Security cookies: Used to detect and prevent fraudulent login attempts, suspicious transaction patterns, and unauthorised account access. These cookies cannot be disabled.

Most browsers allow you to manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing the c77 Platform, but may affect personalisation features. Strictly necessary and security cookies cannot be disabled as they are fundamental to the secure operation of your c77 account.

c77 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory retention obligations, and to resolve potential disputes. The following retention periods apply as a general guide:

At the end of the applicable retention period, personal data is securely and irreversibly deleted or anonymised so that it can no longer be associated with an individual user. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

Registered c77 users hold the following rights in respect of their personal data. These rights are subject to certain conditions and exemptions as detailed below and may be limited where data processing is required for legal or regulatory compliance purposes.

How to exercise your rights: Submit a data rights request to c77's support team at support [at] c77.lol, clearly identifying yourself (as a registered c77 user) and the specific right you wish to exercise. c77 will acknowledge your request within 3 business days and respond substantively within 30 calendar days. Where a request is particularly complex or numerous requests have been received, this period may be extended by up to 60 further days, of which you will be informed.

c77 implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• TLS 1.3 encryption for all data in transit between user devices and c77 servers
• AES-256 encryption for all personal data stored on c77 infrastructure
• Multi-factor authentication required for all c77 internal staff accessing production systems containing personal data
• Role-based access controls ensuring that c77 employees can only access personal data that is necessary for their specific job function
• Continuous intrusion detection and security monitoring of all c77 infrastructure with 24/7 security operations oversight
• Regular penetration testing by independent third-party security specialists to identify and remediate vulnerabilities
• Vendor security assessments conducted for all third-party processors before they are granted access to c77 user data
• Data pseudonymisation applied to gaming analytics and performance reporting datasets to minimise exposure of directly identifying information

Notwithstanding these measures, no internet transmission or data storage system can be guaranteed to be 100% secure. c77 will notify affected users and relevant authorities in the event of a personal data breach in accordance with the breach notification obligations under our licensing framework.

The c77 Platform is strictly intended for adults aged 21 years and above. c77 does not knowingly collect personal data from individuals under the age of 21. Age verification is required during the account registration and KYC process, and c77 employs technical and procedural measures designed to prevent underage access to the Platform.

If c77 becomes aware that personal data has been collected from a person under the age of 21 — whether through a false declaration at registration or otherwise — c77 will immediately:

• Permanently close the account;
• Void any winnings accrued in the account;
• Return any net deposits to the originating payment source;
• Delete the personal data associated with the account to the extent permitted by regulatory obligations; and
• Report the incident to relevant authorities where legally required.

12.1 Opt-in Required. c77 sends marketing communications — including promotional SMS messages about bonuses, new game launches, PSL betting specials, and c77 Casino offers — only to users who have expressly opted in to receive such communications. Opt-in is offered as a clearly labelled, non-pre-ticked checkbox during registration.

12.2 Opt-out. You may withdraw consent to receive marketing communications from c77 at any time by:

• Replying "STOP" to any promotional SMS message from c77;
• Updating your communication preferences in your c77 account settings; or
• Contacting c77 support at support [at] c77.lol and requesting removal from marketing lists.

Opt-out requests will be processed within 5 business days. Note that opting out of marketing communications will not affect transactional messages — you will continue to receive account, payment, and security notifications that are necessary for the operation of your c77 account.

12.3 No Third-Party Marketing. c77 does not share your personal data with unaffiliated third parties for their own marketing purposes. All marketing communications you receive in connection with c77 are sent by c77 directly.

12.4 Responsible Gaming Communications. c77 may, where our responsible gaming monitoring systems identify indicators of problem gambling behaviour, send responsible gaming messages to your registered mobile number regardless of your marketing preferences. These messages are a duty-of-care obligation under our gaming licence and are not marketing communications.

The c77 Platform may contain references to third-party payment services (such as JazzCash, EasyPaisa, or USDT wallets) and banking providers. When you interact with these services to make deposits or withdrawals, you are subject to the privacy policies of those third-party providers in respect of the data they collect directly from you through their own platforms.

c77 has no control over, and accepts no responsibility for, the privacy practices of third-party providers. We recommend that you review the privacy policies of JazzCash, EasyPaisa, and any other payment provider you use in connection with your c77 transactions.

c77 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or c77's licensing obligations. The "Last Reviewed" date at the top of this Policy indicates when the most recent update was made.

Where changes to this Policy are material — meaning they significantly affect your rights or the way in which c77 processes your personal data — c77 will provide advance notice via SMS to your registered Pakistani mobile number at least 14 days before the changes take effect. Your continued use of the c77 Platform after the effective date of a revised Policy constitutes acceptance of the updated terms.

Where changes relate to new processing activities that require your consent (for example, a new category of marketing communication), c77 will seek fresh consent before commencing such processing.

All data privacy enquiries, data rights requests, and privacy complaints should be directed to c77's data privacy team. Our team operates 24 hours a day, 7 days a week and will acknowledge all privacy-related communications within 3 business days.

If you are not satisfied with c77's handling of your privacy complaint following our internal review process, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction in which c77 holds its gaming licence, or to the dispute resolution body designated under our gaming licence terms.

c77 will cooperate fully with any investigation by a regulatory or supervisory authority in connection with a privacy complaint submitted by one of our registered users. We are committed to resolving all legitimate privacy concerns promptly and transparently.