hi309 Privacy Policy

1 About This Policy

This Privacy Policy explains how hi309 — Pakistan's premier online casino and sports betting platform, operating at hi309.pro — collects, uses, stores, and protects personal information provided by or collected from users of the platform. It applies to all interactions with hi309, including account registration, deposit and withdrawal transactions, gameplay, customer support communications, and browsing activity on the hi309 website.

This policy should be read together with the hi309 Terms & Conditions, which govern the overall relationship between hi309 and its registered users. In the event of any conflict between these two documents regarding data processing matters, this Privacy Policy shall prevail.

2 Data Controller

For the purposes of this Privacy Policy, hi309 acts as the data controller in respect of all personal data collected from users of the platform. As data controller, hi309 determines the purposes for which personal data is processed and the means by which that processing is carried out.

hi309 operates under international gaming licence oversight. Where applicable data protection regulations require the appointment of a Data Protection Officer (DPO) or equivalent role, hi309 has fulfilled that requirement. All data protection queries and subject access requests should be directed to the support contact listed in Section 14 of this policy.

Where hi309 engages third-party service providers to process personal data on its behalf — for example, payment processors such as JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank — those providers act as data processors under written contractual agreements that obligate them to handle personal data only in accordance with hi309's documented instructions and applicable data protection law.

3 Data We Collect

hi309 collects the following categories of personal data from users:

hi309 does not intentionally collect special category data (such as health, religious, or political information) unless it is voluntarily provided in the context of a responsible gaming or support interaction. Such data is handled with enhanced safeguards.

4 How We Collect Data

hi309 collects personal data through the following channels:

• Direct submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, submitting a support request, or responding to a promotional offer.
• Automated technical collection: Data collected automatically when you access the hi309 website, including your IP address, device identifiers, browser type, and session behaviour. This is collected through server logs and first-party analytics tools.
• Cookies and similar technologies: hi309 uses cookies and local storage to maintain session state, remember user preferences, and analyse platform usage patterns. See Section 6 for full details.
• Third-party verification partners: During the KYC process, hi309 may receive identity and address verification data from authorised document verification providers to confirm the accuracy of information you have submitted.
• Payment processors: When you initiate a transaction via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, hi309 receives transaction confirmation data including amount, timestamp, and payment method reference, but does not receive or store your full banking credentials.

5 Purpose & Legal Basis for Processing

hi309 processes personal data only where a lawful basis exists. The primary purposes for which we process your data, and the corresponding legal basis for each, are as follows:

• Account management and platform access — processing is necessary for the performance of the contract between hi309 and the registered user (i.e., the Terms & Conditions).
• Identity and age verification (KYC) — processing is necessary to comply with hi309's legal and regulatory obligations, including age verification (21+) and anti-money-laundering requirements.
• Transaction processing (deposits and withdrawals) — processing is necessary for the performance of the contract and to comply with financial reporting obligations.
• Fraud detection and security monitoring — processing is based on hi309's legitimate interest in protecting the platform, its users, and its financial integrity from fraudulent activity.
• Responsible gaming monitoring — processing is based on hi309's legal obligation to identify and assist users displaying signs of problem gambling, as required under its licensing conditions.
• Marketing communications — processing is based on your explicit consent, given at the time of registration. You may withdraw this consent at any time via your account settings or by contacting support.
• Legal compliance and regulatory reporting — processing is necessary to fulfil hi309's obligations to relevant regulatory and law enforcement authorities.

6 Cookies & Tracking Technologies

hi309 uses cookies — small text files stored on your device — and similar technologies such as local storage and session tokens to operate the platform effectively. The following categories of cookies are in use:

• Strictly necessary cookies: Essential for platform functionality, including user authentication, session management, and security. These cannot be disabled without preventing access to the platform.
• Functional cookies: Used to remember your preferences such as language settings, display preferences, and responsible gaming limits you have set. Disabling these may affect your experience.
• Analytics cookies: Used to collect anonymised data about how users interact with the hi309 platform, including pages visited, time on site, and navigation paths. This data helps hi309 improve the platform experience. No personally identifiable data is transmitted in analytics events.
• Security cookies: Used to detect and prevent fraudulent account access, bot activity, and suspicious login behaviour.

hi309 does not use third-party advertising or retargeting cookies. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to or using the hi309 platform.

7 Data Sharing & Disclosure

hi309 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared only in the following limited circumstances:

• Payment processors: Financial transaction data is shared with JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank strictly to process your deposit and withdrawal requests. Each processor operates under its own privacy policy and applicable financial regulations.
• Identity verification providers: During KYC, relevant identity documents may be processed by authorised verification service providers under binding data processing agreements with hi309.
• Regulatory and law enforcement authorities: hi309 may disclose personal data to regulatory bodies, licensing authorities, or law enforcement agencies where required to do so by applicable law, a court order, or a regulatory direction. hi309 will notify you of such disclosures where legally permitted to do so.
• Anti-fraud and anti-money-laundering bodies: Where required by hi309's licensing conditions, account and transaction data may be reported to authorised anti-money-laundering monitoring bodies.
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by hi309 may have access to personal data on a strictly need-to-know basis under confidentiality obligations.

In all cases where personal data is shared with third parties, hi309 ensures appropriate contractual, technical, and organisational safeguards are in place.

8 International Data Transfers

hi309 operates under an international gaming licence and may store or process personal data on servers located outside Pakistan. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that applicable in your country of residence, hi309 implements appropriate safeguards to ensure that your data remains protected to a standard consistent with this Privacy Policy.

Such safeguards may include standard contractual clauses approved by relevant data protection authorities, binding corporate rules, or reliance on adequacy decisions where applicable. By using the hi309 platform, you acknowledge and accept that your personal data may be transferred to and processed in jurisdictions outside Pakistan for the purposes described in this policy.

9 Data Retention

hi309 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for a minimum of 5 years following permanent account closure, in compliance with anti-money-laundering regulations.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction, in compliance with financial record-keeping requirements.
• Support communications: Retained for 3 years from the date of the final communication, to support complaint resolution and dispute management.
• Technical and usage logs: Retained for up to 13 months for security monitoring and platform analytics purposes, then deleted or anonymised.
• Marketing consent records: Retained for the duration of the consent and for 3 years thereafter, as evidence of the consent having been obtained.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes as it no longer constitutes personal data.

10 Security Measures

hi309 maintains a comprehensive information security programme designed to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures in place include:

• 256-bit SSL/TLS encryption on all data transmitted between users and the hi309 platform.
• AES-256 encryption at rest for all sensitive data fields including passwords, financial data, and identity documents.
• Two-factor authentication (2FA) available to all registered users and strongly recommended for account security.
• Access controls: Internal access to personal data is restricted to hi309 personnel with a documented need to access that data, under role-based permission systems.
• Intrusion detection and monitoring: The hi309 platform is monitored continuously for anomalous access patterns, potential breaches, and unauthorised activity.
• Regular security audits: hi309 conducts regular penetration testing and security reviews of its platform and data infrastructure.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, hi309 will notify affected users and the relevant regulatory authority within the timeframes required by applicable law.

11 Your Rights

Subject to applicable data protection law and any overriding regulatory obligations, you have the following rights in respect of your personal data held by hi309:

• Right of access: You may request a copy of all personal data hi309 holds about you (Subject Access Request). Requests will be fulfilled within 30 days.
• Right to rectification: You may request correction of any personal data that is inaccurate or incomplete. Many details can be updated directly within your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to hi309's legal and regulatory retention obligations.
• Right to restrict processing: You may request that hi309 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
• Right to object: You may object to processing carried out on the basis of hi309's legitimate interests. You may also object at any time to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact hi309 support at [email protected]. Please include your full name, registered email address, and a clear description of the right you wish to exercise. hi309 may request proof of identity before processing a rights request.

12 Children & Minors

The hi309 platform is strictly intended for adults aged 21 years and above. hi309 does not knowingly collect, store, or process personal data belonging to any person under the age of 21. Age verification is a mandatory step in the hi309 account registration and KYC process.

If hi309 becomes aware or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all associated funds will be frozen pending investigation, and the personal data will be deleted as soon as it is safe and legally permissible to do so.

13 Changes to This Policy

hi309 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or the way in which the platform operates. Where changes are material, hi309 will notify registered users by email to the address associated with their account and will publish the updated policy on this page with a revised effective date.

Your continued use of the hi309 platform following the publication of an updated Privacy Policy constitutes your acceptance of the changes. If you do not accept any amendment to this policy, you should stop using the platform and request account closure before the amended policy's effective date.

This Privacy Policy was last updated on 1 January 2026. It supersedes all prior versions of the hi309 privacy notice.

14 Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the way hi309 handles your personal data, please contact our support team using the details below:

• Support email: [email protected]
• Response language: English
• Support availability: 24 hours a day, 7 days a week
• Response timeframe: Privacy-related queries are acknowledged within 24 hours and receive a substantive response within 5 business days. Subject Access Requests are fulfilled within 30 calendar days.

If you are unsatisfied with hi309's response to a privacy complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction or to the dispute resolution body associated with hi309's international gaming licence. Details of the applicable authority will be provided in hi309's final response to your complaint.