a321 Privacy Policy – How We Handle Your Personal Data

This Privacy Policy belongs to a321, the online sports betting and live casino platform accessible at a321.run. When we say "a321", "we", "us" or "our" in this document, we are referring to the operators of the a321 platform who act as the data controller responsible for your personal information.

a321 is a platform built specifically for Pakistani players. We understand that handing over personal information to any online platform requires trust, and we take that responsibility seriously. This policy is designed to give you a clear, honest picture of exactly what happens with your data from the moment you land on a321 to years after you stop using the platform.

This Privacy Policy forms part of the broader agreement between you and a321, alongside the Terms and Conditions and the Responsible Gaming Policy. By registering an account or using any feature of a321, you acknowledge that you have read and understood this policy.

a321 collects different types of information depending on how you interact with the platform. Below is a full breakdown of what we may hold about you:

We only collect what we genuinely need to operate your account, process transactions, comply with legal obligations and keep the platform secure and fair. We do not collect data speculatively or hold it beyond the periods described in Section 9.

a321 collects your personal information through three main channels:

• Directly from you: When you register an account, update your profile, make a deposit or withdrawal, contact support, participate in a promotion or submit any form on a321, you provide us with information directly. This is the primary source of your personal data on our platform.
• Automatically through your use of the platform: When you visit a321, our servers automatically record certain technical information — your IP address, the pages you visit, the time you spend on each section, the device and browser you use and any errors you encounter. This happens on every visit whether you are logged in or not.
• From payment providers: When you deposit via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or card, the payment provider confirms transaction details to a321 so we can credit your account. The payment provider does not share your full payment credentials with us — only the information required to reconcile the transaction.

a321 does not purchase personal data from any data broker or third-party marketing list. We do not obtain your information from social media platforms or any source other than those described above.

Every use of your personal data at a321 serves a specific, legitimate purpose. Here is how we use the different categories of information we hold:

• To operate your account: Your identity and contact data allow us to create and maintain your a321 account, verify your identity, process logins and communicate important account information to you.
• To process transactions: Financial data is essential for processing deposits and withdrawals in PKR. We match your transaction records to your account to ensure payments are credited and withdrawn correctly.
• To enforce our Terms: Betting and gaming data allows us to enforce fair play rules, detect bonus abuse, identify multiple accounts and investigate any disputes that arise.
• To comply with legal obligations: Identity data and transaction records are required to comply with anti-money laundering (AML) regulations and to respond to requests from relevant authorities where required by law.
• To provide responsible gaming support: a321 monitors betting patterns to identify players who may be experiencing gambling-related harm. Where concerning patterns are observed, our responsible gaming team may reach out to offer support tools. This is done in your interest, not for commercial purposes.
• To improve the platform: Technical and usage data helps us understand how the platform is used, identify performance bottlenecks, fix bugs and prioritise new features. This analysis is conducted on aggregated, anonymised data wherever possible.
• To send you relevant communications: Where you have opted in, we may contact you with promotions, bonus offers and platform news relevant to your use of a321. You can withdraw marketing consent at any time via your account settings or by emailing support@a321.run.

a321 processes your personal data under the following legal bases, depending on the specific purpose:

• Performance of a contract: Processing your registration data, managing your account and handling deposits and withdrawals are all necessary to fulfil the service agreement between you and a321.
• Legal obligation: Identity verification, transaction record retention and AML compliance are required by applicable regulations. a321 must process certain data to remain compliant, regardless of individual consent.
• Legitimate interests: Platform security, fraud prevention, fair play monitoring and service improvement are pursued on the basis of a321's legitimate interests as an operator, provided these interests do not override your fundamental privacy rights.
• Consent: Marketing communications are sent only where you have given explicit consent at registration or subsequently via account settings. This consent can be withdrawn at any time.

a321 does not sell, rent or trade your personal data. We share it only with the specific third parties listed below, and only to the extent necessary for the stated purpose:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT operators and card networks (Visa/Mastercard) receive only the transaction data necessary to process your deposit or withdrawal. They do not receive your full betting history or account profile.
• Identity verification providers: Where KYC verification is required, your identity documents may be shared with a certified identity verification service provider. These providers are bound by strict data handling agreements and cannot use your data for any purpose other than verification.
• IT and platform service providers: a321 uses technical infrastructure providers (hosting, security, analytics) who process limited platform data under data processing agreements. These providers act on our instructions and cannot use your data independently.
• Regulatory and law enforcement bodies: Where required by applicable law, court order or regulatory request, a321 will disclose information to the relevant authority. We will only disclose what is required and will inform you where legally permissible to do so.

All financial transactions at a321 take place in Pakistani Rupees. Given the sensitivity of financial information, we apply extra care to how payment-related data is handled:

• a321 does not store your full mobile wallet credentials (Easypaisa/JazzCash PIN, bank account password) at any point. We only store the reference information required to reconcile transactions — for example, the last four digits of a JazzCash number or the transaction reference ID.
• Visa and Mastercard payment details are processed directly through a PCI-DSS compliant payment gateway. a321's servers never receive or store your full card number, CVV or card expiry date.
• Your PKR deposit and withdrawal history is retained as part of your account record for the retention periods described in Section 9. This history is accessible to you through your account dashboard at any time.
• Transaction data submitted as part of an AML investigation may be retained beyond standard periods where required by law.

If you believe there has been an unauthorised transaction on your a321 account, contact support immediately. We can freeze account activity while the matter is investigated and will work with you and the relevant payment provider to resolve it as quickly as possible.

a321 takes the security of your personal data seriously. The following technical and organisational measures are in place to protect your information:

• Encryption in transit: All communication between your browser or app and a321 is encrypted using TLS (Transport Layer Security). This prevents interception of your data as it travels across the internet.
• Encryption at rest: Sensitive personal data fields — including identity information and financial references — are encrypted in our database. Even in the unlikely event of a database breach, encrypted fields are not readable without the decryption key.
• Access controls: Access to personal data within a321 is restricted on a strict need-to-know basis. Support staff can view the information necessary to resolve your query. They cannot access payment credentials or full identity documents unless specifically required for a verification task.
• Account security: Your a321 account is protected by your password. We recommend using a strong, unique password not used on any other platform. a321 will never ask for your password by email, chat or phone.
• Incident response: In the event of a data breach that poses a risk to your personal information, a321 will notify affected users and relevant authorities in accordance with applicable obligations. We maintain an internal incident response protocol for this purpose.

While a321 applies robust security measures, no system is 100% immune to risk. You also play a role in keeping your account secure — use a strong password, don't share your login credentials and contact us immediately if you notice any suspicious activity.

a321 retains personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. The general retention periods we apply are:

• Active account data: Retained for the duration of your account with a321 plus a minimum of 5 years after account closure, in line with standard financial record-keeping obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction. This is a common regulatory requirement for financial record-keeping.
• Identity verification documents: Retained for the duration of your account plus 5 years from closure. Where AML concerns have been raised, these may be held for up to 7 years.
• Support communications: Retained for 3 years from the date of the last communication, or longer where the communication is related to an ongoing dispute or compliance matter.
• Marketing preference records: Opt-in and opt-out records are retained indefinitely as evidence of your consent status. The underlying marketing communications data is deleted after 2 years of inactivity.
• Technical and usage logs: Retained for 12 months on a rolling basis for security and performance analysis purposes.

a321 uses cookies — small text files stored by your browser — to enable essential platform functions and improve your experience. We do not use cookies to track you across the web or build advertising profiles.

Most browsers allow you to manage or block cookies through their settings menu. Blocking essential cookies will prevent you from logging in to a321 or using core platform features. For instructions on managing cookies in your specific browser, refer to the browser's help documentation.

a321 does not use third-party advertising cookies or allow any advertising network to place cookies via the a321 platform. We do not participate in cross-site behavioural advertising.

As an a321 user, you have the following rights with respect to your personal data. To exercise any of these rights, contact us at support@a321.run with your registered email address or username:

We aim to respond to all data rights requests within 30 calendar days. In complex cases we may extend this by a further 30 days and will inform you if this is the case. All requests must be made from your registered email address so we can verify your identity before disclosing or amending data.

a321 does not knowingly collect personal information from anyone under the age of 18. Our platform is strictly for adults and all registrations are subject to age verification.

If we discover or are notified that an account has been registered by a person under 18, we will immediately close the account, return any deposited funds to the original payment method and delete all personal data associated with that account, retaining only the minimum information required for our records of the incident.

a321 may update this Privacy Policy from time to time as the platform evolves, as regulations change or to reflect new processing activities. When we make changes, we will update the "Last Updated" date at the top of this page.

Where changes are material — meaning they significantly affect your privacy rights or how your data is used — we will notify you via the email address registered on your account at least 7 days before the changes take effect. For minor or administrative updates, no direct notification may be sent.

Your continued use of a321 following any update to this policy constitutes your acceptance of the revised version. If you disagree with any changes, you are entitled to close your account and request deletion of your data under the terms of Section 11.

If you have any questions, concerns or complaints about this Privacy Policy or the way a321 handles your personal data, please get in touch. We are committed to resolving privacy queries promptly and transparently.

• Email: support@a321.run — mark your email "Privacy Query" in the subject line for fastest routing
• Live Chat: Available within your a321 account dashboard after login — available 24 hours a day, 7 days a week
• Response time: Privacy queries are typically acknowledged within 24 hours and resolved within 30 days

For data rights requests specifically — access, erasure, rectification or portability — please email from your registered a321 email address and state clearly which right you are exercising. This allows us to verify your identity and process the request efficiently.

If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.