bellybet Privacy Policy

1 Who We Are

This Privacy Policy is issued by bellybet, the operator of the online gaming and sports betting platform accessible at bellybet.net ("bellybet", "we", "us", "our"). bellybet operates as an internationally licensed online gaming platform, providing cricket betting, live casino, slot games, and related entertainment services primarily to players in Pakistan.

For the purposes of applicable data protection law, bellybet acts as the data controller in respect of personal data collected from registered players and website visitors. This means bellybet determines the purposes and means by which your personal data is processed.

Any questions about this Privacy Policy, or requests relating to your personal data, should be directed to the bellybet data support team. Contact details are provided in Section 14 of this Policy.

2 Personal Data We Collect

bellybet collects the following categories of personal data from players and website visitors:

Identity & Contact Data

• Full legal name as it appears on your Pakistani CNIC.
• Pakistani CNIC number (used for age verification and KYC compliance).
• Date of birth.
• Residential address (city, province, postal code — Pakistan).
• Email address registered to the account.
• Mobile phone number (used for account verification and two-factor authentication).

Account & Activity Data

• bellybet username and encrypted password hash.
• Account registration date, time, and IP address at registration.
• Login history: timestamps, IP addresses, device types.
• Betting history: all wagers placed, markets selected, stakes, and outcomes.
• Casino and slot game session data: game titles played, session durations, wager amounts, and win/loss records.
• Bonus and promotion participation history.
• Self-exclusion and responsible gaming tool usage records.

Financial Data

• Deposit and withdrawal transaction records (amounts, timestamps, payment method type).
• Masked payment method identifiers (e.g., last four digits of a card, masked JazzCash or EasyPaisa number).
• PKR account balance history.
• Chargeback and dispute records, where applicable.

Technical & Device Data

• IP address at each login and at the time of each bet placement.
• Device type, operating system, and browser version.
• Device fingerprint data (used for duplicate account detection and fraud prevention).
• Geolocation data at the approximate city level (derived from IP; precise GPS location is not collected).
• Cookie identifiers and session tokens (see Section 8).

Communications Data

• Records of live chat conversations with the bellybet support team.
• Email correspondence with bellybet (including complaint and KYC verification emails).
• Records of any formal complaint or dispute submitted through the platform.

3 How We Collect Your Data

bellybet collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in a promotion.
• Automatically — through cookies, server logs, and device fingerprinting technology as you browse and use the bellybet platform.
• From payment service providers — transaction confirmation data from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard processors, used to reconcile deposits and withdrawals against your bellybet wallet.
• From identity verification services — where bellybet uses a third-party KYC or CNIC verification service to confirm the authenticity of documents submitted during account verification.
• From fraud prevention services — device reputation data and IP risk scoring from third-party fraud detection providers used to protect the integrity of the platform.

4 Why We Use Your Data

The table below sets out each purpose for which bellybet processes personal data, along with the specific data categories used for that purpose:

5 Legal Basis for Processing

bellybet processes your personal data on the following legal bases:

• Performance of a contract — processing that is necessary to provide the gaming services you have registered for, including account management, bet processing, and payment handling.
• Legal obligation — processing required to comply with applicable anti-money laundering regulations, age verification obligations under our gaming licence, and any lawful request from a regulatory body or law enforcement authority.
• Legitimate interests — fraud detection and prevention, duplicate account identification, platform security, responsible gaming monitoring, and analytics used to improve the platform. bellybet has assessed that these legitimate interests are not overridden by your fundamental rights and freedoms.
• Consent — sending you promotional emails, SMS, or push notifications about bonuses, new games, or special offers. You may withdraw this consent at any time by updating your communication preferences in your account settings or by contacting the bellybet support team.

6 Sharing Your Data

bellybet does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients only where necessary and lawful:

• Payment service providers — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard processors, solely to facilitate PKR deposits and withdrawals.
• Identity and KYC verification providers — third-party services that verify the authenticity of CNIC documents submitted during account registration and KYC checks.
• Fraud prevention and AML services — providers that supply IP risk scoring, device reputation data, and transaction monitoring services used to protect the platform and comply with our anti-money laundering obligations.
• Game software providers — the certified third-party developers whose slot and casino game titles are hosted on the bellybet platform. These providers may receive anonymised session data necessary to deliver game functionality.
• IT and hosting infrastructure providers — cloud hosting and content delivery network (CDN) providers used to operate the bellybet platform. These providers operate under strict data processing agreements.
• Regulatory authorities and law enforcement — where bellybet is legally required to disclose data in response to a lawful order, court direction, or regulatory audit.
• Professional advisers — lawyers, auditors, and insurers acting in their professional capacity in connection with bellybet's business operations, under obligations of confidentiality.

All third-party service providers with access to personal data are required to implement appropriate technical and organisational security measures and to process data only on bellybet's documented instructions.

7 Payment Data & PCI DSS Compliance

bellybet takes a strict approach to payment credential data. The following rules govern how payment information is handled on the platform:

• Full card numbers, CVV codes, JazzCash wallet PINs, EasyPaisa account passwords, and online banking login credentials are never stored by bellybet at any point.
• All payment transactions are processed through certified payment gateways that operate under Payment Card Industry Data Security Standard (PCI DSS) compliance frameworks.
• bellybet retains only masked payment identifiers (for example, the last four digits of a debit card, or a masked mobile wallet number) alongside transaction reference numbers and PKR amounts. This masked data is retained for the period required by applicable AML regulations.
• Withdrawal requests are verified against the depositing payment method to ensure funds are returned to the correct source. This verification uses masked identifiers only and does not require bellybet to access or store full payment credentials.

8 Cookies & Tracking Technologies

bellybet uses cookies and similar tracking technologies to operate the platform, maintain your login session, prevent fraud, and analyse usage patterns. The following categories of cookies are in use:

You can manage your cookie preferences at any time through the cookie settings panel available in your bellybet account. Declining analytics cookies will not affect your ability to use any gaming feature on the platform. However, disabling strictly necessary cookies by adjusting your browser settings may prevent certain platform features — including login and payment processing — from functioning correctly.

9 Data Retention

bellybet retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Account data and KYC documents — retained for the duration of your active account, plus a minimum of 5 years following permanent account closure, in accordance with anti-money laundering record-keeping requirements.
• Financial transaction records — retained for a minimum of 5 years from the date of the transaction, as required under applicable AML regulations.
• Betting and gaming activity logs — retained for a minimum of 3 years from the date of each session, for dispute resolution and regulatory audit purposes.
• Customer support and complaint records — retained for 3 years from the date the matter was closed.
• Marketing consent records and promotional communications — retained until you withdraw consent, plus 12 months for audit trail purposes.
• Analytics data — anonymised within 13 months of collection. Anonymised data does not constitute personal data and is not subject to deletion obligations.
• Self-exclusion records — retained for the duration of the exclusion period plus 5 years, to prevent re-registration in contravention of responsible gaming obligations.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard data destruction methods.

10 How We Protect Your Data

bellybet implements the following technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure:

• 256-bit SSL/TLS encryption on all data transmitted between your device and bellybet's servers.
• AES-256 encryption at rest for all stored personal data and financial records.
• Password hashing — account passwords are stored only as salted cryptographic hashes. bellybet staff cannot view your password in any form.
• Two-factor authentication (2FA) — available to all players and mandated for all staff with access to player data systems.
• Role-based access controls — bellybet staff access to personal data is restricted to the minimum necessary for each employee's specific job function.
• Regular penetration testing — bellybet's platform infrastructure undergoes scheduled independent security assessments.
• Intrusion detection and anomaly monitoring — automated systems monitor for unusual access patterns and trigger alerts for immediate investigation.
• Staff training — all bellybet employees and contractors with access to personal data receive mandatory data protection training on appointment and on an annual basis.

While bellybet takes all reasonable precautions, no internet-based system is completely secure. You play an important role in keeping your account safe — please use a strong, unique password for your bellybet account and enable two-factor authentication.

11 Your Data Rights

As a bellybet player, you have the following rights in relation to your personal data. You may exercise any of these rights by contacting the bellybet data support team (see Section 14):

12 Minors & Age Verification

The bellybet platform is strictly intended for adults aged 21 years and above. bellybet does not knowingly collect or process personal data from individuals under the age of 21.

All new accounts registered from Pakistan are subject to mandatory CNIC-based age verification before full platform access is granted. Where bellybet discovers or has reasonable grounds to suspect that a registered account belongs to an individual under the age of 21, the following actions will be taken immediately:

• The account will be suspended pending investigation.
• All funds held in the account will be frozen.
• If the underage status is confirmed, the account will be permanently closed and all associated data will be handled in accordance with applicable child protection obligations.
• The matter may be reported to relevant authorities where required by law.

Parents and guardians who believe a minor may have registered a bellybet account using false information are encouraged to contact the bellybet support team immediately. Reports of this nature are treated as high priority and are investigated within 24 hours of receipt.

13 Changes to This Privacy Policy

bellybet may update this Privacy Policy from time to time to reflect changes in our data practices, updates to applicable law, or changes to the services we provide. The date at the top of this document indicates when the Policy was last revised.

Where changes are material — for example, changes to the categories of data we collect, new purposes for processing, or changes to your rights — bellybet will notify registered players by email to the address on file at least 14 days before the changes take effect.

Non-material clarifications or corrections may be made without prior notice. The current version of this Policy is always accessible at bellybet.net/privacy-policy. We encourage you to review this page periodically.

Your continued use of the bellybet platform after the effective date of any revision constitutes your acknowledgement of the updated Policy. If you do not accept the revised terms, you should stop using the platform and contact the bellybet support team to close your account.

14 Contact & Data Requests

Data Support Team

For all privacy-related enquiries, requests to exercise your data rights, or to report a data protection concern, please contact the bellybet data support team through the live chat feature on the platform (available 24/7 in Urdu and English) or by email. The support email address is displayed in the footer of every page on the bellybet website.

When submitting a data rights request, please include:

• Your registered bellybet username.
• The email address associated with your account.
• A clear description of the right you wish to exercise (access, rectification, erasure, etc.).
• Any relevant transaction IDs or dates to help us locate the specific records in question.

bellybet may ask you to verify your identity before processing a data request, to ensure that personal data is not disclosed to or deleted at the request of an unauthorised third party. Verification is typically conducted by confirming details against the information held on your registered account.

Complaints

If you are not satisfied with how bellybet has handled your personal data or responded to a data rights request, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction, or to the dispute resolution body specified under bellybet's international gaming licence.