TabOnline Privacy Policy – How We Protect Your Data

1Who We Are — The Data Controller

TabOnline (operating at tabonline.bet) is the data controller for all personal data collected from members and visitors of the platform. As data controller, TabOnline determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly and transparently.

If you have any questions about how TabOnline processes your data, or if you wish to exercise any of your data rights, you can contact us at any time:

• Email: support@tabonline.bet
• Live Chat: Available 24/7 directly within the TabOnline platform

All data-related enquiries are handled by TabOnline's compliance and privacy team. Requests are acknowledged within two business days and resolved within 30 calendar days of receipt.

2What Data TabOnline Collects

TabOnline collects data in several categories depending on how you interact with the platform. The table below sets out what we collect, why we collect it and how it is obtained.

TabOnline does not collect or store full payment card numbers, CVV codes or full bank account details. All payment card processing is handled by certified PCI-DSS compliant payment processors who do not share full card data with TabOnline.

3How TabOnline Uses Your Data

TabOnline uses your personal data for the following clearly defined purposes. We do not use your data for any purpose not listed here without first obtaining your consent.

• Account management: Creating and maintaining your TabOnline account, authenticating your identity when you log in, processing OTP verification and keeping your account information accurate and up to date.
• Payment processing: Processing PKR deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card payment processors. Verifying that payment methods belong to you as part of anti-fraud checks.
• Bet and game settlement: Recording your betting and gaming activity, settling bets according to the applicable market rules, calculating and applying bonuses and VIP rewards, and maintaining your transaction history.
• KYC and AML compliance: Verifying your identity and age as required by our licensing obligations. Monitoring transaction patterns for indicators of money laundering, fraud or other financial crime as required by applicable anti-money laundering regulations.
• Platform security: Detecting and preventing fraud, unauthorised account access, multi-accounting, bot usage and other prohibited activities. Protecting the integrity of betting and gaming outcomes.
• Customer support: Responding to your support queries, resolving complaints and maintaining records of communications for quality assurance and dispute resolution purposes.
• Legal compliance: Meeting our obligations under applicable licensing, financial regulation, anti-money laundering and data protection laws. Responding to lawful requests from regulatory authorities.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how members use the platform, identify technical issues and develop new features. This analysis does not involve individually identifiable data.
• Marketing communications (with consent only): Sending you information about promotions, new games, bonus offers and platform updates — but only if you have opted in. See Section 10 for details on how to manage your marketing preferences.

4Legal Basis for Processing

Every instance of data processing at TabOnline has a defined legal basis. The primary bases we rely on are:

• Contract performance: Processing necessary to deliver the services you have signed up for — running your account, processing bets, settling winnings and paying out withdrawals. Without this processing, TabOnline could not operate your account.
• Legal obligation: Processing required to comply with applicable laws and regulations, including identity verification (KYC), anti-money laundering monitoring and responses to lawful regulatory requests.
• Legitimate interests: Processing necessary for TabOnline's legitimate interests in fraud prevention, platform security, dispute resolution and improving the service — provided these interests are not overridden by your own rights and interests.
• Consent: Processing for marketing communications and non-essential cookies, where we have obtained your explicit opt-in consent. Consent can be withdrawn at any time without affecting your access to the platform.

5Sharing Your Data with Third Parties

TabOnline does not sell your personal data. We share data only with the limited categories of third parties listed below, and only to the extent necessary for the stated purpose.

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay and card payment processors receive the minimum data necessary to process your transactions — typically a wallet reference or masked card identifier, transaction amount and timestamp. Full financial credentials are never transmitted to TabOnline from these processors.
• KYC and identity verification providers: Where automated identity verification is used, your name, date of birth and ID document images may be shared with a certified identity verification provider. These providers operate under strict data processing agreements with TabOnline.
• Gaming platform providers: Live casino game providers receive a session token and pseudonymous player identifier to deliver the game stream. They do not receive your name, mobile number or payment details.
• Regulatory and law enforcement authorities: TabOnline will disclose personal data to competent authorities where required to do so by law, court order or regulatory instruction. We will notify you of such disclosures where we are legally permitted to do so.
• Professional advisers: Legal, audit and compliance professionals who are bound by professional confidentiality obligations may access data on a need-to-know basis in connection with their engagement with TabOnline.

All third parties who process data on TabOnline's behalf do so under written data processing agreements that require them to maintain appropriate security standards and prohibit them from using your data for any purpose other than the specific function they perform for us.

6Cookies and Tracking Technologies

TabOnline uses cookies and similar technologies on the platform. Cookies are small text files stored on your device that allow the platform to remember certain information about your visit. We categorise our use of cookies as follows:

• Essential cookies: Required for the platform to function. These include session authentication tokens, CSRF protection tokens and cookies that remember your logged-in state. These cannot be disabled without breaking the platform.
• Functional cookies: Remember your preferences such as your chosen language, betting stake defaults and odds format. These are not strictly essential but significantly improve your experience. You can disable them but some preferences will not persist between sessions.
• Analytics cookies: Help us understand how members navigate the platform — which pages are visited most, where members encounter errors and how long sessions last. This data is aggregated and anonymised before analysis. Analytics cookies require your consent.
• Marketing cookies: Used only if you have opted in to marketing communications. These allow us to understand which promotions led to registrations or deposits so we can make future communications more relevant. These require explicit consent and can be withdrawn at any time.

You can manage your cookie preferences at any time through your browser settings or the cookie preference centre in your TabOnline account. Blocking essential cookies will prevent the platform from operating correctly.

7Data Retention Periods

TabOnline retains personal data only for as long as is necessary for the purposes it was collected for, or as required by applicable law. The retention periods below represent the maximum time we hold each data category before deletion or anonymisation.

After the applicable retention period, data is either permanently deleted from TabOnline's systems or anonymised so that it can no longer be associated with any individual. Anonymised data may be retained for statistical analysis indefinitely.

The longer retention periods for financial records (7 years) are mandated by anti-money laundering regulations and cannot be shortened upon request. For all other data categories, you may request earlier deletion — see Section 9 for details on your data rights.

8Security Measures

TabOnline takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction or alteration.

• Encryption at rest: All personal data stored in TabOnline's databases is encrypted using AES-256, the same encryption standard used by financial institutions worldwide.
• Encryption in transit: All data transmitted between your device and TabOnline's servers uses TLS 1.3. Connections using older, less secure protocols are rejected.
• Password security: Member passwords are hashed using bcrypt before storage. TabOnline never stores passwords in plain text and cannot retrieve your password — only reset it through an authenticated process.
• Access controls: Internal access to member data is restricted on a strict need-to-know basis. TabOnline staff can only access the data required for their specific job function. All internal access is logged and audited.
• Two-factor authentication: OTP verification is required for account login and for sensitive operations including password changes and large withdrawal requests.
• Fraud monitoring: Automated systems monitor platform activity continuously for indicators of account compromise, fraudulent transactions and suspicious betting patterns. Anomalies trigger alerts for review by the security team.
• Penetration testing: TabOnline engages independent security specialists to conduct regular penetration tests of the platform infrastructure. Identified vulnerabilities are remediated according to a defined severity-based schedule.

Despite these measures, no online system can guarantee 100% security. If you suspect your account has been compromised, contact TabOnline support immediately so we can take protective action.

9Your Data Rights

As a TabOnline member, you have meaningful rights over your personal data. These rights are set out below. To exercise any of them, contact TabOnline support with your request — we will respond within 30 calendar days.

Requests to exercise your rights are free of charge. TabOnline will not discriminate against members who exercise their data rights — doing so will not affect your ability to use the platform or receive the same quality of service.

10Marketing Communications

TabOnline may send you marketing communications about promotions, new games, bonus offers and platform news — but only if you have given your explicit consent to receive them. This consent is requested during registration and can be updated at any time in your account settings under "Communication Preferences".

Channels through which TabOnline may send marketing communications (with consent):

• SMS to your registered Pakistani mobile number
• Push notifications within the platform interface
• Email, if an email address has been provided and opted in

TabOnline does not use third-party advertising platforms to target members or former members with advertising outside of the TabOnline platform. We do not share your contact details with marketing agencies or affiliates for the purpose of third-party outreach.

To withdraw consent for marketing communications at any time, either update your preferences in account settings or contact support. Withdrawal of marketing consent takes effect within 48 hours. You will continue to receive essential non-marketing account communications (e.g., OTP codes, withdrawal confirmations, security alerts) regardless of your marketing preferences — these are not marketing and are necessary for your account to function.

11Children's Privacy

TabOnline is strictly an adults-only platform. No person under the age of 18 is permitted to create an account or use any feature of the service. TabOnline does not knowingly collect personal data from anyone under 18.

Where TabOnline identifies that an account has been created by a minor, or receives a report that a minor may be using the platform, the account will be immediately suspended pending investigation. If confirmed, the account will be permanently closed, all balances forfeited and any personal data held deleted as promptly as legally permissible.

If you are a parent or guardian and believe a minor in your care may have created a TabOnline account, please contact support immediately at support@tabonline.bet. We will act on credible reports promptly and confidentially.

12Third-Party Links

The TabOnline platform does not contain links to external websites. Internal navigation uses only the paths defined within the platform's own structure. TabOnline's Privacy Policy applies only to the tabonline.bet domain and does not extend to any third-party services, platforms or payment providers whose privacy practices are governed by their own separate policies.

13Changes to This Privacy Policy

TabOnline reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, applicable law or the services we offer. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page.
• Post a notification within the TabOnline platform interface for active members.
• For significant changes affecting how we use your data, send a direct notification to your registered mobile number by SMS.

Continued use of TabOnline after a privacy policy update constitutes acceptance of the revised policy. If you do not agree with changes to the policy, you may close your account at any time by contacting support. Your data will be retained for the applicable legal periods following account closure even if you have requested deletion, but will not be used for any new purposes after the closure date.

We recommend reviewing this policy periodically, particularly if you are a regular TabOnline member. Archived versions of previous policies are available on request.

14Contact TabOnline About Your Privacy

For any questions about this Privacy Policy, for data rights requests or to report a potential data security issue, you can reach TabOnline through the following channels:

• Email: support@tabonline.bet — mark your subject line "Privacy" for fastest routing to the compliance team.
• Live Chat: Available 24/7 directly within the TabOnline platform — suitable for general questions. For formal data rights requests, email is preferred as it provides a written record.

TabOnline aims to acknowledge all privacy-related contacts within two business days. Formal data rights requests (access, deletion, correction etc.) are resolved within 30 calendar days of identity verification. If your request is complex or involves a large volume of data, we will inform you of any extension to this timeline before the 30-day period expires.

If you are not satisfied with how TabOnline has handled your privacy concern after raising it with us, you have the right to escalate your complaint to the relevant supervisory or regulatory authority with jurisdiction over our operations. TabOnline will cooperate fully with any such investigation.