555ace Privacy Policy — How We Protect Your Personal Data

555ace ("we," "us," "our," the "Platform," the "Company") is committed to protecting the privacy and personal data of every player who uses the 555ace online casino and sports betting platform. This Privacy Policy ("Policy") has been prepared in accordance with internationally recognised data protection principles and applies to all personal information collected, processed, stored, or transmitted in connection with your use of 555ace's services.

This Policy covers data collected through all 555ace touchpoints: the website at 555ace.asia, any mobile-optimised browser interfaces, the customer support live chat system, email correspondence, KYC verification processes, and any other interactions between you and 555ace. It applies equally to registered players, prospective players who browse without registering, and former players whose data is retained in accordance with the retention schedule in Section 7.

We have structured this Policy to be as clear and readable as possible. Where we have used technical or legal terminology, we have explained it in plain English immediately following. Our aim is for every 555ace player — whether you are logging in from Karachi, Lahore, Islamabad, or Faisalabad — to be able to read this Policy and genuinely understand what we do with your information.

For the purposes of this Privacy Policy, 555ace acts as the data controller with respect to the personal information of its players. As data controller, 555ace determines the purposes and means by which personal data is processed in connection with the 555ace Platform and its associated services.

555ace operates under an international gaming licence. Our data protection practices are aligned with the requirements imposed by our licensing authority and with internationally recognised data protection frameworks, including the principles set out in the General Data Protection Regulation ("GDPR") as a reference standard, even where the GDPR does not directly apply as mandatory legislation to all players using the Platform.

All data protection enquiries, access requests, and complaints should be directed to the 555ace data protection team via the contact information provided in Section 15 of this Policy. 555ace will acknowledge all privacy-related correspondence within five (5) business days of receipt.

555ace collects personal data through several channels. The categories of personal data we collect are described below. We collect only what is necessary for the purposes described in Section 4 — we do not collect personal data speculatively or beyond what the Platform requires to function.

3.1 Registration & Account Data

When you create a 555ace account, we collect: your full legal name as it appears on government-issued identity documents; your date of birth (for mandatory age verification); your Pakistani mobile phone number; your chosen username; and your password (stored exclusively in hashed, irreversible form — we cannot read your password and no employee of 555ace can retrieve it).

3.2 Identity Verification (KYC) Data

To comply with our licensing obligations and AML/CFT regulations, 555ace conducts mandatory Know Your Customer ("KYC") verification. KYC data may include: Pakistani CNIC (Computerised National Identity Card) number and a scan or photograph of the physical card; passport data where provided as an alternative identity document; proof of residential address documents; and photographs or video selfies used for biometric identity matching where required by our KYC service provider.

3.3 Financial & Payment Data

When you make deposits or withdrawals, 555ace processes: JazzCash account numbers, EasyPaisa wallet identifiers, bank account details (IBAN, account number, bank name) for HBL, UBL, Allied Bank, Meezan Bank, or other accepted banking institutions; SadaPay wallet details; USDT TRC20 wallet addresses; deposit and withdrawal amounts and timestamps; and transaction reference numbers assigned by 555ace and payment processors.

3.4 Gaming Activity Data

The 555ace Platform automatically generates and retains records of all gaming activity, including: betting history across all sports and casino markets; bet amounts, odds accepted, outcomes, and net win/loss records; casino game sessions (game titles played, session duration, stake amounts, returns); slot game play records; and live dealer game participation records.

3.5 Technical & Device Data

When you access 555ace, our systems automatically collect: IP address and associated geographic region data; device type, operating system, and browser version; session duration and interaction logs; page navigation sequences; and connection quality metadata. This technical data is used for security monitoring, fraud prevention, and Platform performance optimisation.

3.6 Customer Support Data

When you interact with 555ace customer support — via live chat, email, or any other channel — records of those interactions are retained, including: the content of chat transcripts and emails; the nature and resolution of any complaints or enquiries; the agent who handled the interaction; and the time and date of each interaction.

555ace processes personal data only where a valid legal basis exists. The primary legal bases we rely upon are as follows:

• Contract Performance: Processing necessary to provide the services you have contracted for — including account management, game operation, and payment processing — is undertaken on the basis of contract performance. Without this processing, 555ace cannot provide the Platform services.
• Legal Obligation: Certain processing activities are required by applicable law, including KYC identity verification, AML/CFT transaction monitoring, responsible gaming record-keeping, regulatory reporting, and data retention obligations. This processing cannot be objected to as it is mandated by law.
• Legitimate Interests: 555ace processes certain data on the basis of legitimate interests, including fraud prevention, network and information security, Platform performance improvement, and responsible gaming monitoring beyond mandatory requirements. In each case, we have assessed that our interests are proportionate and not overridden by your privacy rights.
• Consent: Where we process data for purposes not covered by the above bases — particularly marketing communications and non-essential cookies — we rely on your explicit, freely given, and withdrawable consent. You may withdraw marketing consent at any time, as described in Section 13.

555ace shares personal data with carefully selected third parties only where necessary for the operation of the Platform, compliance with legal obligations, or where you have provided explicit consent. We do not sell personal data. The categories of third parties with whom data may be shared are:

• Payment Processors: JazzCash (Jazz/Mobilink), EasyPaisa (Telenor Microfinance Bank), and banking partners (HBL, UBL, Allied Bank, Meezan Bank, SadaPay) receive financial and identity data necessary to process your deposits and withdrawals in accordance with their own payment processing terms and applicable banking regulations.
• KYC & Identity Verification Providers: Licensed identity verification service providers receive the identity documents and biometric data you submit during the KYC process, for the sole purpose of verifying your identity and age.
• Game Software Providers: Casino game providers (including but not limited to Pragmatic Play, NetEnt, Red Tiger, and Big Time Gaming) receive the minimum technical data necessary to operate their games within the 555ace Platform environment. These providers are bound by data processing agreements with 555ace.
• Regulatory Authorities: Where required by our licensing obligations, gaming regulators, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction, 555ace will disclose personal data as legally required.
• Technology Infrastructure Providers: Cloud hosting and CDN service providers who process data as technical sub-processors under binding data processing agreements that prohibit independent use of your data.
• Anti-Fraud Services: Specialist fraud detection and AML screening service providers who assist 555ace in identifying suspicious transactions, duplicate accounts, and other prohibited activities.

555ace retains personal data for as long as necessary to fulfil the purposes described in this Policy, including satisfaction of legal, accounting, and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual. Anonymised and aggregated data (e.g., statistical analysis of Platform usage) may be retained indefinitely as it no longer constitutes personal data.

555ace implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and the 555ace Platform is encrypted using TLS 1.3 (256-bit SSL). The HTTPS padlock in your browser confirms active encryption on every page of the Platform.
• Encryption at Rest: Sensitive personal data stored in 555ace databases — including identity documents, KYC data, and financial records — is encrypted at rest using AES-256 encryption.
• Password Security: User passwords are never stored in readable form. All passwords are processed through a one-way cryptographic hashing algorithm with salt. 555ace employees cannot retrieve your password and will never ask you to provide it.
• Two-Factor Authentication: 555ace supports two-factor authentication (2FA) for player accounts via OTP delivered to your registered Pakistani mobile number.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. 555ace staff access controls are role-based, logged, and regularly audited.
• Network Security: The 555ace Platform infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, DDoS mitigation services, and continuous security monitoring.
• Penetration Testing: 555ace engages independent security specialists to conduct regular penetration testing and vulnerability assessments of the Platform infrastructure.
• Data Breach Response: 555ace maintains a documented incident response procedure. In the event of a data breach that creates a risk to your rights and freedoms, affected players will be notified without undue delay.

555ace uses cookies and similar tracking technologies to operate the Platform, maintain your session, and improve your experience. A cookie is a small text file placed on your device by a website. The categories of cookies used by 555ace are:

You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent the Platform from functioning correctly. Disabling analytics cookies will not affect Platform functionality. 555ace does not use cookies for cross-site behavioural advertising or third-party tracking beyond what is described in this Policy.

As an internationally operating gaming platform, 555ace may transfer your personal data to third-party processors located in countries outside Pakistan. Such transfers may occur in connection with cloud infrastructure services, KYC verification providers, game software providers, and fraud detection services.

Where personal data is transferred to countries that do not maintain data protection standards equivalent to those applicable to the 555ace Platform, 555ace ensures that appropriate safeguards are in place. These safeguards include contractual data protection clauses binding the receiving party to standards consistent with those described in this Policy, and — where applicable — reliance on adequacy determinations or equivalent mechanisms recognised under applicable law.

You may request information about the specific safeguards in place for any particular international data transfer by contacting the 555ace data protection team at the contact details provided in Section 15.

The 555ace Platform is strictly restricted to individuals who are 21 years of age or older. 555ace does not knowingly collect or process personal data from individuals under the age of 21, and takes all reasonable technical and procedural steps to prevent minors from accessing the Platform.

Age verification is conducted as part of the mandatory KYC process for all new account registrations. Where 555ace becomes aware that personal data has been collected from an individual who was under the age of 21 at the time of collection, that data will be deleted immediately, the associated account permanently closed, and any balances forfeited.

If you have reason to believe that an individual under the age of 21 has accessed or registered on the 555ace Platform, please notify us immediately via the contact details in Section 15 so that we may take appropriate action without delay.

Subject to applicable law and certain exceptions required by our legal obligations (such as AML record-keeping requirements), you hold the following rights with respect to your personal data held by 555ace. To exercise any of these rights, contact the 555ace data protection team as described in Section 15.

555ace sends marketing communications — including promotional bonus offers, new game announcements, PSL and cricket season notifications, and platform updates — only to players who have provided explicit consent to receive such communications. Consent is collected during account registration and may be modified at any time through your account notification settings.

Marketing communications may be delivered via SMS to your registered Pakistani mobile number, and via notification through the 555ace Platform interface. Each marketing communication we send includes a clear and functional opt-out mechanism.

To opt out of all marketing communications from 555ace at any time: update your notification preferences in your account settings panel, or contact 555ace customer support via live chat with an explicit opt-out request. Opt-outs are processed within 5 business days. Note that opting out of marketing communications does not affect transactional notifications (such as deposit confirmations, withdrawal updates, and KYC status notices), which are required for account operation.

555ace reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, legal obligations, or the services we offer. The "Last Updated" date at the top of this Policy reflects when the current version came into effect.

Where we make material changes to this Policy — changes that affect your rights, the categories of data we collect, the purposes for which we use your data, or the parties with whom we share it — we will notify you by email to your registered address and/or via a prominent notice on the Platform at least fourteen (14) calendar days before the updated Policy takes effect.

Your continued use of the 555ace Platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised Policy. If you do not accept the updated Policy, please cease using the Platform and close your account before the effective date of the changes.

For all privacy-related enquiries, data subject access requests, consent withdrawal requests, or complaints regarding 555ace's data processing practices, please contact the 555ace data protection team through the following channels:

• Live Chat: Available 24/7 directly through the 555ace Platform — select "Privacy / Data Request" as the subject of your enquiry.
• Support Email (plain text — not a clickable link): [email protected] — include "Privacy Request" in the subject line of your message.

555ace will acknowledge all privacy-related requests within five (5) business days of receipt and will aim to respond substantively within thirty (30) calendar days, in accordance with applicable data protection standards. Complex requests may take up to ninety (90) calendar days to fully resolve; we will notify you of any expected delay within the initial thirty-day period.

If you are not satisfied with how 555ace has handled a privacy complaint or data subject request, you have the right to escalate your complaint to the relevant data protection supervisory authority or regulatory body applicable in your jurisdiction. Details of applicable supervisory authorities are available from the 555ace data protection team upon request.