MustPlay Privacy Policy — How We Protect Your Data

01 About This Privacy Policy

This Privacy Policy applies to all players who register or use MustPlay — whether you access the platform through the website at mustplay.vu or through the MustPlay mobile app on Android or iOS. It covers all personal data collected in connection with your account, your PKR transactions, your gameplay activity and any communication you have with our support team.

MustPlay takes data privacy seriously. We collect only the information we genuinely need to operate your account, process PKR deposits and withdrawals, verify your identity and provide you with a smooth gaming experience. We do not collect data for the sake of it, and we do not share it with parties who have no legitimate role in delivering our services to you.

By registering an account on MustPlay, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described here. If you have any concerns about how your data is handled, please contact MustPlay support before proceeding with registration.

02 What Personal Data We Collect

MustPlay collects personal information through several channels — during registration, during account verification, through your use of the platform and through your communications with our support team. The categories of data we collect are as follows:

Account Registration Data

• Full legal name, date of birth and gender.
• Email address and mobile phone number.
• Username and encrypted account password.
• Residential address and city within Pakistan.

Identity Verification (KYC) Data

• Government-issued photo identification — such as your CNIC (Computerised National Identity Card) or passport.
• Proof of address documentation where required.
• Selfie or video verification where required during enhanced verification checks.

Financial and Payment Data

• PKR deposit and withdrawal history, including amounts, dates and payment methods used.
• JazzCash or Easypaisa mobile wallet identifiers associated with your transactions.
• Bank account or card details used for deposits or withdrawals (stored in tokenised form where applicable — we do not store raw card numbers).
• Raast payment references where applicable.

Gameplay and Activity Data

• Games played, bets placed, results, session durations and win/loss records.
• Sports Betting activity including Cricket, PSL, T20 and other markets.
• Bonus and promotion usage history.
• VIP tier and programme participation records.

Technical and Device Data

• IP address, browser type and version, operating system and device model.
• Device identifiers and mobile advertising IDs where applicable.
• Pages visited on MustPlay, clickstream data and session timestamps.
• Geolocation data at a city or region level, derived from your IP address.

Communications Data

• Live chat transcripts and support ticket contents when you contact MustPlay support.
• Email correspondence sent to or received from MustPlay's support team.
• Responses to surveys or promotional communications where you choose to participate.

03 How We Use Your Personal Data

MustPlay uses the personal data collected from players exclusively for legitimate purposes related to operating the platform and serving our users. The table below summarises how your data is used and the reason behind each use:

MustPlay does not use your personal data for automated decision-making that produces significant legal or similarly material effects on you as an individual without a human review process being available.

04 PKR Payments and Identity Verification

Because MustPlay handles real-money PKR transactions, identity verification is a necessary part of the platform's operation. This section explains how payment data and KYC documentation are specifically handled.

• Payment data such as JazzCash wallet numbers, Easypaisa mobile numbers, Raast IDs and bank account details are stored securely and used only to process your specific deposit and withdrawal requests.
• MustPlay does not store raw payment card numbers. Card data is tokenised through the payment processor and MustPlay retains only the masked card reference for display purposes in your account.
• KYC documents — such as your CNIC — are stored in an encrypted format within MustPlay's secure document management system. Access is restricted to authorised personnel involved in the verification process only.
• Completed KYC verification is retained on your account record for the duration of your account and for a period after account closure as required for audit and legal compliance purposes.
• MustPlay may share payment-related data with its payment processing partners — such as JazzCash, Easypaisa and banking institutions — solely to complete your requested transaction. These partners operate under their own data protection policies.

05 Cookies and Tracking Technologies

MustPlay uses cookies and similar tracking technologies on the website and mobile app to ensure the platform works correctly, to remember your preferences and to help us understand how players use the platform.

Types of Cookies We Use

• Essential cookies: These are required for the platform to function. They manage your login session, keep you authenticated during a gaming session and maintain your basket or game state. Disabling these cookies will prevent MustPlay from working correctly.
• Functional cookies: These remember your preferences — such as your preferred language, PKR display settings and notification preferences — so you do not have to reset them on each visit.
• Analytics cookies: MustPlay uses anonymised analytics data to understand which pages are visited most, how long sessions last and where players encounter difficulty. This data is aggregated and cannot be used to identify you individually.
• Security cookies: These help MustPlay detect and prevent fraudulent logins, bot activity and suspicious session behaviour. They are essential to account protection and cannot be disabled.

You can manage non-essential cookies through your browser settings. However, disabling essential or security cookies may affect your ability to log in and use the platform properly. MustPlay does not use third-party advertising cookies or sell cookie data to advertisers.

06 Sharing Your Personal Data

MustPlay does not sell, rent or trade your personal information to any third party for commercial or marketing purposes. Your data may be shared only in the following specific and limited circumstances:

• Payment processors: JazzCash, Easypaisa, Raast and banking partners receive the minimum payment data necessary to process your PKR transactions. They do not receive your full account profile or gameplay history.
• Identity verification services: Third-party KYC providers may receive your identity documents for automated or manual verification. These partners operate under strict data processing agreements and are prohibited from using your data for any other purpose.
• Technology and infrastructure providers: Cloud hosting, database management and security service providers who process data on MustPlay's behalf under contractual data processing agreements. They act only on MustPlay's instructions.
• Fraud prevention and financial intelligence: Where MustPlay detects or suspects fraudulent activity, money laundering or payment fraud, relevant data may be shared with financial institutions or specialist fraud prevention bodies to protect the platform and other players.
• Legal obligations: MustPlay may be required to disclose your data in response to a lawful request from a competent authority — such as a court order or a formal legal process. MustPlay will only comply with requests that are lawful and will share the minimum data necessary to satisfy the obligation.

In all cases where data is shared with a third party, MustPlay requires that party to handle the data securely, use it only for the stated purpose and not retain it beyond what is necessary.

07 How Long We Keep Your Data

MustPlay retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and for a reasonable period thereafter to meet legal, audit and dispute resolution requirements.

• Active accounts: Your personal data is retained for the full duration of your account being open and active on MustPlay.
• Closed accounts: Following account closure — whether at your request or due to a Terms violation — MustPlay retains your core account data, transaction history and KYC records for a period of five years. This is to satisfy financial record-keeping obligations and to allow investigation of any disputes that arise after closure.
• Support communications: Support chat transcripts and email correspondence are retained for up to two years from the date of the last message in the relevant ticket or conversation thread.
• Session and technical logs: IP address logs and device data are retained for up to twelve months for security and fraud investigation purposes, after which they are deleted or anonymised.
• Marketing preferences: If you have opted in to receiving promotional communications from MustPlay, your preference and associated contact data are retained until you opt out. Opt-out requests are actioned within ten business days.

When data is no longer required, MustPlay deletes it securely or anonymises it so that it can no longer be linked to you as an individual.

08 How We Protect Your Data

MustPlay applies a combination of technical and organisational security measures to protect your personal data against unauthorised access, loss, misuse or disclosure. Key security measures include:

• All data transmitted between your device and MustPlay's servers is encrypted using TLS (Transport Layer Security) — the same encryption standard used by banks and major financial institutions.
• Account passwords are hashed using industry-standard algorithms and are never stored in plain text. MustPlay support staff cannot view your password and will never ask you for it.
• Access to player personal data and financial records within MustPlay's internal systems is strictly role-based. Only authorised personnel with a legitimate operational need can access specific categories of data, and all internal access is logged.
• MustPlay's infrastructure is hosted on secure cloud servers with firewall protection, intrusion detection systems and regular security audits. Physical access to server infrastructure is restricted and monitored.
• Two-factor authentication (2FA) is available for player accounts as an additional layer of login security. MustPlay strongly recommends enabling 2FA, particularly for accounts with higher PKR balances.
• In the event of a data breach that affects your personal information, MustPlay will notify affected players as soon as practicably possible, describe the nature of the breach and outline the steps being taken to contain it.

09 Your Rights Over Your Personal Data

As a MustPlay player, you have specific rights regarding your personal information. MustPlay respects these rights and provides mechanisms for you to exercise them through your account settings or via support:

To exercise any of these rights, contact MustPlay support via live chat or the support ticket system. MustPlay will respond to all valid data rights requests within a reasonable period. We may ask you to verify your identity before processing a request to protect against unauthorised data access.

10 Children's Privacy

MustPlay is strictly an adults-only platform. We do not knowingly collect personal data from anyone under the age of 18. Registration on MustPlay requires you to confirm that you are at least 18 years old, and identity verification checks are in place to enforce this requirement.

• If MustPlay becomes aware that an account has been created by or on behalf of someone under the age of 18, that account will be closed immediately and any deposited funds handled in accordance with MustPlay's Terms and Conditions.
• If you are a parent or guardian and believe that a minor under your care has accessed or registered on MustPlay, please contact support immediately so the account can be reviewed and closed without delay.
• MustPlay will not retain personal data of a confirmed minor beyond what is required to document and close the account in compliance with its safeguarding obligations.

11 Changes to This Privacy Policy

MustPlay may update this Privacy Policy from time to time to reflect changes in how the platform operates, updates to data handling practices or changes in applicable requirements. When this happens, the "Last updated" date shown at the top of this page will be revised.

For significant changes — particularly those that affect how your personal data is used or shared — MustPlay will notify you through your registered email address or by displaying a notice when you next log in to your account. It is your responsibility to review this page periodically to stay informed of the current policy.

Continued use of MustPlay after a Privacy Policy update constitutes your acceptance of the revised policy. If you do not agree with any changes, you should stop using MustPlay and may request account closure by contacting support. Any data already collected will be retained as per the retention schedule described in Section 7.

12 How to Contact Us About Privacy

If you have any questions about this Privacy Policy, want to understand how a specific piece of your data is being used, or wish to exercise any of your data rights, MustPlay's support team is available around the clock to help.

You can reach MustPlay support through the live chat feature available within your account dashboard and on the MustPlay app, or by submitting a support ticket. The platform's support email address is displayed in the footer of every page on mustplay.vu.

When contacting MustPlay about a data or privacy matter, please include your registered username, the nature of your request and any relevant account details to help the support team handle your query as efficiently as possible.