spribe Privacy Policy

This Privacy Policy is issued by spribe ("spribe", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at spribe.vu. spribe acts as the data controller in respect of all personal data collected from registered players, prospective players, and visitors to the Platform.

As data controller, spribe determines the purposes and means by which your personal data is processed. We are responsible for ensuring that all processing activities are conducted lawfully, fairly, and transparently, in accordance with our international gaming licence obligations and applicable data protection standards.

For all data protection enquiries, please contact the spribe data privacy team through the support channels described in Section 14 of this Policy. We are committed to responding to all data-related queries in a timely and transparent manner.

spribe collects personal data across several categories, depending on how you interact with the Platform. The following table summarises the main categories of data we collect and their typical sources:

We do not collect special category data (as defined under applicable data protection frameworks) — such as racial or ethnic origin, political opinions, health data, or biometric data — except where expressly required to fulfil a specific legal obligation and with your explicit prior consent.

spribe collects personal data through the following channels and mechanisms:

• Direct Submission: Data you actively provide during account registration, identity verification (KYC), payment processing, support interactions, and promotional opt-ins. This is the primary source of your identity, contact, and financial data.
• Automated Collection: Technical data collected automatically when you visit spribe.vu or use the Platform — including IP addresses, device identifiers, browser type and version, pages visited, and session duration — via server logs, session tracking mechanisms, and functional cookies.
• Third-Party Sources: Data received from identity verification partners (for KYC compliance), payment processors (for transaction confirmation and fraud screening), and fraud prevention databases where we have a legitimate interest in verifying the authenticity of account activity.
• Publicly Available Sources: In limited circumstances related to fraud prevention or regulatory compliance, we may cross-reference information from publicly accessible sources such as sanctions lists, politically exposed persons (PEP) databases, or adverse media archives.

spribe processes your personal data for the following specific purposes, each of which is tied to a defined legal basis described in Section 5:

• Account Creation & Management: To create, maintain, and administer your registered spribe account, including processing login requests and managing account preferences.
• Identity Verification (KYC): To verify your identity and age (21+ requirement), comply with anti-money laundering obligations, and fulfil Know Your Customer requirements under our international gaming licence conditions.
• Payment Processing: To process deposits and withdrawals in PKR via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, including verifying payment method ownership and detecting fraudulent transactions.
• Platform Delivery & Personalisation: To deliver the full range of spribe services including sports betting (cricket, PSL, international events), casino games, crash titles, bingo, and instant games — and to personalise your platform experience based on activity history.
• Responsible Gaming Monitoring: To monitor gaming behaviour for indicators of problem gambling, enforce responsible gaming limits you have set, and respond to self-exclusion requests in accordance with our responsible gaming obligations.
• Customer Support: To respond to enquiries, resolve disputes, process complaints, and provide technical assistance.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, bonus abuse, unauthorised account access, money laundering, and other prohibited conduct.
• Regulatory Compliance: To comply with applicable legal obligations, including responses to lawful requests from regulatory authorities, law enforcement agencies, and licensing bodies.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications. This processing is subject to your consent, which may be withdrawn at any time.
• Platform Analytics & Improvement: To analyse aggregated, anonymised usage data for the purpose of improving platform performance, game offerings, and user experience.

All personal data processing by spribe is conducted on one or more of the following lawful bases:

• Contractual Necessity: Processing required to perform the contract between you and spribe — i.e., to provide the Platform services you registered for. This covers account management, payment processing, game delivery, and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC/AML obligations, gaming licence conditions, tax reporting, and responses to law enforcement requests.
• Legitimate Interests: Processing conducted on the basis of spribe's legitimate business interests, where those interests are not overridden by your rights and freedoms. This covers fraud prevention, security monitoring, responsible gaming oversight, and platform analytics.
• Consent: Processing conducted with your freely given, specific, and informed consent. This applies exclusively to marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

spribe does not sell or rent your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive only the minimum data necessary to process your deposit or withdrawal transaction. These providers operate under their own data protection policies and are required to maintain appropriate security standards.
• Identity Verification Providers: Third-party KYC and age verification service providers receive identity documents and personal details submitted during the verification process. All such providers operate under data processing agreements with spribe and may not use your data for their own purposes.
• Fraud Prevention & AML Screening: Specialist fraud prevention and anti-money laundering screening services may receive transaction data and account information for the purpose of risk assessment and sanctions screening. This processing is conducted on the basis of legal obligation and legitimate interests.
• Game Technology Providers: The developers and operators of specific game titles available on the Platform may receive anonymised session data (such as game rounds played and bet amounts) for technical and audit purposes. Personally identifiable data is not shared with game providers beyond what is necessary for game delivery.
• Regulatory & Law Enforcement Authorities: spribe will disclose personal data to regulatory bodies, licensing authorities, tax authorities, or law enforcement agencies where required to do so by law, court order, or binding regulatory directive.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged by spribe may access personal data on a need-to-know basis, subject to professional confidentiality obligations.

All third-party service providers operating on spribe's behalf are required to process personal data only as directed by spribe, maintain appropriate technical and organisational security measures, and not use your data for independent purposes beyond the scope of their engagement.

spribe uses cookies and similar tracking technologies on spribe.vu to ensure the Platform functions correctly, to protect account security, and to improve the user experience for Pakistani players. The following cookie categories are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load balancing cookies. They cannot be disabled without impairing Platform functionality and do not require your consent.
• Functional Cookies: Enable personalised features such as remembering your language preference, game display settings, and last-visited sections of the Platform. These are deployed on the basis of our legitimate interest in providing a consistent user experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and interact with the Platform. This data helps us identify technical issues, understand popular game categories, and improve overall Platform performance. These cookies require your consent.
• Session Security Cookies: Short-lived cookies that support two-factor authentication verification, CSRF protection, and fraud detection during active Platform sessions. These are strictly necessary and expire at the end of each session.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from accessing certain areas of the Platform. Disabling analytics cookies will not affect your ability to use Platform services but will limit our ability to improve the Platform based on usage data.

spribe retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention standards apply:

• Account & Identity Data: Retained for the lifetime of your active account plus a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements applicable under our gaming licence conditions.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in accordance with applicable financial regulatory requirements. This includes deposit, withdrawal, and bonus credit records.
• Gaming Activity Data: Retained for the lifetime of your active account plus 5 years, to support regulatory audit requirements, dispute resolution, and responsible gaming monitoring obligations.
• Customer Support Records: Retained for 3 years from the date of the final support interaction, to support dispute resolution and service improvement.
• Marketing Preference Records: Retained for the duration of your account and 2 years following account closure, as evidence of consent and opt-out records.
• Technical & Log Data: Typically retained for 12 months from collection, after which it is aggregated and anonymised for analytics purposes or permanently deleted.

Upon expiry of the applicable retention period, personal data is either permanently deleted from all spribe systems or irreversibly anonymised such that it can no longer be attributed to any identifiable individual.

As a registered spribe player, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team using the details in Section 14. spribe will respond to all data rights requests within 30 calendar days of receipt:

• Right of Access: You may request a copy of all personal data spribe holds about you, along with information about how it is processed. This is sometimes referred to as a Subject Access Request (SAR).
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held about you. Corrections to identity data may require submission of updated supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing on legitimate interest grounds and no overriding interest exists. Note that data subject to legal retention obligations cannot be deleted until those obligations are fulfilled.
• Right to Restriction of Processing: You may request that spribe restricts the processing of your data in certain circumstances — for example, while a rectification request is being assessed or while an objection to processing is pending resolution.
• Right to Data Portability: For data processed on the basis of your consent or contractual necessity, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing conducted on the basis of legitimate interests. spribe will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

spribe implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• Transport Layer Security (TLS): All data in transit between your device and spribe's servers is encrypted using current TLS standards, ensuring that data cannot be intercepted in readable form during transmission.
• Password Hashing: Account passwords are never stored in plain text. We use industry-standard cryptographic hashing algorithms with salting to ensure that passwords cannot be recovered even in the event of a data security incident.
• Access Controls: Access to personal data within spribe's systems is restricted on a strict need-to-know basis. Internal staff access is governed by role-based permissions, and all access events are logged and auditable.
• Two-Factor Authentication: Players are strongly encouraged to enable two-factor authentication on their spribe accounts. 2FA provides a significant additional layer of protection against unauthorised account access.
• Penetration Testing & Security Audits: spribe's Platform and supporting infrastructure are subject to regular security assessments, vulnerability scans, and independent penetration testing to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: spribe maintains a documented data security incident response plan. In the event of a data breach affecting your personal data, we will notify you and relevant regulatory authorities as required by our licence conditions and applicable data protection obligations.

While spribe takes all reasonable and practicable measures to protect your personal data, no online platform can guarantee absolute security against all possible threats. You are strongly encouraged to maintain a strong, unique password for your spribe account and to enable two-factor authentication at the earliest opportunity.

The spribe Platform is strictly intended for adults aged 21 years and above. spribe does not knowingly collect personal data from individuals under 21 years of age. Our registration process includes mandatory age declaration, and we conduct age verification checks as part of our KYC process.

If spribe becomes aware that personal data has been collected from an individual who is under 21 years of age — whether through misrepresentation during registration or through subsequent discovery — the following actions will be taken immediately:

• The associated account will be permanently suspended and closed.
• All personal data associated with the account will be deleted as soon as all mandatory retention obligations related to the registration event and any transactions are satisfied.
• Any funds deposited will be returned to the original payment source.
• The incident will be logged and reported to our licensing authority as required under responsible gaming obligations.

As an internationally licensed online gaming platform, spribe may process and store personal data on servers and systems located outside of Pakistan. Where personal data is transferred internationally — for example, to data centres, cloud infrastructure providers, or third-party service partners located in other jurisdictions — spribe ensures that appropriate safeguards are in place to protect your data.

Such safeguards may include:

• Contractual data processing agreements incorporating standard data protection clauses that impose equivalent protection obligations on the receiving party.
• Transfers only to jurisdictions that maintain adequate data protection standards as assessed by internationally recognised frameworks.
• Technical measures such as data encryption in transit and at rest, ensuring that the physical location of data storage does not create additional risk to your privacy.

By using the spribe Platform, you acknowledge and consent to the international transfer of your personal data as described in this Policy, subject at all times to the safeguards described above.

spribe reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or Platform services. Material changes to this Policy — i.e., changes that significantly affect how we collect or use your personal data — will be communicated to registered players via the email address on file at least 14 days before the change takes effect.

Non-material revisions — such as corrections to typographical errors, restructuring of existing sections for clarity, or updates that do not substantively change data processing practices — may be made without prior notice. The effective date at the top of this Policy will be updated to reflect any revision.

We encourage you to review this Privacy Policy periodically to stay informed about how spribe protects your personal data. Your continued use of the Platform following any Policy update constitutes acknowledgement of the revised Policy.

Prior versions of this Privacy Policy are archived and available upon request from the spribe data privacy team.

For all data protection enquiries, Subject Access Requests, or concerns relating to how spribe processes your personal data, please contact our support team. Our data privacy team is available to assist with the following types of requests:

• Subject Access Requests (requests for copies of your personal data)
• Rectification, erasure, or restriction requests
• Marketing opt-out and consent withdrawal requests
• Questions about specific data processing activities described in this Policy
• Reports of suspected data security incidents or unauthorised account access
• Complaints regarding how your personal data has been handled

spribe aims to resolve all data privacy concerns promptly and fairly through our internal process. If you have submitted a complaint and are not satisfied with our response within 30 days, you may escalate your concern to the relevant supervisory authority or data protection regulator in your jurisdiction.