EPWin Privacy Policy – How We Protect Your Data in Pakistan

1 Who We Are

EPWin is an online betting and casino platform operating at https://epwin.bet, serving players based in Pakistan. In this Privacy Policy, "EPWin", "we", "us", and "our" refer to the EPWin platform and its operating entity. "You" and "your" refer to any individual who visits the EPWin website, creates an account, or uses any EPWin service.

EPWin acts as the data controller for all personal information collected through the platform. This means we are responsible for deciding what data is collected, how it is processed, how long it is retained, and who it is shared with. We take this responsibility seriously and have structured our data practices to protect the privacy of every Pakistani player on the platform.

This Privacy Policy applies to all EPWin services, including cricket and PSL sports betting, casino games (Andar Bahar, Jackpot Slots, Fishing Games, Ludo Games, Aviator), live cricket score features, account management, customer support interactions, and marketing communications.

2 What Personal Data EPWin Collects

EPWin collects personal data in two broad categories: information you provide directly, and information collected automatically when you use the platform.

EPWin does not collect or store full card numbers. Payment card data beyond the last four digits is processed directly by our PCI-DSS compliant payment processor and is not transmitted to or stored on EPWin's own servers.

3 How EPWin Collects Your Data

EPWin collects personal data through the following channels:

• Directly from you: When you fill in the registration form, submit identity verification documents, make a deposit, place a bet, contact customer support, or update your account settings.
• Automatically via the platform: EPWin's servers automatically log technical data (IP address, device type, browser) each time you visit the platform. This data is collected using standard web server logs and first-party analytics tools.
• Cookies and similar technologies: EPWin uses cookies to maintain your login session, remember your preferences, detect fraud, and measure platform performance. See Section 6 for full cookie details.
• From payment processors: When you make a deposit or withdrawal, EPWin receives confirmation data from your payment provider (Easypaisa, JazzCash, etc.) confirming the transaction amount, status, and the masked account identifier used.
• From identity verification partners: Where EPWin uses a third-party KYC provider to verify your identity documents, we receive a verified/not-verified result along with the document type used. We do not receive or store raw document images from these providers beyond what is necessary for your account record.

4 Why EPWin Uses Your Personal Data

EPWin uses your personal data only for legitimate purposes directly related to operating the platform and fulfilling our obligations to you. Specifically:

• Account management: Creating, maintaining, and securing your EPWin account. This includes authentication, password resets, and account recovery.
• Payment processing: Verifying and processing deposits and withdrawals in PKR via your chosen payment method. EPWin cannot process payments without collecting the financial data described in Section 2.
• Identity verification (KYC/AML): Confirming that you are who you say you are, that you are at least 18 years old, and that your account activity is consistent with legitimate use. This is a legal obligation for EPWin under applicable anti-money laundering regulations.
• Providing games and services: Running the betting and casino games you use on EPWin, recording your game history, settling bets, and calculating winnings accurately.
• Customer support: Responding to your queries, investigating complaints, and resolving disputes. Support agents need access to your account and transaction history to assist you effectively.
• Fraud prevention and platform security: Detecting and preventing fraudulent account activity, bonus abuse, money laundering, and other threats to the integrity of the EPWin platform.
• Responsible gaming compliance: Monitoring gaming behaviour against the responsible gaming limits you have set, and identifying patterns that may indicate problem gambling in accordance with our duty of care obligations.
• Marketing communications: Sending you information about EPWin promotions, bonuses, and new games — but only where you have given explicit consent to receive such communications. You can withdraw this consent at any time.
• Platform improvement: Using aggregated, anonymised usage data to understand how the platform is used and identify areas for improvement. This analysis does not involve individual user profiling.

5 Who EPWin Shares Your Data With

EPWin does not sell your personal data to any third party. We share data only where it is genuinely necessary to operate the platform or comply with legal requirements. The categories of third parties with whom EPWin may share your data are:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking partners, and Visa/Mastercard processing networks — to process your deposits and withdrawals. These providers receive only the data necessary to complete the transaction.
• Identity verification providers: Third-party KYC/AML service providers who assist EPWin in verifying player identities and assessing financial risk. These providers are contractually bound to process data only for verification purposes.
• Technology and hosting partners: Cloud infrastructure and hosting providers who store EPWin platform data on secure servers. These partners process data under strict data processing agreements and have no right to use your data for their own purposes.
• Game content providers: Where EPWin's games are provided by licensed third-party game studios, those studios may receive anonymised session data necessary to run and certify the fairness of their games. Individual player identities are not shared with game providers.
• Legal authorities: Where EPWin is required by law, court order, or regulatory instruction to disclose specific account or transaction information. EPWin will not disclose more than is legally required in such cases.

All third parties who receive EPWin player data are required to maintain appropriate data security standards and are prohibited from using the data for any purpose beyond the specific service they provide to EPWin.

6 Cookies & Tracking Technologies

EPWin uses cookies — small text files stored on your device — to make the platform work properly and to understand how it is being used. Here is what each type of cookie does on EPWin:

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking essential cookies will prevent EPWin from functioning correctly. Blocking preference or analytics cookies will not affect your ability to play games or process payments.

EPWin does not use third-party advertising cookies. We do not place cookies on your device that track your activity across other websites or build advertising profiles.

7 How EPWin Keeps Your Data Secure

EPWin takes technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, or loss. Our security arrangements include:

• Encryption in transit: All data transmitted between your device and EPWin's servers is encrypted using SSL/TLS. You can verify this by the padlock icon in your browser address bar when visiting epwin.bet.
• Encryption at rest: Sensitive data stored in EPWin's databases — including personal identity information and financial records — is encrypted using AES-256 encryption.
• Access controls: Access to player data within EPWin is restricted on a strict need-to-know basis. Staff members can only access the data categories necessary for their specific role. Access logs are maintained and reviewed regularly.
• Payment security: Card payment processing on EPWin is handled by a PCI-DSS Level 1 certified payment processor. Full card numbers never pass through or are stored on EPWin's own infrastructure.
• Account security: EPWin supports two-factor authentication (2FA) for all accounts. We strongly encourage all EPWin players to enable 2FA in their account security settings.
• Breach response: In the event of a data breach affecting your personal data, EPWin will notify affected players and relevant authorities as required by applicable law, within the legally prescribed timeframe.

While EPWin implements robust security measures, no internet-based service can guarantee absolute security. You are also responsible for maintaining the confidentiality of your EPWin account credentials. If you suspect your account has been accessed without your permission, contact support@epwin.bet immediately.

8 How Long EPWin Keeps Your Data

EPWin retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or to comply with legal obligations. The following retention periods apply:

• Account data (name, contact details, identity verification): Retained for the lifetime of your active EPWin account plus a minimum of 5 years after account closure, in accordance with applicable anti-money laundering record-keeping requirements.
• Financial transaction records (deposits, withdrawals, bet settlements): Retained for a minimum of 7 years from the date of each transaction, in accordance with financial record-keeping obligations.
• Game activity data (betting history, session data): Retained for a minimum of 2 years from the date of each session, and may be retained for longer where relevant to an ongoing dispute, investigation, or compliance review.
• Customer support communications: Retained for 3 years from the date of the last communication in a given thread, or until the matter to which they relate is fully resolved, whichever is later.
• Marketing consent records: Retained for the duration of your EPWin account. If you withdraw marketing consent, EPWin retains a record of the withdrawal date for compliance purposes.
• Analytics and technical data: Aggregated and anonymised analytics data is retained indefinitely. Raw technical logs containing IP addresses are retained for 90 days before being deleted or anonymised.

When a retention period expires and no other legal ground for retention exists, EPWin securely deletes or anonymises the relevant data on a regular data purge schedule.

9 Your Data Rights as an EPWin Player

EPWin respects your rights over your personal data. As a player on the platform, you have the following rights, each of which you can exercise by contacting EPWin at support@epwin.bet:

EPWin will respond to all rights requests within 30 days. In cases of complexity or high volume, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it. Exercising your data rights is free of charge.

10 Children & Minors

EPWin is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. The EPWin registration process includes age verification steps designed to prevent minors from accessing the platform.

If EPWin becomes aware that an account has been created by or on behalf of a minor, the account will be immediately closed, all associated balances will be forfeited, and any personal data collected in connection with that account will be deleted except where retention is required by law in connection with the investigation of the underage access.

If you are a parent or guardian and believe that a minor in your household may have accessed EPWin using your payment details or identity information, please contact EPWin immediately at support@epwin.bet so that the account can be reviewed and closed without delay.

11 Third-Party Links & Services

EPWin's platform contains links to related pages such as the Responsible Gaming page, FAQ, and other internal sections of the epwin.bet website. All of these are part of the EPWin platform and covered by this Privacy Policy.

EPWin does not include links to third-party websites in the main platform interface. If you arrive at a third-party website from outside the EPWin platform — for example through a search engine result — that site's own privacy policy applies to any data collected by that site. EPWin is not responsible for the privacy practices of websites it does not operate.

12 Changes to This Privacy Policy

EPWin reviews this Privacy Policy periodically and updates it when our data practices change, when new services are introduced, or when legal or regulatory requirements change.

When we make material changes to this policy — such as changes to the categories of data we collect, new third parties we share data with, or changes to your rights — we will notify registered EPWin players by email at least 14 days before the changes take effect, and update the "Last Updated" date at the top of this page.

For minor editorial or clarification changes that do not affect the substance of the policy, we will update the page without separate notification. Your continued use of EPWin after any updated Privacy Policy takes effect constitutes your acceptance of the updated policy.

If you do not agree with changes to this Privacy Policy, you should stop using EPWin and close your account by contacting support@epwin.bet before the effective date of the changes.

13 How to Contact EPWin About Privacy

For any questions about this Privacy Policy, to exercise a data right, or to report a privacy concern, contact EPWin using the following details:

EPWin will acknowledge your request promptly and provide a substantive response within 30 days. Where a request requires additional verification of your identity before we can act on it, we will ask you to confirm your account details and may request supporting documentation.

For further information about your account's privacy settings, responsible gaming tools, or account closure, visit the Responsible Gaming page or the FAQ.