Privacy Policy – How winpk Collects, Uses, and Protects Your Personal Data

This Privacy Policy (hereinafter "Policy") describes how winpk (hereinafter "winpk", "we", "us", or "the Platform") collects, processes, stores, shares, and protects the personal data of individuals who register for and use the winpk online casino and sports betting platform accessible at winpk.org (hereinafter "the Platform" or "the Site").

This Policy applies to all personal data collected through: the winpk registration process; the use of any winpk product (including live casino, sports betting, slot games, instant games, and the winpk cashier); any communication between you and winpk (including support interactions, complaints, and bonus enquiries); and any use of the winpk website, including browsing behaviour and cookie data.

This Policy should be read in conjunction with winpk's Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with winpk. By creating a winpk account or using any part of the winpk Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

For the purposes of this Privacy Policy, winpk is the data controller responsible for the personal data of registered players and website visitors. winpk is the entity that determines the purposes and means of processing personal data collected through the winpk Platform.

winpk operates the Platform under an international gaming licence, the conditions of which include mandatory data protection obligations applicable to all registered players regardless of their location. Players accessing winpk from Pakistan are subject to the data protection standards required under winpk's international gaming licence, which winpk applies as its minimum standard across all jurisdictions.

All enquiries regarding winpk's data processing activities, data subject access requests, and privacy complaints should be directed to winpk's designated Data Protection contact via email at [email protected] with the subject line "Privacy Enquiry" or "Data Subject Request" as applicable.

winpk collects the following categories of personal data from registered players and, in limited cases, from prospective players who interact with the winpk website without registering an account:

winpk does not collect sensitive personal data categories (such as racial or ethnic origin, political opinions, religious beliefs, or biometric data) except where a document submitted for KYC purposes incidentally contains such information — in which case that information is not separately recorded or processed by winpk.

winpk collects personal data through the following channels and mechanisms:

• Direct Collection: Data you actively provide when creating your winpk account, completing KYC verification, making deposits or withdrawals via JazzCash, EasyPaisa, or bank transfer, contacting winpk support, or participating in winpk promotions and surveys.
• Automated Technical Collection: Data collected automatically when you access the winpk website or mobile interface, including cookies, web beacons, log files, and similar tracking technologies. This includes your IP address, device identifiers, browser type, and pages visited on the winpk site.
• Payment Processor Data: Data received from winpk's payment processing partners (including JazzCash, EasyPaisa, and banking partners) in the course of processing your deposits and withdrawals in PKR. This data is received under strict data processing agreements between winpk and its payment partners.
• Third-Party Identity Verification: Data received from third-party identity verification services used by winpk to conduct automated or manual KYC checks on player-submitted identity documents. These services operate under data processing agreements with winpk.
• Fraud and AML Screening: Data received from fraud detection, anti-money laundering (AML) screening, and sanctions checking services as part of winpk's compliance obligations under its international gaming licence.

winpk processes your personal data only for specified, explicit, and legitimate purposes. The following table sets out the principal purposes for which winpk processes your personal data and the corresponding legal basis for each:

winpk does not sell, rent, or trade your personal data to any unaffiliated third party for their own commercial or marketing purposes. winpk shares your personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment Processing Partners: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Visa/Mastercard processing networks, to the extent required to process your PKR deposits and withdrawals. These partners receive only the data necessary for payment execution and are bound by strict data processing agreements with winpk.
• Identity Verification Providers: Third-party KYC and identity verification service providers who process document images and personal data on winpk's behalf to verify the identity and age of winpk players. All such providers operate under data processing agreements with winpk.
• Fraud and AML Compliance Services: Fraud detection, AML screening, and sanctions list checking services used by winpk to fulfil its compliance obligations under its international gaming licence. Data shared with these services is limited to the minimum required for screening purposes.
• Game Software Providers: Third-party game studios and live dealer operators whose games are hosted on the winpk Platform may receive limited technical data (such as session tokens and bet data) necessary for game function and integrity. These providers do not receive identity data.
• Gaming Licence Regulatory Authority: winpk's international gaming licence authority may require winpk to report certain player data as part of licensing compliance, including in relation to AML reporting, problem gambling investigations, or regulatory audits.
• Law Enforcement and Legal Process: winpk will disclose personal data to law enforcement authorities, courts, or regulatory bodies where required to do so by applicable law, court order, or where winpk reasonably believes disclosure is necessary to prevent fraud, crime, or harm.

winpk retains personal data for only as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law, licensing conditions, or AML obligations. The following retention periods apply to the principal categories of data winpk holds:

• Account Data (identity, contact, login): Retained for the duration of your active winpk account plus a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements under winpk's international gaming licence.
• KYC Documents (CNIC, passport, proof of address): Retained for a minimum of five (5) years following the completion of KYC verification or account closure (whichever is later), as required by AML regulatory standards.
• Payment and Transaction Records (PKR deposits, withdrawals, JazzCash/EasyPaisa logs): Retained for a minimum of five (5) years following each transaction, as required by AML and licensing obligations.
• Gaming Activity Records (bets, game sessions, PSL cricket bets): Retained for a minimum of five (5) years following account closure or last activity, whichever is later.
• Customer Support Communications: Retained for three (3) years following the resolution of the relevant support interaction or complaint.
• Marketing Consent Records: Retained until marketing consent is withdrawn by the player and for one (1) year thereafter as proof of consent management.
• Cookie and Technical Data: Retained in accordance with the cookie retention periods set out in Section 9 of this Policy.

Upon expiry of the applicable retention period, winpk will securely delete or anonymise the relevant personal data in accordance with its internal data disposal procedures. Anonymised data (from which all identifying information has been permanently removed) may be retained indefinitely for analytical and statistical purposes.

winpk implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The principal security measures winpk employs include:

• 256-bit SSL/TLS Encryption: All data transmitted between players and winpk's servers is encrypted using industry-standard 256-bit SSL/TLS encryption. This applies to login sessions, payment transactions, KYC document uploads, and all other data exchanges on the winpk Platform.
• Password Hashing: winpk stores player passwords in one-way cryptographic hashed form. Your actual password is never stored or accessible to winpk staff in plain text.
• Access Controls: Access to player personal data within winpk's internal systems is restricted on a strictly need-to-know basis. Staff with access to personal data receive mandatory privacy training and are bound by confidentiality obligations.
• Two-Factor Authentication: winpk offers optional two-factor authentication (2FA) to players for account login, adding an additional verification layer beyond password entry via SMS OTP to the player's registered Pakistani mobile number.
• Fraud Monitoring Systems: winpk operates real-time automated systems that monitor login attempts, session behaviour, and transaction patterns to detect and respond to potential account compromises or fraudulent activity.
• Regular Security Audits: winpk's platform security is subject to periodic independent security assessments to identify and address vulnerabilities in line with industry standards for online gaming operators.

winpk uses cookies and similar tracking technologies on the winpk website and Platform to enable core functionality, improve the player experience, analyse Platform usage, and in limited cases to deliver relevant promotional content. The following categories of cookies are used by winpk:

• Strictly Necessary Cookies: These cookies are essential for the winpk Platform to function. They include session authentication cookies that keep you logged in to your winpk account during a session, and cookies that remember your preferences within the current session. These cookies cannot be disabled without affecting Platform functionality.
• Functional Cookies: These cookies enable winpk to remember your preferences — such as your chosen display language, preferred game categories, and cashier settings — across multiple sessions to personalise your winpk experience.
• Analytics Cookies: winpk uses analytics tools to collect aggregate data about how players navigate and use the winpk Platform. This data helps winpk improve its products and user interface. Analytics cookies do not identify individual players directly.
• Responsible Gaming Cookies: winpk uses specific cookies to enforce responsible gaming settings you have activated on your account — such as session time limits and cool-off period status. These are necessary to maintain the integrity of your responsible gaming preferences across sessions.

You may control cookie settings through your browser's privacy settings. Please note that disabling strictly necessary cookies will prevent you from accessing your winpk account and using the Platform. winpk's cookie preferences centre is accessible via the cookie banner displayed upon your first visit to the winpk website.

winpk strictly prohibits the registration and use of the Platform by individuals under the age of 21 years. winpk does not knowingly collect or process personal data from individuals under 21. Age verification is a mandatory step in the winpk registration and KYC process, and winpk employs automated age-checking procedures as well as manual document review to enforce this requirement.

If winpk becomes aware or has reasonable grounds to believe that a player is under the age of 21, winpk will immediately suspend the relevant account, initiate a mandatory KYC review, and if underage status is confirmed, permanently close the account, refund all deposits, void all winnings, and delete the personal data collected in relation to that account to the extent not required to be retained for AML or regulatory purposes.

Every winpk player has the following rights with respect to their personal data held by winpk. These rights may be exercised by contacting winpk's Data Protection team at [email protected] with the subject line "Data Subject Request":

• Right of Access: You may request a copy of all personal data winpk holds about you (a "Subject Access Request"). winpk will provide a complete response within 30 days of receiving a valid request.
• Right to Rectification: If you believe that personal data winpk holds about you is inaccurate or incomplete, you may request that it be corrected. Basic account details (name, mobile number, email) can be updated directly from your winpk account settings; other corrections should be requested via the Data Protection contact.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data. Please note that winpk is subject to mandatory data retention obligations under its international gaming licence and AML regulations, and cannot delete data that it is legally required to retain. Erasure requests will be fulfilled to the maximum extent permitted by law.
• Right to Restriction of Processing: You may request that winpk restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where processing is unlawful but you do not want the data deleted.
• Right to Data Portability: You may request that winpk provide you with your personal data in a structured, commonly used, and machine-readable format, and transfer that data to another controller where technically feasible.
• Right to Object: You have the right to object to winpk's processing of your personal data where winpk relies on legitimate interests as the legal basis, and where you have grounds relating to your particular situation. You have an absolute right to object to processing for direct marketing purposes.

winpk will acknowledge all data subject requests within 48 hours of receipt and will respond in full within 30 calendar days. In complex cases, this period may be extended by a further 60 days — winpk will notify you within the initial 30-day period if such an extension is required and the reasons for it.

winpk may send you marketing communications about winpk's products, promotions, bonuses, and events via email, SMS to your registered Pakistani mobile number, and push notifications (where applicable) — but only where you have provided explicit consent to receive such communications at registration or subsequently through your winpk account settings.

You may withdraw consent to receive winpk marketing communications at any time by: (a) clicking the "unsubscribe" link included in every winpk marketing email; (b) replying STOP to any winpk SMS marketing message; (c) updating your communication preferences in the Notifications section of your winpk account settings; or (d) contacting winpk's support team and requesting removal from marketing communications.

Withdrawal of marketing consent does not affect winpk's right to send you service-related transactional communications related to your winpk account — such as deposit confirmation notifications, withdrawal processing updates, responsible gaming limit acknowledgements, and KYC document request notifications. These transactional messages are not marketing communications and are sent regardless of marketing consent status.

In operating the winpk Platform for Pakistani players, your personal data may be transferred to and processed in countries other than Pakistan — including the jurisdiction in which winpk holds its international gaming licence and the locations where winpk's technology infrastructure, game software providers, and payment processing partners are based.

winpk ensures that all international transfers of personal data are subject to appropriate safeguards, which may include: standard contractual clauses approved by the relevant data protection authority; binding corporate rules where applicable; adequacy decisions where the destination country's data protection standards are recognised as equivalent to international standards; or the specific data processing agreement terms applicable to each third-party recipient.

Where personal data is transferred to jurisdictions outside Pakistan in connection with payment processing through JazzCash, EasyPaisa, or international card networks, such transfers are governed by the relevant payment network's own data protection frameworks, which winpk has assessed as providing adequate protection for player payment data.

winpk reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, winpk's data processing practices, or its international gaming licence requirements. All changes to this Policy will be reflected in an updated "Last Updated" date at the top of this page.

Where changes to this Privacy Policy are material — meaning they significantly affect the nature of the data winpk collects, the purposes for which it is used, or the rights available to players — winpk will notify registered players by email to the registered address at least fourteen (14) days before the changes take effect. Your continued use of the winpk Platform after the effective date of any update constitutes your acceptance of the revised Policy.

If you do not agree with any changes to this Privacy Policy, you are entitled to close your winpk account in accordance with the account closure procedure described in winpk's Terms & Conditions. Any data retained following account closure will be handled in accordance with the retention periods set out in Section 7 of this Policy.

For all privacy-related enquiries, data subject access requests, marketing opt-out requests, or complaints regarding winpk's data processing practices, please contact the winpk Data Protection team using the details below:

• Email: [email protected] — Subject line: "Privacy Enquiry" or "Data Subject Request"
• Live Chat: Available 24/7 in English and Urdu via your winpk account dashboard — type "Privacy" in the initial message to be routed to the appropriate team.
• Response Time: winpk acknowledges all privacy enquiries within 48 hours and resolves data subject requests within 30 calendar days.

If you are a player based in Pakistan and you are not satisfied with winpk's response to your privacy complaint, you may escalate your complaint to the dispute resolution body designated by winpk's international gaming licence authority, details of which are available on the winpk website. winpk is committed to resolving all data protection concerns fairly and transparently.