winpakar Privacy Policy

1 About This Policy

This Privacy Policy sets out how winpakar collects, uses, stores, and protects the personal data of players and visitors to winpakar.org, in accordance with the data protection obligations imposed by winpakar's international gaming licence and applicable privacy legislation. winpakar is committed to handling your personal data lawfully, fairly, and transparently.

This Policy should be read alongside winpakar's Terms and Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Privacy Policy and any other winpakar document, this Privacy Policy shall prevail in relation to data protection matters.

winpakar may update this Privacy Policy from time to time in response to changes in applicable law, regulatory guidance, or our internal data practices. The most current version will always be published at winpakar.org/privacy-policy with the "Last Updated" date shown at the top of this page.

2 Personal Data We Collect

winpakar collects the following categories of personal data from players and visitors:

2.1 Identity & Contact Data

• Full legal name as it appears on your CNIC or passport;
• Date of birth (to verify you are 21 years of age or older);
• CNIC number or passport number for KYC verification;
• Residential address (including city — Karachi, Lahore, Islamabad, Faisalabad, etc.);
• Pakistani mobile number and email address.

2.2 Financial Data

• JazzCash or EasyPaisa mobile wallet account details;
• HBL, UBL, or Meezan Bank account details where used for deposits or withdrawals;
• Debit card details (card number, expiry, billing address — stored in tokenised form only);
• Transaction history including deposit amounts, withdrawal amounts, and dates in PKR.

2.3 Gaming & Activity Data

• Bet history, game session data, and wagering records;
• Account login timestamps, session durations, and device identifiers;
• Responsible gaming tool usage (deposit limits set, self-exclusion requests, cooling-off periods);
• Bonus and promotion usage history.

2.4 Technical & Device Data

• IP address and approximate geographic location derived from IP;
• Browser type and version, operating system, and device type;
• Pages visited on winpakar.org, referral source, and time spent on pages;
• Cookie identifiers and similar tracking technologies (see Section 7).

2.5 Communications Data

• Records of correspondence with winpakar support, including emails, live chat transcripts, and complaint records;
• Survey and feedback responses where voluntarily submitted.

3 How We Collect Your Data

winpakar collects personal data through the following channels:

3.1 Direct Collection

Data you provide directly when you register a winpakar account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion. This is the primary source of personal data for registered players.

3.2 Automated Collection

Data collected automatically as you browse and interact with winpakar.org, including through cookies, web beacons, and server logs. This data helps winpakar maintain platform security, improve the user experience, and detect fraudulent activity. See Section 7 for full details of our cookie practices.

3.3 Third-Party Sources

winpakar may receive personal data from third-party sources in limited circumstances, including:

• Identity verification providers — to confirm the accuracy of CNIC or passport data submitted during KYC;
• Payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) — to confirm payment method ownership and transaction status;
• Fraud prevention and AML screening services — to cross-reference player identity against sanctions lists and fraud databases;
• Regulatory and law enforcement authorities — where lawfully required to share or receive data under winpakar's licensing obligations.

4 How We Use Your Personal Data

winpakar uses the personal data collected for the following defined purposes:

5 Legal Basis for Processing

winpakar processes your personal data on the following legal bases:

• Contractual necessity — processing required to perform our obligations under the winpakar Terms and Conditions, including account management, payment processing, and dispute resolution;
• Legal obligation — processing required to comply with winpakar's international gaming licence, AML regulations, and any applicable regulatory direction;
• Legitimate interests — processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics, where those interests are not overridden by your privacy rights;
• Consent — where you have given specific, informed consent to a processing activity (such as receiving marketing communications). Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6 Sharing Your Personal Data

winpakar does not sell your personal data. We share personal data with third parties only in the following defined circumstances:

6.1 Service Providers

winpakar engages carefully selected third-party service providers who process personal data on our behalf under strict contractual data processing agreements. These include KYC and identity verification providers, payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank), fraud prevention services, cloud hosting providers, and customer support platform operators. All such providers are contractually prohibited from using your data for any purpose other than the specific service they provide to winpakar.

6.2 Game Providers

Where you play third-party casino games available through the winpakar platform, limited technical data (such as session tokens and player identifiers) may be shared with the relevant game provider for the purpose of delivering the game and recording the result. Game providers do not receive your CNIC, financial account details, or full contact information.

6.3 Regulatory & Legal Disclosures

winpakar may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by law, court order, or our licensing obligations — including in the context of AML investigations or fraud proceedings. winpakar will notify affected players of such disclosures where legally permitted to do so.

6.4 Business Transfers

In the event that winpakar undergoes a merger, acquisition, or sale of all or part of its business, personal data held by winpakar may be transferred to the acquiring entity as part of that transaction. Affected players will be notified in advance of any such transfer and of any material change to data handling practices that results from it.

7 Cookies & Tracking Technologies

winpakar.org uses cookies and similar tracking technologies to provide a functional, secure, and personalised browsing experience. Cookies are small text files stored on your device by your browser. The following categories of cookies are used on winpakar.org:

• Strictly Necessary Cookies — essential to the operation of the platform, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing core platform functionality;
• Functional Cookies — remember your preferences such as language settings and responsible gaming tool configurations;
• Analytics Cookies — collect aggregated, anonymised data about how players navigate winpakar.org, used to identify performance issues and improve the platform experience;
• Security Cookies — detect and prevent fraudulent login attempts, bot activity, and suspicious navigation patterns.

winpakar does not use third-party advertising or behavioural tracking cookies that profile your activity across external websites. You can manage cookie preferences through your browser settings at any time. Disabling analytics or functional cookies may affect your experience on winpakar.org but will not prevent access to core betting and gaming services.

8 Data Security

winpakar implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and winpakar servers;
• Encryption at rest for sensitive personal and financial data stored on winpakar infrastructure;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular independent security audits and penetration testing of winpakar's platform and infrastructure;
• Multi-factor authentication requirements for all internal winpakar system access;
• Documented incident response procedures for the management of any personal data breach.

In the event of a personal data breach that poses a risk to your rights and freedoms, winpakar will notify the relevant regulatory authority within 72 hours of becoming aware of the breach, and will notify affected players without undue delay where the breach is likely to result in a high risk to those individuals.

You play an important role in keeping your winpakar account secure. You are responsible for maintaining the confidentiality of your login credentials and for notifying winpakar immediately if you suspect unauthorised access to your account.

9 Data Retention

winpakar retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by law or our licensing obligations. The following general retention periods apply:

• Account and identity data — retained for the duration of your winpakar account plus a minimum of 5 years following account closure, in accordance with AML record-keeping requirements;
• Financial transaction records — retained for a minimum of 5 years from the date of each transaction;
• Gaming and betting records — retained for the duration of your account plus 2 years following closure;
• Customer support communications — retained for 3 years from the date of the interaction;
• Marketing consent records — retained for the duration of your consent plus 1 year to evidence compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (which can no longer identify you) may be retained indefinitely for statistical and platform improvement purposes.

10 Your Data Rights

winpakar respects your rights over your personal data. Subject to applicable law and our licensing obligations, you hold the following rights in relation to the personal data winpakar holds about you:

• Right of Access — you may request a copy of the personal data winpakar holds about you, together with information about how it is used;
• Right to Rectification — you may request that inaccurate or incomplete personal data be corrected;
• Right to Erasure — you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to any overriding legal retention obligations;
• Right to Restriction — you may request that winpakar restrict processing of your data in certain circumstances, such as while a rectification request is being assessed;
• Right to Portability — you may request that data you provided to winpakar be returned to you in a structured, machine-readable format;
• Right to Object — you may object to processing based on legitimate interests, including direct marketing;
• Right to Withdraw Consent — where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact winpakar's support team. winpakar will respond to all data rights requests within 30 days. We may request proof of identity before processing a data rights request to protect against fraudulent or unauthorised requests.

11 Children & Minors

winpakar's services are strictly intended for adults aged 21 years and over. winpakar does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the winpakar registration process, and winpakar reserves the right to request documentary proof of age at any point.

If winpakar becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all transactions voided, and any data collected deleted in accordance with our data retention procedures. If you are a parent or guardian and believe your child has registered a winpakar account, please contact our support team immediately so that appropriate action can be taken.

12 International Data Transfers

winpakar operates under an international gaming licence and uses cloud infrastructure and service providers that may be located outside Pakistan. Where personal data is transferred to a country that does not provide an equivalent level of data protection to that applicable in Pakistan, winpakar will implement appropriate safeguards to protect your data, including:

• Standard contractual clauses approved by the relevant data protection authority;
• Binding corporate rules where applicable to intra-group transfers;
• Transfers to jurisdictions recognised as providing an adequate level of data protection by applicable regulatory standards.

You may request details of the specific safeguards in place for any particular international transfer by contacting winpakar's support team.

13 Changes to This Privacy Policy

winpakar reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or regulatory guidance. Material changes — for example, changes to the categories of data collected, new purposes for which data is used, or new third-party sharing arrangements — will be communicated to registered players via email to the address on record at least 14 days before the amended Policy takes effect.

Non-material changes (such as corrections to typographical errors or clarifications that do not alter the substance of the Policy) may be made without advance notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. Your continued use of winpakar.org following the effective date of any update constitutes acceptance of the revised Privacy Policy.

14 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how winpakar has handled your personal data, please contact our support team. Our Data Protection contact address is:

[email protected]

Please mark your correspondence "Privacy Enquiry" or "Data Rights Request" to ensure it is directed to the correct team. winpakar aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days.

If you are not satisfied with winpakar's response to your privacy complaint, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction where you believe the processing infringement occurred, or to the dispute resolution body under winpakar's gaming licence. Contact details for the relevant supervisory authority are available on request from our support team.