1. Introduction
EPWin ("EPWin", "we", "us", "the Platform") is committed to protecting the personal information of every player who registers and plays on our platform. This Privacy Policy describes how EPWin collects, processes, stores, and protects the personal data of users based in Pakistan who access the EPWin website at epwin.app.
This Policy applies to all users of the EPWin platform regardless of the device or method used to access it, including through a web browser on a mobile phone, tablet, laptop, or desktop computer. It covers all personal data collected from the point of registration, throughout your active use of EPWin, and for the period following account closure during which data may be retained for legal and regulatory purposes.
Your agreement: By creating an account on EPWin and using our services, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree, please do not register an account or use EPWin's services.
This Privacy Policy should be read alongside EPWin's Terms and Conditions and Responsible Gaming Policy. Together these documents form the complete framework governing your relationship with EPWin.
2. Personal Data We Collect
EPWin collects personal data from you in several ways — directly when you provide it during registration or support interactions, automatically as you use the platform, and in limited circumstances from third-party payment processors and verification services. Below is a detailed breakdown of the categories of data EPWin collects.
2.1 Registration and Account Data
- Full legal name as it appears on your CNIC (Computerised National Identity Card)
- Date of birth (to verify minimum age of 18 years)
- Pakistani mobile phone number
- Email address (where provided)
- Username and password (password stored in hashed, non-readable form)
- City and province of residence
2.2 Identity Verification Data
- CNIC number and a copy or photograph of the CNIC document
- Selfie photograph or video for identity matching (where required for enhanced verification)
- Proof of address documents such as a utility bill or bank statement
2.3 Financial and Payment Data
- Mobile wallet identifiers (Easypaisa account number, JazzCash number, NayaPay/SadaPay account details)
- Bank account details for IBFT transfers (account title, bank name, IBAN)
- Partial card details for Visa/Mastercard transactions (last four digits, expiry, card type — full card numbers are processed by our payment gateway, not stored by EPWin)
- Transaction history: deposit amounts, withdrawal amounts, dates, and payment method used
2.4 Gaming and Betting Activity Data
- Bets placed, games played, stakes, outcomes, and winnings
- Session duration, session frequency, and time-of-day patterns
- Bonus offers claimed and wagering progress
- Game preferences and browsing history within the EPWin platform
2.5 Technical and Device Data
- IP address at time of registration and subsequent logins
- Device type, operating system, and browser type
- Mobile network operator (e.g., Jazz, Telenor, Zong, Ufone, Warid)
- Cookies and similar tracking technologies (see Section 9)
2.6 Communication Data
- Records of live chat, WhatsApp, Telegram, and email interactions with EPWin's support team
- Feedback, complaints, and dispute records
3. How EPWin Uses Your Personal Data
EPWin uses the personal data it collects for specific, defined purposes. We do not use your data in ways you would not reasonably expect. The primary purposes for which EPWin processes your personal data are:
EPWin does not use your data to make fully automated decisions that have legal or similarly significant effects on you without an opportunity for human review. If automated systems flag your account for any reason (fraud detection, responsible gaming triggers), the matter is reviewed by a member of EPWin's team before action is taken.
4. Legal Basis for Processing
EPWin processes your personal data on one or more of the following legal bases depending on the specific purpose:
- Contractual necessity: Processing required to deliver the services you have contracted for when creating an EPWin account — including account management, payment processing, and game delivery.
- Legitimate interests: Processing necessary for EPWin's legitimate business interests including fraud prevention, security monitoring, platform improvement, and responsible gaming compliance — provided those interests are not overridden by your rights.
- Legal obligation: Processing required to comply with applicable laws and regulatory requirements including anti-money laundering (AML) checks, identity verification, and financial record-keeping.
- Consent: Processing based on your specific, freely given consent — primarily for direct marketing communications. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.
5. Data Sharing and Third Parties
EPWin does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. However, EPWin may share specific data with carefully selected third parties in the following limited circumstances:
5.1 Payment Service Providers
To process deposits and withdrawals, EPWin shares relevant payment data with authorised Pakistani payment gateways and mobile wallet operators (Easypaisa, JazzCash, NayaPay, SadaPay) and banking partners. These providers are contractually bound to handle your data securely and solely for the purpose of processing your transactions.
5.2 Identity Verification Services
EPWin uses third-party Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance services to verify player identities. Where required, CNIC details and supporting documents may be submitted to these services. All such providers are contractually bound to strict data protection standards.
5.3 Technology Infrastructure
EPWin uses cloud hosting, database management, and cybersecurity services operated by third-party technology providers. These providers access data only to the extent necessary to provide their contracted services and are prohibited from using EPWin player data for any other purpose.
5.4 Game Software Providers
Certain games on EPWin are powered by third-party game studios. These providers may receive technical session data (such as anonymised session IDs) to facilitate game delivery but do not receive personal identifying information about individual players.
5.5 Legal and Regulatory Disclosure
EPWin may disclose personal data to law enforcement agencies, regulatory authorities, or financial institutions where required by applicable law, court order, or where EPWin reasonably believes such disclosure is necessary to prevent fraud, money laundering, or other serious criminal activity.
No Data Sales: EPWin will never sell your personal data to advertisers, data brokers, or any other commercial third party. This is a firm commitment that forms part of our core operating principles.
6. Data Security
EPWin employs industry-standard and above-standard security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our key security measures include:
- SSL-256 encryption: All data transmitted between your device and EPWin's servers is encrypted using 256-bit SSL/TLS encryption — the same standard used by major global banks.
- Password hashing: User passwords are never stored in plain text. They are processed through a one-way cryptographic hash function, meaning EPWin staff cannot read your password.
- Segregated financial data: Payment method details are processed and tokenised by certified payment gateways. Raw financial credentials are never stored on EPWin's core servers.
- Access controls: EPWin staff access to personal data is strictly limited by role. Only staff with a verified operational need can access specific categories of player data, and all access is logged.
- Fraud monitoring: Automated systems monitor account activity, login attempts, and transaction patterns in real time to detect and respond to suspicious activity.
- Regular security audits: EPWin conducts periodic security reviews and penetration testing to identify and address vulnerabilities before they can be exploited.
Your responsibility: While EPWin works hard to secure your data on our end, you are responsible for keeping your login credentials confidential. Never share your password with anyone — EPWin staff will never ask for your full password in any communication.
7. Data Retention
EPWin retains your personal data for as long as your account is active and for a defined period after account closure, as required by applicable laws and our own operational policies.
- Active accounts: Data is retained for the full duration that your EPWin account remains open.
- After account closure: EPWin retains account and transaction data for a minimum of five years following account closure to comply with anti-money laundering regulations, financial record-keeping requirements, and to handle any disputes arising after closure.
- Identity verification documents: CNIC copies and supporting identity documents are retained for the same five-year period following account closure unless a longer period is required by law.
- Marketing data: If you withdraw consent for marketing communications, your data is removed from marketing lists promptly and no further communications are sent. This does not affect retention of other data categories.
- Technical logs: Server and security logs are retained for up to 24 months for security investigation and fraud prevention purposes.
Once the applicable retention period expires, your data is securely deleted or anonymised such that it can no longer be associated with you as an individual.
8. Your Data Rights
As an EPWin player based in Pakistan, you have the following rights in relation to your personal data. To exercise any of these rights, contact EPWin at support@epwin.app with your account details and the specific request.
Right of Access
Request a copy of the personal data EPWin holds about you. We will respond within 30 days of receiving a verified request.
Right to Rectification
Request correction of inaccurate or incomplete personal data. Some corrections may require identity re-verification.
Right to Erasure
Request deletion of your data where there is no longer a legitimate legal or contractual reason to retain it. Note: regulatory retention requirements may limit deletion scope.
Right to Object
Object to processing of your data for marketing purposes at any time. You can opt out of all marketing communications via your account settings or by contacting support.
Right to Restriction
Request that EPWin restricts the processing of your data in certain circumstances — for example while a dispute or rectification request is being resolved.
Right to Portability
Request a copy of your data in a structured, machine-readable format so you can transfer it to another service provider where technically feasible.
EPWin will respond to all verified data rights requests within 30 calendar days. In complex cases, an extension of up to an additional 30 days may be required, and you will be informed promptly if this is the case.
9. Cookies and Tracking Technologies
EPWin uses cookies and similar tracking technologies to make the platform work correctly, remember your preferences, and analyse usage patterns to improve the experience for Pakistani players.
A cookie is a small text file placed on your device when you visit a website. It does not give EPWin access to your device or any personal data beyond what is described below.
You can manage your cookie preferences through your browser settings. Please note that disabling essential cookies will prevent you from logging in or using core platform features. EPWin does not use cookies for cross-site advertising or to build advertising profiles.
10. Minors and Under-18 Policy
EPWin's platform is strictly for adults aged 18 and above. EPWin does not knowingly collect, store, or process personal data belonging to anyone under 18 years of age.
If EPWin discovers or is notified that an account belongs to a minor, the account will be closed immediately, all funds will be forfeited, and all personal data associated with the account will be deleted as quickly as is legally permissible. Where required, the matter may be reported to relevant Pakistani authorities.
Parents and guardians: If you believe a minor in your household has registered an EPWin account, please contact us immediately at support@epwin.app. We will investigate and close the account promptly.
11. Marketing Communications
With your consent, EPWin may send you promotional communications about new games, bonuses, tournaments, cricket betting specials, and other offers relevant to Pakistani players. These communications may be sent via SMS to your registered mobile number, or via WhatsApp and Telegram on the channels you have opted into through your account settings.
You can opt out of marketing communications at any time through any of the following methods:
- Updating your communication preferences in your EPWin account settings under "Notifications"
- Replying "STOP" to any SMS received from EPWin
- Contacting EPWin's support team at support@epwin.app with a request to unsubscribe from all marketing
Opting out of marketing will not affect your ability to use EPWin's platform, and EPWin will continue to send essential account-related communications (such as deposit confirmations, withdrawal notifications, and security alerts) regardless of your marketing preferences.
EPWin does not share your contact details with third-party marketers and will never send you unsolicited commercial communications on behalf of any other brand or organisation.
12. Changes to This Privacy Policy
EPWin may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify active players via the mobile number or email associated with their account, or through a prominent notification on the EPWin platform.
The effective date of the current version of this Policy is displayed at the top of this page. It is your responsibility to review the Privacy Policy periodically. Continuing to use EPWin after a revised Policy takes effect constitutes acceptance of the updated terms.
If you disagree with any changes made to this Policy, you may close your EPWin account. EPWin will return your verified balance and delete your data in accordance with Section 7 of this Policy.
13. Contact EPWin About Your Privacy
If you have questions, concerns, or requests relating to this Privacy Policy or how EPWin handles your personal data, please contact us through the following channels: