Privacy Policy

WinPKP ("the Platform", "we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access or use the online casino and sports betting services available at https://winpkp.cam. This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed.

This Policy applies to all current and former registered users ("Players", "you", "your") and to visitors who access the Platform without creating an account. It covers data collected through the website, any associated mobile interfaces and any communications exchanged between you and our support team.

WinPKP processes personal data in accordance with applicable international data protection standards consistent with the operator's licensing jurisdiction. We do not claim that our data processing practices are overseen by or compliant with any Pakistani domestic data protection authority, nor do we claim endorsement by the Government of Pakistan, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan or any Pakistani financial institution.

The following capitalised terms carry the meanings below throughout this Policy:

We collect the following categories of Personal Data in the course of operating the Platform:

3.1 Registration and Identity Data

• Full legal name, date of birth and gender;
• Email address and account password (stored in hashed form);
• Country and city of residence (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar);
• Contact telephone number (where provided);
• CNIC number and copies of government-issued identity documents submitted for KYC verification.

3.2 Financial Data

• Deposit and withdrawal transaction records denominated in PKR;
• Payment method references associated with your Account (e.g., last four digits of a card, wallet identifiers — note: full card numbers are never stored on Platform servers);
• Source of funds documentation submitted in connection with enhanced due diligence procedures.

3.3 Technical and Usage Data

• IP address, browser type, device type and operating system;
• Session timestamps, pages visited and features accessed;
• Betting history, game history and wager amounts;
• Responsible-gambling limit settings and self-exclusion records.

3.4 Communications Data

• Content of support ticket exchanges, live chat transcripts and email correspondence;
• Feedback and survey responses submitted voluntarily.

Personal Data is collected through the following channels:

• Direct submission: Information you provide when completing the registration form, submitting KYC documents, contacting support or responding to surveys;
• Automated collection: Technical and usage data collected automatically as you browse and interact with the Platform, including via Cookies and server log files;
• Third-party sources: Identity verification and fraud-prevention data received from KYC and anti-money-laundering service providers engaged by the Platform;
• Payment processors: Transaction confirmation data received from third-party payment gateways used to process deposits and withdrawals;
• Analytics providers: Aggregated behavioural data from analytics tools used to improve platform performance and user experience.

We process your Personal Data only where a lawful basis exists. The table below summarises the primary purposes and the corresponding legal basis for each processing activity:

Where we rely on legitimate interests as a lawful basis, we have assessed that our interests are not overridden by your rights and freedoms, taking into account the reasonable expectations of a person using an online gaming platform.

6.1 We do not sell your Personal Data. WinPKP does not sell, rent or trade your Personal Data to third parties for their own marketing or commercial purposes.

6.2 Authorised disclosures. We may share your Personal Data with the following categories of recipients, strictly for the purposes described in Section 5:

• KYC and compliance service providers: Third-party identity verification and AML screening platforms that process your identity documents on our behalf under contractual data processing agreements;
• Payment processors: Payment gateways and financial intermediaries required to process deposits and withdrawals. Note that payment references such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are mentioned for contextual reference only — the Platform does not imply that any such provider processes gambling transactions;
• Technology and hosting providers: Cloud infrastructure and platform-as-a-service providers that store and process data on our behalf in secure data centres;
• Analytics providers: Aggregated, pseudonymised data shared with analytics tools for platform improvement purposes;
• Legal and regulatory authorities: Where we are required by applicable law, court order, or the directive of a competent regulatory authority to disclose Personal Data.

6.3 Business transfers. In the event of a merger, acquisition or sale of all or part of the Platform's operations, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via a notice on the Platform.

WinPKP uses Cookies and similar tracking technologies to maintain session state, remember your preferences and collect anonymised usage analytics. The categories of Cookies we deploy are:

You may manage Cookie preferences through your browser settings. Disabling Cookies other than Strictly Necessary ones may limit your access to certain Platform features. Instructions for managing Cookies are available in your browser's help documentation.

We retain Personal Data for no longer than is necessary for the purposes for which it was collected, subject to applicable legal obligations. The indicative retention periods below apply unless a longer period is required by law or legitimate business necessity:

• Account registration data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, to satisfy AML and operator-licence record-keeping obligations;
• KYC documentation: Retained for a minimum of five (5) years from the date of submission or from account closure, whichever is later;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction;
• Responsible-gambling records: Self-exclusion and limit-setting records retained for the duration applicable to the self-exclusion period plus a minimum of two (2) years;
• Support communications: Retained for two (2) years from the date of the last communication;
• Analytics data: Retained in aggregated, anonymised form indefinitely; pseudonymised individual records retained for twelve (12) months.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our internal data disposal procedures.

WinPKP implements appropriate technical and organisational measures to protect Personal Data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using Transport Layer Security (TLS/SSL);
• Encryption at rest: Sensitive Personal Data stored in our databases is encrypted at rest using industry-standard encryption algorithms;
• Password hashing: Account passwords are stored as salted cryptographic hashes — we do not store your password in readable form;
• Access controls: Access to Personal Data by Platform staff is restricted on a need-to-know basis and is subject to role-based access controls and audit logging;
• Penetration testing: The Platform is subject to periodic security assessments by qualified third parties;
• Incident response: We maintain a documented data-breach incident response procedure and will notify affected individuals and relevant regulatory authorities in accordance with applicable legal requirements.

Subject to applicable law and the legal bases on which we process your data, you may exercise the following rights with respect to your Personal Data held by WinPKP:

To exercise any of the above rights, please contact us at [email protected] with a clear description of your request. We will acknowledge your request within five (5) business days and respond substantively within thirty (30) days, subject to identity verification.

Personal Data collected from you may be transferred to, and processed in, countries outside of Pakistan. This includes transfers to the jurisdiction(s) in which the Platform's hosting infrastructure is located and where our service providers operate.

Where such transfers occur, we take steps to ensure that your Personal Data is afforded a level of protection consistent with applicable data protection standards. This may include:

• Transfers to countries recognised as providing an adequate level of data protection;
• Use of contractual data transfer mechanisms with Data Processors (such as standard contractual clauses or equivalent arrangements);
• Binding corporate rules where transfers are made within a group of entities.

By using the Platform from Pakistan or any other location, you acknowledge that your data may be transferred internationally for processing as described in this Policy.

WinPKP is strictly an adults-only platform. We do not knowingly collect Personal Data from individuals under the age of 18, or under the higher minimum age required by the operator's license jurisdiction. If we become aware that Personal Data has been submitted by a minor, we will take immediate steps to delete that data and close the associated account without processing any pending transactions.

If you are a parent or guardian and believe that a minor in your care has registered on the Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

The Platform may contain references to, or integrate with, third-party services including game providers, payment processing gateways and analytics platforms. This Policy applies solely to Personal Data processed by WinPKP in its capacity as Data Controller.

Third-party service providers operate under their own privacy policies and data processing terms. We are not responsible for the privacy practices of third-party services, and we encourage you to review the privacy policies of any third-party provider whose services you access through or in connection with the Platform.

Payment method names referenced on this Platform — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are mentioned for contextual familiarity only. WinPKP does not imply that any such provider endorses gambling, processes gambling transactions or is affiliated with this Platform. Users should review the terms and privacy policies of their chosen payment providers independently.

WinPKP reserves the right to update or amend this Privacy Policy at any time. Where a change is material — such as a change to the categories of Personal Data collected, a new purpose for processing, or a change to your rights — we will provide not less than fourteen (14) days' advance notice by posting a prominent notice on the Platform and sending an email to your registered address.

The date shown at the top of this page ("Last updated") reflects the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not accept the revised terms, please discontinue use of the Platform and contact support to request account closure.

We recommend that you review this Policy periodically to stay informed of how WinPKP protects your data.

If you have any questions about this Privacy Policy, wish to exercise your data rights or wish to raise a complaint about how your Personal Data has been handled, please contact us using the details below. All privacy-related requests are handled by our support team and are logged for compliance purposes.

If you are not satisfied with our response to your complaint, you may have the right to lodge a complaint with the relevant supervisory authority in the jurisdiction under whose law your data protection rights arise. The specific authority will depend on your country of residence and the Platform's licensing jurisdiction.