epiwin Privacy
Policy

1 Who We Are

epiwin is an online gaming and sports betting platform accessible at epiwin.org. epiwin offers cricket betting, live casino games, slot games, and sports betting markets to registered players, with a primary focus on serving Pakistani users across major cities including Karachi, Lahore, Islamabad, Faisalabad, and Rawalpindi.

For the purposes of this Privacy Policy, epiwin acts as the data controller in respect of the personal data it collects and processes from players and visitors to the epiwin Platform. As data controller, epiwin determines the purposes for which personal data is processed and the means by which that processing is carried out.

2 Data We Collect

epiwin collects personal data from players and Platform visitors in the categories described below. We apply the principle of data minimisation throughout — only the data genuinely necessary for each stated purpose is collected.

3 How We Collect Data

epiwin collects personal data through the following channels:

• Account Registration: When you register an Account on epiwin.org, you directly provide your name, date of birth, email address, mobile number, and residential address.
• KYC Verification: When completing identity verification, you upload a copy of your CNIC, passport, or driving licence. This document is processed by epiwin's KYC verification system.
• Deposits and Withdrawals: When you make a payment transaction, epiwin receives transaction details from your chosen payment provider — such as JazzCash, EasyPaisa, HBL, or UBL — necessary to process and reconcile the transaction.
• Platform Usage: As you browse and use the epiwin Platform, technical and usage data is automatically collected via server logs, session tracking, and analytics tools. This happens for all visitors, whether or not they are registered.
• Cookies and Similar Technologies: epiwin uses cookies and similar tracking technologies to collect device and usage information. Full details are provided in Section 9 of this Policy.
• Customer Support Interactions: When you contact epiwin's support team via live chat or email, the content and metadata of those communications are recorded for quality assurance and dispute resolution purposes.
• Third-Party Verification Services: Where required, epiwin may use third-party identity verification or fraud screening services to cross-reference the information you provide during registration or KYC.

4 Why We Use Your Data

epiwin uses the personal data it collects for the following specific purposes:

• Account creation and management: To set up and maintain your epiwin Account, verify your identity, and provide you with access to all Platform features.
• Age and identity verification (KYC): To confirm that you are 21 years of age or older and that your identity matches the payment methods registered to your Account, in compliance with our responsible gaming and regulatory obligations.
• Payment processing: To facilitate deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and USDT TRC20 efficiently and securely.
• Providing gaming services: To operate cricket betting, live casino, slot games, and sports betting markets, to record bet and game outcomes, and to calculate and credit winnings accurately.
• Responsible gaming monitoring: To identify patterns of play that may indicate problem gambling behaviour, to enforce deposit limits and self-exclusion requests, and to contact players who may be experiencing gambling-related harm.
• Fraud prevention and security: To detect and investigate suspicious account activity, fraudulent payment behaviour, bonus abuse, multi-accounting, and any other form of platform misuse.
• Anti-money laundering (AML) compliance: To monitor transactions for suspicious financial activity and to fulfil epiwin's reporting obligations to relevant financial intelligence authorities where required by law.
• Customer support: To respond to your support enquiries, resolve disputes, handle complaints, and improve the overall quality of epiwin's customer service.
• Platform improvement: To analyse aggregated, anonymised usage data in order to improve the design, performance, and content of the epiwin Platform for all Pakistani players.
• Marketing communications: To send you relevant promotional communications about epiwin bonuses, PSL cricket betting promotions, and new Platform features — but only where you have explicitly opted in to receive such communications.
• Legal compliance: To meet epiwin's obligations under applicable data protection, gaming regulation, financial crime prevention, and consumer protection laws.

5 Legal Basis for Processing

epiwin processes your personal data only where a valid legal basis exists under applicable data protection law. The legal bases epiwin relies upon are as follows:

• Contractual necessity: Processing is necessary to perform the contract between you and epiwin — specifically, to operate your Account, process payments, and deliver gaming services. This is the primary legal basis for core account and payment data processing.
• Legal obligation: Processing is necessary to comply with epiwin's legal obligations, including KYC identity verification, AML transaction monitoring, and regulatory reporting requirements.
• Legitimate interests: Processing is necessary for epiwin's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving our services — provided those interests are not overridden by your fundamental data protection rights.
• Consent: For marketing communications and non-essential cookies, epiwin processes your data only where you have given freely provided, specific, informed, and unambiguous consent. You may withdraw this consent at any time with immediate effect.

6 Who We Share Data With

epiwin does not sell, rent, or share your personal data with third parties for their own marketing or commercial purposes under any circumstances. epiwin shares personal data only in the following strictly limited circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and USDT TRC20 processors receive the minimum transaction data necessary to process your deposit or withdrawal.
• KYC and identity verification providers: epiwin uses trusted third-party KYC service providers to assist with identity document verification. These providers process your identity data solely for verification purposes under strict data processing agreements.
• Game content providers: Live casino and slot game providers such as Evolution Gaming and Pragmatic Play receive session data necessary to deliver their games within the epiwin Platform. These providers operate under their own privacy policies and epiwin data processing agreements.
• Fraud and security screening providers: epiwin uses specialist fraud detection services that may process IP addresses, device fingerprints, and transaction metadata to identify and prevent fraudulent activity on the Platform.
• Regulatory authorities: epiwin will share personal data with gaming regulators, financial intelligence units, or law enforcement agencies where required to do so by applicable law or a valid legal order. epiwin will not notify you of such disclosure where prohibited by law from doing so.
• Professional advisers: epiwin's legal advisers, auditors, and compliance consultants may access personal data on a strictly confidential, need-to-know basis in connection with their professional services to epiwin.

7 International Data Transfers

The epiwin Platform serves players primarily in Pakistan, but its infrastructure and some of its third-party service providers operate in other countries. As a result, your personal data may be transferred to and stored in countries outside Pakistan, including countries within the European Economic Area (EEA) and other jurisdictions.

Where personal data is transferred internationally, epiwin ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection laws. These safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities, incorporated into agreements with all international data processors.
• Transfers only to countries or organisations that have been assessed as providing an adequate level of data protection for the specific processing activity involved.
• Application of epiwin's own data protection standards and security requirements to all international processing arrangements, regardless of the legal framework in the destination country.

You may request further information about the specific safeguards in place for any international transfer of your personal data by contacting epiwin's support team via in-platform live chat.

8 Data Retention

epiwin retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or anonymised in accordance with epiwin's data destruction procedures. Anonymised data — from which no individual can be identified — may be retained indefinitely for statistical and analytical purposes.

9 Cookies & Tracking Technologies

epiwin uses cookies and similar technologies on epiwin.org to ensure the Platform functions correctly, to keep your session secure, to detect fraudulent activity, and to understand how players use the Platform so that we can improve it.

You can manage or withdraw your cookie consent at any time by clearing your browser cookies and revisiting epiwin.org, where the cookie consent banner will reappear. Note that disabling strictly necessary cookies may affect the functionality of the epiwin Platform.

10 Your Data Rights

As a player on the epiwin Platform, you have the following rights in relation to your personal data. epiwin is committed to honouring all valid data rights requests within 30 calendar days of receipt.

• Right of Access: You have the right to request a copy of all personal data epiwin holds about you, along with information about how that data is used and with whom it is shared. Submit a subject access request via in-platform live chat or by emailing [email protected].
• Right to Rectification: If any personal data epiwin holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing and no overriding legitimate grounds exist. This right is subject to epiwin's legal retention obligations — certain financial and identity data must be retained for regulatory compliance even after Account closure.
• Right to Restriction of Processing: You may request that epiwin temporarily restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being verified following a rectification request.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to epiwin in a structured, commonly used, machine-readable format, and to request that this data be transmitted directly to another service provider where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data where epiwin relies on legitimate interests as its legal basis. You may also object at any time to the use of your data for direct marketing purposes, with immediate effect.
• Rights Related to Automated Decision-Making: If epiwin makes a solely automated decision that significantly affects you — such as an automated Account suspension triggered by fraud detection systems — you have the right to request human review of that decision.

11 Children & Minors

The epiwin Platform is strictly intended for adults aged 21 years and over. epiwin does not knowingly collect personal data from any individual under the age of 21. Age verification is conducted as part of the registration process and again prior to processing any withdrawal.

If epiwin becomes aware that personal data has been collected from an individual who is under 21 years of age, the following steps will be taken immediately:

• The Account will be suspended pending investigation.
• All personal data associated with the under-age Account will be permanently deleted from epiwin's systems as promptly as possible, subject to any overriding legal obligations.
• Any deposits made by the under-age player will be returned to the original payment method where technically possible.
• Any winnings accumulated by the under-age Account will be forfeited in full.

12 Security Measures

epiwin maintains a comprehensive information security programme designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and epiwin servers is encrypted using industry-standard TLS 1.2 or higher protocols.
• Encryption at Rest: Sensitive personal data, including KYC documents and financial data, is stored in encrypted form on epiwin's secured servers. Encryption keys are managed under strict access controls.
• Access Controls: Access to personal data within epiwin's internal systems is strictly limited on a need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and undergo regular data protection training.
• Two-Factor Authentication (2FA): epiwin offers 2FA for player accounts and mandates 2FA for all internal staff accounts with access to player data systems.
• Intrusion Detection and Monitoring: epiwin's infrastructure is monitored 24/7 for suspicious activity, unauthorised access attempts, and anomalous data flows by dedicated security systems.
• Penetration Testing: epiwin's Platform undergoes regular third-party security penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: epiwin maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, epiwin will notify affected players and relevant authorities within the timeframes required by applicable law.

13 Third-Party Services

The epiwin Platform integrates with a number of third-party service providers to deliver certain features and functionality. While epiwin carefully selects and vets all third-party providers, each provider operates under its own privacy policy in respect of the data it processes on its own systems.

Third-party integrations present on the epiwin Platform include:

• Live game providers (such as Evolution Gaming and Pragmatic Play) for live casino and slot game content delivery.
• Payment gateway providers for the processing of JazzCash, EasyPaisa, and bank transfer transactions.
• KYC and identity verification services for automated document verification and liveness checks.
• Analytics platforms that receive anonymised, aggregated usage data to help epiwin understand how the Platform is used and where improvements can be made.
• Fraud and risk management services that process technical data such as IP addresses and device identifiers for real-time fraud screening.

epiwin requires all third-party providers to process personal data only in accordance with epiwin's instructions and to maintain security standards consistent with those described in this Privacy Policy. epiwin does not permit third-party providers to use personal data received from epiwin for their own independent marketing or commercial purposes.

14 Policy Updates

epiwin may update this Privacy Policy from time to time to reflect changes in applicable law, changes in epiwin's data processing practices, or changes in the services epiwin offers. The effective date at the top of this Policy will be updated whenever a substantive change is made.

Where a proposed change to this Privacy Policy materially affects your rights or the way in which epiwin processes your personal data, epiwin will notify registered players by email or via a prominent in-platform notification at least 14 days before the change takes effect. Continued use of the epiwin Platform after the effective date of a Policy update constitutes acceptance of the updated Policy.

epiwin encourages all players to review this Privacy Policy periodically. The most current version of the epiwin Privacy Policy is always available at epiwin.org/privacy-policy. If you disagree with any changes to this Policy, you have the right to close your Account and request deletion of your data in accordance with Section 10 above.

15 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or to epiwin's handling of your personal data, please contact epiwin's customer support team in the first instance:

• In-platform live chat: Available 24/7 directly within the epiwin Platform — the fastest way to reach us.
• Email: [email protected] — epiwin aims to acknowledge all email enquiries within 24 hours and to provide a substantive response within 5 business days.

If you are not satisfied with epiwin's response to your data protection concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. epiwin will cooperate fully with any such investigation and will implement any remedial action required by the supervisory authority.