epiwin Privacy Policy

1.1  epiwin ("we," "us," "our," or "the Company") is committed to protecting the privacy and personal data of every player who uses our online gaming platform. This Privacy Policy has been prepared in accordance with applicable international data protection standards and reflects the data protection obligations imposed on epiwin by its gaming licence.

1.2  This Policy applies to all personal information collected, processed, stored, or shared by epiwin in connection with the operation of the epiwin platform at epiwin.one — including account registration, KYC verification, payment processing, sports betting, casino gaming, and customer support interactions.

1.3  For the purpose of this Policy, "personal data" means any information that identifies or can be used to identify a natural person — directly or indirectly — including name, CNIC number, mobile number, email address, financial information, IP address, and device identifiers.

1.4  We encourage all epiwin players, particularly first-time users from Karachi, Lahore, Faisalabad, Islamabad, and across Pakistan, to read this Policy carefully before creating an account or depositing funds. If you have any questions about how epiwin handles your data, you are welcome to contact us at [email protected].

2.1  For the purposes of applicable data protection law, epiwin acts as the data controller in respect of all personal data collected through the epiwin platform. As data controller, epiwin determines the purposes and means by which your personal data is processed.

2.2  epiwin operates under an internationally recognised gaming licence. Full licence details, including the name of the licensing authority and the licence number, are available on the epiwin About Us page at epiwin.one/about-us.

2.3  All enquiries relating to this Privacy Policy, including requests to exercise your data subject rights, should be directed to epiwin's support team:

3.1  epiwin collects only the personal data that is necessary to provide the services described on the epiwin platform. The categories of personal data we collect are as follows:

3.1.1  Identity Data

• Full legal name (as it appears on your Pakistani CNIC)
• Date of birth (for age verification — minimum age 21)
• CNIC number and a copy of your CNIC document
• Selfie photograph for facial matching during KYC verification
• Gender (as stated on CNIC, if provided)

3.1.2  Contact Data

• Pakistani mobile phone number (primary account identifier)
• Email address
• City of residence (e.g., Karachi, Lahore, Rawalpindi) where provided

3.1.3  Financial & Transaction Data

• JazzCash or EasyPaisa mobile wallet number used for deposits and withdrawals
• Bank account details for HBL, UBL, or Meezan Bank transfers where applicable
• All deposit, withdrawal, and transaction amounts in PKR
• Bet history, game history, and account balance records

3.1.4  Technical & Usage Data

• IP address and geolocation data at login
• Device type, model, and operating system
• Browser type and version
• Session duration, pages visited, and features used on epiwin
• Crash reports and error logs

3.1.5  Responsible Gaming Data

• Any deposit limits, loss limits, or session limits you configure in your epiwin account
• Cool-off or self-exclusion records
• Responsible gaming questionnaire responses, where provided voluntarily

3.1.6  Communications Data

• Records of all live chat conversations with epiwin support
• Email correspondence with epiwin
• Any information you voluntarily provide when submitting a complaint or query

4.1  epiwin collects your personal data through the following channels:

• Direct collection during account registration: when you create your epiwin account, you provide your mobile number, email address, and personal details.
• KYC verification submissions: when you upload identity documents (CNIC, selfie photograph) to enable withdrawal access.
• Payment transactions: your JazzCash, EasyPaisa, or bank account details are provided when you make a deposit or request a withdrawal on epiwin.
• Platform usage: technical and usage data is collected automatically when you log in to epiwin and use any part of the platform, including the casino, sportsbook, and account settings.
• Cookies and tracking technologies: as described in Section 8 of this Policy.
• Customer support interactions: information you provide when you contact epiwin support via live chat or email.
• Third-party payment processors: confirmation data from JazzCash and EasyPaisa or banking institutions when processing your transactions.

5.1  epiwin processes your personal data for the following specific purposes:

5.2  epiwin will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your express consent or establishing another lawful basis for the additional processing.

6.1  epiwin processes your personal data in accordance with applicable data protection law. The lawful bases on which we rely are:

• Contract Performance: Processing necessary to perform our obligations under the agreement between you and epiwin — including operating your account, processing your PKR deposits and withdrawals via JazzCash or EasyPaisa, and settling bets.
• Legal Obligation: Processing required to comply with applicable law — including KYC/AML obligations under our gaming licence, anti-fraud requirements, responsible gaming obligations, and regulatory reporting duties.
• Legitimate Interests: Processing necessary for epiwin's legitimate interests that do not override your rights — including platform security, fraud prevention, technical analytics, and platform improvement.
• Consent: Processing based on your express, freely given, and specific consent — primarily for marketing communications. Where consent is the basis, you have the right to withdraw it at any time without affecting the lawfulness of processing conducted prior to withdrawal.

7.1  epiwin does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party. We share personal data with third parties only to the extent strictly necessary and only in the following circumstances:

7.1.1  Payment Processing Partners

To process your PKR deposits and withdrawals, epiwin shares necessary transaction data with JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank. These providers act as independent data controllers in respect of the payment data they process and are subject to their own privacy and data protection obligations.

7.1.2  KYC & Identity Verification Providers

epiwin may engage third-party KYC verification platforms to assist in verifying the identity and age of new players. Where a third-party KYC provider is engaged, they act as a data processor on epiwin's instructions and are bound by a data processing agreement that restricts their use of your data.

7.1.3  Game Providers

Third-party game studios whose titles are available in the epiwin casino may receive anonymised or pseudonymised session data necessary for game functionality, RTP tracking, and jackpot processing. Game providers do not receive your full identity data.

7.1.4  Legal and Regulatory Authorities

epiwin may be required to disclose your personal data to law enforcement agencies, regulatory bodies, or courts in response to a valid legal request, court order, or regulatory requirement. We will, where legally permissible, notify you before disclosing your data in such circumstances.

7.1.5  Anti-Fraud and AML Services

epiwin may share data with fraud prevention and anti-money laundering screening services to fulfil our legal obligations under our gaming licence. Adverse findings from these checks may result in account suspension or closure in accordance with our Terms & Conditions.

8.1  epiwin uses cookies and similar technologies on the epiwin platform to ensure its proper functioning, maintain your session while logged in, and analyse how Pakistani players use the platform so we can improve the experience.

8.2  Essential Cookies: These are cookies that are strictly necessary for the epiwin platform to function — including session management cookies that keep you logged in to your account during a gaming session. These cannot be disabled.

8.3  Analytical Cookies: These cookies help epiwin understand how players navigate the platform, which games are most popular, and where technical issues may be occurring. Data collected is aggregated and anonymised where possible. We use this information solely to improve the epiwin platform experience for Pakistani players.

8.4  Preference Cookies: These cookies remember your settings and preferences on epiwin — such as your preferred game lobby view or notification settings — so you don't have to reconfigure them each time you log in.

8.5  Security Cookies: Used to detect and prevent fraudulent activity, unauthorised login attempts, and suspicious session behaviour on the epiwin platform.

8.6  You can manage cookie preferences through your browser settings. Please note that disabling certain cookie categories may impair the functionality of the epiwin platform — in particular, disabling essential cookies will prevent you from maintaining a logged-in session.

9.1  epiwin implements appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and epiwin's servers — whether you are connecting via mobile data (Jazz, Zong, Ufone, Telenor) or WiFi.
• Encrypted storage of sensitive personal data at rest, including CNIC documents, payment details, and account credentials.
• Two-factor authentication (2FA) available for all epiwin accounts — we strongly recommend all Pakistani epiwin players enable 2FA in their account security settings.
• Access controls restricting access to personal data to only those epiwin staff members who require it to perform their specific role.
• Regular security assessments and vulnerability testing of the epiwin platform infrastructure.
• Segregated player funds — player balance data is maintained separately from epiwin operating account data.

9.2  In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, epiwin will notify you without undue delay through your registered mobile number or email address, and will take all reasonable steps to mitigate the impact of the breach.

10.1  epiwin retains your personal data for as long as is necessary to fulfil the purposes for which it was collected and to meet applicable legal, regulatory, and licence obligations. The following general retention guidelines apply:

• Account data (active account): Retained for the full duration of your epiwin account's active period.
• Account data (closed account): Retained for a minimum of five (5) years following account closure — required for anti-money laundering compliance and gaming licence obligations.
• KYC documents (CNIC, selfie): Retained for a minimum of five (5) years from verification date or account closure, whichever is later.
• Transaction records (deposits, withdrawals, bets): Retained for a minimum of five (5) years for financial record and AML compliance purposes.
• Customer support communications: Retained for up to three (3) years from the date of the interaction.
• Marketing consent records: Retained until you withdraw consent, then archived for a further two (2) years as evidence of consent management.

10.2  Upon expiry of the applicable retention period, epiwin will securely delete or anonymise your personal data such that it can no longer be associated with your identity.

11.1  As an epiwin player, you have the following rights in relation to your personal data, subject to applicable law and our legitimate interests and legal obligations:

• Right of Access: You have the right to request a copy of the personal data epiwin holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate personal data epiwin holds about you. For name or CNIC corrections, identity documentation may be required.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. This right is subject to overriding legal retention obligations.
• Right to Restriction: You have the right to request that epiwin restricts its processing of your data in certain circumstances — for example, where you contest the accuracy of the data while epiwin verifies it.
• Right to Data Portability: Where processing is based on consent or contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to epiwin's processing of your personal data where that processing is based on legitimate interests, including profiling for responsible gaming purposes.
• Right to Withdraw Consent: Where processing is based on your consent — such as marketing communications — you may withdraw that consent at any time via your epiwin account settings or by contacting support.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to your epiwin account, if you believe epiwin has not handled your data in accordance with applicable law.

11.2  To exercise any of these rights, please contact epiwin at [email protected] with the subject line "Data Rights Request — [Your Full Name]." epiwin will respond within thirty (30) calendar days of receipt of a valid request.

12.1  The epiwin platform is strictly intended for adults aged twenty-one (21) years and older. epiwin does not knowingly collect or process personal data from any individual under the age of 21.

12.2  If epiwin discovers that personal data has been collected from a player who is under 21 years of age, that account will be immediately closed, all data will be deleted (subject to any legal retention obligations relating to the incident), and any balances will be returned to the originating payment method.

12.3  If you are a parent or guardian and believe that your child under the age of 21 has registered an account on epiwin, please contact us immediately at [email protected] with subject line "Underage Account Report." We will investigate and take immediate action.

12.4  epiwin strongly recommends that parents and guardians in Pakistan install appropriate internet filtering or parental control software on any device that may be accessed by minors, to prevent access to online gaming platforms.

13.1  epiwin reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the services offered on the epiwin platform.

13.2  When material changes are made to this Privacy Policy, epiwin will notify all registered players via their registered email address or Pakistani mobile number at least seven (7) days before the changes take effect. Non-material changes (such as formatting updates or clarifications that do not affect your rights) may be published without advance notice.

13.3  Your continued use of the epiwin platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised Policy. The "Last Updated" date at the top of this document will always reflect the date of the most recent revision. If you do not agree with any changes, you must cease using the epiwin platform and may close your account as described in epiwin's Terms & Conditions.

14.1  If you have any questions, concerns, or requests regarding this Privacy Policy or epiwin's handling of your personal data, please contact us using the details below. epiwin takes all privacy enquiries seriously and will respond within four (4) business hours during operational hours.

14.2  epiwin is committed to resolving all privacy concerns fairly and promptly. If you are not satisfied with our response to your privacy complaint, you are entitled to escalate your complaint to the appropriate supervisory authority under our licensing jurisdiction.