Privacy Policy

This Privacy Policy ("Policy") sets out the basis on which prwin ("prwin", "we", "us", "our") collects, processes, stores and shares personal data relating to users ("you", "your") of the prwin platform located at https://prwin.cam (the "Platform").

prwin is committed to handling your personal data responsibly, transparently and in accordance with applicable data protection laws and the privacy standards required under its operating licence. We recognise that trust is fundamental to the relationship between a gaming operator and its users, and we treat the protection of your personal information as a business-critical obligation — not merely a legal formality.

This Policy applies to all personal data collected through the Platform, including data collected during account registration, identity verification (KYC), financial transactions, gameplay activity, customer support interactions, and general browsing of the Platform. It applies to all users who access the Platform regardless of their location, though it is written with particular attention to the needs and rights of users based in Pakistan.

By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any aspect of this Policy, you must not use the Platform.

The following terms have specific meanings throughout this Policy:

prwin collects the following categories of personal data in the course of operating the Platform and providing services to registered users:

3.1 Identity and Registration Data

• Full legal name (as it appears on your CNIC or passport).
• Date of birth and age verification data.
• Username and encrypted password.
• Gender (where provided voluntarily).
• Nationality and country of residence.

3.2 Contact Data

• Email address (primary contact and account security channel).
• Mobile phone number (for two-factor authentication and account notifications).
• Residential address (for KYC and verification purposes).

3.3 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued photo identification (CNIC, passport or driving licence).
• Proof of address documents (utility bill, bank statement dated within 3 months).
• Source of funds documentation where required by AML obligations.
• Selfie or liveness-check data where biometric verification is used.

3.4 Financial and Transaction Data

• Deposit and withdrawal history, amounts and timestamps.
• Payment method identifiers (e.g., masked account numbers, wallet IDs for services such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah — referenced as familiar Pakistani payment methods; availability must be confirmed in the cashier).
• Transaction reference numbers and processing statuses.

3.5 Gaming and Behavioural Data

• Bet history, game session logs, wagering amounts and outcomes.
• Sports markets accessed (including cricket, PSL, T20, ICC tournaments, football and UFC markets where available).
• Bonus and promotion usage records.
• Responsible gambling tool usage (deposit limits, loss limits, session limits, self-exclusion records).

3.6 Technical and Device Data

• IP address and geolocation data (country/city level).
• Device type, operating system and browser type and version.
• Device identifiers and session tokens.
• Platform access logs including timestamps and pages visited.

3.7 Communications Data

• Records of support interactions via Live Chat, Help Center tickets and email.
• Feedback, complaints and survey responses submitted through the Platform.

prwin collects personal data through the following channels and mechanisms:

• Direct input by you: Data you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, using customer support, or completing surveys and feedback forms on the Platform.
• Automated technical collection: Data collected automatically when you access or use the Platform, including IP address, device information, session data, page interaction data and cookie-derived data.
• Third-party KYC providers: Verification outcomes and identity check results returned to prwin by authorised KYC and identity verification service providers following your submission of identity documents through the Platform's secure verification portal.
• Payment processors: Transaction confirmation data and payment status information returned by payment processing partners following deposit or withdrawal operations.
• Fraud and security monitoring: Behavioural and technical signals collected through automated systems designed to detect suspicious access patterns, collusion, bonus abuse and other prohibited conduct.
• Analytics tools: Aggregated and pseudonymised data generated by analytics platforms used by prwin to understand Platform usage patterns and improve the user experience.

prwin processes your personal data for the following purposes. Each purpose is linked to a specific legal basis, which is set out in Section 6 below.

prwin does not process your personal data for any purpose that is incompatible with the purposes listed above. If we intend to use your data for a new purpose that is materially different from those listed, we will notify you and, where required, seek your consent before doing so.

Where data protection law requires prwin to identify a lawful basis for processing your personal data, prwin relies on the following bases:

• Contractual necessity: Processing required to perform the contract between you and prwin — including account registration, KYC, transaction processing and delivery of gaming services. Without this processing, prwin cannot provide the Platform to you.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including AML/CFT obligations, responsible gambling duties, licence conditions and court orders.
• Legitimate interests: Processing necessary for prwin's legitimate business interests, provided those interests are not overridden by your data rights — including fraud prevention, platform security, abuse detection, internal analytics and service improvement.
• Consent: Processing for which prwin has obtained your freely given, specific and informed consent — including marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

prwin does not sell your personal data to any third party. We share personal data only in the following circumstances and only to the extent necessary for the relevant purpose:

• KYC and identity verification providers: Third-party providers contracted by prwin to perform identity document verification, age checks and liveness detection as part of the KYC process. These providers act as Data Processors under binding contractual obligations.
• Payment processors: Financial service providers involved in processing your deposit and withdrawal transactions. These partners receive only the data necessary to complete the relevant transaction and are subject to their own regulatory obligations.
• Game software providers: Third-party casino game and sports betting technology providers whose games are integrated into the Platform. These providers may receive pseudonymised game session data for settlement and technical support purposes.
• Fraud prevention and security services: Specialist providers that assist prwin in detecting and preventing fraud, collusion, money laundering and other prohibited conduct on the Platform.
• Analytics providers: Third-party analytics platforms used by prwin to understand Platform usage and improve the user experience. Data shared for analytics purposes is pseudonymised or aggregated wherever possible.
• Regulatory and law enforcement authorities: Where prwin is legally required to disclose personal data — including to its licensing regulator, financial intelligence units, or law enforcement agencies investigating financial crime or match-fixing.
• Group companies and affiliates: Where prwin operates through affiliated entities, personal data may be shared within the group for the purposes described in this Policy, subject to internal data sharing agreements.
• Professional advisors: Legal counsel, auditors and other professional advisors where necessary and subject to confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of assets involving prwin, personal data may be transferred to the relevant successor entity, subject to equivalent data protection commitments.

Given the global nature of online gaming infrastructure, your personal data may be transferred to and processed in countries outside Pakistan and outside the jurisdiction in which prwin holds its operating licence. Such transfers may occur when using cloud hosting providers, KYC verification services, payment processors or analytics tools that operate internationally.

Where personal data is transferred internationally, prwin ensures that appropriate safeguards are in place to protect your data, including one or more of the following mechanisms:

• Transfer to a jurisdiction that has been assessed as providing an adequate level of data protection by the relevant regulatory authority.
• Use of standard contractual clauses approved by the applicable data protection authority, incorporated into contracts with receiving entities.
• Binding corporate rules where data is transferred within the prwin group of companies.
• Other lawful transfer mechanisms as permitted under applicable data protection law.

You may request further information about the specific safeguards in place for any particular international transfer by contacting our support team using the contact details set out in Section 15.

prwin retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or our regulatory obligations. The following general retention principles apply:

• Active account data: Retained for the duration of your account relationship with prwin, plus any post-closure period required by law or regulation.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure, in accordance with standard AML record-keeping requirements applicable under prwin's operating licence. Longer periods may apply where required by specific regulatory direction.
• Financial and transaction records: Retained for a minimum of five (5) years from the date of the relevant transaction, consistent with AML and financial record-keeping obligations.
• Gaming and betting records: Retained for a minimum of three (3) years following account closure for dispute resolution and regulatory audit purposes.
• Customer support communications: Retained for three (3) years from the date of the interaction, or longer where the interaction relates to a formal complaint or regulatory matter.
• Marketing preferences and consent records: Retained for the duration of the account relationship and for a period of two (2) years following opt-out or account closure.
• Technical logs and device data: Retained for up to twelve (12) months unless required longer for security investigation purposes.

When personal data is no longer required and no legal retention obligation applies, prwin will securely delete or anonymise that data so that it can no longer be attributed to an identified individual.

prwin uses cookies and similar tracking technologies (including web beacons, pixels and local storage) on the Platform. The following categories of cookies are used:

You can manage or withdraw your consent for optional and marketing cookies at any time through your browser settings or the cookie preference centre available on the Platform. Withdrawing consent for optional cookies will not affect Platform functionality for strictly necessary or security cookies, which remain active at all times.

Subject to applicable data protection law and certain exceptions, you have the following rights in relation to the personal data prwin holds about you. These rights can be exercised by contacting our support team through the channels listed in Section 15.

prwin will respond to all verified data rights requests within 30 calendar days. For complex requests, this period may be extended by a further two months, in which case we will inform you of the extension and the reason for it within the initial 30-day period.

Please note that certain rights are subject to exceptions. For example, prwin may be unable to delete data that it is legally required to retain under AML record-keeping obligations, even if you request erasure. We will always explain the specific reason if a right cannot be exercised in full.

prwin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. Key security measures include:

• Transport Layer Security (TLS): All data in transit between your device and the Platform is encrypted using TLS 1.2 or higher. The Platform enforces HTTPS across all pages.
• Encryption at rest: Sensitive personal data — including identity documents, payment details and authentication credentials — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: Access to personal data is restricted to authorised prwin personnel and contractors on a strict need-to-know basis. All access is logged and periodically reviewed.
• Multi-factor authentication: Administrative access to systems holding personal data requires multi-factor authentication. Users are also strongly encouraged to enable two-factor authentication on their accounts.
• Penetration testing: prwin conducts regular vulnerability assessments and penetration tests on the Platform and its underlying infrastructure to identify and remediate security weaknesses proactively.
• Incident response: prwin maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by applicable law.
• Third-party security standards: All Data Processors engaged by prwin are contractually required to implement security measures at least equivalent to those described in this section.

While prwin takes all reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure. You are also responsible for maintaining the security of your own account credentials and must not share your password with any third party.

The prwin Platform is strictly intended for adults only. Users must be aged 18 years or older — or the higher minimum age required by the operator's licence jurisdiction — to register an account and use the Platform. prwin does not knowingly collect or process personal data relating to individuals under the applicable minimum age.

As part of the registration and KYC process, all users are required to verify their age by submitting government-issued photo identification. Accounts where age verification cannot be completed satisfactorily will be suspended pending resolution.

If prwin becomes aware that personal data has been collected from a minor — including through a misrepresentation of age at registration — that account will be immediately suspended, all relevant data will be reviewed, and any funds in the account will be handled in accordance with applicable regulatory requirements. The personal data of the minor will be deleted to the extent permitted by law and regulation.

If you have reason to believe that a minor has registered on the Platform using false age information, please contact our support team immediately using the details in Section 15.

prwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services we offer. The date at the top of this Policy will always reflect the date of the most recent revision.

Where a change is material — meaning it significantly affects how we process your personal data or the rights available to you — prwin will notify you by:

• Displaying a prominent notice on the Platform for a reasonable period following the change.
• Sending a notification to the email address registered on your account, where the change requires your attention or consent.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with any change to this Policy, you must stop using the Platform and may request account closure through the Help Center.

We encourage you to review this Policy periodically — particularly before making any significant financial transactions on the Platform — to stay informed about how prwin protects your data.

If you have any questions, concerns or requests relating to this Privacy Policy or to prwin's processing of your personal data, please contact our Data Protection team through the following channels:

• Help Center: Available within your account dashboard — the fastest route for account-specific queries and data rights requests.
• Live Chat: Available on the Platform for real-time support during operating hours.
• Email (plain text — not a link): [email protected]

When submitting a data rights request, please include your registered username and a clear description of the right you wish to exercise or the concern you wish to raise. Identity verification will be required before any personal data is disclosed or altered in response to a request.