Win Rupees Privacy Policy — How We Protect Pakistani Players

This Privacy Policy ("Policy") describes how Win Rupees ("we", "us", "our") collects, processes, stores, and protects the personal information of players and visitors who interact with our platform at winrupees.click.

Win Rupees is an online casino and sports betting platform built specifically for Pakistani players. Because we handle financial transactions in Pakistani Rupees (PKR) and process personal data from individuals across Pakistan, we take data protection seriously — not just as a legal obligation, but as a core part of the trust that Win Rupees has built with its players since 2020.

By registering a Win Rupees account, depositing funds, placing bets, or simply browsing our platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside our Terms and Conditions and Responsible Gaming Policy.

For the purposes of this Privacy Policy, the data controller responsible for your personal information is Win Rupees, operating the online gaming platform at winrupees.click. Win Rupees is the entity that determines the purposes and means of processing your personal data — in plain terms, we decide what data is collected, why it is collected, and how it is used.

Win Rupees operates under a valid gaming licence from an internationally recognised regulatory authority. Our data handling practices are subject to the terms of that licence, which include specific requirements around player data protection, anti-money laundering (AML) record-keeping, and responsible gaming data management.

If you have any questions about how Win Rupees handles your data, you can contact our dedicated privacy point of contact at support@winrupees.click. We aim to respond to all privacy-related enquiries within 5 business days.

Win Rupees collects personal data in three ways: information you give us directly, information we collect automatically when you use the platform, and information we receive from third parties (such as payment processors). Here is a breakdown of each category:

3.1 — Information You Provide Directly

• Registration data: Full legal name, date of birth, Pakistani mobile number, and email address.
• Identity verification documents: Pakistani CNIC or NICOP number and, where required for enhanced verification, a scanned copy of your identity document.
• Payment information: Your Easypaisa mobile number, JazzCash account, NayaPay / SadaPay wallet identifiers, IBFT bank account details, or Visa/Mastercard card details. Note that full card numbers are handled exclusively by our PCI-DSS compliant payment processors — Win Rupees does not store full card numbers on our own systems.
• Correspondence: Any messages, emails, or live chat conversations you have with Win Rupees support staff.
• Responsible gaming preferences: Deposit limits, loss limits, self-exclusion requests, and session time preferences you configure in your account settings.

3.2 — Information Collected Automatically

• Device and browser data: IP address, device type and model, operating system version, browser type, and screen resolution.
• Session data: Login timestamps, session duration, pages visited, games played, bets placed, and navigation patterns within Win Rupees.
• Transaction logs: A complete record of all deposits, withdrawals, bonus activations, and gameplay outcomes associated with your account.
• Cookie data: Tracking and preference information collected via cookies — see Section 7 for full details.
• Location signals: General geographic location inferred from your IP address, used to confirm that you are accessing Win Rupees from a permitted jurisdiction.

3.3 — Information from Third Parties

• Payment processors: Transaction status confirmations, payment method verification results, and fraud screening signals from Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT systems, and card processing networks.
• Identity verification services: Results of automated CNIC/NICOP verification checks where applicable.
• Responsible gaming databases: Self-exclusion status information from cross-operator responsible gaming registries, where Win Rupees participates in such schemes.

Win Rupees uses personal data collected from Pakistani players for the following specific purposes. We process data only for the purposes listed here and do not use it for purposes that are incompatible with this Policy without obtaining your consent.

Win Rupees processes personal data under one or more of the following legal bases, depending on the nature of the processing activity:

• Contract performance: Processing that is necessary to provide you with the services you have signed up for — account management, PKR payment processing, game delivery, and withdrawal processing all fall under this basis.
• Legal obligation: Processing required to comply with anti-money laundering laws, gaming licence conditions, tax reporting obligations, and identity verification requirements. Win Rupees cannot operate as a licensed platform without this data processing.
• Legitimate interests: Processing for fraud detection, security monitoring, platform analytics, and improving the overall Win Rupees service — where these interests do not override your fundamental privacy rights.
• Consent: Processing for marketing communications and certain cookies. You can withdraw consent at any time by updating your account preferences or contacting us at support@winrupees.click. Withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal.

Because Win Rupees processes all transactions in Pakistani Rupees (PKR), we interact with the following local payment infrastructure on your behalf: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT bank transfer networks, and Visa/Mastercard card processing. Here is how your financial data is handled in each case:

• Mobile wallet payments (Easypaisa, JazzCash, NayaPay, SadaPay): Win Rupees receives your registered mobile number or wallet ID and passes deposit/withdrawal instructions to the relevant provider. We retain a record of transaction amounts, timestamps, and reference numbers — but not your mobile wallet PIN or password.
• IBFT bank transfers: We collect your bank account number and bank name to process withdrawals. Deposit IBFT payments are verified by reference to transaction reference numbers provided by your bank. We do not retain your full bank account details beyond what is required for the transaction record.
• Card payments (Visa/Mastercard): Card payments are processed by a PCI-DSS Level 1 compliant payment processor. Win Rupees never stores your full 16-digit card number, CVV, or PIN on our servers. We retain only a masked card reference (e.g., last four digits) and the transaction outcome.

All financial transaction data is retained for a minimum of five years to comply with anti-money laundering regulations applicable to our gaming licence. This data is stored on encrypted servers and accessible only to authorised Win Rupees compliance personnel.

Win Rupees uses cookies and similar tracking technologies to make the platform work correctly, to understand how Pakistani players use the site, and to deliver relevant content. Here is what each type of cookie does:

• Strictly necessary cookies: Required for basic platform functionality — keeping you logged in, remembering your session preferences, and maintaining your bet slip. These cookies cannot be disabled without breaking core Win Rupees features.
• Performance and analytics cookies: Help us understand which games are most popular, where players encounter difficulties, and how the Win Rupees platform performs across different Pakistani mobile devices and networks. Data collected is aggregated and anonymised.
• Functional cookies: Remember your preferences such as preferred language, notification settings, and responsible gaming limits, so you do not have to re-enter them every session.
• Marketing cookies: Used with your consent to track whether Win Rupees promotional communications have been engaged with. You can opt out of marketing cookies at any time via the cookie preferences panel or by contacting support.

Most modern browsers allow you to control or disable cookies through browser settings. Note that disabling strictly necessary cookies will impair the functionality of Win Rupees and may prevent you from logging in or placing bets.

Win Rupees does not sell your personal data. We share your data with third parties only in the following specific and limited circumstances:

Protecting the personal and financial data of Pakistani players is one of Win Rupees' primary technical responsibilities. We implement the following security measures across our platform:

• 256-bit TLS/SSL encryption on all data transmitted between your device and Win Rupees servers — including login, payment, and gameplay sessions.
• Encrypted at-rest storage for all personal data held on Win Rupees databases. Encryption keys are managed separately from the data they protect.
• Access controls — Win Rupees staff are granted access to player data only on a need-to-know basis, with role-based permissions and full access logging in place.
• Multi-factor authentication available for all Win Rupees player accounts. We strongly recommend enabling this feature in your account security settings.
• Regular penetration testing conducted by independent security specialists to identify and remediate vulnerabilities before they can be exploited.
• Fraud monitoring systems that analyse transaction patterns, login behaviour, and device fingerprints in real time to detect and block suspicious activity.
• PCI-DSS compliant payment processing ensuring that card data is never handled directly by Win Rupees systems.

Despite these measures, no digital system can guarantee absolute security. If you believe your Win Rupees account has been compromised, please contact us immediately at support@winrupees.click and change your password without delay.

Win Rupees retains your personal data only for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal obligations. The following retention periods apply:

• Active account data (name, contact details, payment methods): Retained for the lifetime of your account plus a minimum of five years following account closure, in line with AML and gaming licence record-keeping requirements.
• Transaction records (deposits, withdrawals, PKR bets, bonus activity): Retained for a minimum of five years from the date of each transaction.
• Identity verification documents (CNIC/NICOP copies): Retained for the period required by our licensing regulator — typically five years post-account closure.
• Customer support correspondence: Retained for three years from the date of the last interaction, or five years if the correspondence relates to a financial dispute.
• Marketing consent records: Retained until you withdraw consent, and for a further two years as evidence of your consent.
• Cookie and analytics data: Aggregated analytics data is retained indefinitely in anonymised form. Individual session identifiers are deleted after 12 months.

When your data is no longer required for any valid purpose, Win Rupees will either securely delete it or anonymise it so that it can no longer be associated with you as an individual.

Every Win Rupees player has rights over their personal data. Here is a plain-language explanation of each right and how to exercise it:

To exercise any of these rights, email support@winrupees.click with a clear description of your request. We will acknowledge receipt within 48 hours and respond fully within 30 days. We do not charge for handling legitimate privacy rights requests.

Win Rupees is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. Our registration process includes a date-of-birth field and we reserve the right to request identity verification to confirm age at any point.

If Win Rupees discovers or is notified that a minor has registered an account, we will immediately suspend the account, refund any deposited funds to the payment method used, delete the minor's personal data from our active systems, and retain only the minimum records required by law for AML compliance purposes.

If you are a parent or guardian and believe that your child has registered a Win Rupees account without your knowledge, please contact us immediately at support@winrupees.click. We will treat such reports as high priority and act swiftly.

Win Rupees will update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, or applicable legal requirements. When we make material changes to this Policy, we will notify registered players by email and by displaying a prominent notice on the Win Rupees platform at least 7 days before the changes take effect.

The "Last Updated" date displayed at the top of this page always reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of Win Rupees after the effective date of any updated Policy constitutes your acceptance of the revised terms.

If you have concerns about any proposed change to this Privacy Policy, please contact us before the effective date. You always have the right to close your account and request deletion of non-mandatory data if you do not accept a revised Policy.

For any privacy-related queries, data subject rights requests, or concerns about how Win Rupees handles your personal information, please contact us through any of the following channels: