Epiwin Privacy Policy – How We Protect Your Data

01 Introduction

This Privacy Policy describes how Epiwin ("we", "us", "the Platform") collects, uses, stores, and protects the personal information of players who register and use the Epiwin platform — including the website and the Epiwin mobile application. Epiwin is an online entertainment platform serving players across Pakistan, and this policy has been written with Pakistan-based users specifically in mind.

We take privacy seriously. The data you share with Epiwin is used only for the purposes described in this policy, and we are committed to handling it responsibly. We do not sell personal data to third parties, and we only share data where it is genuinely necessary to deliver the services you use.

This Privacy Policy should be read alongside the Terms and Conditions, which govern your overall use of the Epiwin platform. Defined terms used in the Terms and Conditions carry the same meaning here.

02 Information We Collect

Epiwin collects personal information in several ways — information you provide directly, information generated by your use of the platform, and in some cases information collected automatically by the technology used to deliver the platform.

Information you provide directly:

• Full name and date of birth (required for registration and age verification)
• Email address and mobile phone number
• City and province of residence
• Username and account password (stored in hashed form — we cannot see your actual password)
• Identity documents provided for verification purposes (such as CNIC or passport copy where requested)
• Payment method details provided when making a deposit or requesting a withdrawal — for example, your JazzCash or Easypaisa mobile number, or bank account information

Information generated by your platform activity:

• Deposit and withdrawal history including amounts in PKR, dates, and payment methods used
• Game session history, wagers placed, and outcomes across casino, slot, fish game, and betting products
• Bonus claims, wagering progress, and promotional activity
• Support communications — messages or queries submitted to the support team

Information collected automatically:

• Device type, operating system, and browser information
• IP address and approximate location data derived from it
• Session timestamps and pages visited within the platform
• Cookie identifiers and similar tracking technology data (see Section 7)

03 How We Use Your Data

The personal information Epiwin collects is used for the following purposes:

• Account creation and management: To register your account, verify your identity, maintain your profile, and allow you to log in securely.
• Payment processing: To process PKR deposits via JazzCash, Easypaisa, Raast, bank transfer, cards, and mobile wallets; to process withdrawal requests to your verified payment method; and to maintain your transaction history.
• Game and betting services: To deliver casino games, slot titles, fish games, and sports betting markets; to record game outcomes and settle bets; and to display your history and balance.
• Security and fraud prevention: To detect and prevent fraudulent activity, multiple account creation, bonus abuse, money laundering, and other conduct prohibited under the Terms and Conditions.
• Customer support: To respond to your queries, resolve account issues, and assist with payment or game-related problems.
• Platform improvement: To analyse how players use Epiwin so we can improve game selection, payment flows, mobile performance, and the overall experience on the platform.
• Responsible gaming: To support the use of responsible gaming tools such as deposit limits and session reminders, and to monitor account activity for signs of problem gambling where tools have been activated.
• Marketing communications: To send you information about bonuses, promotions, new games, and PSL or cricket betting offers — but only where you have opted in or where we have a legitimate interest in doing so. You can opt out at any time.

04 Legal Basis for Processing

Epiwin processes your personal data on the following legal grounds:

• Contract performance: Processing your account data, transactions, and game activity is necessary to deliver the services you signed up for.
• Legitimate interests: Fraud detection, security monitoring, and platform improvement are carried out on the basis of Epiwin's legitimate interests in operating a secure and reliable platform — balanced against your privacy interests.
• Legal obligation: In some cases, Epiwin is required to collect and retain certain information — for example, identity verification data — to comply with applicable legal obligations.
• Consent: Where we rely on your consent — for example, for certain marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

05 Payment Data and PKR Transactions

Epiwin handles PKR transaction data with particular care. When you make a deposit or request a withdrawal using JazzCash, Easypaisa, Raast, bank transfer, a card, or another mobile wallet, the payment details you provide are used solely to process that transaction and to maintain your account transaction history.

Epiwin does not store full card numbers. Card payments are processed through encrypted payment gateway connections and the card data handling obligations are governed by the relevant payment provider's security standards.

Mobile wallet identifiers — such as your JazzCash or Easypaisa registered mobile number — are stored securely in your account as a verified withdrawal destination and are not used for any other purpose or shared with third parties outside of what is necessary to process your payment.

Your complete PKR deposit and withdrawal history is available to you at any time through the transaction history section of your Epiwin account dashboard.

06 Sharing Your Data

Epiwin does not sell your personal data to third parties. We only share your information in the following limited circumstances:

• Payment processors: To complete your PKR deposit or withdrawal, relevant transaction details are shared with the payment provider you have selected — JazzCash, Easypaisa, Raast, your bank, or your card network. These providers process your payment under their own privacy terms and security standards.
• Identity verification providers: Where we use a third-party service to assist with verifying your identity documents, your verification data is shared with that provider under a strict data processing agreement.
• Technology and hosting providers: Epiwin's platform is hosted and delivered using third-party infrastructure and software services. These providers have access to data only as necessary to perform their technical functions and are contractually bound to handle it securely.
• Legal and compliance obligations: Epiwin may disclose your data to law enforcement agencies, regulatory bodies, or courts if required to do so by applicable law, a valid legal order, or to protect the rights and safety of Epiwin, its players, or the public.
• Business transfers: In the event that Epiwin undergoes a merger, acquisition, or transfer of assets, your personal data may form part of the transferred assets. You will be notified if this occurs and your data becomes subject to a different privacy policy as a result.

In all cases where we share data with third parties, we require those parties to maintain appropriate security measures and to use the data only for the purpose for which it was shared.

07 Cookies and Tracking Technologies

Epiwin uses cookies and similar technologies — including local storage and session identifiers — to deliver and improve the platform. Here is a summary of the types of cookies we use:

You can manage or disable non-essential cookies through your browser settings. Note that disabling essential cookies will prevent you from logging in or using core features of the platform. Epiwin does not use third-party advertising networks or allow external ad trackers on the platform.

08 Data Retention

Epiwin retains your personal data for as long as your account is active and for a defined period after account closure, in line with the following principles:

• Active accounts: All account data, transaction records, and game history are retained for the full duration your account is active on Epiwin.
• Closed accounts: After an account is closed — whether voluntarily or by Epiwin — we retain certain data for a period of up to five years. This retention is necessary to comply with legal obligations, resolve any outstanding disputes, investigate any suspected misconduct, and maintain financial records related to PKR transactions.
• Identity verification documents: Copies of identity documents submitted for verification are retained for the period required by applicable law and our internal compliance obligations, after which they are securely deleted.
• Support communications: Messages submitted to Epiwin support are retained for a period of two years to allow for follow-up and quality monitoring, and then deleted.
• Marketing preferences: Your opt-in or opt-out status for marketing communications is retained even after account closure to ensure we respect your stated preferences.

When data is no longer required and the applicable retention period has passed, it is securely deleted or anonymised so that it can no longer be associated with your identity.

09 Data Security

Epiwin takes the security of your personal data seriously. We implement a range of technical and organisational measures to protect your information against unauthorised access, loss, alteration, or disclosure:

• Encryption in transit: All data transmitted between your browser or app and Epiwin's servers is protected using TLS encryption (the padlock you see in your browser's address bar).
• Encrypted storage: Sensitive data fields — including account passwords (which are hashed and salted, never stored in plain text) and payment identifiers — are stored in encrypted form.
• Access controls: Internal access to personal data is restricted on a need-to-know basis. Staff members can only access data relevant to their specific role, and all access is logged.
• Security monitoring: Epiwin's systems are monitored for suspicious activity. Unusual login patterns, multiple failed authentication attempts, and anomalous transaction behaviour trigger automated alerts for review.
• Regular reviews: Our security measures are reviewed and updated regularly to address evolving threats and industry best practice.

While Epiwin takes every reasonable step to protect your data, no online platform can guarantee absolute security. You also have a role to play — keeping your Epiwin password secure, not sharing your login credentials, and using a secure network connection when accessing the platform all reduce the risk of unauthorised access to your account.

10 Your Rights Over Your Data

As an Epiwin player, you have the following rights regarding your personal data. To exercise any of these rights, contact the support team using the details in Section 14.

We will respond to data rights requests within a reasonable timeframe. In some cases we may need to verify your identity before processing a request. There is no fee for exercising your rights under normal circumstances.

11 Children's Privacy

Epiwin is strictly an adults-only platform. Registration and use of the platform is not permitted for anyone under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age.

If we become aware that an account has been registered by someone under 18, that account will be immediately closed, any PKR balance will be returned to the payment method used (after verification), and all associated personal data will be deleted. If you believe a minor has created an account on Epiwin, please contact support immediately.

Parents and guardians who share a device with a minor are encouraged to use device-level parental controls to prevent access to online gaming and betting platforms. Responsible gaming guidance for adults is available at epiwin.app/responsible-gaming.

12 Marketing Communications

Epiwin may send you promotional communications about bonuses, new games, slot releases, fish game updates, PSL and cricket betting offers, and other platform news. These communications may be sent via email or SMS to the contact details registered on your account.

We send marketing communications only where:

• You opted in to receive them during or after registration, or
• You are an existing player and the communication relates to similar services to those you have already used, and you have not opted out.

You can opt out of marketing communications at any time by:

• Using the unsubscribe link included in any marketing email from Epiwin, or
• Updating your communication preferences in the notifications section of your Epiwin account settings, or
• Contacting the support team and requesting to be removed from the marketing list.

Opting out of marketing communications does not affect transactional messages — you will continue to receive account-related notifications such as deposit confirmations, withdrawal updates, and security alerts regardless of your marketing preference.

13 Changes to This Privacy Policy

Epiwin may update this Privacy Policy from time to time to reflect changes in how we operate, the services we offer, or applicable legal requirements. When we make changes, the updated policy will be published on this page with a revised "Last Updated" date at the top.

For significant changes that materially affect how we collect or use your personal data, we will aim to notify registered players via their registered email address or through a notification within the platform before the changes take effect.

Your continued use of Epiwin after a revised Privacy Policy has been published constitutes your acceptance of those changes. If you disagree with any update, you should stop using the platform and contact support to request account closure. Previous versions of this Privacy Policy are available on request through the support team.

14 Contact Us

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how Epiwin has handled your personal information, please get in touch:

• Email: [email protected] — include your registered username and a brief description of your request.
• Support Chat: Available in-platform after logging in to your account for real-time assistance.
• FAQ: Common privacy questions are addressed at epiwin.app/faq.

We aim to respond to all privacy-related queries within five working days. For formal data rights requests, we will acknowledge receipt promptly and complete the request within 30 days where possible.