Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how Epiwon ("we", "us", "our", "the Platform") collects, uses, stores, shares and protects personal data relating to users ("you", "your") of the website located at https://epiwon.cam.

Epiwon is an English-language online betting information platform serving Pakistani users with transparent odds guides, responsible gambling resources and clear terms across sports betting, live casino and slots categories. We are committed to handling your personal information with care, transparency and respect for your rights.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling policy, both of which form part of your agreement with Epiwon.

Epiwon does not operate a physical office in Pakistan and does not claim local licensing or endorsement from any Pakistani governmental authority, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan or any provincial body. Nothing in this Policy constitutes legal advice. You remain solely responsible for understanding and complying with applicable local laws, including the Prevention of Gambling Act, 1977.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, including name, email address, phone number, IP address, device identifiers and financial transaction details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion or any other handling activity, whether automated or manual.
• "Data Controller" means Epiwon, which determines the purposes and means by which Personal Data is processed.
• "Data Processor" means any third party that processes Personal Data on behalf of Epiwon, under a binding contractual arrangement.
• "Cookies" means small text files placed on your device by the Platform, used to store session state, preferences and analytics data.
• "KYC" (Know Your Customer) means the identity and document verification process required prior to withdrawal processing, under applicable anti-money laundering regulations.
• "Sensitive Data" means a special category of Personal Data including, but not limited to, financial account details, government-issued identity document numbers and any data that could expose a user to heightened risk if disclosed.

3 Data We Collect

We collect personal data through different channels and at different points in your interaction with the Platform. The categories of data we collect are described below.

3.1 Registration Data

When you create an account, we collect your full legal name, date of birth, residential address, email address and phone number. This information is required to establish your account, verify your age eligibility and communicate important account notifications to you.

3.2 Identity Verification (KYC) Data

Before processing withdrawal requests, we collect identity verification documents. These typically include a valid government-issued photo ID (such as a Pakistani CNIC, passport or driving licence) and recent proof of address. We may also collect a selfie photograph for facial verification purposes where required by our compliance obligations.

3.3 Financial Transaction Data

We record deposit and withdrawal transaction histories, including amounts, timestamps and the payment references used. Where you initiate a transaction through familiar Pakistani payment channels — such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah — we record sufficient transactional metadata to reconcile your account. We do not store full payment credentials (such as card numbers) on our servers; these are handled by our payment processing partners under their own security standards.

3.4 Usage and Behavioural Data

We automatically collect data about how you interact with the Platform. This includes pages visited, betting markets viewed, games played, session duration, click patterns, search queries and navigation paths. This data is used to improve platform performance and personalise your experience.

3.5 Technical and Device Data

We collect technical information about the device and network you use to access the Platform, including your IP address, browser type and version, operating system, device model, screen resolution, language settings and time zone. IP addresses may be used to perform geographic restriction checks.

3.6 Communications Data

When you contact our support team — via email at [email protected] or through any live chat or ticketing feature — we retain a record of that correspondence, including message content, timestamps and any attachments, to help us resolve your enquiry and maintain a support history.

4 How We Process Your Data

We use the personal data we collect for the following purposes:

• Account Management: Creating and maintaining your account, processing your bets and transactions, and providing access to the full features of the Platform.
• Identity and Age Verification: Confirming that you meet the minimum age requirement (18 years or the higher minimum required by the applicable jurisdiction) and that your identity matches the payment methods you use.
• Fraud Prevention and Security: Detecting, investigating and preventing fraudulent activity, multi-accounting, money laundering, bonus abuse and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory Compliance: Meeting our obligations under applicable anti-money laundering (AML) laws, know-your-customer (KYC) requirements and any mandatory reporting obligations to competent authorities.
• Service Improvement: Analysing usage patterns and user feedback to improve platform features, fix technical issues and develop new content and betting categories — including our coverage of Pakistan cricket, PSL/T20 markets, ICC tournaments, football, UFC and esports.
• Personalisation: Tailoring your experience on the Platform based on your betting preferences, favourite sports and usage history, so that relevant content appears more prominently for you.
• Responsible Gambling: Monitoring account activity for patterns that may indicate problem gambling behaviour, implementing voluntary limits you have requested (deposit limits, loss limits, session time limits), and communicating responsible gambling resources to at-risk users.
• Communications: Sending service-critical communications (account confirmations, security alerts, withdrawal notifications), and where you have consented, promotional messages about relevant offers and new features.

5 Legal Basis for Processing

Depending on the context in which we process your data, we rely on one or more of the following legal bases:

• Contractual Necessity: Processing that is necessary to perform our contract with you — for example, operating your account, settling bets and processing deposits and withdrawals.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations and responses to lawful requests from law enforcement or regulatory authorities.
• Legitimate Interests: Processing carried out in pursuit of our legitimate business interests — such as fraud prevention, platform security, analytics and service improvement — where these interests are not overridden by your rights and freedoms.
• Consent: Where we rely on your freely given, specific and informed consent — principally for sending optional promotional communications. You may withdraw consent at any time by contacting [email protected].

6 Data Sharing

Epiwon does not sell, rent or trade your personal data to any third party. We share data only in the limited circumstances described below.

6.1 Service Providers and Data Processors

We engage carefully selected third-party service providers who assist in operating the Platform. These may include identity verification providers, payment processing partners, cloud hosting services, fraud detection vendors and customer support tooling providers. Each processor is bound by a data processing agreement that prohibits use of your data for any purpose beyond delivering the contracted service.

6.2 Regulatory and Law Enforcement Authorities

We may disclose your personal data to competent regulatory or law enforcement authorities where we are legally required to do so — for example, in response to a court order, regulatory investigation, AML reporting obligation or other lawful demand. We do not make voluntary disclosures beyond what is legally required.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or part of Epiwon's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to this Privacy Policy that results from it.

6.4 Responsible Gambling Organisations

In limited circumstances, and only where strictly necessary to protect a user's wellbeing, we may share relevant account information with recognised responsible gambling support organisations, in accordance with our obligations under the operator's licensing framework.

7 Cookies & Tracking Technologies

Epiwon uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences and understand how users interact with the site.

7.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens and load-balancing cookies. They cannot be disabled without impairing core functionality.
• Functional Cookies: Store your preferences (such as language settings, odds format and display preferences) so that they persist between sessions.
• Analytics Cookies: Collect aggregate, anonymised data about how users navigate the Platform — which pages are visited most, where users click and how long sessions last. This data is used to improve content and navigation.
• Security Cookies: Help detect and prevent fraudulent access, multi-accounting and suspicious activity patterns.

7.2 Managing Cookies

You can control cookie settings through your browser's privacy and security settings. Most browsers allow you to block or delete cookies. Be aware that disabling certain cookies may affect the functionality of the Platform — for example, you may not remain logged in between pages if session cookies are blocked.

We do not use cookies to build advertising profiles or share your browsing data with advertising networks.

8 Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or regulation.

• Active Account Data: Retained for the duration of your account's existence on the Platform.
• Transaction and KYC Records: Retained for a minimum of five (5) years following account closure, in line with standard AML record-keeping obligations applicable under the operator's licensing framework.
• Support Communications: Retained for three (3) years from the date of the relevant interaction, to assist with ongoing or future dispute resolution.
• Analytics Data: Retained in aggregated, anonymised form indefinitely for platform improvement purposes. Anonymised data cannot be linked back to individual users.
• Self-Exclusion Records: Where a user has self-excluded, we retain a record of that self-exclusion and the associated account details for the duration of the exclusion period and a reasonable period thereafter, to prevent re-registration.

When data is no longer required for any of the above purposes, it is securely deleted or anonymised in accordance with our internal data lifecycle procedures.

9 International Data Transfers

Epiwon operates within the operator's licensing jurisdiction, which may be located outside Pakistan. As a result, your personal data may be transferred to and processed in countries other than Pakistan. These countries may have data protection frameworks that differ from those you are accustomed to.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place. These may include standard contractual clauses with data processors, binding corporate rules or transfers to jurisdictions that offer an adequate level of protection under the applicable licensing framework's data protection standards.

10 Your Rights

Subject to applicable law and any overriding obligations we hold under regulation, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed, where it is stored and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that we may be legally required to retain certain records even following such a request.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data, pending verification.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a machine-readable copy of your personal data for transfer to another service provider.
• Right to Object: You may object to processing carried out on the basis of our legitimate interests, including profiling, where your individual circumstances justify such an objection. You may also object at any time to the use of your data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request. We will respond within thirty (30) days. We may need to verify your identity before acting on a request to protect against unauthorised data access.

11 Children's Privacy

The Epiwon Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the operator's licensing jurisdiction. We do not knowingly collect personal data from individuals under the applicable minimum age.

If you are a parent or guardian and believe that a minor under your care has provided personal data to us, please contact us immediately at [email protected]. Upon verification, we will take prompt steps to delete the relevant data and close the associated account.

12 Security Measures

Epiwon implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your browser and our servers;
• Encryption of sensitive data at rest, including KYC documents and financial records;
• Strict access controls limiting internal access to personal data on a need-to-know basis, with all access logged and audited;
• Multi-factor authentication requirements for staff accessing production systems;
• Regular penetration testing and vulnerability assessments carried out by qualified security professionals;
• Incident response procedures to detect, respond to and report data breaches within required regulatory timeframes.

While we apply robust security practices, no system is completely impenetrable. You are also responsible for keeping your own account credentials secure. If you suspect unauthorised access to your account, please notify us immediately at [email protected]. We will never ask you for your password via email or any other unsolicited channel.

13 Policy Amendments

Epiwon reserves the right to update or modify this Privacy Policy at any time. When we make material changes, we will provide notice through a prominent banner on the Platform and, where appropriate, by email to your registered address.

The revised Policy will display an updated "Last Updated" date at the top of this page. We encourage you to review this page periodically. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the changes.

If you do not accept the revised Policy, you must discontinue use of the Platform and may request account closure by contacting [email protected].

14 Contact Us

If you have any questions, concerns or complaints about this Privacy Policy or how Epiwon handles your personal data, please reach out to our support team. We are committed to resolving privacy-related enquiries promptly and transparently.

Our support team assists users from across Pakistan — including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. For platform-related questions not covered here, please visit our FAQ page. For responsible gambling enquiries including self-exclusion, deposit limits and support resources, visit our Responsible Gambling page.