Privacy Policy – 228win Pakistan Data Protection Commitment

1. Introduction

This Privacy Policy describes how 228win collects, uses, stores and protects the personal information of everyone who registers an account or uses any service available at 228win.ws ("the Platform"). When we say "228win", "we", "us" or "our" in this document, we mean the operator of the 228win platform. When we say "you" or "your", we mean any person who registers on or accesses the platform.

228win is committed to handling personal data responsibly. We collect only the information we genuinely need to run the platform and provide services to Pakistani players. We do not sell your data to third parties under any circumstances. We do not share your data with advertisers for the purpose of profiling or targeting you outside of the 228win platform.

This Policy should be read alongside the 228win Terms and Conditions and the Responsible Gaming guidelines. Together, these three documents define the full agreement between you and 228win. By registering an account at 228win or using any part of the platform, you confirm that you have read and accept this Privacy Policy.

2. Data Controller

228win is the data controller for all personal information collected through the 228win platform. As data controller, 228win determines the purposes for which your personal data is processed and the means by which it is processed. All data handling at 228win is conducted in accordance with the platform's licensing obligations and applicable data protection standards.

If you have questions about how your data is handled, you can contact 228win's data contact point at any time:

• Email: support@228win.ws
• Live Chat: Available 24/7 directly within the 228win platform

228win takes data controller responsibilities seriously. Any member of the platform team who handles player data is subject to strict access controls and confidentiality obligations. Only staff who require access to personal data to perform their specific role are permitted to access it.

3. Personal Data We Collect

228win collects personal data through several means: information you provide directly during registration and account use, information generated automatically through your interaction with the platform, and in some cases information provided by third-party payment and verification services. Here is a clear breakdown of what we collect and when:

228win does not collect sensitive personal categories of data — such as health information, religious beliefs, political opinions or biometric data — except where identity document submission incidentally contains such information as part of a standard government-issued ID. In such cases, only the information necessary for identity verification is processed.

4. How 228win Uses Your Personal Data

228win processes your personal data for specific, defined purposes. We do not use your data for purposes beyond those listed here without obtaining fresh consent or informing you of the additional purpose in advance.

• Account creation and management: Your registration data is used to create and maintain your 228win account, verify your identity and ensure that only you can access your account.
• Providing gaming services: Transaction data and game history are necessary to process bets, settle results, credit winnings and display your account balance and history accurately.
• Payment processing: Financial data is used exclusively to process deposits and withdrawals through your chosen payment method. Card details are tokenised and handled by PCI-DSS compliant payment processors — 228win does not store raw card numbers on its servers.
• Identity verification and fraud prevention: KYC documents are used to verify that you are who you say you are, that you meet the 18+ age requirement and that no duplicate accounts exist. Device and IP data is used to detect unusual account access patterns and prevent account takeovers.
• Responsible gaming: Usage data and session information is used by 228win's player protection systems to identify patterns that may indicate problem gambling and to enforce voluntary limits set by players.
• Customer support: Communication data is used to resolve queries, process complaints and provide help with account issues. Support conversations are retained to allow continuity of service and for quality assurance.
• Legal and regulatory compliance: 228win is required to maintain certain records by its licensing authority and applicable financial regulations. Transaction records and identity verification data form part of this compliance obligation.
• Platform improvement: Anonymised and aggregated usage data helps 228win understand how players use different features and make improvements to the platform. This analysis does not identify individual players.
• Marketing communications: If you have opted in to receive promotional communications from 228win, we will send you notifications about bonuses, new games and other platform news. You can opt out at any time.

228win will never use your personal data to make automated decisions that have significant legal or financial effects on you without a human review component. For example, account closure decisions are reviewed by the 228win compliance team, not determined solely by automated systems.

5. Legal Basis for Processing

228win processes personal data under the following legal grounds:

• Contract performance: Processing necessary to deliver the services you have registered for — account management, bet settlement, payment processing. Without this processing, 228win cannot provide you with its services.
• Legal obligation: Processing required to comply with licensing conditions, anti-money laundering regulations and other applicable legal requirements, including the retention of transaction records and identity verification documents.
• Legitimate interests: Processing for fraud detection, platform security and responsible gaming monitoring, where these interests do not override your fundamental rights and freedoms.
• Consent: Processing for optional activities such as marketing communications and the setting of optional cookies. You can withdraw consent for these activities at any time without affecting the provision of core platform services.

6. Sharing Your Data

228win does not sell your personal data to any third party. We do not share your data with advertising networks for the purpose of building profiles to target you with ads outside of the 228win platform. The circumstances in which 228win may share your data with third parties are strictly limited:

• Payment processors: Your financial information is shared with the payment service providers you choose to use (Easypaisa, JazzCash, NayaPay, SadaPay, bank partners and card networks) solely for the purpose of processing your deposits and withdrawals. These providers process your data under their own privacy policies and are bound by applicable financial data security standards.
• Identity verification providers: Where 228win uses a third-party KYC verification service to process your identity documents, your document data is shared with that provider for the sole purpose of verifying your identity. KYC providers used by 228win are contractually bound to process your data only as directed by 228win and not to retain it beyond the verification period.
• Game technology providers: Game suppliers whose titles are hosted on the 228win platform may receive technical data (session identifiers, bet amounts) necessary to run their games and ensure correct settlement. They do not receive personally identifiable information beyond what is technically necessary.
• Regulatory and law enforcement authorities: 228win will share personal data with its licensing authority, financial intelligence units or law enforcement agencies when required to do so by law, court order or regulatory direction. 228win will not voluntarily share data with authorities beyond what is legally required.
• Professional advisers: In certain circumstances, 228win's legal, financial or security advisers may need to access personal data as part of their professional engagement. These parties are bound by professional confidentiality obligations.

7. Data Retention Periods

228win retains personal data for as long as it is necessary for the purpose for which it was collected, subject to any legal obligations that require longer retention. The following general retention periods apply:

• Account and registration data: Retained for the lifetime of your account plus five years after account closure, to meet regulatory record-keeping requirements.
• Transaction and betting records: Retained for a minimum of five years from the date of each transaction, in line with anti-money laundering regulations applicable to gaming operators.
• Identity verification documents: Retained for five years from the date of verification or from the date of account closure, whichever is later.
• Customer support communications: Retained for three years from the date of the last interaction in a given support thread, or until a related dispute is fully resolved if that is later.
• Technical and device data (logs): Retained for twelve months on a rolling basis, after which they are anonymised or deleted.
• Marketing preferences and opt-in records: Retained for as long as your account is active, or until you withdraw consent, whichever comes first.

When data is no longer required and there is no legal obligation to retain it, 228win deletes it securely or anonymises it so that it can no longer be attributed to any individual.

8. How 228win Protects Your Data

228win implements technical and organisational security measures appropriate to the sensitivity of the data we hold. These include:

• Encryption in transit: All communication between your browser or device and the 228win platform is encrypted using TLS 1.3. Data transmitted between 228win's servers and payment providers is also encrypted.
• Encryption at rest: Sensitive personal data stored on 228win's servers — including identity documents and financial data — is encrypted using AES-256.
• Access controls: Access to personal data within 228win's systems is restricted on a need-to-know basis. Staff members can only access the data categories their role requires. All access is logged and reviewed.
• Password security: Player account passwords are stored as salted hashes. 228win staff cannot view your password and will never ask you to disclose it.
• Fraud monitoring: Automated systems monitor login patterns, transaction behaviours and device usage to detect and prevent unauthorised account access and fraudulent activity.
• Security assessments: 228win conducts regular reviews of its security infrastructure and processes to identify and address potential vulnerabilities.

Despite these measures, no internet-based system can guarantee absolute security. 228win encourages players to protect their own accounts by using a strong, unique password, enabling any two-factor authentication options available and logging out of their account when using shared devices. If you suspect your account has been compromised, contact 228win support immediately.

9. Cookies and Tracking Technologies

228win uses cookies and similar technologies on its platform. A cookie is a small text file placed on your device when you visit a website. Cookies allow the platform to remember your preferences, keep you logged in and understand how the site is being used.

228win uses the following categories of cookies:

• Essential cookies: Required for the platform to function. These include session cookies that keep you logged in, cookies that maintain your game state and cookies that remember your deposit method preferences. These cannot be disabled without preventing core platform functionality.
• Performance and analytics cookies: Used to understand how players navigate the platform — which pages are visited, how long sessions last and where players encounter difficulties. This data is used in aggregated, anonymised form to improve the platform. These cookies are optional.
• Functional cookies: Remember your preferences such as language settings, notification preferences and responsible gaming tool configurations. These enhance your experience but are not essential to core functionality.
• Marketing cookies: Used only if you have consented to receiving promotional communications from 228win. These help ensure that promotional messages shown to you within the 228win platform are relevant to your gaming activity. 228win does not place third-party advertising cookies on its platform.

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, or to receive a notification before a cookie is set. Blocking essential cookies will affect the platform's ability to function correctly.

10. Your Rights Over Your Personal Data

228win respects your rights over your own personal information. The following rights are available to you as a 228win player:

To exercise any of these rights, contact 228win by email at support@228win.ws or through the platform's live chat. We will respond to all data rights requests within 30 calendar days. Complex requests may take longer, in which case we will inform you of the expected timeline.

228win will not discriminate against any player for exercising their data rights. Exercising your rights will not result in reduced service quality, account restrictions or any other adverse consequence, except where the nature of your request (such as requesting deletion of all data) makes continued account operation impossible.

11. Minors and Data Protection

228win does not knowingly collect personal data from individuals under the age of 18. The platform is strictly for adults and age verification is part of the registration and KYC process for this reason. If 228win discovers or is notified that an account has been registered by a person under 18, that account will be closed immediately and all personal data associated with it will be deleted, subject to any legal obligations to retain certain records related to the detection of underage gambling.

Parents or guardians who believe a minor has registered an account at 228win should contact customer support immediately at support@228win.ws. 228win will investigate and act on all such reports promptly.

12. International Data Transfers

Some of 228win's service providers — including game technology suppliers and infrastructure providers — may be located outside Pakistan. Where personal data is transferred to a provider outside Pakistan, 228win takes steps to ensure that the transfer is protected by appropriate safeguards. These may include contractual data protection clauses that bind the receiving party to handle your data in accordance with standards equivalent to those described in this Policy.

228win will not transfer your data to any jurisdiction where adequate data protection standards cannot be ensured. If you would like more information about the specific transfers applicable to your data, contact 228win at support@228win.ws.

13. Changes to This Privacy Policy

228win reviews and updates this Privacy Policy periodically to reflect changes in how we operate, changes in the services we offer and evolving data protection standards. When significant changes are made, registered players will be notified via a platform notification or by email to the address or mobile number on their account, before the changes take effect.

The effective date at the top of this Policy shows when it was last updated. We encourage you to review this page from time to time. Continued use of the 228win platform following notification of a change to this Policy constitutes your acceptance of the updated Policy.

If you do not agree with a change made to this Policy, you may request account closure in accordance with the process described in the 228win Terms and Conditions.

14. Contact Us About Privacy

If you have any questions, concerns or complaints about how 228win handles your personal data, please get in touch. We take all privacy-related communications seriously and will respond promptly.

• Live Chat: Available 24 hours a day, 7 days a week within the 228win platform — typically the fastest way to reach us
• Email: support@228win.ws — for formal privacy queries, data rights requests or complaints

When submitting a data rights request by email, please include your registered mobile number and a brief description of your request so we can locate your account and respond efficiently. We will acknowledge your request within 24 hours and aim to resolve it within 30 calendar days.

This Privacy Policy was last reviewed and updated on 1 July 2025.