Privacy Policy – GoPKWin Pakistan Online Gaming Platform

GoPKWin ("we," "us," "our") operates the online gaming platform accessible at gopkwin.ws and all associated sub-domains, mobile-optimised pages, and features. GoPKWin is the data controller for all personal information collected through the platform.

This Privacy Policy applies to all users of GoPKWin including registered members, visitors who browse without registering, and anyone who contacts GoPKWin through support channels. It covers personal data collected through the website, through payment processing flows, and through any communications between you and GoPKWin's support or operations teams.

GoPKWin is designed for and primarily serves users in Pakistan. Our data practices are built around the realities of the Pakistani digital ecosystem — Easypaisa, JazzCash, and other local payment providers — and our communications with users are conducted in English (en-PK) or Urdu as appropriate.

GoPKWin collects only the personal information necessary to provide you with a functional, secure, and legal online gaming experience. The categories of data we collect are as follows:

GoPKWin does not collect full payment credentials such as Easypaisa PINs, JazzCash passwords, full card numbers, or bank account details. These are handled entirely within the respective payment provider's secure environment.

Every piece of personal data GoPKWin holds serves a specific, identifiable purpose. We do not collect data speculatively. Below is a clear account of why we collect each type of information:

• Registration data — to create and manage your GoPKWin account, verify your identity, communicate with you about your account, and ensure one account per person compliance.
• Identity verification data — to confirm you are who you say you are, to meet our obligations under anti-money-laundering (AML) and Know Your Customer (KYC) requirements, and to verify you are over 18 years of age before enabling real-money gaming.
• Financial transaction data — to process your PKR deposits and withdrawals correctly, maintain accurate account balances, generate statements for your review, investigate any transaction disputes, and detect fraudulent or suspicious financial activity.
• Technical data — to maintain platform security, detect and prevent fraud, identify and fix technical issues, analyse platform performance, and understand how Pakistani users interact with GoPKWin so we can improve the experience.
• Gaming activity data — to provide accurate game history for your review, to power our responsible gaming monitoring systems that identify potential problem gambling behaviour, and to ensure fair play compliance across the platform.
• Support communications — to resolve your queries, maintain a record of the assistance provided, and train support staff to improve service quality.
• Marketing preferences — to send you promotional content about GoPKWin if you have opted in, and to ensure we do not send marketing to members who have opted out or self-excluded.

GoPKWin processes personal data under the following legal bases. Each processing activity has an identifiable lawful reason:

• Contract performance: Processing necessary to deliver the GoPKWin service you have signed up for — account management, game access, deposit and withdrawal processing.
• Legal obligation: Processing required for GoPKWin to comply with applicable legal requirements — KYC identity verification, AML transaction monitoring, record-keeping obligations, and responses to lawful requests from Pakistani regulatory or legal authorities.
• Legitimate interest: Processing necessary for GoPKWin's legitimate business interests that do not override your privacy rights — fraud prevention, platform security, responsible gaming monitoring, and platform analytics used to improve the product.
• Consent: Processing based on your explicit, freely-given consent — marketing communications. You can withdraw consent for marketing at any time without affecting your ability to use GoPKWin.

GoPKWin applies multiple layers of technical and organisational security to protect your personal data. The measures in place include:

• Encryption in transit: All data transmitted between your browser or app and GoPKWin's servers is protected by 256-bit SSL/TLS encryption — the same standard used by Pakistani banks for their digital banking platforms.
• Encryption at rest: Sensitive personal data including identity verification documents and CNIC images are encrypted at the database level, meaning that even if an unauthorised party somehow accessed the database, the data would be unreadable without the decryption keys.
• Access controls: Access to personal data within GoPKWin's systems is restricted on a strict need-to-know basis. Staff members can only access the data directly relevant to their job function. All access is logged and regularly audited.
• Payment data isolation: GoPKWin does not store sensitive payment credentials. Your Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or card payment data is processed entirely within the respective payment provider's secure environment. GoPKWin only receives a confirmation of the transaction outcome, not your payment credentials.
• Infrastructure security: GoPKWin's platform infrastructure uses firewalled server environments, intrusion detection systems, regular security patching, and periodic independent penetration testing.
• Staff training: All GoPKWin staff who handle personal data receive mandatory data protection training and are bound by confidentiality agreements.

Despite these measures, no online system can guarantee 100% security. If you believe your GoPKWin account has been compromised, contact support@gopkwin.ws immediately so we can investigate and take protective action.

GoPKWin shares your personal data only in the following specific circumstances, and never for commercial exploitation:

• Payment processors: To execute your deposit and withdrawal requests, GoPKWin shares the minimum necessary data (such as your registered mobile number or email) with Easypaisa, JazzCash, NayaPay, SadaPay, or your bank as required to process the transaction. These providers are themselves subject to strict data protection obligations.
• Identity verification providers: If KYC verification is triggered on your account, your CNIC data and verification images are processed by GoPKWin's contracted identity verification partner. This partner is selected for their security credentials and is contractually prohibited from using your data for any purpose other than completing the verification.
• Fraud and security partners: GoPKWin uses specialist technical tools for fraud detection and cybersecurity monitoring. These tools may process technical data including IP addresses and device fingerprints. They do not receive your name, contact details, or financial account information.
• Legal and regulatory authorities: GoPKWin will disclose personal data to Pakistani law enforcement, regulatory bodies, or courts when required to do so by a lawful order, warrant, or regulatory requirement. We do not do this voluntarily or pre-emptively.
• Business successors: In the event of a merger, acquisition, or sale of GoPKWin's business or assets, your personal data may be transferred to the successor entity. You will be notified in advance of any such transfer and given the opportunity to request deletion of your data if you do not wish it to be transferred.

GoPKWin does not share your personal data with advertisers, data brokers, marketing agencies, or any other third party for commercial purposes. Full stop.

GoPKWin uses cookies and similar technologies to make the platform work properly and to improve your experience. Here is a plain-language breakdown of what we use and why:

• Essential cookies: These are strictly necessary for the platform to function. They maintain your login session so you do not need to re-enter your credentials every time you navigate between pages. Without these cookies, GoPKWin cannot work. They cannot be disabled.
• Functional cookies: These remember your preferences — such as your preferred language, last-visited game section, and notification settings — so the platform feels familiar when you return. You can disable these without affecting core functionality.
• Analytics cookies: GoPKWin uses anonymised analytics tools to understand how Pakistani users navigate the platform — which pages are visited most, where users encounter friction, and how gaming sessions typically flow. This data is aggregated and cannot be traced back to an individual member.
• Security cookies: Short-lived session tokens that help GoPKWin detect and prevent account takeover attempts, CSRF attacks, and other security threats. These are essential and cannot be disabled.

GoPKWin does not use third-party advertising cookies or tracking pixels that follow you across other websites. You can manage cookie preferences through your browser settings. Most modern mobile browsers on Pakistani devices — Chrome, Safari, Samsung Internet — provide cookie controls in their settings menu.

GoPKWin retains personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

• Active account data: Retained for the duration of your membership plus five years following account closure. This covers transaction records, gaming history, and identity verification documents — retained to meet anti-money-laundering record-keeping requirements.
• Support communications: Retained for two years from the date of the communication. This allows us to reference previous interactions when handling follow-up queries and to maintain quality assurance records.
• Technical and security logs: Retained for twelve months. Used for fraud investigation and security auditing purposes.
• Marketing consent records: Retained for the duration of your membership plus one year after closure, to demonstrate compliance with consent requirements in the event of a dispute.
• Anonymised analytics data: Retained indefinitely in anonymised, aggregated form. Individual identity cannot be reconstructed from this data.

When personal data is no longer required and its retention period has expired, GoPKWin deletes it securely using methods that prevent recovery. Physical documents (if any) are shredded; digital records are overwritten using secure deletion protocols.

As a GoPKWin member, you have the following rights with respect to your personal data. To exercise any of these rights, contact support@gopkwin.ws with "Data Rights Request" in the subject line. Requests are processed within seven business days.

GoPKWin's services are strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18 years of age.

GoPKWin's registration process includes a date of birth field and age verification checks. If GoPKWin discovers that a member has provided a false date of birth and is under 18 years of age, the account will be immediately suspended, any funds deposited will be returned in full, and all personal data associated with the account will be deleted promptly.

If you are a parent or guardian and believe a minor in your household has attempted to register on GoPKWin, please contact us immediately at support@gopkwin.ws so we can investigate and take appropriate action.

GoPKWin's responsible gaming system processes member gaming activity data to identify patterns that may indicate problem gambling behaviour. This processing is conducted under GoPKWin's legitimate interest in protecting the welfare of its members. Specifically:

• GoPKWin's automated monitoring tools analyse gaming session length, frequency of play, deposit patterns, and changes in wagering behaviour to identify members who may be showing signs of problem gambling.
• Where concerning patterns are detected, GoPKWin's responsible gaming team may reach out proactively to check on a member's wellbeing and inform them of the tools available.
• If a member voluntarily self-excludes, GoPKWin retains a record of the self-exclusion and uses it to prevent that member from creating a new account during the exclusion period. This record is maintained for the duration of the exclusion plus two years.
• Data processed for responsible gaming purposes is handled with the highest level of sensitivity and is accessible only to trained responsible gaming staff within GoPKWin. It is not shared with any third party except in the context of a legal obligation.

You can access GoPKWin's full responsible gaming framework — deposit limits, session controls, cool-off periods, and self-exclusion — at our Responsible Gaming page.

GoPKWin may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made — changes that meaningfully affect how your personal data is used — GoPKWin will:

• Notify registered members by email to their registered address at least 14 days before the change takes effect
• Display a prominent notice on the GoPKWin platform for a minimum of 30 days following the change
• Update the "Last Updated" date at the top of this policy document

Minor updates — such as clarifications that do not alter the substance of the policy, corrections to typographical errors, or changes required by legal compliance — may be made without advance notice but will always be reflected in the version date.

Your continued use of GoPKWin after the effective date of any updated Privacy Policy constitutes your acceptance of the revised policy. If you do not accept the changes, you should contact GoPKWin to discuss your options, which may include account closure with return of eligible balances.

GoPKWin takes privacy complaints seriously and will investigate every concern raised in good faith. If you have a question about this Privacy Policy, want to exercise a data right, or wish to raise a privacy concern, please contact us through the following channels:

• Privacy enquiries (general): support@gopkwin.ws — subject: "Privacy"
• Data rights requests: support@gopkwin.ws — subject: "Data Rights Request"
• Privacy complaints: support@gopkwin.ws — subject: "Privacy Complaint"
• Live chat: Available 24/7 from within your GoPKWin account

GoPKWin will acknowledge your privacy enquiry or complaint within 24 hours and aim to provide a substantive response within seven business days. For complex matters requiring internal investigation, we may request up to 30 days and will keep you informed of progress.

If you are not satisfied with GoPKWin's response to a privacy complaint, you have the right to escalate to GoPKWin's senior management review team by replying with "Escalate" to the original response. We take escalated privacy matters with the highest seriousness.

For other legal documents relevant to your use of GoPKWin, see our Terms and Conditions and Responsible Gaming pages. For common questions about how the platform works, visit our FAQ.