bpaxch Privacy
Policy & Data Protection

This Privacy Policy describes how bpaxch ("we", "us", "our") collects, uses, stores, shares, and protects personal data relating to individuals ("you", "your") who register for and use the bpaxch Platform at bpaxch.com, including any associated mobile applications and services offered through the Platform.

bpaxch is committed to protecting the privacy and personal data of all registered players, visitors, and prospective players who interact with the Platform. This Policy is written in plain English and is intended to be clear, transparent, and easy to understand. Where legal terminology is unavoidable, we have provided plain-language explanations alongside.

By registering an Account on bpaxch, or by continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read, understood, and agreed to the collection and use of your personal data as described in this Privacy Policy. If you do not agree with any part of this Policy, you must not register or continue to use the bpaxch Platform.

For the purposes of applicable data protection legislation, bpaxch is the data controller responsible for your personal data. As data controller, bpaxch determines the purposes and means by which your personal data is processed. bpaxch operates under an international gaming licence and is subject to the data protection and privacy obligations imposed by that licensing jurisdiction.

bpaxch has appointed an internal data protection point of contact who is responsible for overseeing compliance with this Privacy Policy and applicable data protection law. If you have any questions, concerns, or requests relating to your personal data, you may contact our support team via the live chat channel available 24/7 on the Platform. Support is available in both Urdu and English to ensure Pakistani players can communicate comfortably.

bpaxch collects the following categories of personal data from players and Platform visitors. We collect only what is necessary and proportionate for the specific purpose for which it is collected.

bpaxch does not knowingly collect special category data (such as data concerning health, religion, or political opinion) except where explicitly required by the responsible gaming obligations described in our Responsible Gaming Policy — for example, where a player voluntarily discloses a gambling-related health concern to our support team.

bpaxch collects personal data through the following channels and mechanisms:

• Direct provision by you: Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, submitting a support request, or updating your Account profile.
• Automated collection: Technical and behavioural data collected automatically when you access or use the Platform, through server logs, cookies, and similar tracking technologies described in Section 10 of this Policy.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency payment processors when you make deposits or receive withdrawals.
• Identity verification providers: Confirmation data received from third-party KYC and identity verification service providers who assist bpaxch in verifying the identity and age of players as required by our regulatory obligations.
• Fraud prevention providers: Risk signals and fraud indicators received from third-party fraud prevention and AML screening services used by bpaxch to protect the Platform and its players.

bpaxch processes your personal data only where a valid legal basis exists for doing so. The legal bases on which bpaxch relies are as follows:

• Performance of a contract: Processing your identity data, contact data, and financial data is necessary to register your Account, provide bpaxch services, process your deposits and withdrawals, and fulfil bpaxch's contractual obligations to you under the Terms & Conditions.
• Legal obligation: Processing your identity data for KYC verification, processing financial transaction data for AML compliance, and retaining records for the minimum period required by our licensing authority are all necessary for bpaxch to comply with applicable legal and regulatory obligations.
• Legitimate interests: Processing technical and behavioural data for fraud prevention, Platform security, service improvement, and responsible gaming monitoring is carried out on the basis of bpaxch's legitimate interests, provided those interests are not overridden by your rights and interests.
• Consent: Where bpaxch sends you optional marketing communications (such as promotional offers and bonus notifications), this is done on the basis of your explicit consent, which you may withdraw at any time through your Account settings or by contacting support.

bpaxch uses the personal data we collect for the following purposes:

• To create, manage, and maintain your bpaxch Account, including processing your registration and verifying your identity and age;
• To process deposits and withdrawals in PKR via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency channels;
• To verify your identity and age as required by our KYC obligations, particularly for players based in Karachi, Lahore, Islamabad, Faisalabad, and other cities across Pakistan;
• To provide customer support via live chat and other communication channels, and to maintain records of support interactions for quality assurance purposes;
• To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other prohibited conduct as described in the bpaxch Terms & Conditions;
• To monitor your gambling behaviour for responsible gaming purposes, including detecting signs of problem gambling and triggering appropriate interventions through the tools described in our Responsible Gaming Policy;
• To personalise your Platform experience, including displaying relevant PSL cricket markets, casino games, slots, and promotional offers based on your Platform usage history;
• To send you service communications — such as Account notifications, transaction confirmations, KYC requests, and important policy updates — which are necessary for the operation of your Account;
• To send you optional promotional and marketing communications about bpaxch bonuses, new games, and special offers, where you have provided consent for such communications;
• To comply with our legal and regulatory obligations under our international gaming licence and applicable data protection law;
• To improve, test, and develop the bpaxch Platform using aggregated and anonymised usage data.

bpaxch does not sell, rent, or trade your personal data to any third party for their own marketing purposes. bpaxch shares your personal data with third parties only in the following circumstances:

• Payment processors: We share financial transaction data with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency processing partners solely for the purpose of executing your deposits and withdrawals. These providers are contractually bound to use your data only for payment processing purposes.
• KYC and identity verification providers: We share identity data (name, date of birth, CNIC details, document images) with our third-party KYC verification service provider for the sole purpose of verifying your identity and age. This provider acts as a data processor under a binding data processing agreement with bpaxch.
• Fraud prevention and AML screening services: We share limited technical and identity data with fraud prevention and AML screening providers to fulfil our regulatory obligations and protect the Platform and its players from financial crime.
• Game content providers: Where you play games on the bpaxch Platform that are supplied by third-party game studios, those studios may receive limited technical data (such as session identifiers) necessary to operate the game. No personally identifiable data beyond what is technically necessary is shared with game providers.
• Regulatory and law enforcement authorities: bpaxch will disclose personal data to regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, by court order, or by the requirements of our gaming licence.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bpaxch's business, personal data held by bpaxch may be transferred to the acquiring entity, subject to equivalent data protection obligations.

bpaxch retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy, or for as long as is required by applicable legal, regulatory, or licensing obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with bpaxch's internal data destruction procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify any individual.

As a bpaxch player, you have the following rights with respect to your personal data. To exercise any of these rights, please contact the bpaxch support team via the live chat channel on the Platform. bpaxch will respond to all data rights requests within thirty (30) calendar days of receipt, free of charge.

• Right of Access: You have the right to request a copy of the personal data bpaxch holds about you, along with information about how it is used and with whom it has been shared. This is commonly known as a Subject Access Request (SAR).
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Certain data corrections (such as name or date of birth) may require supporting documentation as part of bpaxch's data integrity procedures.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing only), or where you object to processing based on legitimate interests. This right is subject to bpaxch's legal obligations to retain certain data as described in Section 8.
• Right to Restriction: You have the right to request that bpaxch restricts the processing of your personal data in certain circumstances — for example, while an inaccuracy is being investigated, or where you have objected to processing and a decision on that objection is pending.
• Right to Data Portability: You have the right to receive personal data that you have provided to bpaxch in a structured, commonly used, machine-readable format, and to request that this data be transmitted to another service provider where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on bpaxch's legitimate interests. bpaxch will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you have the right to withdraw that consent at any time through your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

bpaxch uses cookies and similar tracking technologies on the Platform to enable essential functionality, improve performance, and where consent has been provided, to analyse Platform usage and personalise your experience.

The following categories of cookies are used on the bpaxch Platform:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as Account authentication, session management, and security. These cookies cannot be disabled without rendering the Platform non-functional.
• Performance & Analytics Cookies: These cookies collect anonymised information about how visitors use the Platform — such as which pages are visited most frequently and where errors occur — allowing bpaxch to improve Platform performance. These cookies are enabled by default but may be disabled through your browser settings.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, currency display settings, and UI layout choices — to provide a more personalised Platform experience on return visits.
• Responsible Gaming Cookies: bpaxch uses specific cookies to enforce session time limits, display responsible gaming reminders, and track the status of any self-exclusion or cooling-off periods you have activated. These cookies are strictly necessary and cannot be disabled.

bpaxch does not use third-party advertising cookies or behavioural advertising technologies that track your activity across other websites beyond the bpaxch Platform. You may manage cookie preferences through your browser settings at any time. Please note that disabling cookies beyond the strictly necessary category may affect the functionality of certain Platform features.

bpaxch implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• TLS 1.3 encryption for all data in transit between your device and bpaxch servers;
• AES-256 encryption for personal data and financial information stored at rest on bpaxch servers;
• Multi-factor authentication requirements for all bpaxch internal staff accessing player data;
• Role-based access controls ensuring that bpaxch staff can only access player data necessary for their specific job function;
• Regular third-party penetration testing and security audits of the Platform infrastructure;
• Automated intrusion detection and monitoring systems operating 24/7;
• Secure data destruction procedures for physical media and electronic storage devices containing personal data;
• Staff training on data protection and information security practices on joining bpaxch and annually thereafter.

bpaxch implements active age verification measures as part of the registration process and KYC verification procedures to prevent access by underage individuals. If bpaxch becomes aware that personal data has been collected from a person under the age of 21 — whether discovered through KYC review, parental notification, or any other means — the following steps will be taken immediately:

• The Account will be suspended immediately pending investigation;
• All personal data associated with the Account will be reviewed and securely deleted to the extent permitted by applicable law;
• Any funds in the Account will be returned to the originating payment method after deduction of any bonus funds credited to the Account;
• The matter will be reported to the relevant regulatory authority as required by our licensing obligations.

Parents and guardians who believe that a minor may have registered on the bpaxch Platform are urged to contact bpaxch support immediately via the 24/7 live chat channel. bpaxch treats all such reports with urgency and the highest priority.

bpaxch's servers and primary data infrastructure are located within the jurisdiction of our international gaming licence. As a result, your personal data will be transferred to and stored in a jurisdiction that may be outside Pakistan. bpaxch ensures that any such international transfer of personal data is carried out in compliance with applicable data protection law and is subject to appropriate safeguards.

Where bpaxch transfers personal data to third-party service providers located in countries outside Pakistan, we ensure that adequate data protection safeguards are in place through one or more of the following mechanisms:

• Data processing agreements incorporating standard contractual clauses that impose data protection obligations on the recipient equivalent to those applicable to bpaxch;
• Transfer to recipients located in jurisdictions that have been determined to provide an adequate level of data protection;
• Other appropriate safeguards as recognised under applicable data protection law.

bpaxch reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or applicable law. When material changes are made to this Policy, bpaxch will notify registered players via the mobile number or email address associated with their Account, or via a prominent notice on the Platform, at least seven (7) calendar days before the amended Policy takes effect.

Non-material changes — such as typographical corrections, clarifications of existing provisions, or restructuring of sections without substantive change — may be made without advance notice and take effect immediately upon publication on the Platform.

The "Last Updated" date at the top of this Policy will always reflect the date on which the most recent version was published. bpaxch recommends that you review this Policy periodically to stay informed about how we are protecting your personal data. Your continued use of the bpaxch Platform after any change to this Policy constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data bpaxch holds about you, please contact our support team through the following channel:

• Live Chat: Available 24/7 on the bpaxch Platform — average response time 3–5 minutes. Support is available in both Urdu and English.
• Support Email: support at bpaxch.com (plain text — not a clickable link)

When contacting bpaxch regarding a data rights request or a privacy concern, please include your registered Account username and a clear description of your request or concern to allow our team to assist you as efficiently as possible.