BPEX Privacy Policy – How We Protect Your Data in Pakistan

1Who We Are

BPEX is an online betting and gaming platform operated exclusively for users in Pakistan. The platform is accessible at bpex.ws and provides sports betting, live casino, slots, virtual sports, and esports betting services denominated entirely in Pakistani Rupees (PKR). All services are provided by BPEX's operating entity, which acts as the data controller responsible for processing your personal information in connection with your use of the BPEX platform.

As data controller, BPEX determines the purposes and means by which your personal data is processed. This Privacy Policy describes those purposes and means in full. If you have questions about how BPEX handles your data, contact the BPEX Data Protection team at support@bpex.ws.

2Personal Data We Collect

BPEX collects only the personal data that is genuinely necessary to provide you with a safe, functional, and compliant betting service. The categories of data we collect include:

3How We Collect Your Data

BPEX collects personal data through the following channels:

3.1 Direct Collection

The majority of your data comes directly from you — when you complete the BPEX registration form, when you make a deposit or withdrawal, when you contact customer support, when you respond to promotional offers, or when you submit identity verification documents. This direct collection is the primary source of your personal data on BPEX.

3.2 Automated Technical Collection

When you access the BPEX website or platform, our servers and analytics tools automatically collect technical data such as your IP address, device specifications, and browsing behaviour on our platform. This data is collected through server logs, cookies, and similar technologies described further in Section 7.

3.3 Third-Party Sources

BPEX may receive data about you from third-party sources in limited circumstances. These include identity verification service providers (who confirm the accuracy of the documents you submit), fraud prevention databases (which help BPEX detect potentially fraudulent account activity), and payment processors (who confirm transaction completions). BPEX uses this third-party data only for the specific purposes for which it was provided and does not use it to build marketing profiles.

4Why We Use Your Data

BPEX uses your personal data for the following specific purposes. For each purpose, we have identified the legal basis on which we rely (see Section 5 for more detail):

• Account creation and management: Processing your registration, verifying your identity, maintaining your account settings, and managing your balance — all of which are necessary to deliver the BPEX service you signed up for.
• Payment processing: Processing deposits via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and Visa/Mastercard, and processing your withdrawal requests back to your registered payment method. Financial data is used only for this purpose and is not stored beyond what is required.
• Identity verification (KYC): Verifying that you are who you say you are, that you meet the age requirement of 18 years or above, and that your payment method belongs to you. This is required by BPEX's anti-money laundering obligations.
• Responsible gaming: Monitoring your usage patterns to identify signs of problem gambling. If BPEX detects patterns that suggest a player may be developing harmful gambling habits, our responsible gaming team will make proactive contact. This use of data is one of the most important things BPEX does with player data.
• Fraud prevention and security: Detecting and preventing unauthorised access to your account, identifying multi-accounting, detecting bonus abuse, and protecting the integrity of the platform for all users.
• Customer support: Resolving your queries, processing complaints, and maintaining records of support interactions so that repeated issues are handled with full context.
• Legal and regulatory compliance: Maintaining transaction records as required by applicable law, reporting to regulatory authorities where required, and responding to lawful requests from law enforcement.
• Platform improvement: Analysing aggregated, anonymised usage data to improve the BPEX platform — identifying features that work well and areas that need improvement. Individual-level data is not used for this purpose unless anonymised.
• Marketing communications (with consent): Sending you promotional offers, bonus notifications, and relevant updates about BPEX products — but only if you have opted in to receive such communications. See Section 12 for full details.

5Legal Basis for Processing

BPEX processes your personal data on the following legal bases, depending on the specific purpose:

• Contract performance: Processing necessary to fulfil our contractual obligations to you as a registered BPEX account holder — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws — including KYC/AML obligations, age verification requirements, and regulatory reporting duties.
• Legitimate interests: Processing carried out for BPEX's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit consent — specifically, direct marketing communications. Consent-based processing can be withdrawn by you at any time without affecting the lawfulness of prior processing.

6Who We Share Your Data With

BPEX shares your personal data only with the categories of recipients listed below, and only to the extent necessary for the stated purpose. BPEX never sells your personal data to any third party under any circumstances.

6.1 Payment Processors

BPEX shares financial transaction data with Easypaisa, JazzCash, NayaPay, SadaPay, and card payment processors solely to process your deposits and withdrawals. These providers receive only the minimum data required to complete the transaction and are contractually obligated to keep it confidential.

6.2 Identity Verification Providers

When you submit KYC documents, BPEX uses a third-party identity verification service to confirm their authenticity. The verification provider processes your document images and returns a pass/fail result. They do not retain copies of your documents beyond the verification period.

6.3 Game and Technology Providers

BPEX uses third-party software providers for casino games, sports data feeds, and platform technology. These providers may receive limited technical data (such as session tokens or anonymous game identifiers) to enable game delivery. They do not receive personally identifiable information unless specifically required for a technical purpose disclosed to you.

6.4 Fraud and AML Services

BPEX uses fraud detection and anti-money laundering screening services that process data against known risk databases. This is a legal obligation and is carried out in compliance with applicable regulations.

6.5 Law Enforcement and Regulatory Bodies

BPEX will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by a lawful order or where BPEX has a legal obligation to report. BPEX will inform you of any such disclosure where it is legally permitted to do so.

7Cookies and Tracking Technologies

BPEX uses cookies and similar tracking technologies on the bpex.ws website and platform. Cookies are small text files stored on your device that help the platform function correctly, remember your preferences, and analyse how the platform is being used. The table below summarises the types of cookies BPEX uses:

You can manage your cookie preferences via your browser settings. Disabling non-essential cookies will not prevent you from using BPEX, but may affect some platform features. Disabling essential cookies will prevent you from logging in.

8Data Security

BPEX takes the security of your personal data seriously and implements appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and BPEX servers is encrypted using industry-standard TLS encryption.
• At-rest encryption: Personal data and financial records stored on BPEX servers are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within BPEX is restricted to staff who have a legitimate need to access it for their role. All staff with access to personal data undergo data protection training.
• Two-factor authentication: BPEX offers two-factor authentication for player accounts as an additional layer of account security.
• Regular security audits: BPEX's platform and security infrastructure are subject to regular penetration testing and security reviews by qualified third parties.
• Breach response: In the event of a personal data breach that poses a risk to your rights and freedoms, BPEX will notify affected users without undue delay and take immediate steps to contain and remediate the breach.

9Data Retention

BPEX retains your personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

• Account and transaction data: Retained for a minimum of 5 years from account closure, as required by anti-money laundering regulations applicable to financial services businesses.
• KYC verification documents: Retained for 5 years from the date of verification, after which document images are securely deleted and only a verification status record is kept.
• Customer support records: Retained for 3 years from the date of the interaction, to support resolution of any future disputes.
• Marketing consent records: Retained indefinitely as evidence of consent, even after you withdraw consent, to demonstrate compliance with applicable regulations. The marketing communications themselves stop immediately upon withdrawal of consent.
• Technical and usage data (anonymised): Anonymised analytics data used for platform improvement has no fixed deletion timeline as it cannot be linked back to any individual.

When data reaches the end of its retention period, BPEX securely deletes or anonymises it so that it can no longer be linked to you as an individual.

10Your Rights Over Your Personal Data

As a BPEX player, you have the following rights over your personal data. To exercise any of these rights, send a request to support@bpex.ws. BPEX will respond within 30 days.

10.1 Right to Access

You have the right to request a copy of all personal data BPEX holds about you. This is sometimes called a Subject Access Request (SAR). BPEX will provide this information in a structured, commonly used format free of charge.

10.2 Right to Rectification

If any personal data BPEX holds about you is inaccurate or incomplete, you have the right to request that we correct it. Basic details such as your contact number or address can be updated directly through your account settings. For identity-related data, contact support.

10.3 Right to Erasure

You have the right to request that BPEX delete your personal data — the "right to be forgotten" — in certain circumstances. This right applies where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing. This right does not apply where BPEX has a legal obligation to retain the data (such as the AML retention requirements described in Section 9).

10.4 Right to Restrict Processing

In certain circumstances, you can request that BPEX limit how it uses your data — for example, while a dispute about accuracy is being resolved — without requiring full deletion.

10.5 Right to Data Portability

You have the right to receive a copy of the personal data you provided to BPEX in a structured, machine-readable format, and to request that BPEX transfer it directly to another controller where technically feasible.

10.6 Right to Object

You have the right to object to processing carried out on the basis of BPEX's legitimate interests. BPEX will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests. You have an absolute right to object to processing for direct marketing purposes — and BPEX will act on such objections immediately.

11Children's Privacy

BPEX is strictly an adult platform. Our services are available only to individuals who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe that a minor has registered an account on BPEX, please contact us immediately at support@bpex.ws. Upon confirmation, we will immediately suspend the account, void any bets, and delete all personal data associated with the minor's account in compliance with applicable regulations.

BPEX employs age verification checks at registration and before processing first withdrawals. We take underage access extremely seriously and invest significantly in systems designed to prevent it.

12Marketing Communications

BPEX will only send you direct marketing communications — including promotional offers, bonus notifications, and product updates — if you have given explicit consent to receive them. Consent is collected during the registration process and can be updated at any time through your account settings or by contacting support@bpex.ws.

If you withdraw your consent to marketing communications, BPEX will stop sending them within 5 business days. Withdrawing marketing consent does not affect your ability to use BPEX or your entitlement to bonuses — it only affects unsolicited communications. Transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts) will continue regardless of your marketing preference, as they are necessary for account management rather than promotional.

13Changes to This Privacy Policy

BPEX reviews this Privacy Policy regularly and updates it when our data practices change, when new laws come into force, or when we introduce new products or features that affect how personal data is used. When material changes are made, BPEX will notify registered users via email and through a prominent in-platform notification at least 7 days before the changes take effect.

The most current version of the BPEX Privacy Policy is always available at bpex.ws/privacy-policy. The effective date at the top of this document will be updated with each revision. We encourage you to review this page periodically even when you have not received a notification, to stay informed about how BPEX protects your data.

14Contact BPEX About Privacy

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, want to raise a concern about how BPEX has handled your personal data, or would like to withdraw a consent you previously gave, please contact us through any of the following channels:

• Email (preferred): support@bpex.ws — please include "Privacy Request" in the subject line for faster routing
• Live Chat: Available 24/7 through the BPEX platform after login

BPEX will acknowledge your query within 24 hours and aim to provide a full response within 30 days. For complex Subject Access Requests or erasure requests, the 30-day period may be extended by a further 30 days, in which case BPEX will inform you of the extension and the reason for it.