Privacy Policy

Nobwin ("we", "us", "our") operates the online betting and casino information platform accessible at nobwin.cam (the "Platform"). We are committed to protecting and respecting the privacy of all individuals who access or use the Platform, including registered account holders and unregistered visitors.

This Privacy Policy ("Policy") sets out in clear, formal terms the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. It covers the categories of data collected, the purposes and legal bases for processing, the conditions under which data may be shared, your rights as a data subject, and the measures we have in place to keep your data secure.

This Policy applies to all users of the Platform, including users accessing the Platform from Pakistan — including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and all other locations. Where references to Pakistani payment methods such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah appear in this Policy, they are included solely for informational context. Their mention does not imply any endorsement, affiliation or data-sharing partnership with those institutions.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including name, contact details, government-issued identification numbers, financial information and online identifiers.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, deletion or any combination thereof.
• "Data Controller" — the entity that determines the purposes and means of the processing of personal data. For the purposes of this Policy, Nobwin acts as data controller in respect of user data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of the data controller, under a formal data processing agreement.
• "User" / "You" — any natural person who accesses, browses or holds a registered account on the Platform.
• "KYC" — Know Your Customer; the identity and age verification process required under applicable anti-money laundering and platform eligibility obligations.
• "Cookies" — small text files placed on your device by the Platform's web server to maintain session state, remember preferences and collect aggregate usage analytics.
• "PKR" — Pakistani Rupee; the currency in which account balances and financial references are displayed on the Platform.

We collect and process the following categories of personal data, subject to the purpose and legal basis described in subsequent sections:

We do not intentionally collect sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs, health data (other than responsible gambling indicators), or biometric data — unless you voluntarily provide it in the context of a support enquiry or KYC process that requires it.

We collect personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting our support team, or updating your account profile.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including via cookies, server logs, and similar tracking technologies described in Section 8 of this Policy.
• Third-party sources: Identity verification data returned by KYC and fraud-prevention service providers; transaction confirmation data from payment processors; geolocation data for compliance and fraud-detection purposes. All third-party data sources are bound by formal data processing agreements.

We process your personal data only where a valid legal basis exists. The primary legal bases on which we rely are:

• Contractual necessity: Processing required to create and operate your account, process deposits and withdrawals in PKR, settle wagers, and deliver the platform services you have requested under our Terms and Conditions.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, KYC requirements, financial crime reporting obligations, and any other mandatory regulatory requirements applicable to the Operator's license jurisdiction.
• Legitimate interests: Processing carried out for fraud detection, platform security, responsible gambling monitoring, and improving the quality and performance of our services — where such interests are not overridden by your fundamental privacy rights.
• Consent: Processing for optional purposes — such as marketing communications — where we have obtained your prior, explicit and freely given consent. You may withdraw consent for consent-based processing at any time without affecting the lawfulness of prior processing.

We use the personal data we collect for the following purposes, each grounded in the legal basis identified in Section 5:

• To create, verify and maintain your Nobwin account, including processing identity and age verification as part of the KYC process.
• To process PKR deposits and withdrawals and to maintain an accurate and auditable transaction record for your account.
• To settle wagers, calculate bonus eligibility and apply responsible gambling tool restrictions configured on your account.
• To detect, investigate and prevent fraud, money laundering, underage gambling, multi-accounting, bonus abuse and other prohibited activities described in our Terms and Conditions.
• To monitor account activity for responsible gambling indicators and, where appropriate, apply platform-initiated protective measures.
• To communicate with you regarding your account, including transaction confirmations, security alerts, policy updates and support responses.
• To improve platform performance, identify technical issues and analyse aggregate usage patterns — always using anonymised or pseudonymised data where possible.
• To comply with applicable regulatory obligations, including AML reporting, tax record-keeping and regulatory audits.
• To send promotional communications about bonuses and offers, where you have provided explicit consent to receive such communications and have not subsequently withdrawn that consent.

We do not sell, rent or trade your personal data to any third party for marketing or commercial purposes. We share personal data only in the following limited circumstances:

• Service providers acting as data processors: We engage carefully selected third-party service providers — including KYC and identity verification providers, payment processors, fraud-detection services, cloud hosting providers and customer support software platforms — who process personal data on our behalf under formal data processing agreements. These processors are contractually prohibited from using your data for any purpose beyond the specific service they provide to us.
• Regulatory and law enforcement disclosure: We may disclose personal data to relevant regulatory authorities, financial intelligence units, law enforcement agencies or courts where we are legally required to do so under applicable AML legislation, a valid court order, or other binding legal obligation. We will notify you of any such disclosure to the extent permitted by law.
• Corporate transactions: In the event of a merger, acquisition, restructuring or sale of all or part of the Nobwin business, personal data may be transferred to the acquiring entity as part of the transaction. Users will be notified of any change in data controller arising from such an event.
• With your explicit consent: We will share your personal data with any third party if you have given your prior explicit and informed consent for us to do so.

We use cookies and similar client-side storage technologies to operate the Platform, maintain the security of your session and understand how the Platform is used in aggregate. The categories of cookies we use are as follows:

You can control and delete cookies through your browser's settings at any time. Please note that disabling strictly necessary or security cookies may impair your ability to access the Platform or complete transactions.

We retain personal data for only as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following indicative retention periods apply:

• Account identity and KYC data: Retained for a minimum of five (5) years from the date of account closure or the last transaction, as required under applicable AML and financial crime regulations.
• Financial transaction records (PKR deposits, withdrawals, wager history): Retained for a minimum of five (5) years from the date of each transaction, in line with standard financial record-keeping obligations.
• Support communications: Retained for three (3) years from the date of the communication, to support dispute resolution and quality assurance.
• Technical and usage data: Retained in identifiable form for up to twelve (12) months; thereafter anonymised and retained in aggregate form for platform analytics purposes.
• Marketing preference data: Retained until you withdraw consent or close your account, whichever is earlier.

Upon expiry of the relevant retention period, personal data is securely deleted or irreversibly anonymised. Requests for early deletion are handled under the User Rights framework described in Section 11, subject to overriding legal retention obligations.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the Platform's servers.
• Encryption at rest for sensitive data categories, including stored passwords and financial identifiers.
• Role-based access controls ensuring that personal data is accessible only to employees and systems that require it for a defined operational purpose.
• Regular security assessments, penetration testing and vulnerability scanning conducted by qualified security personnel.
• Incident response procedures that include user notification protocols in the event of a data breach that is likely to result in a high risk to your rights and freedoms.

Notwithstanding the measures described above, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of data transmitted to or stored on the Platform. You are responsible for maintaining the security of your own device and account credentials, including enabling two-factor authentication (2FA) where available.

Subject to applicable law and any overriding regulatory retention obligations, you hold the following rights in respect of your personal data held by Nobwin:

To exercise any of the above rights, please contact our support team via live chat from your account dashboard or by email as set out in Section 15. We will respond to verified requests within 30 calendar days. In complex cases we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.

The Platform is operated by an entity licensed in an international jurisdiction. As a result, your personal data may be transferred to and processed in countries outside Pakistan, including within the Operator's license jurisdiction and the locations of our third-party service providers.

Where such international transfers occur, we implement appropriate safeguards to ensure that your personal data continues to receive a level of protection consistent with the principles set out in this Policy. Applicable safeguards may include standard contractual clauses incorporated into data processing agreements, adequacy determinations, or other recognised transfer mechanisms.

The Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the Operator or applicable license jurisdiction. We do not knowingly collect personal data from any person under the applicable minimum age. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor in your care has registered an account or provided personal data to the Platform without your knowledge, please contact our support team immediately using the contact details in Section 15. We will act on verified reports promptly and in good faith.

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or the services we provide. The date of the most recent revision is displayed at the top of this page.

Where amendments are material in nature — such as introducing a new category of data collection or a new processing purpose — we will notify registered Users via the email address held on their account at least 14 days before the change takes effect. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy.

We encourage you to review this Policy periodically to remain informed about how we protect your personal data.

If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week from your account dashboard. This is the fastest channel for urgent privacy or data security concerns.
• Email (plain text — not a link): [email protected]

Please include your registered account username and a clear description of your request in all communications. For identity verification purposes, we may ask you to confirm additional account details before acting on a data subject rights request.

We aim to acknowledge all data-related enquiries within 5 business days and to provide a substantive response within 30 calendar days of receipt of a verified request. If your concern relates to a potential data breach or unauthorised access to your account, please contact us via live chat immediately so that we can take prompt protective action.