38win Privacy Policy
How We Protect Your Personal Data

Introduction

38win ("we", "us", "our") is committed to protecting and respecting the privacy of every individual who accesses or uses the 38win platform at 38win.im. This Privacy Policy explains how 38win collects, uses, stores, shares, and protects personal data relating to registered players, prospective players, and visitors to our platform.

This Policy applies to all personal data processed by 38win in connection with the operation of its online casino, sports betting, and associated services — including cricket betting, PSL markets, live dealer games, slot titles, and all payment and account management functions accessible to Pakistani players.

This Privacy Policy should be read alongside the 38win Terms & Conditions, which govern the overall relationship between 38win and its registered players. By creating an account or using the 38win platform, you confirm that you have read and accepted both documents.

Personal Data We Collect

38win collects personal data in the categories set out below. The specific data collected about any individual player will depend on the services used and the stage of the account lifecycle reached.

38win does not intentionally collect special category data (such as health data, racial or ethnic origin, or religious beliefs) unless specifically required for responsible gaming assessments and only where you have provided such data voluntarily.

How We Collect Your Data

38win collects personal data through the following channels:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or responding to promotions.
• Automated Technologies: Data collected automatically when you visit or interact with the 38win platform, including through cookies, web beacons, server logs, and similar tracking technologies. See Section 7 for full details.
• Third-Party Sources: Data received from identity verification providers, payment processors (including JazzCash, EasyPaisa, and banking partners), fraud prevention agencies, and credit reference agencies where permitted by applicable law.
• Publicly Available Sources: In limited circumstances, 38win may verify information against publicly available records where required by our anti-money-laundering or know-your-customer obligations.

Legal Basis for Processing

38win processes personal data on one or more of the following legal grounds, depending on the nature of the processing activity:

• Contractual Necessity: Processing required to perform the contract between 38win and you as a registered player — including account management, transaction processing, and game operation.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money-laundering regulations, know-your-customer requirements, age verification obligations, and responses to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing carried out in pursuit of 38win's legitimate business interests, including fraud prevention, platform security, service improvement, and analytics — where those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — for example, the receipt of promotional communications or marketing emails. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

How We Use Your Personal Data

38win uses the personal data it collects for the following purposes:

• Account Registration & Management: To create, maintain, and administer your 38win account, including processing deposits and withdrawals in PKR and managing your account balance.
• Identity & Age Verification: To verify that you are who you claim to be and that you meet the minimum age requirement of 21 years, in compliance with our licensing obligations and responsible gaming commitments.
• Transaction Processing: To process deposits, withdrawals, and bonus credits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard, and to maintain accurate financial records.
• Customer Support: To respond to your queries, complaints, and requests, and to maintain records of all support interactions for quality assurance and dispute resolution purposes.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, underage gambling, and other prohibited conduct on the platform.
• Responsible Gaming: To monitor gambling patterns and identify players who may be experiencing gambling-related harm, and to administer self-exclusion, cooling-off, and deposit-limit requests.
• Platform Improvement: To analyse usage patterns and player behaviour to improve the functionality, content, and user experience of the 38win platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have consented to receive such communications. You may opt out at any time.
• Legal Compliance: To fulfil our obligations under applicable laws and regulations, and to respond to lawful requests from regulatory or law enforcement authorities.

Sharing Your Personal Data

38win does not sell your personal data. We may share your personal data with the following categories of third parties, strictly as necessary and subject to appropriate data protection safeguards:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, Mastercard, and associated payment service providers — solely for the purpose of processing your financial transactions.
• Identity Verification Providers: Third-party KYC and age verification services engaged by 38win to verify player identities and comply with anti-money-laundering regulations.
• IT & Hosting Providers: Cloud hosting providers and IT infrastructure partners who process data on our behalf under strict contractual data processing agreements.
• Fraud Prevention Agencies: Specialist fraud detection and prevention services used to protect the integrity of the platform and the safety of all players.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or regulatory direction, 38win will disclose personal data to the relevant authority. We will notify affected players of such disclosures where we are legally permitted to do so.
• Game Content Providers: Licensed game studios and software providers whose games are featured on the 38win platform may receive limited technical data necessary to deliver game functionality — but do not receive personally identifiable information beyond what is strictly required.

Cookies & Tracking Technologies

The 38win platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences — such as language settings, display preferences, and previously entered account information — to improve your experience across sessions.
• Analytical Cookies: Used to collect aggregate, anonymised data about how players interact with the platform, enabling 38win to identify areas for improvement. These cookies do not personally identify individual players.
• Marketing Cookies: Used to deliver relevant promotional content to players who have consented to receive marketing communications. These cookies track engagement with 38win promotions across sessions.

You may control cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the 38win platform, but may affect certain personalised features. By continuing to use the platform with cookies enabled, you consent to 38win's use of cookies as described in this section.

Data Security

38win implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 38win platform.
• Encryption of sensitive data at rest, including financial records and identity documents.
• Strict access controls ensuring that only authorised 38win personnel with a legitimate operational need can access personal data.
• Regular security audits, penetration testing, and vulnerability assessments of platform infrastructure.
• Incident response procedures ensuring that any data breach is identified, contained, and reported to relevant authorities and affected players in accordance with applicable notification obligations.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed as completely secure. 38win will notify you promptly if we become aware of any security incident that is likely to result in a risk to your rights or freedoms.

Data Retention

38win retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law or our licensing obligations.

As a general guide, the following retention periods apply:

• Active Account Data: Retained for the duration of your active account and for a period of at least five (5) years following account closure, in compliance with anti-money-laundering and financial record-keeping obligations.
• KYC & Identity Verification Records: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with applicable regulatory requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Support & Communications Records: Retained for three (3) years from the date of the last interaction, unless the matter relates to an unresolved dispute, in which case records are retained until the dispute is fully resolved.
• Marketing Consent Records: Retained for as long as you remain opted in, plus a reasonable period following opt-out to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any identifiable individual.

Your Privacy Rights

As a 38win player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact the 38win data team using the contact details in Section 13.

• Right of Access: You have the right to request a copy of the personal data that 38win holds about you, together with information about how it is being used.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held about you be corrected without undue delay.
• Right to Erasure: In certain circumstances, you have the right to request that 38win delete your personal data — for example, where the data is no longer necessary for the purpose for which it was collected. Note that this right is subject to overriding legal obligations, including financial record-keeping and anti-money-laundering requirements, which may prevent full erasure.
• Right to Restrict Processing: You have the right to request that 38win restricts the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.
• Right to Object: You have the right to object to the processing of your personal data where such processing is based on legitimate interests. You also have an absolute right to object to the use of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out prior to withdrawal.

38win will respond to all valid data rights requests within thirty (30) days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further two months, in which case we will notify you of the extension and the reason for it.

Children & Minors

The 38win platform is strictly intended for adults aged 21 years and over. We do not knowingly collect, process, or retain personal data from individuals under the age of 21.

If 38win becomes aware that personal data has been collected from a person under 21, the relevant account will be immediately suspended, all wagering activity will be voided, and the personal data will be deleted or retained solely for the purpose of demonstrating compliance with our age verification obligations.

Updates to This Privacy Policy

38win reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. The effective date at the top of this Policy will be updated to reflect the date of any revision.

Where changes to this Policy are material — meaning they affect your rights or the way we process your personal data in a significant way — 38win will provide reasonable prior notice via your registered email address and/or a prominent notice on the platform before the changes take effect.

Your continued use of the 38win platform following the effective date of any revised Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes, you should stop using the platform and contact support to arrange account closure.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 38win handles your personal data, please contact our support team using the details below. All privacy-related enquiries are handled with full discretion and responded to within the timeframes set out in Section 10.

Email: [email protected]

Our team is available 24 hours a day, 7 days a week. When contacting us about a data privacy matter, please include your registered account username and a clear description of your request so that we can identify your record and respond as efficiently as possible.

For requests relating to data erasure, access, or rectification, please include sufficient information to verify your identity before we process your request — this is necessary to ensure we do not disclose or delete personal data in response to unauthorised requests.