truwin Privacy Policy — How We Handle Your Data

01. Introduction & Scope

This Privacy Policy ("Policy") is published by truwin ("we", "us", "our", "Company") and applies to all personal data collected through the truwin website at truwin.org, the truwin mobile platform, and all associated services including the online casino, sportsbook, live dealer games, PKR cashier, customer support channels, and marketing communications (collectively, the "Platform").

truwin is the data controller for all personal data collected through the Platform. This means truwin determines the purposes for which your data is collected and the manner in which it is processed. Where truwin engages third-party service providers to process data on its behalf, those providers act as data processors and are bound by contractual obligations that are no less protective than those set out in this Policy.

This Policy should be read alongside the truwin Terms and Conditions, which are incorporated herein by reference. In the event of any conflict between this Policy and the Terms and Conditions on matters of data handling, this Policy shall prevail.

02. Data We Collect

truwin collects the following categories of personal data from registered players and platform visitors:

• Identity Data: Full legal name, date of birth, gender, CNIC number or passport number, and a copy of a government-issued identification document as required for KYC verification.
• Contact Data: Email address, Pakistani mobile phone number (for account notifications and SMS-based two-factor authentication), and city of residence (e.g., Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi).
• Financial Data: JazzCash wallet ID, EasyPaisa mobile account number, HBL, UBL, or Meezan Bank account details, Raast payment ID, Visa or Mastercard card details (processed via PCI-DSS compliant payment gateways), and a complete PKR transaction history for your account.
• Technical Data: IP address, browser type and version, operating system, device identifier, screen resolution, referral URL, and session login timestamps.
• Usage Data: Games played, stakes placed, wagering history, session duration, responsible gaming tool usage, and navigation patterns within the Platform.
• Marketing Preferences: Your consent status for email and SMS marketing, preferred game categories, and promotional engagement history.
• Support & Communications Data: Content of live chat sessions, email correspondence with the truwin support team, and records of any formal complaints or disputes.

03. How We Collect Your Data

truwin collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to a survey or promotion.
• Automated Technical Collection: Data collected automatically when you interact with the Platform, including through session cookies, server-side logging, and analytics tools. This includes IP address, device fingerprint, and in-session behavioural data.
• Third-Party Sources: Identity verification data from KYC service providers; fraud risk scores from payment processors; and where applicable, publicly available information used to verify your identity or comply with anti-money laundering regulations.

04. How We Use Your Data

truwin uses the personal data we collect for the following purposes, each of which rests on a specific legal basis:

• Account Management: To register and maintain your player account, authenticate your identity at login, and manage your account preferences and settings. (Legal basis: contractual necessity.)
• KYC & Age Verification: To verify that you meet the minimum age requirement of 21 years and to comply with anti-money laundering and counter-financing of terrorism (AML/CFT) obligations. (Legal basis: legal obligation.)
• Payment Processing: To process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and card networks. (Legal basis: contractual necessity.)
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other prohibited conduct. (Legal basis: legitimate interest; legal obligation.)
• Responsible Gaming: To monitor gaming behaviour and identify players who may be exhibiting signs of problem gambling, and to enforce self-exclusion, deposit limit, and session time restrictions set by the player. (Legal basis: legal obligation; legitimate interest.)
• Customer Support: To respond to your enquiries, resolve complaints, and maintain records of support interactions. (Legal basis: contractual necessity; legitimate interest.)
• Platform Improvement: To analyse usage patterns, test new features, and improve the overall performance and user experience of the truwin Platform. (Legal basis: legitimate interest.)
• Marketing & Promotions: To send you personalised bonus offers, PSL cricket betting promotions, and Platform updates where you have opted in to receive such communications. (Legal basis: consent.)
• Legal Compliance: To comply with applicable laws, respond to lawful requests from government authorities or courts, and enforce our Terms and Conditions. (Legal basis: legal obligation.)

05. Cookies & Tracking Technologies

truwin uses cookies and similar tracking technologies on truwin.org. Cookies are small text files stored on your device that help us recognise you across sessions, maintain your login state, and collect usage analytics. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management, login authentication, and security tokens. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, preferred game lobby view, and responsible gaming tool configurations.
• Analytics Cookies: Used to collect aggregated and anonymised data about how players navigate and use the Platform, helping truwin identify performance issues and improve usability.
• Marketing Cookies: Used to deliver relevant promotional content based on your gaming activity and preferences, where you have consented to receive marketing communications.

You may manage non-essential cookie preferences through the cookie consent banner displayed on your first visit to truwin.org, or at any time through your browser settings. Note that disabling certain functional cookies may impair the Platform's functionality.

06. Data Sharing & Third-Party Processors

truwin does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the following circumstances and only to the extent necessary:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and card network processors receive the financial data necessary to process your PKR deposit or withdrawal transactions. All payment processors used by truwin are required to maintain PCI-DSS compliance.
• KYC & Identity Verification Providers: Third-party identity verification service providers receive the identity documents you submit during the KYC process. These providers are contractually bound to use your data solely for identity verification purposes.
• Fraud Prevention Services: Risk and fraud management platforms receive technical and transactional data to generate risk scores and flag suspicious activity on the Platform.
• IT Infrastructure Providers: Cloud hosting and data centre providers that store Platform data are engaged as data processors under strict contractual terms that prohibit them from accessing or using player data for any purpose other than infrastructure provision.
• Legal & Regulatory Authorities: truwin will disclose personal data to government authorities, law enforcement agencies, or courts in Pakistan or other relevant jurisdictions where required by law, court order, or regulatory directive.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged by truwin who require access to player data in the course of providing professional services, subject to confidentiality obligations.

07. International Data Transfers

Some of truwin's third-party service providers, including cloud infrastructure and KYC verification platforms, may process data in jurisdictions outside Pakistan. Where such transfers occur, truwin takes steps to ensure that your personal data receives an adequate level of protection, including by entering into standard contractual clauses or relying on other legally recognised transfer mechanisms.

By using the truwin Platform, you acknowledge that your personal data may be transferred to and processed in countries other than Pakistan. truwin will always prioritise service providers that maintain robust data protection standards consistent with GDPR-aligned principles, even where the local law of the processing jurisdiction may not require the same level of protection.

08. Data Security

truwin implements a multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational security measures include:

• TLS 1.3 encryption for all data in transit between your device and truwin.org;
• AES-256 encryption for sensitive data stored at rest on truwin infrastructure;
• bcrypt password hashing — plain-text passwords are never stored;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• SMS-based two-factor authentication (2FA) available to all registered players;
• Continuous server-side monitoring for anomalous login patterns and automated fraud detection;
• Regular third-party security audits and penetration testing of the Platform;
• Incident response procedures for managing data breaches, including notification protocols where required by applicable law.

Despite these measures, no online platform can guarantee absolute security. In the unlikely event of a data breach that poses a significant risk to your rights and freedoms, truwin will notify affected players and the relevant supervisory authority without undue delay.

09. Data Retention

truwin retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account & Identity Data: Retained for the lifetime of your account plus a minimum of five (5) years following account closure, in order to meet AML/CFT record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with applicable financial regulations.
• KYC Verification Documents: Retained for five (5) years following account closure or the completion of the KYC review process, whichever is later.
• Support & Communication Records: Retained for three (3) years from the date of the last interaction, or longer if the records relate to an unresolved legal dispute.
• Marketing Preference Data: Retained until you withdraw your consent to receive marketing communications, after which it is deleted within thirty (30) days.
• Technical & Usage Data: Retained for up to twenty-four (24) months from collection, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

10. Your Privacy Rights

As a registered truwin player, you have the following rights in respect of your personal data. To exercise any of these rights, please contact the truwin support team using the contact details in Section 14.

• Right of Access: You may request a copy of the personal data truwin holds about you, along with information about how it is processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated.
• Right to Erasure: You may request that your personal data be deleted, subject to truwin's legal obligations to retain certain data as described in Section 9.
• Right to Restrict Processing: You may request that truwin restrict the processing of your personal data in certain circumstances, such as where you contest its accuracy.
• Right to Data Portability: You may request a copy of the personal data you have provided to truwin in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interest, including direct marketing. Where you object to marketing, we will stop using your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

truwin will respond to all valid data subject requests within thirty (30) calendar days. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reason for the delay.

11. Children & Minors

The truwin Platform is strictly intended for adults aged 21 years and over. truwin does not knowingly collect personal data from individuals under the age of 21. If truwin becomes aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account in accordance with our Terms and Conditions.

Parents and guardians who believe that their child may have registered on the truwin Platform are encouraged to contact the support team immediately at [email protected] so that the account can be investigated and, if confirmed, closed without delay.

12. Marketing Communications

truwin may send you promotional communications — including PSL cricket betting offers, casino bonus notifications, and new game launch announcements — by email or SMS, where you have expressly opted in to receive such communications during registration or at a later date through the account settings dashboard.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link included in every marketing email;
• Replying "STOP" to any marketing SMS;
• Updating your communication preferences in the truwin account settings dashboard; or
• Contacting the truwin support team directly at [email protected].

Please note that opting out of marketing communications does not affect transactional communications, including account verification emails, deposit and withdrawal confirmations, security alerts, and support responses — these are sent based on contractual necessity and cannot be opted out of while your account is active.

13. Amendments to This Policy

truwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. Where amendments are material, truwin will notify registered players via the email address associated with their account prior to the changes taking effect.

The version number and effective date displayed at the top of this Policy indicate the current revision in force. Continued use of the truwin Platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. It is your responsibility to review this Policy periodically. Prior versions are available from the truwin support team upon request.

14. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a privacy-related concern, please contact the truwin Data Protection team using the following details:

Email: [email protected]

Please include "Privacy Request" in the subject line of your email, along with your registered username and a brief description of your query. The truwin support team aims to respond to all privacy-related enquiries within five (5) business days and to resolve formal data rights requests within thirty (30) calendar days.

If you are not satisfied with truwin's response to a privacy complaint, you have the right to escalate your concern to the relevant data protection supervisory authority in the jurisdiction governing your use of the Platform.