Privacy Policy – 1 Winning Pakistan Data Protection

This Privacy Policy applies to 1 Winning, the online gaming and sports betting platform available at 1winning.bet. When this policy refers to "1 Winning", "we", "us", or "our", it means the operator that runs the platform and is responsible for determining how your personal data is collected and used.

As the data controller, 1 Winning is responsible for your personal information and for ensuring it is handled in accordance with applicable data protection laws. We've written this policy specifically for our Pakistani player base, in plain English, so you know exactly what's happening with your data rather than having to decode pages of legal language.

If you have any questions about this Privacy Policy or about how 1 Winning handles your data, you can reach our dedicated Data Privacy team at privacy@1winning.bet. We respond to all privacy-related enquiries within 48 hours on business days.

1 Winning collects personal data in three main ways: information you provide directly, information generated automatically when you use the platform, and in limited cases, information from third-party sources for verification purposes. Here is a breakdown of each category:

Information you provide directly:

• Full legal name and date of birth (required for account registration and age verification)
• CNIC number or passport number (required for KYC identity verification)
• Contact details — mobile number and email address
• City and province of residence
• Payment method details — Easypaisa or JazzCash mobile number, IBFT bank account details, or Visa/Mastercard card details. Note: 1 Winning never stores full card numbers; only tokenised references are retained.
• KYC documents — scanned copies of CNIC, passport, or driving licence submitted for verification
• Any information you voluntarily provide in support chat conversations or email correspondence

Information generated automatically:

• IP address and approximate geographic location at time of login
• Device type, operating system, and browser information
• Session timestamps — when you logged in, how long you played, when you logged out
• Full gaming history — games played, bet amounts in PKR, outcomes, and account balance changes
• Deposit and withdrawal transaction records with timestamps and payment method references
• Click and navigation behaviour within the 1 Winning platform (used for UX improvement only)

Information from third-party sources:

• Identity verification results from KYC partners when processing document submissions
• Fraud risk scores from payment processing partners to protect against unauthorised transactions
• Age verification confirmation from authorised verification services

Every use of your personal data at 1 Winning has a specific, legitimate purpose. We don't collect data on the off chance it might be useful later — everything we hold serves one of the following functions:

• Account management: Creating and maintaining your 1 Winning account, processing logins, applying account preferences, and managing security settings
• Identity and age verification: Confirming that you are who you say you are and that you meet the minimum age requirement of 18 before any real-money play is permitted
• Processing PKR transactions: Handling deposits via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and Visa/Mastercard — and processing withdrawal requests to these same methods within our stated timeframes
• Responsible gaming: Monitoring gaming patterns to identify potentially problematic behaviour and trigger appropriate responsible gaming interventions. This is a legal and ethical obligation, not optional.
• Fraud prevention and security: Using IP data, device fingerprinting, and transaction analysis to detect and prevent fraud, money laundering, bonus abuse, and unauthorised account access
• Customer support: Using your account history and communication records to resolve queries, complaints, and disputes effectively and fairly
• Legal compliance: Maintaining records required by our operating licence and applicable financial regulations
• Platform improvement: Analysing aggregated, anonymised usage data to identify where the 1 Winning platform can be made faster, easier to use, or more relevant to Pakistani players
• Marketing communications (with consent): Sending relevant offers, tournament announcements, and platform updates to players who have opted in. Never to players who have opted out.

1 Winning processes your personal data under one of four legal grounds, depending on the activity involved:

1. Contract performance: Most data processing at 1 Winning is necessary to fulfil our contractual obligations to you as a registered player — operating your account, processing transactions, and providing the gaming services you've signed up for.
2. Legal obligation: Certain data processing is mandatory under our operating licence — KYC verification, AML transaction monitoring, and record keeping are examples of legally required activities we cannot opt out of.
3. Legitimate interests: Fraud prevention, platform security, and technical performance monitoring are conducted under our legitimate interest in operating a safe, functional service. We always balance this against your privacy rights.
4. Consent: Marketing communications, optional cookies, and any data sharing beyond what is strictly necessary for your account are only conducted with your explicit consent. You can withdraw consent at any time.

1 Winning does not sell your personal data to any third party. However, operating a gaming platform in Pakistan does require sharing certain data with trusted service providers and regulatory bodies. Here is a complete list of the categories of parties who may receive your data and why:

• KYC and identity verification partners: Your CNIC or passport details are shared with authorised verification services to confirm your identity. These partners are bound by strict data processing agreements and cannot use your data for any other purpose.
• Payment processing partners: Easypaisa, JazzCash, NayaPay, SadaPay, and banking partners receive the minimum transaction data necessary to process your deposits and withdrawals. No gaming history or personal profile data is shared with payment providers.
• Fraud detection services: Transaction data may be shared with fraud risk partners to detect and prevent financial crime. These partners operate under data processing agreements that prohibit secondary use.
• Game content providers: Third-party game studios whose titles appear on 1 Winning receive anonymised session data for game performance purposes. They do not receive your name, CNIC, contact details, or financial information.
• Regulatory and law enforcement authorities: Where legally required under our operating licence or by court order, 1 Winning may be required to disclose player data to regulatory bodies or law enforcement. We will always notify you if legally permitted to do so.
• IT infrastructure providers: Cloud hosting and database providers who store 1 Winning's data operate under strict security agreements and do not have access to readable player data.

We do not share your data with advertisers, data brokers, social media platforms, or any other commercial third party for marketing purposes — with or without your consent. That kind of arrangement is not part of how 1 Winning operates.

1 Winning uses cookies and similar tracking technologies on the platform. A cookie is a small text file stored on your device when you visit a website. They allow the platform to remember your preferences, maintain your login session, and understand how the site is being used.

We use four categories of cookies at 1 Winning:

• Essential cookies: Required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against CSRF attacks. You cannot opt out of essential cookies — without them, the platform cannot work.
• Functional cookies: Remember your preferences such as language settings and display options. Disabling these means you'll need to re-enter preferences on each visit.
• Analytics cookies: Collect anonymised data about how players navigate 1 Winning — which pages are visited most, where players drop off, and how long sessions last. This data is aggregated and used only to improve the platform. Opt-out available.
• Marketing cookies: Only activated with your explicit consent. Used to personalise promotional messages shown on the 1 Winning platform. Never used to track you across other websites.

You can manage your cookie preferences at any time from the Cookie Settings option in your account, or by adjusting your browser settings. Note that disabling all cookies may affect the functionality of parts of the 1 Winning platform.

Data security is a technical priority at 1 Winning, not an afterthought. The following measures are in place to protect your personal and financial information:

• 256-bit SSL/TLS encryption on all data transmitted between your device and 1 Winning's servers
• Encryption at rest for all personally identifiable information stored in our databases
• Role-based access controls — staff members can only access the data their role requires. Customer support can see account history but not CNIC scans, for example.
• Two-factor authentication for all internal staff accessing the player management system
• Regular penetration testing by independent security firms to identify and remediate vulnerabilities before they can be exploited
• Automated intrusion detection systems that alert our security team to unusual access patterns in real time
• Regular security training for all staff who handle player data, with mandatory refresher training annually
• Incident response plan — in the event of a data breach, 1 Winning will notify affected players promptly and take immediate action to contain and remediate the incident

1 Winning retains personal data only for as long as it is necessary for the purpose it was collected, or as required by our operating licence and applicable law. Specific retention periods are as follows:

• Account data (name, contact details, preferences): Retained for the duration of your active account, plus a mandatory post-closure period of five years for regulatory compliance purposes.
• KYC documents (CNIC, passport scans): Retained for the duration of the account plus five years after account closure, as required by anti-money laundering regulations.
• PKR transaction records: Retained for a minimum of five years after the transaction date, as required by financial record-keeping regulations.
• Gaming history: Retained for the duration of the account plus five years, primarily for responsible gaming monitoring and dispute resolution purposes.
• Support correspondence: Retained for two years after the conversation closes.
• Device and IP logs: Retained on a rolling 12-month basis for security and fraud prevention purposes.
• Marketing consent records: Retained indefinitely to demonstrate that communications were sent with valid consent, even after you unsubscribe.

Once the applicable retention period expires, data is securely and permanently deleted from 1 Winning's systems. You can request early deletion of non-regulated data at any time — see Section 9 for details of your data rights.

As a registered player at 1 Winning, you have meaningful rights over your personal data. Here is what you can exercise and how:

To exercise any of these rights, email privacy@1winning.bet with "Data Rights Request — [your username]" in the subject line. We acknowledge all requests within 48 hours and fulfil them within 30 calendar days. Identity verification may be required before we can action a request to protect against unauthorised access to your data.

1 Winning does not knowingly collect personal data from anyone under the age of 18. The platform requires all registering users to confirm they are 18 or older, and age verification is conducted on all accounts before real-money play is permitted.

If we discover that personal data has been collected from a person under 18 — whether through false declaration during registration or any other means — that account will be closed immediately, all funds will be returned to the original payment method, and all associated personal data will be deleted from our systems without delay.

If you are a parent or guardian and you believe your child may have registered an account at 1 Winning, please contact us immediately at privacy@1winning.bet. We will investigate and take appropriate action as a matter of priority. The protection of minors from gambling products is a responsibility we take personally and seriously.

1 Winning reviews this Privacy Policy regularly and may update it to reflect changes in our data practices, new legal requirements, or feedback from our player community. The version number and effective date at the top of this page always reflect the current, in-force version.

When material changes are made — changes that significantly affect how we use your data or your rights as a player — registered 1 Winning players will be notified by email at least 14 days before the changes take effect. Minor clarifications or formatting updates may be made without prior notice but will always be reflected in the version number and effective date.

Your continued use of 1 Winning after the effective date of any updated Privacy Policy constitutes acceptance of the revised terms. If you disagree with any changes, you have the right to close your account and withdraw any remaining PKR balance before the changes take effect.

If you have any questions, concerns, or requests related to this Privacy Policy or the way 1 Winning handles your personal data, please get in touch:

• Email (privacy team): privacy@1winning.bet — for data rights requests, privacy concerns, and cookie opt-out requests
• Email (general support): support@1winning.bet — for account-related queries including data access or account closure
• Live chat: Available 24/7 from within your 1 Winning account. Our support agents can raise privacy requests on your behalf and escalate to the Data Privacy team.

We are committed to resolving privacy concerns fairly and transparently. If you feel that your privacy rights have not been respected and our response has not been satisfactory, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. Details of the applicable authority are available from our support team on request.