20win Privacy Policy

1. Scope & Applicability

This Privacy Policy ("Policy") applies to all users who access or use the 20win platform, including the website at https://20win.bio, any associated mobile applications, and all related services offered by 20win (collectively, the "Platform"). This Policy applies regardless of whether you are browsing as a guest, a registered player, or a returning member.

By accessing the Platform, you acknowledge that you have read, understood, and agree to the data practices described herein. If you do not agree with any part of this Policy, we respectfully ask that you discontinue use of the Platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the overall agreement between you and 20win.

2. Data We Collect

We collect personal data in the following categories:

• Identity Data: Full legal name, date of birth, CNIC (Computerised National Identity Card) number, scanned ID documents provided during Know Your Customer (KYC) verification.
• Contact Data: Email address, Pakistani mobile number (e.g., Jazz, Zong, Telenor, Ufone, or Warid numbers), and city of residence (e.g., Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi).
• Financial Data: JazzCash account details, EasyPaisa wallet ID, bank account or IBAN for HBL, UBL, Meezan Bank, or Raast transfers, and card details (Visa/Mastercard) used for deposits and withdrawals — processed exclusively via PCI-DSS compliant payment gateways.
• Usage Data: IP address, browser type and version, device model, operating system, pages visited, session duration, game history, bet amounts, and login timestamps.
• Communications Data: Support chat transcripts, email correspondence, and feedback submissions you send to our team.
• Verification Data: Any information you provide when responding to identity or source-of-funds verification requests required under responsible gaming and anti-money laundering obligations.

We do not collect sensitive data such as racial or ethnic origin, religious beliefs, political opinions, or biometric data unless specifically required by law. In all such exceptional cases, we will notify you before collection.

3. How We Use Your Data

20win uses your personal data for the following purposes:

• Account Management: To create, maintain, and verify your 20win player account, and to communicate account-related updates and notifications.
• Service Delivery: To process deposits and withdrawals via Pakistani payment channels, to credit winnings, and to ensure correct operation of casino games, cricket betting markets, and slot titles.
• Legal Compliance: To fulfil our obligations under applicable anti-money laundering (AML) laws, counter-terrorism financing (CTF) frameworks, and international gaming regulations.
• Responsible Gaming: To monitor playing patterns, apply deposit or session limits where requested, enforce self-exclusion decisions, and intervene proactively where problem gambling indicators are detected.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent account activity, unauthorised access, bonus abuse, and other violations of our Terms & Conditions.
• Customer Support: To respond to queries, investigate disputes, and improve the quality of our 24/7 support services.
• Marketing (with consent only): To send you promotional emails or SMS messages about offers, new game releases, PSL cricket betting specials, or platform updates — only where you have explicitly opted in. You may unsubscribe at any time.
• Platform Improvement: To analyse aggregated usage data in order to improve platform performance, user experience, and game selection.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: Processing required to deliver the services you have signed up for, including account creation, deposits, withdrawals, and game access.
• Legal Obligation: Processing required to comply with AML, CTF, KYC, and other regulatory requirements applicable to internationally licensed gaming operators.
• Legitimate Interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your data protection rights.
• Consent: Processing for optional purposes such as marketing communications, where you have given clear, informed, and freely withdrawable consent.

5. Sharing & Disclosure of Data

20win does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your data only in the following limited circumstances:

• Payment Processors: We share necessary financial data with regulated payment service providers (including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and card networks) solely to process your transactions securely.
• Identity Verification Providers: We may engage licensed KYC and AML screening partners to verify identity documents and perform sanctions checks. These partners are contractually bound to strict confidentiality obligations.
• Technology & Hosting Partners: Our platform infrastructure and cloud hosting providers may process data on our behalf under binding data processing agreements that require equivalent levels of data protection.
• Regulatory Authorities: We may disclose personal data to relevant regulatory bodies, law enforcement agencies, or government authorities where required by applicable law, court order, or regulatory direction — without prior notice to you where legally prohibited.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of 20win's business, your data may be transferred as part of that transaction. We will notify you before any such transfer takes effect and before your data becomes subject to a different privacy policy.

Any third party that receives your personal data is required by contract to handle it in accordance with applicable data protection standards and may only use it for the specific purpose for which it was shared.

6. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

• Active Account Data: Retained for the full duration of your registered account with 20win.
• Post-Closure Data: Following account closure, we retain identity, financial, and transaction records for a minimum of five (5) years to comply with AML and tax reporting obligations.
• Support Records: Chat and email support transcripts are retained for up to two (2) years for quality assurance and dispute resolution purposes.
• Marketing Data: Retained until you withdraw consent or unsubscribe, after which it is promptly deleted from active marketing lists.

When data is no longer required, we apply secure deletion or anonymisation procedures so that it can no longer be linked back to you personally.

7. Security Measures

20win takes the security of your personal data seriously. We employ a layered set of technical and organisational safeguards including:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data stored at rest in our databases.
• Multi-factor authentication (MFA) options available on player accounts.
• Regular third-party penetration testing and vulnerability assessments of our platform.
• Role-based access controls ensuring only authorised personnel can access personal data relevant to their job function.
• Continuous intrusion detection and 24/7 security monitoring of our infrastructure.

Despite these measures, no online platform can guarantee absolute security. In the unlikely event of a data breach that is likely to result in high risk to your rights, we will notify affected users and relevant authorities in accordance with our obligations under applicable law.

8. Cookies & Tracking Technologies

20win uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use include:

• Essential Cookies: Strictly necessary for the Platform to function — for example, maintaining your logged-in session and remembering your language or region preferences (Pakistan / English).
• Analytics Cookies: Used to understand how users navigate the Platform, which game categories are most popular, and where users encounter issues, helping us improve the overall experience.
• Functionality Cookies: Remember your preferences such as default currency (PKR), preferred payment method, and display settings.
• Marketing Cookies (with consent): Used only where you have consented, to show relevant promotional content about 20win offers, cricket betting markets, and new slot releases.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling essential cookies may impair your ability to use core Platform features such as logging in or completing transactions.

9. Your Rights

As a user of 20win, you have the following rights with respect to your personal data:

• Right of Access: You may request a copy of all personal data we hold about you at any time.
• Right to Rectification: You may ask us to correct inaccurate or incomplete personal data without undue delay.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Right to Restriction: You may ask us to restrict processing of your data while a complaint or accuracy dispute is being resolved.
• Right to Data Portability: You may request a structured, machine-readable copy of the data you have provided to us, where technically feasible.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing, at any time.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing emails), you may withdraw that consent at any time with immediate effect going forward.

To exercise any of these rights, contact our support team via live chat on the Platform or by email at [email protected]. We aim to respond to all verified requests within thirty (30) calendar days.

10. Minors & Age Verification

20win is strictly an adults-only platform. You must be 21 years of age or older to register an account, make deposits, or participate in any form of real-money gaming on 20win. This requirement is absolute and non-negotiable.

We implement age verification procedures at the point of registration, during KYC checks, and at any point where we have reasonable grounds to suspect a user may be underage. Any account found to belong to a person under the age of 21 will be immediately suspended, all balances frozen, and the matter referred to the appropriate authorities if required.

We do not knowingly collect personal data from anyone under the age of 21. If you believe that a minor has accessed or registered on our Platform, please contact us immediately at [email protected] so we can take appropriate action without delay.

11. Changes to This Policy

20win reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Post a prominent notice on the Platform homepage for a minimum of fourteen (14) days following the change.
• Send an email notification to all registered users whose accounts are active at the time of the update.

Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you disagree with any changes, you may close your account and request deletion of your data by contacting support.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 20win handles your personal data, please do not hesitate to get in touch with our dedicated Data Privacy team:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the 20win Platform — the fastest route to a response.
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and provide a full response within 30 calendar days.

For matters related to problem gambling, self-exclusion, or deposit limits, please visit our Responsible Gaming page for dedicated tools and resources.