apiwin Privacy Policy

apiwin is Pakistan's premier online gaming and sports betting platform, accessible at apiwin.pro. We offer a comprehensive range of services including cricket betting, PSL markets, live casino games, slot games, jackpot fishing, and sports wagering, all denominated in Pakistani Rupees (PKR).

For the purposes of this Privacy Policy, apiwin acts as the data controller in respect of the personal data of all registered users and visitors to the Platform. As data controller, apiwin determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.

This Privacy Policy applies to all individuals who access, browse, or register on the apiwin Platform, regardless of the device or method of access used. It covers all personal data collected through the website, mobile-optimised interfaces, and any communications you have with our customer support team.

apiwin collects personal data in several ways: directly from you when you register or interact with our Platform, automatically through your use of the Platform, and in limited circumstances from third-party verification and payment service providers. The categories of data we collect are as follows:

We do not collect any special categories of sensitive personal data (such as health, religious, or political data) unless you choose to disclose such information voluntarily in the course of a responsible gaming interaction. In that context, any sensitive data disclosed is processed solely for the purpose of providing appropriate responsible gaming support and is handled with the highest level of confidentiality.

apiwin uses your personal data for the following clearly defined purposes. We do not use your data for any purpose that is incompatible with the purposes listed here without first obtaining your consent or establishing a fresh legal basis:

• Account Creation and Management: To register your account, verify your identity, maintain your account profile, and manage your preferences and settings on the Platform;
• Service Delivery: To process your bets and game sessions, calculate winnings, apply bonuses and promotions, and deliver the full range of apiwin gaming and sports betting services;
• Payment Processing: To process deposits via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, and GrabPay, and to process withdrawal requests back to your verified payment method;
• KYC and Fraud Prevention: To verify your identity and age (21+) in compliance with our anti-money laundering and fraud prevention obligations, and to detect and investigate suspicious activity on your account;
• Responsible Gaming: To monitor your gaming activity for indicators of problem gambling, to implement deposit limits, cool-off periods, and self-exclusion requests, and to provide targeted responsible gaming communications where appropriate;
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of our communications with you;
• Legal Compliance: To comply with applicable laws, regulatory requirements, court orders, and directions from competent authorities;
• Platform Improvement: To analyse usage patterns, diagnose technical issues, test new features, and improve the overall performance and user experience of the apiwin Platform;
• Marketing: To send you promotional offers, bonus notifications, and personalised recommendations, subject to your marketing preferences and the provisions of Section 11 of this Policy.

• Contractual Necessity: The majority of our processing activities — including account management, payment processing, and game delivery — are necessary for the performance of the contract between you and apiwin, as set out in our Terms and Conditions;
• Legal Obligation: Certain processing activities — including KYC verification, AML record-keeping, and responses to regulatory enquiries — are required by applicable law and we have no discretion to omit them;
• Legitimate Interests: We process technical and usage data for fraud detection, platform security, and service improvement on the basis of our legitimate interests as an operator, provided those interests are not overridden by your fundamental rights and freedoms;
• Consent: Where we process your data for direct marketing communications or for non-essential cookies and tracking technologies, we rely on your freely given, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

apiwin does not sell or commercially share your personal data. We share your data only in the following limited and controlled circumstances:

• KYC and Identity Verification Providers: To verify your identity, date of birth, and CNIC details against government databases, we share necessary identity data with accredited third-party KYC verification partners operating under strict data processing agreements;
• Payment Service Providers: To process your deposits and withdrawals via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, and GrabPay, we share transactional data with the relevant payment service provider. Each provider operates under its own privacy policy and applicable financial regulations;
• Game Studio Providers: Where you play games hosted by third-party studios — including live casino and slot providers — certain session data is shared with those studios to facilitate game delivery and dispute resolution. Studios are contractually prohibited from using this data for any other purpose;
• Regulatory Authorities: We may be required to share personal data with gaming regulators, financial intelligence units, or law enforcement agencies in response to lawful requests or as required by our licensing obligations;
• Professional Advisers: In limited circumstances, personal data may be accessed by our legal, accounting, or auditing advisers under strict confidentiality obligations;
• Business Successors: In the event of a merger, acquisition, or sale of all or part of apiwin's business, personal data may be transferred to the acquiring entity, subject to the same privacy protections as described in this Policy.

All third-party data processors engaged by apiwin are required to process personal data only on apiwin's documented instructions, to implement appropriate technical and organisational security measures, and to delete or return personal data at the conclusion of their engagement.

apiwin uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and — with your consent — deliver personalised content and marketing. The categories of cookies we use are as follows:

You may manage your cookie preferences at any time by adjusting your browser settings or by using the cookie preference centre accessible from the footer of the Platform. Please note that disabling strictly necessary or functional cookies may impair your ability to use certain features of the Platform, including login and cashier functions.

apiwin retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and Identity Data: Retained for the duration of your active account, plus a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements;
• Transaction and Betting Records: Retained for a minimum of 5 years from the date of each transaction, as required by applicable financial and gaming regulations;
• KYC Documentation: Retained for a minimum of 5 years following the completion of the verification process or the closure of the account, whichever is later;
• Customer Support Communications: Retained for 3 years from the date of the last communication, to enable dispute resolution and quality assurance;
• Technical and Usage Data: Retained in identifiable form for up to 24 months, after which it is aggregated and anonymised for long-term analytics purposes;
• Marketing Preferences: Retained until you withdraw your consent or object to marketing communications, plus a reasonable period thereafter to suppress your data from future campaigns.

Where personal data is no longer required for any lawful purpose, apiwin will securely delete or permanently anonymise it in accordance with our data destruction policy.

Our security measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and apiwin servers is encrypted using 256-bit TLS/SSL protocols. Our certificates are maintained by a trusted certificate authority and renewed regularly;
• Encryption at Rest: Sensitive data fields — including identity documents, payment method references, and KYC data — are encrypted at rest using AES-256 encryption;
• Access Controls: Access to personal data within apiwin's systems is restricted on a strict need-to-know basis using role-based access controls. All internal access events are logged and subject to periodic audit review;
• Two-Factor Authentication: Two-factor authentication is available for all user accounts and is mandatory for internal staff access to data management systems;
• Penetration Testing: apiwin's Platform undergoes regular independent security penetration testing. Identified vulnerabilities are triaged and remediated according to their severity rating;
• Incident Response: apiwin maintains a documented data breach incident response procedure. In the event of a confirmed breach affecting your personal data, we will notify you and the relevant regulatory authority within the timeframes required by applicable law.

While we take every reasonable step to protect your data, no internet-based platform can guarantee absolute security. You play an important role in keeping your account safe by using a strong password, enabling two-factor authentication, and keeping your login credentials strictly confidential.

As a user of apiwin, you have the following rights in respect of your personal data. These rights are not absolute — certain exceptions and limitations apply, particularly where processing is required for legal compliance or fraud prevention — but apiwin will always respond to your request and explain any applicable limitations clearly.

apiwin employs age verification as a mandatory step in the registration and KYC process. All users are required to confirm their date of birth at registration and to provide government-issued identity documentation confirming they meet the 21+ requirement before any deposits or withdrawals are permitted.

If you are a parent or guardian and believe that a minor in your care has registered on apiwin, please contact our support team immediately via live chat or at the email address in Section 14. We will investigate and take appropriate action without delay.

Where you have given your consent during registration or at a later stage, apiwin may contact you with promotional offers, bonus notifications, PSL cricket betting promotions, new game announcements, and other marketing content via email, SMS, or in-platform notification.

You may withdraw your consent to marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email;
• Adjusting your notification preferences in your account settings;
• Contacting our support team via live chat or email and requesting to be removed from marketing communications.

Please allow up to 5 business days for your preference to take effect across all communication channels. Withdrawal of marketing consent will not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts — which are necessary for the operation of your account and cannot be disabled.

apiwin does not engage in unsolicited cold marketing. We will never contact you on a channel or in a format to which you have not previously consented.

To deliver our services, apiwin may transfer your personal data to third-party service providers whose servers or operations are located outside Pakistan. Such transfers occur in the following contexts:

• To game studio providers whose servers are hosted in international data centres;
• To KYC verification partners who may process identity data on infrastructure located in other jurisdictions;
• To cloud infrastructure providers who operate distributed server networks across multiple regions.

Wherever personal data is transferred internationally, apiwin takes steps to ensure that an appropriate level of protection is maintained. These steps include entering into standard contractual data protection clauses with all international data processors, conducting due diligence on the data protection frameworks of the destination jurisdiction, and applying additional technical safeguards — such as encryption — where necessary.

You may request details of the international transfers applicable to your personal data and the safeguards in place by contacting our privacy team at the address in Section 14.

apiwin reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, new regulatory requirements, or changes to the services we offer. The effective date displayed at the top of this page will be updated each time a revision is made.

Where changes to this Policy are material — meaning they meaningfully affect your rights or our processing activities — apiwin will provide advance notice by publishing the updated Policy on this page and, where practicable, notifying registered users via in-account notification or email at least 14 days before the changes take effect .

Your continued use of the apiwin Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes to this Policy, you should discontinue use of the Platform and may request account closure in accordance with our Terms and Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or apiwin's processing of your personal data, you may contact our privacy team through the following channels:

• Email: [email protected] (please include "Privacy Request" in the subject line)
• Live Chat: Available 24/7 via the chat widget on the Platform — average response time 3–5 minutes
• Response Time: We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a full response within 30 days of receipt

If you are not satisfied with our response to your privacy concern, or if you believe apiwin is processing your personal data in a manner that is not compliant with applicable data protection law, you have the right to escalate your complaint to the relevant supervisory or regulatory authority in your jurisdiction. Our team will provide guidance on the appropriate authority upon request.

apiwin is committed to resolving all privacy complaints promptly, fairly, and transparently. We treat every privacy enquiry with the same level of seriousness and respect that we apply to the security of your data itself.