10win Privacy Policy – How We Handle Your Personal Data in Pakistan

This Privacy Policy describes how 10win ("the Platform", "we", "us", "our"), accessible at https://10win.life, collects, processes, stores and protects the personal data of its registered members and website visitors, with particular reference to players based in Pakistan.

Privacy matters to us — not as a compliance checkbox but as a genuine commitment to the people who use our platform. Pakistani players entrust 10win with personal information including their name, contact details and financial transaction history. We take that trust seriously and handle it accordingly.

This policy is written in plain English. Our goal is that by the end of it you have a clear, honest picture of what 10win does with your data and what options you have. If any section is unclear, please contact our support team before proceeding.

By registering an account or continuing to use the 10win platform, you confirm that you have read and understood this Privacy Policy and agree to its terms. This policy operates alongside and should be read in conjunction with our Terms and Conditions.

10win collects personal data in three broad ways: information you provide directly, information generated automatically through your use of the platform, and in limited cases information received from third-party service providers.

Information you provide directly:

• Full legal name and date of birth (required for account registration and KYC verification)
• Pakistani CNIC number (collected as part of identity verification for higher-value withdrawals)
• Mobile phone number (used for account security, OTPs and promotional communications if opted in)
• Email address (used for account management communications)
• Residential address (collected during enhanced KYC verification)
• KYC documentation: CNIC, passport or driving licence images, proof of address

Information generated automatically:

• IP address and approximate geographic location at login
• Device information including device type, operating system and browser version
• Session logs including login timestamps, game sessions played and bets placed
• Transaction history: deposit amounts, withdrawal requests, bonus usage and balances
• Communication records: support chat transcripts and email correspondence
• Cookie and tracking data as described in Section 6

Information from third parties:

• Identity verification results from certified KYC/AML service providers
• Payment confirmation data from Easypaisa, JazzCash, NayaPay, SadaPay and banking partners — limited to transaction reference numbers, amounts and success/failure status
• Fraud detection signals from third-party security services (aggregated and anonymised where possible)

10win uses the personal data it collects for the following specific purposes:

10win processes personal data on the following legal grounds:

• Contractual necessity: Processing your name, contact details and transaction data is necessary to fulfil the service contract between you and 10win — without it we cannot run your account, accept deposits or pay out winnings.
• Legal obligation: Identity verification (KYC), anti-money laundering (AML) monitoring and certain record-keeping are required by the regulatory framework under which 10win operates.
• Legitimate interest: Fraud detection, platform security, responsible gaming monitoring and internal analytics are carried out on the basis of 10win's legitimate interest in operating a safe and compliant platform.
• Consent: Marketing communications (promotional emails, SMS) and optional analytics tracking are only carried out where you have given explicit consent. You can withdraw consent at any time through account settings or by contacting support.

10win takes a strict approach to payment data. We are clear about what we hold and what we do not:

• What 10win does NOT store: We do not store your Easypaisa or JazzCash PIN or account password. We do not store full debit or credit card numbers. We do not store bank account login credentials. All sensitive payment credentials are processed exclusively by certified payment gateways (PCI-DSS compliant processors) and never touch 10win's own servers.
• What 10win does store: Transaction reference numbers (for reconciliation purposes), transaction amounts, payment method type (e.g. "Easypaisa"), truncated identifiers where necessary for customer support (e.g. the last four digits of a card or the registered mobile number associated with a wallet), and transaction success/failure status.
• Purpose limitation: Financial transaction records are retained for the minimum period required by applicable financial regulations and our licensing obligations, after which they are securely deleted or anonymised.

10win uses cookies and similar tracking technologies to operate and improve the platform. Here is a straightforward breakdown of what we use and why:

• Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery, and preference cookies that remember your language and display settings. You cannot opt out of essential cookies while using the platform.
• Analytics cookies: Used to understand how members navigate the platform — which pages are visited, how long sessions last and where users encounter difficulties. This data is collected in aggregate and anonymised form. You can opt out via your browser settings or by contacting support.
• Marketing/retargeting cookies: Only used if you have given explicit consent to receive personalised promotions. These cookies help 10win show relevant offers rather than generic ones. You can withdraw consent at any time from account settings.

Most browsers allow you to control or delete cookies through their settings menu. Disabling essential cookies may prevent parts of the 10win platform from functioning correctly.

10win does not sell your personal data. We share it only in the following specific and necessary circumstances:

• Payment processors: To facilitate deposits and withdrawals, transaction data is shared with our certified payment processing partners (Easypaisa, JazzCash and their respective gateway providers). These partners are contractually bound to handle data only for payment processing purposes.
• KYC/AML service providers: To fulfil identity verification and anti-money laundering obligations, identity documents may be processed by certified third-party KYC providers. These providers operate under strict data processing agreements.
• Regulatory and law enforcement: Where required by applicable law or a valid legal order, 10win will share necessary data with regulatory authorities or law enforcement agencies. 10win will not do this voluntarily beyond its legal obligations.
• Fraud prevention networks: Aggregated and anonymised risk signals may be shared with industry fraud prevention services to protect 10win and its members from known fraud patterns.
• Technology infrastructure: Trusted cloud hosting and database providers process data on 10win's behalf under strict data processing agreements. They are not permitted to use this data for their own purposes.

10win retains personal data only for as long as is necessary for the purpose it was collected. Specific retention periods are as follows:

• Account data (name, contact details, account preferences): Retained for the lifetime of the active account plus 5 years following account closure, in line with financial record-keeping obligations.
• Transaction records (deposits, withdrawals, bet history): Retained for 7 years from the date of the transaction, as required by anti-money laundering regulations.
• KYC documentation (CNIC copies, proof of address): Retained for 5 years following account closure or the completion of a transaction requiring KYC, whichever is later.
• Support correspondence: Retained for 3 years from the date of the communication to enable resolution of follow-up queries and disputes.
• Analytics data: Aggregated platform analytics are retained indefinitely in anonymised form. Individual session logs are deleted after 90 days.

After the applicable retention period, personal data is securely deleted or irreversibly anonymised. You may request earlier deletion of certain data types — see Section 10 for your rights.

10win employs a layered approach to data security. Here is what we have in place to protect your information:

• Encryption in transit: All data passed between your device and 10win servers is encrypted using TLS 1.3, the current industry standard. This applies to all platform interactions including login, betting, deposits and account settings changes.
• Encryption at rest: Sensitive personal data stored on 10win servers is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within 10win's systems is restricted to staff with a genuine operational need on a role-based access control basis. All data access events are logged and audited.
• Two-factor authentication: 10win encourages and supports two-factor authentication (2FA) on all accounts. For high-value withdrawal requests, additional verification steps are required.
• Penetration testing: The 10win platform undergoes regular independent security assessments to identify and address vulnerabilities before they can be exploited.
• Incident response: 10win maintains a documented incident response plan. In the event of a data breach affecting member data, affected members will be notified promptly, along with relevant regulatory authorities where required.

As a 10win member you have the following rights in relation to your personal data. These can be exercised by contacting support@10win.life with the subject line "Data Rights Request" and your registered mobile number for verification.

The 10win platform is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, you must not attempt to register an account or use any part of the 10win platform.

10win employs age verification procedures at the registration stage and during KYC review. Any account identified as belonging to a person under 18 will be immediately closed and any balance forfeited.

If a parent or guardian believes their minor child has registered an account at 10win, they should contact support@10win.life immediately with the account details. 10win will investigate and close any confirmed underage account within 24 hours of a verified report. The minor's personal data will then be permanently deleted from 10win's systems as quickly as legal obligations allow.

10win may send you promotional communications about bonuses, new games, special offers and platform features. This is subject to your preferences:

• Opt-in: You will only receive marketing emails and promotional SMS messages if you have explicitly opted in during registration or subsequently in your account settings.
• Opting out: You can unsubscribe from marketing communications at any time by visiting your 10win account settings and adjusting notification preferences, or by clicking the unsubscribe link in any marketing email, or by contacting support@10win.life. Opt-out requests take effect within 48 hours.
• Transactional messages: Account security alerts, withdrawal confirmation messages, deposit receipts and KYC request notifications are transactional communications and will continue regardless of marketing preferences. These are necessary to operate your account safely.

The 10win platform does not contain links to external third-party websites. This Privacy Policy applies exclusively to data processed in connection with your use of https://10win.life and its sub-pages. If you access any other website, that site's own privacy policy governs how your data is handled — 10win has no responsibility or oversight over third-party sites.

10win reviews and updates this Privacy Policy periodically to reflect changes in platform functionality, legal requirements or best practice. When material changes are made:

• The "Last Updated" date at the top of this page will be revised.
• Registered members will be notified by email and/or SMS at least 7 days before the changes take effect.
• A notification will appear on the 10win platform during the notice period.

Where a change involves the use of your data in a materially different way from what you originally agreed to, 10win will seek fresh consent where required rather than relying on implicit acceptance. Continued use of the platform after the effective date of any revision constitutes acceptance of the updated Privacy Policy.

If you have any question, concern or request relating to your personal data or this Privacy Policy, please get in touch:

• Email: support@10win.life — subject line "Privacy / Data Rights Request"
• Live Chat: Available 24 hours a day, 7 days a week via the 10win website. For data rights requests, live chat will direct you to the email process for written confirmation purposes.
• Response time: 10win aims to acknowledge all data rights requests within 72 hours and complete them within 30 calendar days. Complex requests may take longer — you will be notified if this is the case.

For any concerns that cannot be resolved directly with 10win's support team, you may escalate to the data protection authority applicable under the regulatory framework governing your interaction with the platform.