Privacy Policy

This Privacy Policy ("Policy") describes how Winrup ("we", "us", "our"), operating the online gaming information and entertainment platform at https://winrup.cam ("Platform"), collects, uses, stores, shares and protects the personal data of users ("you", "your", "User") who access or use the Platform.

Winrup is an English-language platform built for players across Pakistan, from Karachi and Lahore to Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. We understand that data privacy is a genuine concern for Pakistani users, and this Policy is written in plain, direct English rather than impenetrable legal jargon — while still meeting the formal requirements of a comprehensive privacy notice.

By registering an account on Winrup or otherwise using the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform immediately.

This Policy should be read alongside the Winrup Terms & Conditions, which form the primary agreement between you and the Platform, and the Responsible Gambling policy, which addresses specific data uses in the context of player protection.

For the purposes of this Privacy Policy, the following terms have the meanings assigned below:

• "Personal Data" — Any information that can directly or indirectly identify a natural person, including name, email address, date of birth, IP address and financial account details.
• "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, erasure or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For this Platform, the Data Controller is Winrup as operated at https://winrup.cam.
• "Data Processor" — A third party that processes personal data on behalf of and under the instruction of the Data Controller.
• "Consent" — Freely given, specific, informed and unambiguous indication of a User's agreement to the processing of their personal data for a stated purpose.
• "Cookies" — Small text files placed on a User's device by a website to store session information, preferences and analytics data.
• "KYC" — Know Your Customer verification, comprising identity and address documentation submitted by a User to satisfy eligibility and anti-money laundering requirements.
• "AML" — Anti-Money Laundering, a set of legal and procedural obligations requiring the Platform to monitor transactions and verify the source of funds.
• "Third Party" — Any individual, company or organisation other than the User and Winrup.

Winrup collects personal data that is necessary and proportionate to the purposes described in this Policy. The categories of data we collect are set out below:

We collect only the personal data that is necessary for the purposes identified in this Policy. We do not collect special categories of sensitive personal data (such as health data, biometric data or political opinions) unless explicitly required by applicable regulatory obligations and with appropriate safeguards in place.

Winrup collects personal data through the following means:

• Direct Submission: Information you provide when completing the registration form, submitting KYC documentation, initiating deposits or withdrawals, contacting support or participating in promotions.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers and session activity, through server logs, cookies and similar tracking technologies.
• Third-Party Verification Sources: Identity verification and fraud screening services that cross-reference submitted information against reference databases to confirm accuracy and detect anomalies.
• Payment Processors: Transaction-level data received from payment intermediaries in connection with deposit and withdrawal processing. References to familiar Pakistani payment infrastructure — such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are contextual only; none of these providers are data-sharing partners of Winrup unless explicitly stated.

Every processing activity carried out by Winrup is grounded in one or more of the following lawful bases:

• Contractual Necessity: Processing required to perform the contract between you and Winrup — including account creation, transaction processing, bonus management and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including AML obligations, KYC requirements and regulatory reporting duties imposed by the operator's licensing jurisdiction.
• Legitimate Interests: Processing that serves Winrup's legitimate business interests — such as fraud prevention, platform security, responsible gambling monitoring and service improvement — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: For non-essential cookies, direct marketing communications and any processing activities not covered by the above bases, Winrup will seek your explicit consent prior to processing. You may withdraw consent at any time, although withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Winrup processes personal data for the following purposes, each of which is supported by an appropriate legal basis as described in Section 5:

1. Account Management: Creating and maintaining your registered account, verifying your identity and eligibility, and processing account-related communications.
2. Transaction Processing: Processing deposits and withdrawals in PKR and other supported currencies, maintaining transaction records and managing payment disputes.
3. Regulatory Compliance: Conducting KYC verification, implementing AML screening, monitoring transactions for suspicious activity and meeting reporting obligations to applicable regulatory authorities.
4. Fraud Prevention and Security: Detecting and preventing fraudulent account activity, collusion, bonus abuse and other prohibited conduct; monitoring login activity and flagging anomalous sessions.
5. Responsible Gambling: Monitoring gaming patterns to identify potential indicators of problem gambling; implementing deposit limits, loss limits, time limits and self-exclusion requests; maintaining exclusion records.
6. Customer Support: Processing support requests, complaints, KYC queries and dispute escalations submitted through Live Chat, Help Center or email.
7. Platform Improvement: Analysing aggregated and anonymised usage data to improve the performance, usability and content of the Platform.
8. Marketing Communications: Where you have provided consent, sending promotional communications about bonuses, new game categories and platform events. You may opt out of marketing communications at any time without affecting your account.

Winrup does not sell, rent or trade your personal data to third parties for their own independent marketing or commercial purposes. Personal data is shared only in the following circumstances and only to the extent necessary:

• Service Providers and Processors: Third-party companies engaged to provide services on our behalf — including payment processing infrastructure, identity verification services, fraud screening tools, customer support platforms and cloud hosting providers — who process data only under written instructions from Winrup and are bound by strict confidentiality and data protection obligations.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, regulation, court order or regulatory directive, Winrup may disclose personal data to competent authorities. This includes compliance with AML reporting obligations and responses to lawful data requests.
• Responsible Gambling Schemes: Where a User has voluntarily enrolled in a self-exclusion scheme or where regulatory requirements mandate registration of self-excluded players with a central exclusion register, relevant data may be shared with the applicable scheme operator.
• Business Transfers: In the event of a merger, acquisition, restructuring or sale of all or part of the Platform's business, personal data held by Winrup may form part of the transferred assets. Users will be notified of any such transfer in advance where practicable, and the acquiring entity will be bound by obligations at least equivalent to those set out in this Policy.

Winrup retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of your account relationship with Winrup and for a further period as required by the operator's licensing regulations and AML obligations following account closure.
• Transaction Records: Financial transaction records are retained for a minimum period consistent with applicable AML and tax record-keeping requirements in the operator's licensing jurisdiction.
• KYC Documentation: Identity and address verification documents are retained for the period mandated by applicable AML regulations, typically a minimum of five years from the date of the last transaction.
• Self-Exclusion Records: Records of self-exclusion requests and their effective periods are retained for a minimum of five years to prevent re-registration during an active exclusion period.
• Support Communications: Customer support records are retained for a period sufficient to handle follow-up enquiries and dispute resolution, typically three years from the date of last contact.
• Technical and Log Data: Server logs and session data are retained for a shorter period, typically up to 12 months, unless a longer period is required for fraud investigation or legal proceedings.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identified individual.

Winrup uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens and load-balancing cookies. These cookies cannot be disabled without severely impairing Platform functionality.
• Functional Cookies: Enable enhanced functionality and personalisation, such as remembering your language preference (English), display settings and previously viewed content. These cookies may be set by Winrup or by third-party service providers.
• Analytics Cookies: Collect anonymised information about how users interact with the Platform — which pages are visited most frequently, where users enter and exit the site, and how long sessions last. This data helps us improve Platform design and content.
• Marketing Cookies: Used to deliver relevant promotional content to users who have consented to receive marketing communications. These cookies may track interactions with promotional materials across sessions.

Non-essential cookies (functional, analytics and marketing) are set only where you have provided consent through the Platform's cookie preference interface. You may withdraw or modify your cookie consent at any time through the same interface. Please note that disabling certain cookies may affect your experience on the Platform.

Your browser settings may also allow you to manage cookies independently. Most browsers allow you to view, delete and block cookies from specific websites. However, blocking strictly necessary cookies will impair the Platform's ability to authenticate your session and provide secure access.

Winrup operates an online platform that may involve the transfer of personal data to jurisdictions outside of Pakistan, including the operator's licensing jurisdiction and the locations of our service providers and data processors.

Where personal data is transferred internationally, Winrup implements appropriate safeguards to ensure that the data continues to receive an adequate level of protection, including where applicable:

• Data processing agreements incorporating standard contractual clauses or equivalent protections;
• Transfers only to jurisdictions or organisations that provide adequate levels of data protection as recognised by the operator's licensing authority;
• Technical and organisational security measures appropriate to the risk associated with the transfer.

Pakistani users should be aware that Pakistan's data protection framework is still developing. Winrup does not claim that international transfers of Pakistani user data are governed by any particular Pakistani legislation. We apply reasonable international best-practice data protection standards to all transfers regardless of the applicable legal framework.

As a User of the Winrup Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact us using the details set out in Section 15 of this Policy.

Winrup will respond to all valid rights requests within 30 days of receipt. In complex cases or where a high volume of requests is received, this period may be extended by a further 60 days with notification. We may ask you to verify your identity before processing a rights request to prevent unauthorised disclosure.

Please note that some rights are subject to limitations — for example, we cannot delete data that we are legally required to retain under AML or regulatory obligations, and data portability applies only where technically feasible and where processing is based on consent or contract.

The Winrup Platform is strictly restricted to adults aged 18 years and over — or the higher minimum age required by the operator's licensing jurisdiction or by applicable local law, whichever is greater. Winrup does not knowingly collect or process personal data relating to individuals under the applicable minimum age.

If we become aware that personal data has been collected from an individual who does not meet the minimum age requirement, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has accessed the Platform using your account or has registered independently, please contact our support team immediately.

If you are the parent or guardian of a minor and are concerned about their potential access to gambling content, we recommend using parental controls available through your internet service provider, device settings or third-party filtering software to restrict access to online gambling sites.

Winrup implements technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration or destruction. These measures include:

• Encryption of data in transit using TLS (Transport Layer Security) protocols;
• Encryption of sensitive data at rest, including payment information and identity documents;
• Role-based access controls restricting data access to authorised personnel only;
• Multi-factor authentication options for account login;
• Regular security assessments and penetration testing;
• Incident response procedures to detect, investigate and notify affected parties of security breaches within required timeframes.

While Winrup implements reasonable security measures, no data transmission over the internet or electronic storage system can be guaranteed to be entirely secure. You also bear responsibility for the security of your account credentials. If you suspect that your account has been compromised, please contact support immediately.

Winrup reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law or regulation, changes to the Platform's data processing activities, or updates to best-practice standards. The "Last reviewed" date at the top of this document indicates when the Policy was most recently updated.

Material changes to this Policy will be communicated to registered users by email notification or through an on-screen notice displayed upon login, with reasonable advance notice where practicable. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

The version of this Policy currently published at https://winrup.cam/privacy-policy constitutes the current and binding version. You are encouraged to review this Policy periodically to remain informed of any changes.

For any questions, concerns or requests relating to this Privacy Policy, or to exercise any of the data subject rights described in Section 11, please contact the Winrup support team through any of the following channels:

• Live Chat: Available 24 hours a day, seven days a week through the Platform. English support is available at all times. Urdu assistance is available during select hours.
• Help Center: Accessible through the Platform's support section for self-service answers to common privacy questions and to submit a formal data subject request ticket.
• Email: Written privacy enquiries may be sent to [email protected] — please include "Privacy Request" in the subject line and your registered account username or email address to enable prompt handling.

We aim to acknowledge all privacy-related communications within 72 hours. Please be aware that we may need to verify your identity before processing your request to prevent unauthorised access to personal data.