Privacy Policy

1. Introduction

winrup ("we", "us", "our") operates the online casino and sports betting platform available at winrup.com (the "Platform"). This Privacy Policy describes how winrup collects, uses, stores, shares, and protects personal data belonging to users ("you", "User", "Player") who access or use the Platform.

By registering for a winrup account and using the Platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Privacy Policy. This Policy forms part of the winrup Terms & Conditions. Where you do not agree with any aspect of this Privacy Policy, you must discontinue use of the Platform.

winrup is committed to handling your personal data responsibly, in a manner consistent with applicable data protection principles and the requirements of the jurisdiction in which winrup operates. We recognise the trust you place in us when you share your information, and we take that responsibility seriously.

2. Data We Collect

winrup collects the following categories of personal data from Users:

2.1 Registration Data. When you create a winrup account, we collect your full name, date of birth, email address, mobile phone number, and residential address. This information is required to open and maintain your account and to comply with our age verification and KYC obligations.

2.2 Identity Verification Data. To satisfy KYC and AML requirements, winrup may collect copies of your CNIC (Computerised National Identity Card), passport, driving licence, or other government-issued identity documents, along with proof of address (such as a utility bill or bank statement).

2.3 Financial Data. winrup collects payment method details necessary to process deposits and withdrawals, including JazzCash account numbers, Easypaisa wallet identifiers, bank account numbers (for HBL, UBL, Meezan Bank, Bank Alfalah transfers), and cryptocurrency wallet addresses where applicable. Full card numbers are never stored on winrup servers.

2.4 Transaction Data. We maintain records of all deposits, withdrawals, bets, game rounds, bonus claims, and other financial transactions associated with your winrup account.

2.5 Device & Usage Data. When you access winrup, we automatically collect technical data including your IP address, browser type and version, device type and operating system, session timestamps, pages visited, and in-platform navigation patterns. This data is used for security monitoring, fraud prevention, and Platform optimisation.

2.6 Communications Data. We retain records of communications you send to winrup support, including live chat logs, emails, and any attachments provided. This data is used to resolve your queries and to improve support quality.

3. How We Use Your Data

winrup uses the personal data we collect for the following purposes:

• To create, manage, and maintain your winrup account;
• To verify your identity and age in accordance with our KYC obligations;
• To process deposits and withdrawal requests in PKR via your chosen payment method;
• To detect and prevent fraud, money laundering, and other prohibited activity;
• To provide customer support and respond to your enquiries;
• To personalise your experience on the Platform, including game recommendations and promotional offers where applicable;
• To comply with applicable legal, regulatory, and licensing obligations;
• To analyse Platform usage and improve our services, products, and user experience;
• To send transactional communications relating to your account, including deposit confirmations, withdrawal notifications, and security alerts;
• To enforce our Terms & Conditions and other applicable policies.

winrup does not use your personal data for automated decision-making that produces significant legal or similarly significant effects on you, without providing an opportunity for human review.

4. Legal Basis for Processing

winrup processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between winrup and you — i.e., to provide the Platform services you have signed up to use;
• Legal Obligation: Processing is necessary to comply with applicable legal and regulatory requirements, including KYC, AML, and licensing obligations;
• Legitimate Interests: Processing is necessary for the pursuit of winrup's legitimate business interests, including fraud prevention, security monitoring, and Platform improvement, where those interests are not overridden by your data protection rights;
• Consent: Where winrup seeks your consent for specific processing activities (such as optional marketing communications), we will obtain that consent explicitly and separately, and you may withdraw it at any time.

5. Data Sharing & Disclosure

5.1 Service Providers. winrup shares personal data with third-party service providers who assist in operating the Platform. These include payment processors (JazzCash, Easypaisa, banking partners), identity verification providers, game software studios, cloud infrastructure providers, and customer support tools. All service providers are contractually bound to process your data only as instructed by winrup and to maintain appropriate security standards.

5.2 Regulatory Authorities. winrup may be required by law, court order, or regulatory direction to disclose personal data to competent authorities. winrup will comply with such obligations and, where legally permissible, will notify you of such disclosure.

5.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of winrup's business, personal data held by winrup may be transferred to the relevant successor entity. You will be notified of any such transfer and the privacy practices applicable following the change.

5.4 No Sale of Data. winrup does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes under any circumstances.

6. KYC & AML Data Handling

The identity documents and financial verification data you submit as part of winrup's KYC process are stored securely and accessed only by authorised personnel responsible for account verification and compliance. This data is used exclusively for:

• Verifying your identity and age to comply with our regulatory obligations;
• Confirming the legitimacy of the payment methods you use;
• Meeting our Anti-Money Laundering (AML) reporting and record-keeping requirements.

KYC documents are retained for the period required by applicable regulations following account closure. They are not used for any commercial purpose beyond those listed above.

7. Cookies & Tracking Technologies

7.1 winrup uses cookies — small text files stored on your device — and similar tracking technologies such as web beacons and local storage to deliver and improve the Platform experience.

7.2 winrup uses the following types of cookies:

• Essential Cookies: Necessary for the Platform to function. These maintain your login session and remember your preferences during a session;
• Analytics Cookies: Collect anonymised data about how Users navigate the Platform, which pages are visited most frequently, and where errors occur — used to improve Platform performance;
• Security Cookies: Support fraud detection and authentication, helping winrup identify suspicious access patterns.

7.3 You can control or disable non-essential cookies through your browser settings. Note that disabling essential cookies may impair Platform functionality, including your ability to remain logged in to your winrup account.

8. Data Retention

winrup retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including the duration of your active account and any applicable statutory or regulatory retention periods thereafter. Specifically:

• Account and transaction data is retained for a minimum of five (5) years following account closure, to comply with AML record-keeping requirements;
• KYC identity documents are retained for the period required by our licensing jurisdiction following the end of the customer relationship;
• Support communications are retained for two (2) years following resolution, unless a longer period is required for ongoing disputes;
• Device and usage data is retained for twelve (12) months in identifiable form, after which it may be retained in anonymised aggregate form indefinitely.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with winrup's data disposal procedures.

9. Data Security

winrup implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between the Platform and your device;
• Encrypted storage of sensitive data at rest, including KYC documents and financial records;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular internal security assessments and monitoring for anomalous access patterns;
• Two-factor authentication options for User accounts.

Notwithstanding the above, no system is entirely immune to security risks. winrup will notify affected Users and relevant authorities in the event of a data breach as required by applicable law. Users are responsible for maintaining the security of their own winrup login credentials.

10. Your Data Rights

Subject to applicable law and regulatory limitations, you have the following rights with respect to the personal data winrup holds about you:

• Right of Access: You may request a copy of the personal data winrup holds about you;
• Right to Rectification: You may request that inaccurate or incomplete data be corrected;
• Right to Erasure: You may request deletion of your personal data, subject to winrup's legal retention obligations;
• Right to Restrict Processing: You may request that winrup limit the processing of your data in certain circumstances;
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that we provide your data in a structured, machine-readable format;
• Right to Object: You may object to processing based on legitimate interests, including direct marketing.

To exercise any of the above rights, contact winrup support at [email protected]. winrup will respond to verifiable requests within thirty (30) days. winrup reserves the right to verify your identity before processing any data rights request.

11. Children's Privacy

winrup is strictly an 18+ platform. We do not knowingly collect personal data from individuals under the age of 18. If winrup becomes aware that it has inadvertently collected data from a minor, that data will be deleted promptly and the associated account will be closed. If you believe a minor has registered with winrup, please contact us immediately at [email protected].

12. International Data Transfers

winrup's Platform infrastructure and some of our third-party service providers may be located outside of Pakistan. Where personal data is transferred internationally, winrup ensures that appropriate safeguards are in place — such as contractual data protection clauses or transfers to jurisdictions with adequate data protection standards — to ensure your data is protected to a standard consistent with this Policy.

13. Updates to This Privacy Policy

winrup may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. When material changes are made, winrup will notify Users via the Platform or by email to your registered address. The date of the most recent revision is displayed at the top of this page. Your continued use of the winrup Platform following notification of an updated Privacy Policy constitutes your acceptance of the revised terms.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or winrup's data practices, please contact our support team. We aim to respond to all privacy-related enquiries within five (5) business days.

Contact: [email protected] (plain text — not a clickable link)

For formal data rights requests or complaints that cannot be resolved through our support team, you may be entitled to refer the matter to a relevant data protection supervisory authority in your jurisdiction.