Privacy Policy — How 365win Handles Your Personal Data

This Privacy Policy describes the data practices of the 365win online gaming and sports betting platform, accessible at https://365win.cam. It applies to all personal data collected through the platform — including data provided during account registration, KYC verification, payment transactions, customer support interactions, and general use of the 365win website and any associated mobile interface.

This policy should be read together with the Terms and Conditions and the Responsible Gaming Policy, both of which are published on the 365win platform. Where these documents reference each other, they collectively form the complete agreement between 365win and its account holders.

For the purposes of applicable data protection law, 365win is the data controller responsible for your personal data collected through this platform. As data controller, 365win determines the purposes and means by which your personal data is processed.

365win operates under an internationally recognised online gaming licence. The platform's data practices are subject to review by the licensing authority as part of its regulatory oversight obligations. Where local data protection law in Pakistan imposes additional obligations relevant to this platform, 365win will comply with those requirements to the extent applicable.

For all data protection related enquiries, players may contact 365win's support team via live chat (available 24/7 within the platform) or via email at [email protected].

365win collects the following categories of personal data in the course of operating the platform:

365win does not intentionally collect sensitive personal data beyond what is required for identity verification. Where CNIC or passport copies are collected for KYC purposes, this data is handled with heightened security controls and retained only for the duration required by our licensing obligations.

365win collects personal data through the following channels:

• Direct input: Information you provide when registering an account, completing KYC, submitting a support request, or communicating with our team via live chat or email.
• Payment processing: Transaction data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other integrated payment processors when deposits and withdrawals are conducted.
• Automated technical logging: Technical data including IP addresses, device identifiers, session duration, and page interaction data collected automatically as you use the platform. This data is collected via server logs and first-party analytics tools.
• Cookies and similar technologies: Session and functional cookies used to maintain your login state, remember your language and display preferences, and support the platform's security features. See Section 8 for full cookie details.
• Third-party verification services: Identity and document verification data received from KYC service providers engaged by 365win to perform identity checks on our behalf.
• Fraud and AML screening: Risk signals and screening results received from fraud detection and anti-money laundering service providers operating on a data-processing-only basis for 365win.

365win processes personal data for the following specific purposes:

• Account creation and management: To register your account, verify your identity, maintain your player profile, and provide access to all platform features.
• Financial transaction processing: To process deposits to your 365win wallet and execute withdrawal requests to your registered payment method, including verification and reconciliation of all PKR transactions.
• Regulatory compliance: To meet Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations imposed by our gaming licence, including identity verification, transaction monitoring, and reporting to relevant authorities where legally required.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent account activity, unauthorised access, payment fraud, bonus abuse, and other prohibited conduct as defined in the 365win Terms and Conditions.
• Customer support: To receive and respond to support requests, resolve account disputes, and maintain records of communications for quality and audit purposes.
• Responsible gaming: To monitor player activity for indicators of problem gambling behaviour and to apply player-configured or platform-initiated responsible gaming controls where appropriate.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to players who have provided consent to receive such communications via SMS or push notification.
• Platform improvement: To analyse aggregated, anonymised usage data for the purposes of improving platform performance, user experience, and game catalogue decisions. No individually identifiable data is used for this purpose.

365win processes your personal data on the following legal bases:

• Contractual necessity: Processing required to deliver the services you have requested by registering a 365win account and accepting the Terms and Conditions — including account management, payment processing, and game access.
• Legal obligation: Processing required to comply with applicable regulatory requirements including KYC, AML, tax reporting, and gaming licence conditions.
• Legitimate interests: Processing carried out in pursuit of 365win's legitimate business interests — including fraud prevention, platform security, and responsible gaming monitoring — where these interests are not overridden by your rights and interests.
• Consent: Processing of your personal data for marketing communications, carried out only where you have actively opted in to receive such communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

365win does not sell your personal data. We share personal data with third parties only in the following defined circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT processing partners receive transaction data strictly for the purpose of processing your deposits and withdrawals. Each processor is bound by its own data protection framework and applicable financial regulations.
• KYC and identity verification providers: Third-party KYC services process your identity documents and personal data on behalf of 365win as data processors. They may not use this data for any purpose beyond fulfilling the verification service.
• Fraud detection and AML screening services: Automated risk scoring and AML monitoring tools process transaction and behavioural data as data processors under contractual data processing agreements with 365win.
• Gaming platform technology providers: Where games or platform infrastructure is provided by third-party technology suppliers, necessary session and account data is shared to deliver those services. Game providers receive only the data required to operate the gaming session.
• Regulatory authorities and law enforcement: Where required by law, court order, or the direction of a competent gaming regulatory authority, 365win will disclose personal data to the relevant body. Players will be notified of such disclosures unless prohibited by law.
• Professional advisers: Legal, audit, and compliance advisers engaged by 365win may access personal data on a confidential, need-to-know basis for the purposes of providing professional services to the platform.

365win uses first-party cookies and similar technologies to support the operation and security of the platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that maintain your logged-in state and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional cookies: Remember your display preferences, language settings, and any responsible gaming controls you have applied to your session. These improve your experience but are not essential to core functionality.
• Analytics cookies: First-party analytics tools collect anonymised data on platform usage patterns — including page load times, error rates, and navigation paths — to support platform performance monitoring and improvement. No personally identifiable information is extracted from this data for analytical purposes.

365win does not use third-party advertising cookies or cross-site tracking technologies. You can manage cookie settings through your browser's privacy controls, though disabling strictly necessary cookies will affect your ability to access the platform.

365win retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to the following retention obligations:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in accordance with gaming licence and AML record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial regulations and audit obligations.
• KYC documents: Identity documents submitted for verification are retained for five (5) years following account closure. Where an AML investigation is ongoing, documents may be retained for longer pending resolution.
• Support communications: Live chat transcripts and support ticket records are retained for two (2) years from the date of the interaction, or longer where a formal complaint or legal dispute remains unresolved.
• Technical and session data: Automatically collected technical logs are retained for twelve (12) months from collection unless a security incident requires longer retention for investigation purposes.
• Marketing preference records: Consent and opt-out records are retained for the duration of the account relationship and five (5) years thereafter as proof of consent management.

Once a retention period expires and no legal basis for continued processing exists, personal data is securely deleted or irreversibly anonymised.

365win implements a layered approach to data security, combining technical controls, operational procedures, and access governance to protect the personal data it holds. Security measures in place include:

• 256-bit SSL/TLS encryption for all data in transit between player devices and 365win servers.
• Encryption at rest for sensitive personal data stored within 365win's database infrastructure.
• Multi-factor authentication requirements for staff access to internal systems holding personal data.
• Role-based access controls limiting data access to staff with a direct operational requirement.
• Regular penetration testing and security assessments of the platform infrastructure.
• Automated fraud and anomaly detection monitoring running continuously across all account and transaction activity.
• Incident response protocols specifying the steps to be taken in the event of a data security breach, including player notification procedures.

As a 365win account holder, you hold the following rights in relation to your personal data. These rights are exercisable by contacting 365win's support team via live chat or at [email protected]:

To exercise any of these rights, please contact the 365win support team with your registered mobile number and a description of your request. We may require identity verification before processing data rights requests to protect against unauthorised access to account information.

365win sends promotional communications — including bonus offers, platform updates, and new game announcements — only to players who have actively opted in to receive such communications via SMS or push notification. Marketing consent is collected during the registration process and can be managed at any time through your account settings.

To opt out of all marketing communications from 365win, you may:

• Update your notification preferences in the account settings section of the platform.
• Reply STOP to any SMS received from 365win.
• Contact the 365win support team via live chat to request removal from all marketing lists.

Opting out of marketing communications does not affect transactional communications relating to your account — including deposit and withdrawal confirmations, security alerts, and responsible gaming notifications — which are sent regardless of marketing preference because they are operationally necessary.

Where 365win discovers or has reasonable grounds to believe that a registered account belongs to a person under the age of 21, the following steps will be taken immediately:

• The account will be suspended pending investigation.
• All gaming activity conducted on the account will be reviewed.
• Any deposited funds will be handled in accordance with applicable law and licensing obligations — which may include return to the payment source or referral to the relevant authority.
• The account will be permanently closed.

If you are a parent or guardian and believe that a minor in your care has registered a 365win account, please contact us immediately via live chat or at [email protected] so we can take prompt action.

365win reserves the right to update or revise this Privacy Policy at any time. Where changes are material — meaning they significantly affect how your personal data is processed or your rights in relation to it — 365win will notify registered players in advance via SMS to the registered mobile number or via platform notification.

The effective date at the top of this document reflects when the current version entered into force. We encourage you to review this policy periodically. Continued use of the 365win platform following any revision constitutes acceptance of the updated policy.

Previous versions of this Privacy Policy are available on request by contacting the 365win support team. If you have concerns about any changes to this policy, you are welcome to reach out before they take effect.

For all privacy-related enquiries, data rights requests, or concerns regarding how 365win handles your personal data, please use the following contact options:

• Live Chat: Available 24/7 inside the platform. This is the fastest channel for urgent data enquiries or account-specific concerns.
• Email: [email protected] — for formal data rights requests and privacy complaints. We aim to respond within 24 hours for general queries and within 5 business days for formal data rights requests.

When submitting a data rights request, please include your registered mobile number and a clear description of your request. Identity verification will be required before any personal data is disclosed, amended, or deleted in response to your request — this is to protect you from unauthorised access to your account information.

This Privacy Policy was last revised on 1 January 2026 and supersedes all previously published versions. In the event of a conflict between this policy and any other document on the 365win platform, this Privacy Policy governs data protection matters. All other matters are governed by the 365win Terms and Conditions.