Data & Privacy
At 228win, your privacy matters as much as your gameplay. This Policy explains exactly what personal data we collect, why we collect it, how we use it, and the rights you hold over your own information.
Last updated: 1 January 2026At a Glance
These cards highlight the most important aspects of our Privacy Policy. They are a summary only — the full policy below contains all binding detail.
All personal data is stored on encrypted servers. We apply industry-standard security controls — including TLS in transit and AES-256 at rest — to protect your information from unauthorised access.
228win does not sell your personal data to third parties. We share data only where required for platform operations, KYC compliance, payment processing, or when legally obliged to do so by a competent authority.
You have the right to access, correct, restrict and request deletion of your personal data, subject to our legal retention obligations. Submit a request at any time via our support email.
We use strictly necessary, functional and analytics cookies to run the platform and improve your experience. You can manage non-essential cookie preferences at any time through your browser settings.
We understand the privacy expectations of users in Karachi, Lahore, Islamabad and across Pakistan. We do not share data with local payment providers beyond what is technically necessary to process your chosen transaction.
When we make material changes to this Privacy Policy, we notify registered users by email and display a prominent notice on the platform at least 7 days before the change takes effect.
This Privacy Policy ("Policy") describes how 228win ("228win", "we", "us", "our"), operator of the online gaming platform at 228win.cam ("Platform"), collects, processes, stores, shares and protects personal data relating to users ("you", "your") who access or interact with the Platform. This Policy forms part of 228win's broader legal framework alongside the Terms and Conditions and the Responsible Gambling Policy.
By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must cease using the Platform and may request account closure by contacting our support team.
228win is committed to handling personal data responsibly and in accordance with the applicable data protection standards of the jurisdiction in which it holds its operating licence. Users in Pakistan should be aware that local data protection laws and regulations may also apply to the processing of their personal information, and 228win endeavours to meet those expectations in practice.
Pakistan-specific note: 228win does not claim any approval or endorsement from the Government of Pakistan, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan, or any provincial authority in relation to data processing or platform operations. Users must understand applicable local law before participating.
The following terms have the meanings set out below wherever they appear in this Policy:
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifier or factors specific to physical, physiological, genetic, mental, economic, cultural or social identity. |
| Processing | Any operation performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure or destruction. |
| Controller | The entity that determines the purposes and means of Processing Personal Data — in this case, 228win as operator of the Platform. |
| Processor | A third party that processes Personal Data on behalf of 228win under a contractual data processing agreement, such as payment processors, KYC verification providers and analytics vendors. |
| Data Subject | The identified or identifiable natural person to whom Personal Data relates — in the context of this Policy, a registered user of the Platform. |
| KYC | Know Your Customer — the identity and address verification process required under the operator's compliance obligations. |
| Cookie | A small text file stored on a user's device by the Platform for purposes including session management, preference retention and analytics. |
228win collects personal data only to the extent necessary to operate the Platform, fulfil our legal and regulatory obligations, and deliver a secure, personalised experience to each user. The categories of data we collect include:
Minimum necessary principle: 228win collects only the data genuinely needed for the stated purposes. We do not collect sensitive categories of data (e.g., racial or ethnic origin, health data, political opinions) unless specifically required for a regulatory purpose and disclosed to you at the point of collection.
228win collects personal data through the following channels:
The majority of personal data we hold is provided directly by you during the registration flow, KYC submission, cashier transactions, responsible gambling tool configuration, and when you contact our support team. You choose what information to provide; however, refusing to supply mandatory fields (such as name, date of birth or KYC documents) may prevent account opening or withdrawal processing.
When you access and use the Platform, we automatically collect technical data including IP address, device fingerprint, session timestamps and clickstream data via server logs, cookies and similar tracking technologies. This data is collected whether or not you are logged into your account.
We receive data from the following categories of third-party provider in the normal course of platform operations:
228win processes your personal data for the following clearly defined purposes. We do not process your data for any purpose incompatible with those stated below:
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining and closing your account; processing login authentication; managing account preferences and responsible gambling settings. |
| Identity Verification | Confirming your identity, age and address to meet KYC requirements and prevent underage access to the Platform. |
| Payment Processing | Processing deposits and withdrawals; verifying payment method ownership; complying with anti-money-laundering requirements. |
| Platform Delivery | Providing the sports betting, live casino, slots and all other gaming services available on the Platform, including displaying personalised odds and game recommendations. |
| Fraud Prevention & Security | Detecting and preventing fraudulent activity, bonus abuse, money laundering, account takeovers and other prohibited conduct as defined in the Terms and Conditions. |
| Responsible Gambling | Monitoring play patterns for indicators of problem gambling; enforcing deposit limits, loss limits, session timers and self-exclusion arrangements; maintaining self-exclusion records. |
| Customer Support | Responding to enquiries, complaints and account disputes; maintaining support communication records for quality and audit purposes. |
| Legal & Regulatory Compliance | Meeting obligations under the operator's licence, including record-keeping, reporting to regulators and responding to lawful requests from authorities. |
| Marketing (opt-in only) | Sending promotional offers, new game announcements and tailored bonus notifications — only where you have given explicit consent and have not subsequently withdrawn it. |
| Platform Improvement | Analysing aggregated, pseudonymised usage data to improve site performance, navigation, game selection and overall user experience. |
Where data protection law requires a lawful basis for each processing activity, 228win relies on the following bases:
To withdraw consent for marketing communications, update your notification preferences in your account settings or contact support directly. Withdrawal of consent for marketing will not affect your ability to use the Platform.
228win does not sell, rent or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following limited circumstances:
We engage third-party processors to perform specific services on our behalf, including payment processing, identity verification, fraud screening, cloud hosting, customer support software and analytics. Each processor is bound by a contractual data processing agreement requiring them to handle your data only as instructed by 228win and to apply appropriate security measures.
228win may be legally required to disclose personal data to our licensing regulator, financial intelligence units, tax authorities or law enforcement agencies where we receive a lawful request or where we are required to do so as a condition of our operating licence. We will notify you of such disclosures where we are legally permitted to do so.
Where a user invokes self-exclusion or we are required under our licence to register a user's exclusion with a third-party responsible gambling scheme, we will share the minimum necessary data (name, date of birth, account identifier) with that scheme for the sole purpose of enforcing the exclusion.
In the event that 228win undergoes a merger, acquisition, asset sale or restructuring, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you by email or prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.
Payment provider context: Payment provider names such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are referenced for contextual familiarity only. 228win does not share your data with these providers beyond what is technically necessary to process your specific transaction, and no endorsement or affiliation is implied.
228win retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulation or licence condition. The following indicative retention periods apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Licence compliance, AML obligations |
| KYC documents | 5 years from account closure or last transaction | AML and regulatory record-keeping requirements |
| Financial transaction records | 5 years from transaction date | AML, tax and audit obligations |
| Betting and gameplay records | 5 years from account closure | Dispute resolution, licence compliance |
| Support communications | 3 years from last interaction | Dispute resolution and quality audit |
| Self-exclusion records | Duration of exclusion + 7 years | Responsible gambling obligations |
| Marketing consent records | Until consent withdrawn + 3 years | Demonstrating lawful basis for marketing |
| Technical / server logs | Up to 12 months | Security monitoring and fraud detection |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymisation is not technically feasible, data is pseudonymised and access is restricted to authorised compliance personnel only.
Depending on the data protection law applicable to your situation, you may hold some or all of the following rights in relation to your personal data held by 228win. To exercise any of these rights, contact us using the details in Section 15.
Request a copy of all personal data we hold about you, along with information about how and why we process it.
Request correction of inaccurate or incomplete personal data. You can update most account details directly in your profile settings.
Request deletion of your personal data where it is no longer necessary for the purposes collected, subject to our legal retention obligations.
Request that we restrict processing of your data in certain circumstances — for example, while the accuracy of data is being contested.
Receive your personal data in a structured, commonly used and machine-readable format where processing is based on consent or contract.
Object to processing based on legitimate interests or for direct marketing purposes. Marketing objections are honoured immediately upon request.
Response timeframe: 228win will acknowledge all data rights requests within 72 hours and aim to fulfil them within 30 days. Where a request is complex or we receive a high volume, we may extend this period by a further 30 days and will notify you accordingly.
228win uses cookies and similar technologies (including local storage and session storage) to operate the Platform, remember your preferences and understand how users navigate the site. The categories of cookies we use are as follows:
These cookies are essential for the Platform to function and cannot be switched off. They include session authentication tokens, load balancing identifiers and security tokens that protect against cross-site request forgery. No consent is required for strictly necessary cookies.
These cookies remember your account preferences such as display language, odds format and responsible gambling limit settings. Disabling them may affect the quality of your experience but will not prevent access to core Platform features.
We use pseudonymised analytics cookies to understand page performance, navigation patterns and feature usage across the Platform. Data collected is aggregated and used solely to improve the Platform. These cookies require your consent where applicable.
You can manage or block non-essential cookies at any time through your browser settings. Most modern browsers allow you to refuse cookies, delete existing cookies, or be notified when a cookie is set. Note that blocking strictly necessary cookies will impair your ability to log in and use the Platform. For guidance on managing cookies in your specific browser, refer to your browser provider's help documentation.
228win applies a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration or destruction. Our technical and organisational measures include:
Your responsibility: No security measure is 100% foolproof. You are responsible for keeping your login credentials confidential. 228win will never ask for your password via email, live chat or any other channel. If you suspect unauthorised access to your account, contact support immediately.
The Platform is strictly for adults aged 18 years or older, or the higher minimum age required by the operator's licence jurisdiction. 228win does not knowingly collect personal data from anyone under the applicable minimum age. Age verification is a mandatory step in the registration and KYC process.
If we become aware that personal data has been collected from a minor, we will immediately suspend the account, void any associated transactions, and delete the data as promptly as our legal retention obligations permit. If you believe a minor has registered on the Platform using false information, please notify us immediately at the support address in Section 15.
For guidance on parental controls and tools to restrict access to online gambling sites, please visit our Responsible Gambling page.
As an online platform operating internationally, 228win may transfer personal data to service providers and infrastructure located outside the country in which you reside, including outside Pakistan. Where such transfers occur, 228win takes steps to ensure that your data receives an equivalent level of protection to that required in the operator's licence jurisdiction.
Safeguards we rely on for international transfers may include contractual clauses requiring recipient entities to apply data protection standards consistent with those under which the data was originally collected, and vendor due-diligence assessments prior to engagement.
If you would like further information about the specific safeguards applied to international transfers of your personal data, please contact us using the details in Section 15 and we will respond within our standard 30-day timeframe.
228win reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. Material changes — those that significantly affect your rights or how we use your data — will be communicated to registered users via the email address on file and by a prominent notice on the Platform at least 7 days before the change takes effect, except where an immediate change is required for legal or security reasons.
The "Last updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Continued use of the Platform after any update constitutes acceptance of the revised Policy. If you do not accept a material change, you may close your account before the effective date and any remaining balance will be returned in accordance with the withdrawal procedures in the Terms and Conditions.
For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please reach out to the 228win data team using the details below. All data rights requests will be acknowledged within 72 hours.
Email (plain text — not a link):
Live chat is available during platform operating hours as communicated by the operator. When submitting a data rights request, please include your registered email address and a clear description of the right you wish to exercise so we can locate your records and respond efficiently.
For further details on how we approach responsible gambling and the tools available to you, please see our Responsible Gambling page. For general platform rules, please review our Terms & Conditions.
Ready to Play?
Your data is protected, your rights are respected, and the platform is built for a fair, secure experience. Players from Karachi, Lahore, Islamabad and across Pakistan are welcome. 18+ Adults only. Local laws may restrict gambling.