Privacy Policy — bpxeah

1 Introduction

This Privacy Policy (hereinafter referred to as the "Policy") is issued by bpxeah (the "Company", "Operator", "we", "us" or "our"), the operator of the online betting and gaming platform accessible at https://bpxeah.cam (the "Platform"). This Policy governs the collection, use, storage, disclosure and protection of personal data relating to individuals ("you", "Player", "User" or "Data Subject") who register for or use the Platform's services.

bpxeah is committed to handling personal data responsibly, transparently and in accordance with the data protection obligations applicable under the Operator's international gaming license jurisdiction. This Policy is designed to ensure you understand precisely what data we collect, why we collect it, how it is used and what controls you have over it.

By registering an account, making a deposit or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood its contents. If you do not agree with any part of this Policy, you should not use the Platform and should contact the support team to close your account.

2 Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, postal address, payment details and government-issued identification numbers.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, the Operator of the bpxeah Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller under a written data processing agreement.
• "KYC" means Know Your Customer — the identity and address verification process required for regulatory compliance.
• "Cookies" means small text files placed on a user's device by a website to store session and behavioural information.
• "AML" means Anti-Money Laundering — the legal and regulatory framework requiring financial operators to detect and report suspicious financial activity.
• "Sensitive Personal Data" means a special category of Personal Data attracting heightened protection, including health data, biometric data and data relating to criminal convictions.

3 Personal Data We Collect

bpxeah collects Personal Data from Players through several channels including account registration, KYC verification processes, payment transactions, customer support interactions, Platform usage and, where applicable, cookies and tracking technologies. The categories of data collected are as follows:

bpxeah does not intentionally collect Sensitive Personal Data. Where identity documents submitted during KYC incidentally contain such data (for example, a CNIC photograph), that data is processed solely for the purposes of the KYC verification and is not used for any other purpose.

4 How We Use Your Personal Data

bpxeah uses the Personal Data collected for the following specific purposes:

• Account creation and management — to establish, maintain and administer your account on the Platform.
• Identity and age verification (KYC) — to confirm your identity, verify your age as 18 or above (or the higher minimum required) and comply with applicable know-your-customer regulations.
• Payment processing — to process deposits and withdrawals in PKR or other supported currencies and to prevent unauthorised financial transactions.
• Anti-money laundering (AML) compliance — to monitor transactional patterns for indicators of money laundering, fraud or other financial crime, as required under applicable law.
• Fraud prevention and account security — to detect, investigate and prevent fraudulent activity, unauthorised account access and abuse of Platform policies.
• Responsible gambling — to monitor usage patterns for signs of problem gambling behaviour, to administer self-exclusion and deposit-limit requests and to signpost support resources where appropriate.
• Customer support — to respond to queries, complaints and support requests submitted via live chat, email or other contact channels.
• Legal compliance — to comply with applicable legal obligations including regulatory reporting, responses to lawful authority requests and record-keeping requirements.
• Platform improvement — to analyse aggregate usage data for the purpose of improving Platform performance, usability and content — only where data is anonymised or pseudonymised at the analysis stage.
• Marketing communications — to send promotional offers and updates to Players who have opted in to marketing communications, subject to the right to opt out at any time.

5 Legal Basis for Processing

Where the applicable data protection framework requires the Operator to identify a legal basis for processing Personal Data, bpxeah relies on the following bases:

• Contractual necessity — processing required to perform the contract between bpxeah and the Player, including account registration, payment processing and service delivery.
• Legal obligation — processing required to comply with applicable law, including KYC, AML and regulatory reporting obligations under the Operator's gaming license.
• Legitimate interests — processing that is necessary for the Operator's legitimate interests (such as fraud prevention, platform security and responsible gambling monitoring), provided that those interests are not overridden by the Player's rights and freedoms.
• Consent — where processing is based on consent (for example, opt-in marketing communications or the use of non-essential cookies), Players have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

6.1 Third-Party Data Processors

bpxeah engages third-party service providers who process Personal Data on the Operator's behalf under written data processing agreements. These include, but are not limited to: identity verification and KYC technology providers; payment processing and fraud detection services; cloud infrastructure and data hosting providers; customer support software platforms; and responsible gambling monitoring services. All such processors are required to implement appropriate technical and organisational security measures and to process data only in accordance with the Operator's documented instructions.

6.2 Regulatory and Legal Disclosures

bpxeah may disclose Personal Data to regulatory bodies, law enforcement agencies or courts where required to do so by applicable law, court order or lawful authority request. In such cases, the Operator will disclose only the minimum data necessary to comply with the legal requirement. Where legally permissible, the Operator will notify the affected Player of such a disclosure request.

6.3 No Sale of Data

bpxeah does not sell, rent, trade or otherwise transfer Personal Data to any third party for their independent commercial or marketing purposes. This prohibition is absolute and applies regardless of the compensation offered by any third party.

7 Data Retention

bpxeah retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Account data is retained for the duration of the Player's account and for a minimum period following account closure as required by the Operator's AML and KYC regulatory obligations under the applicable gaming license.
• Financial transaction records are retained for the period required by applicable anti-money laundering regulations, which is typically a minimum of five (5) years from the date of the transaction.
• KYC and identity verification documents are retained for the period required by applicable AML and gaming regulatory frameworks, typically five (5) years following the end of the business relationship.
• Support communications are retained for a defined period for quality assurance and dispute resolution purposes, after which they are securely deleted or anonymised.
• Marketing consent records are retained for as long as the Player remains registered and for a reasonable period following account closure to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, Personal Data is securely deleted, anonymised or pseudonymised in accordance with the Operator's data disposal procedures.

8 Data Security

bpxeah implements appropriate technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction or disclosure. These measures include, but are not limited to:

• Encryption of data in transit using TLS (Transport Layer Security) protocols.
• Encryption of sensitive data at rest using industry-standard algorithms.
• Role-based access controls limiting employee access to Personal Data to those with a legitimate operational need.
• Two-factor authentication for internal systems processing Personal Data.
• Regular security assessments and penetration testing of the Platform's infrastructure.
• Incident response procedures for detecting, reporting and responding to personal data breaches.

While bpxeah takes all reasonable steps to protect your Personal Data, no data transmission over the internet can be guaranteed as completely secure. Players are responsible for maintaining the security of their own account credentials and for not sharing login information with third parties.

9 Cookies & Tracking Technologies

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit the Platform. bpxeah uses cookies and similar tracking technologies to maintain session state, support platform functionality, prevent fraud and — where you have consented — to analyse Platform usage and personalise your experience.

9.2 Types of Cookies Used

• Strictly necessary cookies — essential for the Platform to function. These cannot be disabled without significantly impairing your ability to use the Platform. No consent is required for these cookies.
• Functional cookies — remember your preferences such as language settings and currency display.
• Analytics cookies — collect anonymised or pseudonymised data about how Players interact with the Platform, used to improve performance. These are deployed only with your consent.
• Security cookies — detect and prevent fraudulent activity and unauthorised access attempts.

9.3 Cookie Control

You can control or delete cookies through your browser settings at any time. Disabling all cookies may impair Platform functionality, including login persistence and session security. Consent-based cookies can be managed through the Platform's cookie consent interface where applicable.

10 Your Data Subject Rights

Subject to the applicable data protection laws and regulatory obligations under the Operator's license jurisdiction, you may have the following rights in relation to the Personal Data bpxeah holds about you:

10.1 Right of Access

You have the right to request confirmation of whether bpxeah processes Personal Data about you and, if so, to receive a copy of that data together with information about the purposes of processing, the categories of data processed and the recipients of the data.

10.2 Right to Rectification

You have the right to request correction of inaccurate Personal Data or completion of incomplete Personal Data held by bpxeah.

10.3 Right to Erasure

You may request deletion of your Personal Data in circumstances where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent (where consent was the processing basis) or where you object to processing based on legitimate interests. This right is subject to overriding legal or regulatory retention obligations — in particular, AML and KYC records cannot be deleted before their regulatory retention period has expired.

10.4 Right to Restrict Processing

You have the right to request that bpxeah restricts the processing of your Personal Data in defined circumstances, including where the accuracy of the data is contested or where you have objected to processing and the Operator is assessing whether its legitimate interests override your rights.

10.5 Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used and machine-readable format.

10.6 Right to Object

You have the right to object at any time to processing of your Personal Data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case the Operator will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

10.7 How to Submit a Rights Request

To exercise any of the rights listed above, please contact the bpxeah Data Protection team using the contact details provided in Section 15 of this Policy. The Operator will respond to verified requests within the timeframe required by the applicable data protection framework. Identity verification may be required before a request is processed.

11 Minors & Age Verification

The Platform is strictly restricted to adults aged 18 years or above, or the higher minimum age required by the applicable gaming license jurisdiction. bpxeah does not knowingly collect or process Personal Data relating to individuals under the required minimum age.

Age verification is conducted as part of the KYC process. Where the Operator has reasonable grounds to believe that a registered Player is under the required minimum age, the Account will be suspended immediately pending verification. If underage use is confirmed, the Account will be permanently closed and any balance held in the Account will be returned subject to the Operator's verification procedures — no gambling winnings will be paid out.

12 Third-Party Services & Payment Providers

The Platform may reference payment services familiar to Pakistani users — including mobile wallets commonly used across cities such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar — solely in the context of payment method guidance. None of these services (including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah) are data processors appointed by bpxeah, nor do they have any role in the collection or processing of your bpxeah account data. These providers are independent entities operating under their own separate privacy policies and terms of service.

When you initiate a deposit or withdrawal using one of these services, your financial data is processed by that provider under their own data governance framework. bpxeah receives only the transaction reference information necessary to confirm receipt or dispatch of funds. Players are encouraged to review the applicable payment provider's privacy policy before initiating transactions.

13 International Data Transfers

As an internationally operated platform, bpxeah's data processing activities may involve the transfer of Personal Data to third-party service providers located in jurisdictions outside Pakistan. Where Personal Data is transferred internationally, bpxeah implements appropriate safeguards — such as contractual data protection clauses or equivalent mechanisms — to ensure that the transferred data continues to receive an adequate level of protection consistent with the obligations set out in this Policy.

By registering and using the Platform, Players acknowledge that their Personal Data may be processed in jurisdictions outside Pakistan. If you have questions about the specific transfer mechanisms applicable to your data, please contact the data protection contact details provided in Section 15.

14 Changes to This Privacy Policy

bpxeah reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, operational practices or Platform functionality. Where amendments are material, the Operator will provide advance notice via the email address registered on your Account or by way of a prominent notice on the Platform prior to the effective date of the change.

The "Effective Date" at the top of this Policy indicates when the current version came into force. Continued use of the Platform after the effective date of any updated Policy constitutes acceptance of the revised terms. Players who do not agree with the amended Policy should cease using the Platform and request account closure before the effective date.

15 Contact Us — Data Protection Queries

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or want to raise a concern about how bpxeah processes your Personal Data, please contact the support team using the details below: