10win Privacy Policy — How We Protect Your Personal Data

This Privacy Policy describes how 10win ("we", "us", "our") collects, uses, stores, and protects the personal data of individuals who access or use the 10win Platform at https://10win.lol ("Platform"). It applies to all Users who register an account, visit the Platform, contact our support team, or interact with any 10win service.

This Privacy Policy should be read together with 10win's Terms & Conditions. Terms defined in the Terms & Conditions carry the same meaning here unless otherwise specified. By using the 10win Platform, you confirm that you have read and understood this Privacy Policy.

This policy was last updated on 1 January 2026. Any future revisions will be communicated to registered Users in advance of the revised policy taking effect, as described in Section 15.

For the purposes of applicable data protection law, the data controller responsible for the personal data of 10win Users is the entity operating the 10win Platform under its international gaming licence. The 10win Platform is operated by the 10win brand entity incorporated under the jurisdiction of its gaming licence.

The 10win brand serves Pakistani users at https://10win.lol. All data processing described in this Privacy Policy is carried out by or on behalf of this entity. References to "10win," "we," "us," or "our" throughout this Policy refer to this data controller entity.

You can contact the 10win data controller at any time regarding your personal data. Contact information is provided in Section 16 of this Policy.

10win collects the following categories of personal data from Users:

10win does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data (other than responsible gaming-related information), or biometric data, except where strictly required to comply with regulatory obligations.

10win collects personal data through the following methods:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion.
• Automatically: When you access the 10win Platform, we automatically collect technical data through server logs, cookies, and similar technologies, including your IP address, device characteristics, and browsing behaviour on the Platform.
• From third-party payment providers: When you use JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank to transact with your 10win account, we receive confirmation data from the relevant payment provider to validate the transaction.
• From identity verification providers: Where 10win uses a third-party KYC service to verify your identity documents, we receive the verification result and associated identity data from that provider.
• From game providers: When you play games on the 10win Platform, game providers (such as Evolution Gaming, Pragmatic Play, and others) may pass session and result data back to 10win's systems for record-keeping and auditing purposes.

10win uses the personal data it collects for the following purposes:

• Account management: Creating, maintaining, and administering your 10win account, including authentication and account security.
• Payment processing: Processing deposits and withdrawals via JazzCash, EasyPaisa, and other supported Pakistani payment methods in PKR.
• Identity verification (KYC): Verifying your identity and age to comply with anti-money laundering (AML) and gaming licence requirements, and to confirm that you are 21 years of age or older.
• Regulatory compliance: Meeting obligations imposed by 10win's international gaming licence, including transaction monitoring, suspicious activity reporting, and record-keeping.
• Customer support: Responding to queries, resolving disputes, and communicating important account information via live chat, email, or SMS.
• Responsible gaming: Monitoring gaming activity for indicators of problematic behaviour and administering deposit limits, cool-off periods, and self-exclusion in accordance with your instructions and our responsible gaming obligations.
• Fraud and security: Detecting, preventing, and investigating fraudulent transactions, multi-accounting, bonus abuse, and other prohibited activities.
• Platform improvement: Analysing aggregated, anonymised usage data to improve the performance, design, and game selection of the 10win Platform.
• Marketing: Sending promotional communications where you have opted in to receive them. See Section 13 for details on managing marketing preferences.

10win processes your personal data only where we have a lawful basis to do so. The applicable legal bases are:

• Contract performance: Processing necessary to provide the 10win gaming service to you under the Terms & Conditions you have agreed to — including account setup, gaming, and payment processing.
• Legal obligation: Processing required to comply with 10win's international gaming licence obligations, including KYC, AML monitoring, and record-keeping requirements imposed by our licencing authority.
• Legitimate interests: Processing for fraud prevention, platform security, and general platform improvement, where our interests do not override your fundamental privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

10win does not sell your personal data. We share personal data with third parties only in the following circumstances and only to the extent necessary:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and any other payment processors used to facilitate deposits and withdrawals to your 10win account. These providers receive only the data necessary to complete the transaction.
• Game providers: Licensed game providers (such as Evolution Gaming, Pragmatic Play, Ezugi, and others) whose games are hosted on the 10win Platform receive session identifiers and wager data necessary to deliver and record gameplay.
• Identity verification providers: Third-party KYC and identity document verification services engaged by 10win to confirm the identity and age of registered Users in compliance with licensing requirements.
• Regulatory and law enforcement authorities: Where required by law, court order, or our gaming licence obligations, 10win may disclose personal data to relevant regulatory bodies, law enforcement agencies, or financial intelligence units.
• Technology and infrastructure providers: Cloud hosting, data storage, cybersecurity, and analytics service providers who process data strictly on 10win's instructions and are bound by appropriate data processing agreements.
• Professional advisers: Legal, accounting, and auditing professionals who provide services to 10win and are subject to professional confidentiality obligations.

10win operates under an international gaming licence and some of the third-party service providers used by 10win — including cloud infrastructure and game providers — may be located outside Pakistan. Where personal data is transferred outside Pakistan to a third country, 10win ensures that appropriate safeguards are in place to protect the data in transit and in storage.

Such safeguards may include standard contractual clauses approved by relevant data protection authorities, binding corporate rules applicable to the recipient entity, or transfers to countries recognised as providing an adequate level of data protection equivalent to the standards upheld by 10win's licensing jurisdiction.

If you wish to obtain further information about the specific safeguards applied to any international transfer of your personal data, please contact 10win's data privacy team at the address provided in Section 16 of this Policy.

10win uses cookies and similar tracking technologies on the Platform to enhance functionality, maintain session security, and — where you have consented — to understand how Users interact with the Platform to guide improvements.

You may manage your cookie preferences at any time via the cookie settings panel available on the 10win Platform. Withdrawing consent for non-essential cookies will not affect your ability to use the core 10win gaming platform.

10win retains personal data only for as long as is necessary for the purposes for which it was collected, subject to any longer retention periods required by law or regulatory obligation.

• Active account data: Retained for the duration of your account and for 5 years following account closure, in compliance with AML record-keeping requirements under 10win's gaming licence.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction in accordance with financial crime prevention obligations.
• KYC documentation: Retained for 5 years from the date of verification or account closure, whichever is later.
• Gaming activity logs: Retained for a minimum of 3 years to support dispute resolution and regulatory audit requirements.
• Support communications: Retained for 2 years following the resolution of the relevant query or complaint.
• Marketing consent records: Retained from the date consent is given until withdrawn, plus 12 months thereafter.

At the end of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an individual User.

As a 10win User, you have the following rights in relation to your personal data. You may exercise any of these rights by contacting 10win's support team as described in Section 16.

The 10win Platform is strictly intended for persons who are 21 years of age or older. 10win does not knowingly collect, use, or retain personal data from individuals under the age of 21. If we discover or are informed that a User is under 21, we will immediately close the relevant account, delete or anonymise the associated personal data (subject to any minimal records required by law), and return any Real Money Funds deposited.

If you believe that a person under the age of 21 has registered an account with 10win, please contact our support team immediately at the details provided in Section 16. We take this matter extremely seriously and will act promptly on any such report.

Parents and guardians are encouraged to use parental control software and to discuss responsible internet use with young people in their household, including the importance of not accessing real-money gaming platforms.

10win may send you promotional communications about new games, bonuses, PSL cricket betting offers, and other 10win services via email or SMS, where you have opted in to receive such communications at the time of registration or through your Account Settings.

You may unsubscribe from marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email received from 10win.
• Replying "STOP" to any marketing SMS received from 10win.
• Updating your marketing preferences in your 10win Account Settings under the Notifications section.
• Contacting our support team via live chat with an opt-out request.

Unsubscribing from marketing communications does not affect 10win's ability to send you transactional communications that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, account security alerts, and regulatory notices.

10win implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and 10win's servers.
• Encryption at rest for all sensitive personal data and financial records stored on 10win's infrastructure.
• Role-based access controls ensuring that 10win staff can only access personal data relevant to their specific job function.
• Two-Factor Authentication (2FA) available to all Users for their own account security, and mandatory for all 10win administrative staff.
• Regular third-party security audits and penetration testing to identify and remediate vulnerabilities in 10win's infrastructure.
• Intrusion detection and DDoS protection systems to identify and respond to active threats to the Platform.
• Staff training on data protection, information security, and phishing awareness conducted regularly for all 10win employees with access to personal data.

Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with 10win is no longer secure, please notify us immediately via live chat.

10win reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered Users via email and/or a prominent notice on the 10win Platform at least 14 days before the revised policy takes effect.

Non-material changes — such as clarifications of existing practice, typographical corrections, or administrative updates — may be made without advance notice. The "Effective" date at the top of this Policy will be updated to reflect the most recent revision date.

Your continued use of the 10win Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the revised policy. If you do not agree with the revised Privacy Policy, you should close your account before the revised policy takes effect by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how 10win has handled your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly on the 10win Platform. Our Urdu and English support agents can assist with basic privacy queries and forward formal requests to our data privacy team.
• Email: [email protected] — please include "Privacy Request" in the subject line. We aim to acknowledge all privacy-related emails within 24 hours and respond substantively within 30 days.

Please note that to protect your privacy, we may need to verify your identity before processing any request relating to your personal data. This is to ensure that personal data is only disclosed to or deleted at the request of the actual account holder.