This Privacy Policy explains how bpxchg collects, uses, stores and protects your personal data when you use the Platform. It also sets out your rights as a data subject and how to exercise them. Please read this document carefully alongside our Terms & Conditions.
Identity information, contact details, KYC documents (such as your CNIC or passport), transaction records, betting activity and device/browser data necessary to operate your account securely.
Account operation, identity verification (KYC/AML), regulatory compliance, fraud prevention, responsible gambling monitoring, customer support and, where you consent, promotional communications.
Third-party service providers essential to operating the Platform — identity verification partners, payment processors, IT infrastructure providers and, where legally required, regulatory or law enforcement bodies.
Subject to applicable law: right to access, rectify, erase, restrict processing, data portability and the right to object. You may exercise these rights by contacting the support team.
The Platform uses essential, functional, analytics and (where consented) marketing cookies. You can manage cookie preferences through your browser settings or the Platform's cookie control centre.
Personal data is retained for as long as your account is active and for a minimum period thereafter as required by applicable AML and regulatory obligations. Retention periods vary by data category.
bpxchg ("the Operator", "we", "us", "our") is the operator of the online sports betting and casino platform accessible at bpxchg.cam (the "Platform"). We are committed to protecting the personal data of every individual who uses our services, and to being transparent about how that data is handled.
This Privacy Policy (the "Policy") describes our practices with respect to the collection, processing, storage, disclosure and protection of personal data when you access or use the Platform, register an account, place bets or wagers, interact with our customer support team, or engage with promotional communications.
This Policy should be read alongside our Terms & Conditions. By using the Platform or creating an account, you acknowledge that you have read and understood this Policy and agree to the processing of your personal data as described herein.
The following terms carry the meanings set out below throughout this Policy:
| Term | Meaning |
|---|---|
| Personal Data | Any information that identifies or can reasonably be used to identify a living individual, directly or indirectly — including name, email address, device identifiers, IP address, transaction records and identity documents. |
| Processing | Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure or destruction. |
| Data Controller | The entity that determines the purposes and means of Processing Personal Data. For the Platform, the Data Controller is bpxchg as identified in Section 3. |
| Data Processor | A third party that processes Personal Data on behalf of the Data Controller under a contractual arrangement — such as KYC verification partners or cloud infrastructure providers. |
| Sensitive Data | Categories of Personal Data requiring heightened protection, including identity document scans (CNIC, passport), financial records, and information relating to health where relevant to responsible gambling assessments. |
| User / you | Any individual who accesses or uses the Platform, including registered account holders and unregistered visitors. |
| KYC Data | Identity and age-verification information collected as part of the Know Your Customer process, including CNIC, passport, proof of address and liveness/selfie data. |
| Consent | A freely given, specific, informed and unambiguous indication of agreement to a specified Processing activity, such as opting in to marketing communications. |
The Data Controller responsible for your Personal Data in connection with the Platform is bpxchg, the operator of bpxchg.cam. Contact details for data-related enquiries are provided in Section 17 of this Policy.
Where the Operator engages third-party Data Processors — for example, identity verification providers or cloud hosting services — those processors are bound by contractual obligations that require them to process your Personal Data only in accordance with the Operator's instructions and to maintain appropriate technical and organisational security measures.
We collect Personal Data in the following categories, depending on how you interact with the Platform:
The Operator processes Personal Data under one or more of the following legal bases, depending on the purpose of processing:
| Legal Basis | Examples of Use |
|---|---|
| Contractual Necessity | Processing required to operate your account, execute deposits and withdrawals, settle bets and provide customer support under the Terms & Conditions. |
| Legal Obligation | KYC identity verification, AML transaction monitoring, age verification, record-keeping for regulatory compliance and responding to lawful authority requests. |
| Legitimate Interests | Fraud detection and prevention, platform security, responsible gambling monitoring and analysis, service improvement and business analytics — balanced against the rights and freedoms of Users. |
| Consent | Marketing communications via email or SMS where you have explicitly opted in; non-essential cookies and tracking technologies where your consent has been obtained through the cookie preference centre. |
We use your Personal Data for the following purposes:
Identity documents submitted for KYC purposes — including CNIC copies, passport copies, selfie images and proof-of-address documents — are treated as Sensitive Data and subject to heightened handling standards:
The Operator does not sell your Personal Data to third parties. We may share your Personal Data with the following categories of recipients, strictly on a need-to-know basis and under binding data-sharing agreements:
| Recipient Category | Purpose | Basis |
|---|---|---|
| KYC / Identity Verification Providers | Processing CNIC, passport and liveness data to verify identity and age | Legal obligation; contractual necessity |
| Payment Processing Partners | Facilitating deposits and withdrawals; payment method references include Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah and crypto processors (context only) | Contractual necessity |
| Cloud Infrastructure & IT Providers | Hosting Platform data; database operations; backup and disaster recovery | Legitimate interests; contractual necessity |
| Fraud & Security Services | IP analysis, device fingerprinting, transaction screening for fraud and AML | Legal obligation; legitimate interests |
| Customer Support Software | Live Chat, ticket management and Help Centre platforms used to deliver support | Contractual necessity |
| Analytics Providers | Pseudonymised platform-usage analytics to improve user experience | Legitimate interests (anonymised/pseudonymised) |
| Regulatory & Law Enforcement Bodies | Disclosure required by applicable law, court order or lawful regulatory authority request | Legal obligation |
Where payment method providers such as Easypaisa, JazzCash, Raast or banks including HBL, UBL, Meezan Bank and Bank Alfalah are referenced in transaction data, this reflects the payment method used by the User and does not imply any formal partnership, endorsement of gambling, or data-sharing agreement beyond what is strictly necessary to process the transaction.
The Operator may transfer Personal Data to processors or infrastructure located outside of Pakistan and outside of the European Economic Area (EEA). Where such transfers occur, the Operator takes steps to ensure that appropriate safeguards are in place — such as contractual clauses that impose data protection obligations on the receiving party equivalent to those applied by the Operator.
For Pakistani users, the Operator notes that there is currently no dedicated comprehensive data-protection legislation in Pakistan equivalent to the EU General Data Protection Regulation (GDPR) or the UK Data Protection Act 2018. The Operator nonetheless endeavours to apply standards of reasonable care in the protection of your Personal Data that reflect widely accepted international data-protection principles, including purpose limitation, data minimisation, storage limitation and the right of access.
Personal Data is retained for the minimum period necessary to fulfil the purpose for which it was collected, or for such longer period as is required by applicable law or regulatory obligation. The following indicative retention periods apply:
| Data Category | Indicative Retention Period | Basis |
|---|---|---|
| Account & Registration Data | Duration of account plus minimum 5 years after closure | AML obligations; legal obligation |
| KYC & Identity Documents | Minimum 5 years from account closure or last transaction | AML / regulatory requirement |
| Transaction & Financial Records | Minimum 5 years from the date of the transaction | AML / regulatory requirement |
| Betting & Game Activity Logs | Minimum 2 years; up to 5 years for dispute-related records | Contractual; legal obligation |
| Support & Complaint Records | 3 years from resolution of the support interaction | Legitimate interests; legal obligation |
| Marketing Consent Records | Until consent is withdrawn plus a further 1 year for records | Consent; legal obligation |
| Technical / Device Logs | Up to 12 months on a rolling basis | Legitimate interests (security) |
Upon expiry of applicable retention periods, Personal Data will be securely deleted, anonymised or archived in a manner that prevents re-identification, depending on the data type and applicable technical constraints.
The Platform uses cookies and similar tracking technologies to operate core functions, analyse usage patterns and, where you have consented, deliver personalised content and marketing. A cookie is a small text file stored on your device when you visit a web page. The Operator uses the following categories of cookies:
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Session management, authentication tokens, security checks, load balancing and core Platform functionality. Cannot be disabled without breaking the Platform. | No — strictly necessary | |
| Remembering language preference, PKR currency setting, responsible gambling tool configurations and notification preferences. | Generally no — facilitates user experience | |
| Pseudonymised tracking of page views, session duration, navigation paths and feature usage to understand how the Platform is used and where improvements can be made. | Yes — via cookie preference centre | |
| Tracking advertising campaign performance and, where you have opted in to marketing, serving relevant promotional content. Marketing cookies are not used without explicit consent. | Yes — requires opt-in consent |
You may manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies; however, disabling essential cookies may prevent certain parts of the Platform from functioning correctly. For analytics and marketing cookies, you can withdraw consent at any time through the Platform's cookie preference centre.
Subject to applicable law and the Operator's regulatory obligations — including obligations that may require retention of data for AML or legal purposes even where a deletion request is made — you have the following rights with respect to your Personal Data:
Request a copy of the Personal Data we hold about you, including the categories of data, purposes of processing and any third parties with whom it has been shared.
Request correction of inaccurate or incomplete Personal Data held on your account — for example, a name misspelling or an outdated address.
Request deletion of your Personal Data where it is no longer necessary for its original purpose, where you withdraw consent, or where you object to processing. This right is subject to retention obligations that may override a deletion request.
Request temporary restriction of processing while a rectification request or objection is being assessed, or where processing is unlawful but you prefer restriction to erasure.
Where processing is based on consent or contractual necessity, receive your Personal Data in a structured, machine-readable format, or request that it be transmitted to another controller where technically feasible.
Object to processing based on legitimate interests — including profiling — where your particular circumstances mean that the Operator's interests are overridden by your rights. You may also object at any time to direct marketing communications.
To exercise any of these rights, please contact the support team through the Platform's Help Centre or at the email address provided in Section 17. The Operator will respond within a reasonable timeframe and, in any event, within the period required by applicable law. The Operator reserves the right to verify your identity before processing a data rights request to prevent unauthorised access to another person's data.
The Operator implements appropriate technical and organisational security measures to protect Personal Data against unauthorised access, loss, disclosure, alteration or destruction. These measures include, without limitation:
Notwithstanding the above, no method of data transmission over the internet is completely secure. The Operator cannot guarantee absolute security of Personal Data transmitted to the Platform, and Users accept this inherent risk when transmitting data online.
The Platform is strictly intended for adults aged 18 years or older — or such higher minimum age as is required by applicable law or the Operator's licence jurisdiction, whichever is the greater. The Operator does not knowingly collect Personal Data from individuals below the applicable minimum age.
Where the Operator discovers or has reasonable grounds to believe that Personal Data has been submitted by or on behalf of a person below the minimum permitted age, it will: immediately suspend the relevant account; delete or securely isolate the personal data associated with that account pending confirmation of age; and return any deposits made, after deduction of any amounts already paid out, in accordance with the Terms & Conditions.
Age verification through the KYC process is the primary mechanism by which the Operator enforces its minimum-age policy. Users are reminded that providing false information about their age during registration is a breach of the Terms & Conditions and may constitute fraud under applicable law.
bpxchg may send you promotional emails, bonus notifications, sports-event alerts and other marketing communications relating to the Platform's own products and services — but only where you have given explicit, informed consent to receive such communications.
Your consent to receive marketing communications may be given or withdrawn at any time through your account's notification preferences settings, or by following the unsubscribe link included in any marketing email. Withdrawal of marketing consent does not affect the lawfulness of any processing carried out prior to the withdrawal.
The Operator does not sell, rent or otherwise transfer your contact information to third parties for marketing purposes. If you receive marketing communications purportedly from bpxchg that appear to originate from a third-party source or that you did not consent to, please report them to support immediately.
The Operator reserves the right to amend, update or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, operational practices or Platform features. Where a material change is made to this Policy, the Operator will:
Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree with a material amendment, you should cease using the Platform and may request account closure as described in the Terms & Conditions.
For any questions, concerns or requests relating to this Privacy Policy or to the processing of your Personal Data, please contact the bpxchg Data team through any of the following channels:
When submitting a data-rights request, please include: (a) your full name and registered email address; (b) a clear description of the right you wish to exercise or the concern you wish to raise; and (c) any relevant reference numbers, dates or supporting context. This will allow the team to identify your account and respond efficiently.
The Operator will acknowledge data-rights requests within a reasonable timeframe and will respond substantively within the period required by applicable law. Where a request cannot be fulfilled — for example, because it conflicts with AML retention obligations — the Operator will provide a written explanation of the reason.
This Privacy Policy forms part of your agreement with bpxchg alongside our Terms & Conditions and Responsible Gambling guidelines. We recommend reading all three before using the Platform. Adults 18+ only; local laws may restrict gambling.
18+ · Adults only · Local laws may restrict gambling · Play responsibly