bpexh Privacy Policy

1. Who We Are

1.1 This Privacy Policy is issued by bpexh ("we", "us", "our", "the Company"), the operator of the online gaming and sports betting platform accessible at bpexh.pro. bpexh operates under an internationally recognised gaming licence and provides its services to eligible players globally, with a dedicated focus on the Pakistani market.

1.2 For the purposes of data protection law, bpexh acts as the data controller in respect of the personal information collected through the bpexh platform. This means we determine the purposes for which, and the manner in which, your personal data is processed.

1.3 This Privacy Policy applies to all personal data collected through the bpexh website, any associated mobile-optimised layouts, account management portals, customer support channels, and any other services operated by or on behalf of bpexh. It applies to all registered players, prospective players, and visitors to the platform.

1.4 This policy should be read alongside the bpexh Terms and Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Data We Collect

2.1 bpexh collects the following categories of personal data from players and platform visitors:

2.2 We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where this arises incidentally through responsible gaming assessments or as required by our licensing obligations.

3. How We Collect Your Data

3.1 Directly From You

The majority of personal data bpexh holds about you is provided directly by you at the point of registration, during KYC verification, when you make deposits or withdrawals, when you configure your account settings, or when you communicate with our support team via live chat or email.

3.2 Automatically Through Platform Use

When you access the bpexh platform, our systems automatically collect certain technical data including your IP address, device fingerprint, browser type, and session activity logs. This data is collected using cookies, session tokens, and server-side logging systems. Please refer to Section 8 for full details of our cookie usage.

3.3 From Third-Party Verification Providers

Where you submit identity documents for KYC verification, our approved third-party identity verification provider will return a verification result and associated data extract to bpexh. We may also receive fraud risk signals from payment processors in connection with deposit and withdrawal activity.

3.4 From Publicly Available Sources

In connection with fraud prevention and responsible gaming obligations, bpexh may cross-reference information you have provided against publicly available sources, including sanctions lists, politically exposed persons (PEP) databases, and self-exclusion registers maintained by licensed gaming regulators.

4. How We Use Your Data

bpexh uses the personal data it collects for the following specific purposes:

• Account creation and management: to register your bpexh account, maintain your player profile, and provide you with access to all platform features;
• Identity verification (KYC): to confirm your age (21+ requirement), verify your identity, and satisfy our licensing obligations regarding player due diligence;
• Payment processing: to process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and bank transfer, and to maintain accurate financial records;
• Gaming operations: to record bet history, calculate and pay winnings, manage bonus eligibility and wagering requirements, and maintain game integrity;
• Customer support: to respond to your queries, resolve disputes, and maintain a history of support interactions;
• Fraud prevention and security: to detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited conduct;
• Responsible gaming: to monitor gaming patterns, enforce player-set limits, process self-exclusion requests, and identify players who may be experiencing gambling-related harm;
• Marketing communications: where you have opted in, to send you promotional offers, bonus notifications, PSL betting alerts, and platform updates via your preferred channel;
• Legal and regulatory compliance: to meet our obligations under applicable gaming licensing conditions, anti-money laundering regulations, and data protection law.

5. Legal Basis for Processing

5.1 bpexh processes your personal data only where a valid legal basis exists under applicable data protection law. The legal bases on which we rely are as follows:

• Performance of a contract: processing your identity, contact, financial, and gaming data is necessary to operate your bpexh account and provide the services you have signed up for;
• Compliance with a legal obligation: processing for KYC verification, anti-money laundering checks, responsible gaming monitoring, and regulatory reporting is required by our licensing conditions;
• Legitimate interests: processing for fraud prevention, platform security, and service improvement is carried out on the basis of our legitimate interest in protecting the integrity of the bpexh platform and the interests of all players, provided that interest is not overridden by your fundamental rights;
• Consent: processing for marketing communications is carried out only where you have given freely informed, specific, and unambiguous consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Sharing Your Data

6.1 bpexh does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own marketing or commercial purposes. Your data is shared only in the following limited and controlled circumstances:

• KYC and identity verification providers: regulated third-party services that verify your identity documents and return a verification result to bpexh;
• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and inter-bank transfer processors who facilitate your PKR transactions;
• Game content providers: licensed casino game suppliers who provide the software infrastructure for live casino, slots, crash games, and other gaming products accessible on bpexh;
• Fraud prevention and AML services: services that screen transactions and player profiles against sanctions lists, PEP databases, and known fraud patterns;
• Regulatory and licensing authorities: where disclosure is required by our gaming licence conditions, a lawful regulatory request, or a court order;
• Professional advisers: auditors, legal advisers, and insurance providers, subject to binding confidentiality obligations.

6.2 All third parties who receive personal data from bpexh are required to process that data only for the specified purpose, to maintain adequate security measures, and to comply with applicable data protection obligations. We do not permit them to use your data for their own independent purposes.

7. Payment Data & KYC

7.1 bpexh does not store full payment credentials such as complete bank account numbers or mobile wallet PINs on our own servers. Financial data is transmitted directly to and stored by our licensed payment processing partners using payment-industry-standard encryption and tokenisation.

7.2 As part of our KYC process, you will be required to submit copies of government-issued identification (CNIC or passport) and proof of your payment method. These documents are processed by our approved identity verification provider and a verification result is returned to bpexh. Submitted documents are stored securely and retained only for the period required by our licensing obligations.

7.3 bpexh will never ask you to send identity documents via unencrypted email or messaging applications. All KYC document submissions must be made through the secure document upload portal within your bpexh account. If you receive a request for documents through any other channel, please contact support immediately.

8. Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the bpexh platform. They allow us to recognise your device, maintain your session, remember your preferences, and analyse how the platform is used.

8.2 Types of Cookies We Use

• Strictly necessary cookies: essential for the platform to function. These include session authentication cookies that keep you logged in to your bpexh account. These cannot be disabled without preventing access to core platform functionality.
• Functional cookies: remember your preferences such as language, currency display settings, and responsible gaming tool configurations.
• Analytics cookies: collect anonymised information about how players navigate the bpexh platform — which pages are visited most, where sessions originate, and how long players spend in different sections. This data is used to improve the platform experience.
• Security cookies: used for fraud detection and bot prevention, including session fingerprinting tokens that help us identify suspicious access patterns.

8.3 Managing Cookies

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using bpexh, but may affect certain platform personalisation features. Note that disabling strictly necessary cookies will prevent you from logging in or maintaining a session on the platform.

9. Data Retention

9.1 bpexh retains your personal data for as long as your account remains active and for such additional period as is required by our licensing obligations and applicable law. In general terms, the following retention periods apply:

• Account and identity data: retained for the duration of your account and for a minimum of five years following account closure, in accordance with standard anti-money laundering record-keeping requirements;
• Financial transaction records: retained for a minimum of five years from the date of the transaction;
• Gaming history: retained for the duration of your account and for a minimum of three years following account closure;
• Support communications: retained for two years from the date of the last interaction;
• Marketing preference records: retained for the duration of your account; opt-out records are retained indefinitely to prevent inadvertent re-subscription.

9.2 Where retention is based solely on our legitimate interests and no legal obligation requires continued retention, we will delete or anonymise your personal data once that interest no longer applies.

10. Your Privacy Rights

10.1 Subject to applicable law and our legitimate processing interests, you have the following rights in respect of your personal data held by bpexh:

• Right of access: you may request a copy of all personal data bpexh holds about you, free of charge, within 30 days of your request;
• Right to rectification: if any personal data we hold about you is inaccurate or incomplete, you have the right to request correction;
• Right to erasure: you may request deletion of your personal data where retention is no longer necessary for the purpose it was collected, subject to our legal retention obligations;
• Right to restrict processing: you may request that we limit how we use your data while a complaint or correction request is being assessed;
• Right to data portability: where processing is based on consent or contract, you may request a machine-readable copy of your data for transfer to another controller;
• Right to withdraw consent: where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time with immediate effect;
• Right to object: you may object to processing carried out on the basis of legitimate interests, including profiling, where your individual circumstances override our interests.

10.2 To exercise any of the above rights, please contact our support team via live chat or email at [email protected]. We will respond within 30 days of receiving a verified request. We may ask you to verify your identity before processing a rights request.

11. Children & Minors

11.1 bpexh strictly prohibits persons under the age of 21 from registering an account or participating in any real-money gaming activity on the platform. Our platform is intended exclusively for adults aged 21 and over.

11.2 We do not knowingly collect personal data from individuals under the age of 21. If bpexh discovers or is informed that an account has been registered by a person under the minimum age, that account will be immediately closed, all balances will be handled in accordance with our Terms and Conditions, and all associated personal data will be deleted unless retention is required by law.

11.3 If you believe that a minor in your household has accessed or registered on the bpexh platform, please contact our support team immediately at [email protected]. We take underage gambling extremely seriously and will act promptly on all such reports.

12. Security Measures

12.1 bpexh implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and bpexh servers;
• AES-256 encryption for sensitive personal and financial data stored at rest;
• Role-based access controls ensuring that only authorised personnel with a legitimate need can access player data;
• Two-factor authentication requirements for all bpexh administrative staff accounts;
• Regular independent security audits and penetration testing of the bpexh platform;
• Automated anomaly detection systems that flag unusual access patterns or data exfiltration attempts;
• Formal data breach response procedures with regulatory notification timelines.

12.2 In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, bpexh will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

13. International Data Transfers

13.1 bpexh is an internationally operated platform and some of your personal data may be transferred to and processed in countries outside Pakistan. This may occur when our third-party KYC providers, game content suppliers, or technical infrastructure providers process data on our behalf from servers located outside Pakistan.

13.2 Where such international transfers occur, bpexh ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection law. These safeguards may include standard contractual clauses, binding corporate rules, or adequacy determinations by the relevant regulatory authority.

13.3 By registering a bpexh account, you acknowledge that your personal data may be transferred internationally in the manner described in this section, subject to the protections outlined above.

14. Changes to This Privacy Policy

14.1 bpexh reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The effective date at the top of this document will be updated each time a revision is made.

14.2 Where a change to this Privacy Policy materially affects how we process your personal data or reduces your rights, we will notify registered players via their registered email address at least 14 days before the change takes effect. For non-material updates, the revised policy will be posted on this page with an updated effective date.

14.3 We encourage you to review this Privacy Policy periodically. Continued use of the bpexh platform following the posting of a revised Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with a material change, you may close your account and request deletion of your data as described in Section 10.

15. Contact & Complaints

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way bpexh handles your personal data, please contact our support team through the following channels:

• Live Chat: available 24/7 directly from any page on the bpexh platform — average response time under 5 minutes;
• Email: [email protected] — please allow up to 24 hours for email responses outside of peak hours.

15.2 When contacting us regarding a privacy matter, please include your registered account username, the nature of your request or concern, and any relevant context that will help us respond accurately and promptly. We will acknowledge all privacy-related requests within 5 business days and aim to resolve them fully within 30 days.

15.3 If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the data protection supervisory authority in the jurisdiction relevant to our gaming licence, or to seek independent legal advice.