1. What Personal Data We Collect
The personal data 22win collects falls into several categories. Not all categories apply to every user — the data collected depends on how you use the platform and what features you access.
| Category |
Specific Data Points |
When Collected |
| Identity Data |
Full name, date of birth, CNIC number or copy |
Registration & KYC verification |
| Contact Data |
Mobile number, email address (if provided) |
Registration |
| Financial Data |
Deposit/withdrawal amounts, payment method reference IDs (not full account numbers) |
Each transaction |
| Verification Data |
CNIC image, proof of address document, selfie (KYC) |
KYC process |
| Activity Data |
Games played, bets placed, wager amounts, session durations |
Ongoing platform use |
| Technical Data |
IP address, device type, operating system, browser type, session tokens |
Each login/session |
| Communication Data |
Live Chat transcripts, support email exchanges |
When you contact support |
| Marketing Data |
Communication preferences, promotional opt-in/out status |
Account setup & settings changes |
We do not collect sensitive categories of data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data beyond what is required for standard identity verification.
2. How We Collect Your Data
22win collects data through three main channels:
- Directly from you: When you complete the registration form, submit KYC documents, contact support, update your account settings, or respond to any request from the 22win team. This is the primary source of the personal data we hold.
- Automatically through your use of the platform: Technical data — IP addresses, device fingerprints, session timestamps, pages visited, games opened — is logged automatically whenever you access the 22win website or mobile platform. This is standard practice across all online services and is used for security monitoring, fraud detection, and platform performance optimisation.
- From third-party sources: Our payment processors (Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, card networks) confirm transaction status and provide reference identifiers. Our fraud detection partners may share flagging information about device or account behaviour patterns associated with known fraudulent activity. We do not receive raw payment credentials from these sources — only transaction confirmation and reference data.
If you use a referral link to register, the referring player's account ID is logged alongside your registration record so that the referral reward can be processed correctly. No personal details about the referring player are shared with you, and no personal details about you are shared with the referring player beyond confirmation that a qualifying registration and deposit was made.
3. How We Use Your Data
22win uses your personal data for the following purposes, each of which has a lawful basis:
- Account management: Creating and maintaining your account, processing login requests, enforcing the one-account-per-person rule, and communicating account-related information to you.
- Transaction processing: Receiving deposits, initiating withdrawals, crediting bonuses, and maintaining accurate financial records for your account. Payment data is also used to satisfy our anti-money laundering record-keeping obligations.
- Identity verification (KYC): Verifying that you meet the 18+ age requirement and that your identity matches the payment methods you use. KYC is both a regulatory obligation and a fraud prevention measure that protects all players on the platform.
- Security and fraud prevention: Monitoring session behaviour, device fingerprints, and transaction patterns for indicators of fraud, money laundering, bonus abuse, multi-accounting, and other prohibited activities. Technical data is the primary input for this monitoring.
- Customer support: Using your contact history, account data, and transaction records to investigate and resolve support queries, bet settlement disputes, and payment issues accurately and fairly.
- Platform improvement: Aggregated, anonymised activity data (games played, features used, session patterns) is analysed to understand how the platform performs and where improvements should be prioritised. This analysis does not identify individual players.
- Legal compliance: Retaining records as required by applicable financial, anti-money laundering, and consumer protection regulations. Disclosing information to law enforcement or regulatory bodies when legally required to do so.
- Marketing communications (with consent): Sending promotional offers, bonus notifications, and platform updates to players who have opted in. You can opt out at any time via account settings or by contacting support.
No automated decision-making with legal effect. 22win does not use fully automated decision-making processes that would produce a legally significant outcome for you without human oversight. Fraud flags triggered by automated monitoring are reviewed by a human team member before any account action is taken.
4. Who We Share Your Data With
22win does not sell your personal data. We share data only in the following circumstances and only to the extent necessary:
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank network operators, and card processors receive the payment initiation data required to execute your transactions. Each of these providers operates under their own privacy policy and PCI-DSS certification.
- Identity verification partners: Where automated or assisted KYC verification is used, your identity documents may be processed by a specialist verification provider. These providers are contracted to use your data exclusively for the verification purpose and to delete documents after the process is complete.
- Fraud prevention services: Device fingerprint data, IP addresses, and behavioural signals may be shared with fraud prevention platforms to identify patterns consistent with prohibited activity. No personally identifiable details such as your name or CNIC number are shared in this context — only technical identifiers.
- Legal and regulatory authorities: 22win will disclose personal data to law enforcement agencies, financial intelligence units, or courts when required to do so by a valid legal order or when we have reasonable grounds to suspect illegal activity involving your account. We will notify you of such disclosure wherever legally permitted to do so.
- Business transfers: In the unlikely event of a merger, acquisition, or sale of 22win as a business, player account data may be transferred as part of that transaction. You would be notified of any such transfer and of any change to the privacy practices applicable to your account before the transfer takes effect.
No other sharing of your personal data takes place without your explicit consent.
5. How We Secure Your Data
22win implements multiple layers of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:
- Transport security: All data transmitted between your device and 22win is encrypted using TLS 1.3 with 256-bit AES encryption. HTTP connections are automatically redirected to HTTPS and HSTS headers prevent downgrade attacks.
- Data storage: Personal data at rest is stored on encrypted servers. Database access is restricted to authorised personnel only and all access events are logged with timestamps for audit purposes.
- Payment security: 22win is PCI-DSS compliant. Card and wallet transaction data is tokenised at the point of entry. Raw card numbers, CVV codes, and full mobile wallet credentials are never stored on 22win infrastructure.
- Access controls: Internal access to personal data is restricted on a need-to-know basis. Staff accounts use multi-factor authentication and all data access by internal systems and staff is logged and periodically reviewed.
- Account security: Player accounts are protected by password hashing (bcrypt), OTP-based verification for withdrawal requests, and session token expiry after periods of inactivity.
- Incident response: 22win maintains a documented security incident response plan. In the event of a data breach that poses a material risk to players, affected users will be notified promptly along with the nature of the breach and recommended actions.
No security system is completely impenetrable. While we take every reasonable precaution to protect your data, we cannot guarantee absolute security. You can help protect your account by using a strong unique password, not sharing your login credentials, and contacting support immediately if you notice any suspicious activity on your account.
6. How Long We Keep Your Data
22win retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal obligations — whichever is longer. The following general retention periods apply:
| Data Type |
Retention Period |
Reason |
| Account registration details |
Duration of account + 5 years after closure |
Legal obligation; dispute resolution |
| Transaction records |
7 years from transaction date |
Anti-money laundering regulation |
| KYC documents |
5 years from account closure |
Financial crime prevention obligation |
| Game and bet records |
12 months active + 5 years archived |
Dispute resolution; regulatory audit |
| Support communications |
3 years from last contact |
Quality assurance; dispute evidence |
| Technical/session logs |
12 months |
Security monitoring; fraud investigation |
| Marketing preferences |
Until opt-out or account closure |
Consent management |
When data has reached the end of its retention period, it is securely deleted or anonymised so that it can no longer be associated with your identity. Where data has been anonymised (rather than deleted), it may be retained indefinitely for aggregate statistical analysis.
7. Cookies and Tracking Technologies
22win uses cookies and similar technologies (local storage, session tokens) to operate the platform, remember your session, and understand how the platform is used. Cookies are small text files stored on your device. We use the following categories:
- Essential cookies: Required for the platform to function. These maintain your login session, store your language and display preferences, and enable core features such as the betting slip and game sessions. You cannot opt out of essential cookies without disabling the platform entirely.
- Security cookies: Used to detect and prevent fraudulent activity, including CSRF protection tokens and device fingerprint data used to identify suspicious login patterns. These are not optional while your account is active.
- Analytics cookies: Anonymised tracking of page views, session durations, and feature usage to help 22win understand platform performance and prioritise improvements. Analytics data cannot be used to identify individual players. You may opt out of analytics cookies via your browser settings without affecting platform functionality.
- Referral tracking: When you access 22win via a referral link, a cookie records the referring player's identifier for the duration of your registration session. This cookie expires once your registration is complete or after 30 days, whichever comes first.
Most browsers allow you to view, manage, and delete cookies through their settings. Note that disabling essential cookies will prevent 22win from functioning correctly. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.
8. Your Data Rights
As a 22win player, you have the following rights regarding the personal data we hold about you. To exercise any of these rights, contact our support team via Live Chat or email support@22win-play.com with your registered mobile number and a description of your request.
Right of Access
Request a copy of all personal data 22win holds about you. We will provide this within 30 days in a readable format.
Right of Correction
Request correction of any inaccurate data — for example, a misspelled name or incorrect date of birth — subject to identity verification.
Right of Erasure
Request deletion of your personal data. Honoured except where retention is required by law — for example, transaction records subject to AML obligations.
Right of Portability
Request your personal data in a structured, machine-readable format (CSV or JSON) so you can transfer it to another service if you wish.
Right to Restrict Processing
Request that 22win restricts how your data is used while a dispute or investigation is pending — for example, during a complaint about data accuracy.
Right to Object
Object to the processing of your data for marketing purposes at any time. Marketing opt-outs take effect within 48 hours of the request being confirmed.
Identity verification for data requests. To protect your privacy, 22win will verify your identity before responding to any data access, correction, or deletion request. You will be asked to confirm your registered mobile number and may be asked to confirm a recent transaction amount. This verification step prevents unauthorised access to your data.
9. Children's Privacy
22win is strictly an adults-only platform. We do not knowingly collect personal data from persons under the age of 18. All registrations require confirmation that the applicant is at least 18 years old, and identity verification (KYC) is used to confirm this where there is doubt.
If 22win discovers or is notified that an account belongs to a person under 18, the account will be closed immediately, all balances forfeited, and any KYC data collected in connection with that account securely deleted beyond any data that must be retained for legal purposes.
If you are a parent or guardian and believe a person under 18 in your household has registered on 22win, contact our support team immediately at support@22win-play.com. We will investigate and take appropriate action within 24 hours of receiving your report.
Keep your account secure. If you share devices with younger family members, ensure your 22win account is protected by a strong password and that you log out after each session. 22win cannot be held responsible for access by minors resulting from a player's failure to secure their own account credentials.
10. Changes to This Privacy Policy
22win may update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or improvements to how we explain our privacy commitments. The "Last Updated" date at the top of this page will always show when the current version was published.
When material changes are made — changes that affect how your data is used or your rights over it in a significant way — we will notify registered players via their registered mobile number at least 7 days before the new policy takes effect. For minor clarifications and non-material updates, the revised policy will simply be published on this page without direct notification.
Your continued use of the 22win platform after a new version of this Privacy Policy takes effect constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you may request account closure as described in the 22win Terms and Conditions. We recommend checking this page periodically, particularly around the start of a new calendar year.
