20win Privacy
Policy

This Privacy Policy applies to the 20win online gaming platform, accessible at 20win.ws. Throughout this Policy, references to "20win", "we", "us", or "our" refer to the operator of the 20win platform and its parent entity, subsidiaries, and affiliates, all of which operate under an internationally recognised gaming licence.

20win is the data controller responsible for the personal information collected from players who register and use the platform, including players based in Karachi, Lahore, Islamabad, Faisalabad, and across Pakistan. As data controller, 20win determines the purposes and means of processing your personal data and is accountable for ensuring that processing is carried out lawfully, fairly, and transparently.

20win collects personal data through several channels — directly from you at registration and during account use, automatically through your interaction with the platform, and in limited circumstances from third-party verification providers. The categories of data we collect are set out in the table below.

20win does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, biometric data, or health information. If any such data is incidentally included in documentation you submit for KYC purposes, it will be used solely for identity verification and will not be processed for any other purpose.

20win uses the personal data collected from Pakistani players for the following specific purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected without first obtaining your explicit consent.

• Account Registration and Management: To create and maintain your 20win account, verify your identity, and enable you to access the full range of casino and sports betting services available on the platform.
• Payment Processing: To process deposits made via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, and to process withdrawal requests back to your registered payment method in PKR.
• Identity and Age Verification: To comply with our licensing obligations by verifying that all real-money players are who they say they are and are at least 21 years of age before accessing real-money gaming products.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multiple account registration, and any other form of prohibited conduct as defined in our Terms and Conditions.
• Regulatory Compliance: To fulfil our obligations under our gaming licence, including record-keeping requirements, transaction reporting, and cooperation with regulatory enquiries from our licensing authority.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and maintain a record of your support interactions for quality assurance purposes.
• Platform Improvement: To analyse aggregated usage data, identify technical issues, test new features, and improve the overall performance and usability of the 20win platform for all Pakistani players.
• Responsible Gaming: To monitor player behaviour for signs of problem gambling, enforce self-exclusion requests, apply deposit limits, and fulfil our duty of care obligations toward vulnerable players.
• Marketing Communications: Where you have opted in to receive promotional communications, to send you information about 20win bonuses, PSL promotions, new game launches, and other relevant offers. You may opt out of marketing communications at any time through your account settings or by contacting support.

20win processes your personal data on the basis of one or more of the following recognised legal grounds, depending on the specific processing activity involved:

• Contractual Necessity: Processing is necessary to perform the contract between you and 20win — specifically, to provide you with the gaming and betting services you have registered for. This covers account creation, payment processing, game access, and customer support.
• Legal Obligation: Processing is required to comply with our legal and regulatory obligations as a licensed gaming operator, including KYC verification, anti-money laundering record-keeping, and cooperation with regulatory and law enforcement authorities.
• Legitimate Interests: Processing is necessary for the legitimate interests of 20win, provided those interests are not overridden by your data protection rights. Legitimate interests processing at 20win covers fraud prevention, platform security, responsible gaming monitoring, and analytics for platform improvement.
• Consent: Where processing is not covered by the above grounds — most notably for direct marketing communications — 20win will seek your explicit, freely given, and informed consent before processing your data for that purpose. You have the right to withdraw consent at any time without affecting the lawfulness of any processing that took place before withdrawal.

20win does not sell your personal data to third parties. We share personal data only with the categories of recipients described below, and only to the extent necessary for the purpose for which sharing is required:

• Payment Service Providers: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the financial data necessary to process deposits and withdrawals. Each provider processes your data under their own privacy policies and applicable financial regulation.
• Game Software Providers: Third-party providers including Pragmatic Play, PG Soft, and others may receive technical identifiers (such as anonymised session tokens) necessary to operate their games within the 20win platform. These providers do not receive your identity or contact data as part of routine game operation.
• KYC and Verification Services: Specialist third-party identity verification providers may process copies of identity documents and facial images to verify your identity and age as required under our gaming licence. These providers are contractually bound to process your data solely for verification purposes.
• Regulatory Authorities: Our gaming licensing authority, and where legally required, financial intelligence units or law enforcement agencies, may receive personal and transactional data as part of our regulatory reporting obligations. 20win will always seek to verify the legitimacy of such requests before disclosing data.
• IT and Cloud Infrastructure Providers: Hosting, database management, and cybersecurity service providers who support the technical operation of the 20win platform may process certain personal data as data processors acting on our instructions under strict contractual data processing agreements.
• Professional Advisors: Legal, accounting, and auditing firms engaged by 20win may access personal data where necessary for the provision of professional advice, subject to strict duties of confidentiality.

The 20win platform uses cookies and similar tracking technologies to operate correctly, remember your preferences, analyse usage patterns, and — where consent is given — deliver relevant promotional content. The categories of cookies used by 20win are as follows:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable core features such as account login, session management, security token validation, and fraud prevention. Strictly necessary cookies cannot be disabled without breaking core platform functionality.
• Performance and Analytics Cookies: These cookies collect aggregated, anonymised data about how players use the platform — which pages are visited most, which game categories attract the most sessions, and where technical errors occur. This data is used solely to improve platform performance and user experience.
• Functional Cookies: These cookies remember your preferences — such as your chosen language, display settings, and responsible gaming limit configurations — so you do not have to reconfigure them on each visit.
• Marketing Cookies: Where you have consented to marketing communications, these cookies help 20win measure the effectiveness of promotional campaigns and ensure that bonus offers shown to you are relevant to your gaming interests. Marketing cookies are only activated upon your explicit consent.

You can manage your cookie preferences through the cookie settings panel accessible in the footer of the 20win website, or through your browser's built-in cookie controls. Note that disabling performance or functional cookies may affect your experience on the platform.

20win retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account relationship with 20win, and for a minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping requirements under our gaming licence.
• Transaction and Betting Records: Retained for a minimum of five (5) years from the date of each transaction, in line with our regulatory record-keeping obligations.
• KYC Documentation: Retained for a minimum of five (5) years following the completion of verification, or such longer period as may be required by our licensing authority.
• Support Communications: Retained for a period of two (2) years from the date of the last interaction, to enable effective dispute resolution and quality assurance.
• Marketing Consent Records: Retained for the duration of your consent, and for one (1) year following withdrawal of consent as evidence that communications ceased promptly upon opt-out.
• Technical and Usage Data: Retained in aggregated, anonymised form for platform analytics; individually identifiable technical data is retained for up to twelve (12) months.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player.

As a registered 20win player, you hold the following rights in respect of the personal data that 20win holds about you. To exercise any of these rights, please contact the 20win support team — your request will be acknowledged within two (2) business days and fulfilled within thirty (30) days, subject to identity verification.

• Right of Access: You have the right to request a copy of the personal data that 20win holds about you, together with information about how it is being used and with whom it has been shared.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. For certain data types such as your registered name or date of birth, documentary evidence of the correct information may be required before a correction is applied.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is not absolute — where 20win is required to retain data by law or regulatory obligation, erasure requests for that data cannot be fulfilled until the mandatory retention period has expired.
• Right to Restrict Processing: You have the right to request that 20win restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.
• Right to Data Portability: You have the right to receive a copy of the personal data you provided to 20win in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data on the basis of legitimate interests, including profiling. You also have an absolute right to object to the use of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where 20win processes your data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

20win's real-money gaming services are strictly restricted to individuals who are at least 21 years of age. The platform does not knowingly collect personal data from anyone under the age of 21, and registration by minors is explicitly prohibited under 20win's Terms and Conditions.

Age verification is conducted at registration and may be repeated at any point during a player's use of the platform. Where 20win discovers or has reasonable grounds to believe that an account belongs to a person under the age of 21, the account will be suspended immediately, all deposits will be returned to the payment source, and the account will be permanently closed. No winnings will be paid out to any account confirmed as belonging to an underage player.

20win implements a comprehensive, layered approach to data security that is reviewed and updated on a regular basis. Technical and organisational measures currently in place include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and 20win's servers is encrypted using industry-standard TLS protocols. The padlock icon in your browser confirms that your connection is secured at all times.
• Encryption at Rest: Personal and financial data stored in 20win's databases is encrypted at rest using AES-256 encryption. Sensitive fields such as identity document references are stored in isolated, access-controlled vaults.
• Access Controls: Access to player personal data within 20win's internal systems is restricted on a strict need-to-know basis. Staff access is logged, monitored, and subject to regular audit. Administrative access requires multi-factor authentication.
• Penetration Testing: 20win's platform and infrastructure undergo regular independent penetration testing to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response: 20win maintains a documented data breach response procedure. In the event of a security incident that poses a risk to your personal data, affected players will be notified promptly and relevant regulatory authorities will be informed in accordance with our licensing obligations.

While 20win takes every reasonable technical precaution to protect your data, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your own login credentials and for logging out of your account on shared devices.

The 20win platform integrates services provided by third-party software vendors, analytics providers, and payment processors. While 20win carefully vets all third-party partners and requires them to maintain data protection standards consistent with this Policy, each third party processes data under its own privacy policy for which 20win is not responsible.

Where third-party service providers act as data processors on behalf of 20win — meaning they process your data under our instructions rather than for their own purposes — 20win enters into written data processing agreements that bind those providers to process data only as directed by 20win, to implement appropriate security measures, and to assist 20win in fulfilling its data protection obligations.

20win does not endorse or accept responsibility for the privacy practices of any third-party websites that may be referenced on the platform. Players are encouraged to review the privacy policies of any third-party service they interact with independently.

20win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law or regulatory guidance, or improvements to our platform and services.

Where changes are material — meaning they significantly affect the way in which we collect, use, or share your personal data — we will provide notice to all registered players via their registered email address or through a prominent notice on the platform no less than fourteen (14) days before the updated Policy takes effect.

For non-material updates — such as clarifications of existing language, corrections of typographical errors, or additions of contact information — the revised Policy will be published on the platform with an updated "Last Updated" date, and continued use of the platform following publication will constitute acceptance of the revised terms.

We encourage all registered players to review this Privacy Policy periodically to stay informed about how 20win protects their personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which 20win processes your personal data, please contact our support team using the details below. Our team is available around the clock and will direct data protection enquiries to the appropriate internal department.

Platform: 20win — 20win.ws
Support Hours: 24 hours a day, 7 days a week
Email: [email protected]
Response Time: Data rights requests acknowledged within 2 business days; fulfilled within 30 days