bpexc
Privacy Policy

1.1 For the purposes of this Privacy Policy, the data controller responsible for your personal information is the bpexc operating entity — the company that holds the international gaming license under which the bpexc Platform at bpexc.bio operates.

1.2 bpexc acts as the primary data controller in respect of all personal data collected through the bpexc Platform, including data collected during registration, KYC verification, gameplay, financial transactions, customer support interactions, and promotional participation.

1.3 Where bpexc engages third-party processors — such as payment gateway operators, identity verification service providers, or game software suppliers — those entities process player data strictly on bpexc's instructions and under contractual data processing agreements. They do not act as independent data controllers in relation to bpexc player data.

2.1 Registration Data. When you create a bpexc account, we collect the following information which you provide directly:

• Identity Data: Full legal name as it appears on your Pakistani national identity document (CNIC or passport);
• Contact Data: Pakistani mobile number (for account verification and SMS OTP); email address;
• Date of Birth: To verify compliance with bpexc's strict 21+ age policy;
• Account Credentials: Username and encrypted password (passwords are never stored in plain text);
• Residential Address: Required for KYC compliance, particularly for players whose account activity triggers enhanced due diligence requirements.

2.2 Identity Verification (KYC) Data. Prior to processing withdrawal requests, bpexc requires the following additional documentation:

• Scanned copy or clear photograph of your CNIC (front and back), valid Pakistani passport, or other government-issued photo identification;
• Proof of payment method ownership — e.g., screenshot confirming JazzCash or EasyPaisa account is registered in your name;
• Source of funds documentation for accounts that exceed specified deposit thresholds under our AML compliance framework.

2.3 Financial Transaction Data. bpexc records all deposit and withdrawal transactions associated with your account, including: transaction amounts in PKR; payment method used; transaction timestamps; and payment gateway reference numbers. This data is retained for the regulatory period required by our gaming license authority.

2.4 Gaming Activity Data. The bpexc Platform automatically records your gaming activity, including: games played; bet amounts and outcomes; session timestamps and duration; bonus offers accepted and wagering progress; and game preferences. This data is used to provide the Service, detect fraud, enforce responsible gaming policies, and improve the bpexc experience.

2.5 Technical & Device Data. When you access bpexc, our systems automatically collect:

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, and browser version;
• Device identifiers used for fraud prevention and multi-account detection;
• Session data including login timestamps and Platform navigation patterns.

3.1 bpexc uses personal data collected from Pakistani players for the following specific purposes:

4.1 Contract Performance. The primary legal basis for bpexc's processing of your personal data is the performance of the contract between you and bpexc — specifically, the account agreement you enter into when you register. Without processing your identity, contact, financial, and gaming data, bpexc cannot deliver the Services you have contracted to receive.

4.2 Legal Obligation. bpexc processes certain categories of personal data because we are legally obliged to do so under the conditions of our international gaming license. This includes mandatory KYC verification, age verification, anti-money laundering (AML) transaction monitoring, and the retention of financial records for regulatory audit purposes.

4.3 Legitimate Interests. bpexc processes some data — principally technical and device data — on the basis of legitimate interests, specifically: fraud prevention; multi-account detection; platform security; and aggregated analytics used to improve the bpexc user experience. We ensure that such processing does not override your fundamental privacy rights.

4.4 Consent. For marketing communications and personalised game recommendations, bpexc relies on your explicit, freely given consent obtained at registration or through your account preferences. You may withdraw marketing consent at any time without affecting the Services you receive from bpexc.

5.1 Principle of Controlled Disclosure. bpexc does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared with external parties only to the extent strictly necessary to: (a) deliver the Services; (b) comply with legal and regulatory obligations; or (c) protect the legitimate interests of bpexc and its player community.

5.2 Categories of Recipients. bpexc may share player data with the following categories of third parties:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Visa/Mastercard gateway operators — for the sole purpose of processing your authorised deposits and withdrawals in PKR;
• Identity verification providers: Third-party KYC services that assist bpexc in verifying the identity and age of players, operating under strict data processing agreements;
• Game software providers: Third-party casino game developers whose games are integrated into the bpexc Platform — these providers may receive anonymised session data but not identifiable personal information without explicit necessity;
• Fraud prevention services: Specialist providers that assist bpexc in detecting and preventing multi-accounting, payment fraud, and bonus abuse;
• Regulatory and licensing authorities: bpexc's gaming license regulator and any other competent legal authority that has a lawful entitlement to receive player data — for example, in the context of an AML investigation;
• Legal and compliance advisers: External legal counsel and compliance consultants who assist bpexc in meeting its regulatory obligations, operating under professional confidentiality obligations.

6.1 As an internationally licensed gaming platform serving Pakistani players, bpexc may transfer certain personal data to servers or service providers located outside Pakistan. Where such transfers occur, bpexc ensures that equivalent data protection standards apply in the destination jurisdiction or that appropriate contractual safeguards — such as standard contractual clauses — are in place.

6.2 bpexc's primary data hosting infrastructure is maintained on servers subject to security and compliance standards commensurate with our international gaming license requirements. All data at rest is encrypted, and access controls are enforced regardless of server location.

6.3 Players based in Pakistan who provide personal data to bpexc consent — by agreeing to these Terms and this Policy — to the processing of their data in the manner and in the locations described in this Policy.

7.1 bpexc retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

7.2 The following retention periods apply to principal categories of bpexc player data:

• Account registration data: Retained for the duration of the active account plus a minimum of five (5) years following account closure, as required by our gaming license;
• KYC identity documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in compliance with AML regulatory requirements;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with applicable financial record-keeping requirements;
• Gaming activity logs: Retained for a minimum of three (3) years to support responsible gaming monitoring, dispute resolution, and fraud investigation;
• Technical and device data: Retained for up to twelve (12) months unless required for an active fraud or compliance investigation;
• Marketing consent records: Retained for the duration of active consent plus three (3) years following withdrawal of consent, to evidence compliance.

7.3 Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymised in accordance with bpexc's data disposal procedures.

8.1 bpexc implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• Encryption in Transit: All data transmitted between your device and bpexc's servers is encrypted using TLS 1.3 (256-bit SSL) — the same standard applied by Pakistani commercial banks to their online banking portals;
• Encryption at Rest: All personal data stored in bpexc's databases is encrypted at rest using AES-256 encryption;
• Access Controls: Access to player personal data within bpexc's systems is restricted to staff with a legitimate operational need. Access is role-based, logged, and subject to regular review;
• Two-Factor Authentication: Administrative access to bpexc's data systems requires multi-factor authentication for all personnel;
• Penetration Testing: bpexc commissions periodic independent penetration tests of its Platform and data infrastructure to identify and remediate vulnerabilities before they can be exploited;
• Incident Response: bpexc maintains a documented data breach response procedure. In the event of a security incident affecting player personal data, affected players will be notified without undue delay.

9.1 bpexc uses cookies and similar tracking technologies on the bpexc Platform to ensure the Platform functions correctly, maintain your session state after bpexc login, and improve the overall player experience. The principal categories of cookies used by bpexc are described below.

10.1 Opt-In Basis. bpexc sends promotional emails, SMS notifications about bonuses and offers, and personalised in-platform recommendations only to players who have explicitly opted in to receive such communications. Marketing consent is collected at the point of bpexc account registration and can be managed through your account notification preferences at any time.

10.2 Opt-Out Rights. You may withdraw consent to receive marketing communications from bpexc at any time by: (a) updating your notification preferences in the bpexc account settings; or (b) contacting bpexc support via live chat with a request to unsubscribe. Withdrawal of marketing consent does not affect the Services provided to you or your ability to use the bpexc Platform.

10.3 Transactional Communications. Certain communications — including deposit confirmations, withdrawal processing notifications, OTP verification codes, and account security alerts — are sent regardless of marketing consent status, as they are necessary for the delivery of the Services and the security of your bpexc account.

10.4 Self-Exclusion & Marketing Suppression. Players who have activated a self-exclusion period through bpexc's responsible gaming tools will have all promotional communications automatically suppressed for the duration of the exclusion period. This is a mandatory protection measure and cannot be overridden by the player while self-exclusion is active.

11.1 bpexc recognises and respects the following rights in relation to your personal data. These rights may be exercised by contacting bpexc support via the Platform's live chat, clearly identifying yourself and specifying the right you wish to exercise:

12.1 bpexc's Services are strictly restricted to individuals aged 21 years or above. bpexc does not knowingly collect, process, or store personal data belonging to individuals under the age of 21. Age verification is a mandatory step in the bpexc registration and KYC processes precisely to prevent underage access to the Platform.

12.2 If bpexc becomes aware — through its own monitoring or through information provided by a third party — that personal data belonging to a person under 21 has been collected on the Platform, bpexc will immediately suspend the relevant account and take steps to delete the associated personal data from its systems, subject to any overriding legal obligation to retain certain records.

12.3 If you are a parent or guardian and you believe that a minor in your care has created a bpexc account, please contact bpexc support immediately with the relevant account details so that we can take prompt action.

13.1 bpexc reserves the right to update or amend this Privacy Policy at any time to reflect changes in: applicable data protection law or regulatory guidance; bpexc's data processing practices; new product features or services introduced to the Platform; or the categories of third parties with whom bpexc works.

13.2 Material changes to this Privacy Policy — defined as changes that significantly affect how we process your personal data or the rights available to you — will be communicated to registered bpexc players via email notification and/or a prominent notice on the Platform at least seven (7) days before the changes take effect.

13.3 Minor or administrative changes — such as formatting corrections, clarifications of existing practices that do not alter their substance, or updates to contact information — may be made without advance notice. The effective date displayed at the top of this Policy will always reflect the date of the most recent revision.

13.4 We encourage all bpexc players to review this Privacy Policy periodically. Your continued use of the bpexc Platform after any amendment takes effect constitutes acceptance of the revised Policy.

14.1 For all inquiries relating to this Privacy Policy or the exercise of your data rights, bpexc players may contact us through the following channels:

• Live Chat: Available 24/7 directly within the bpexc Platform — the fastest channel for most privacy inquiries;
• Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Subject Request" for efficient routing to our data privacy team;
• Response Commitment: bpexc aims to acknowledge all privacy-related inquiries within 24 hours and to provide a substantive response to data subject requests within 30 calendar days of receipt of the request and any necessary identity verification.

14.2 Where a Player is dissatisfied with bpexc's response to a privacy inquiry or data subject request, the Player may escalate the complaint through bpexc's standard complaints process as described in the Terms and Conditions.