Your personal data belongs to you. This Privacy Policy explains exactly what information bpexc collects, why we collect it, how we protect it, who we share it with, and the rights you hold over your own data.
Registration details, identity documents (CNIC / passport for KYC), device data, transaction records and usage logs — collected only for specified, lawful purposes.
HTTPS encryption in transit, access-controlled storage, staff data-handling training and a breach notification process that prioritises user safety.
Limited to payment processors, identity verification providers, fraud-prevention services and legal/regulatory authorities — never sold to third-party advertisers.
We use session cookies, analytics cookies and preference cookies. You can manage cookie preferences through your browser settings at any time.
Access, rectification, erasure, portability, objection and restriction rights — you can exercise them at any time by contacting our support team.
Retention periods are tied to legal obligations — typically 5 years post-account closure for AML compliance — after which data is securely deleted or anonymised.
bpexc ("we", "us", "our", "the Platform") operates the website at https://bpexc.cam and associated interfaces. We are committed to protecting the privacy and personal data of all users ("you", "your") who access or register on the bpexc Platform.
This Privacy Policy ("Policy") describes in detail how we collect, use, store, share and protect personal data in connection with your use of the Platform. It also sets out the rights available to you and how to exercise them.
By registering an Account or continuing to use the bpexc Platform, you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein. This Policy is incorporated by reference into and forms part of the bpexc Terms & Conditions.
This Policy is written in English. Where this Policy intersects with applicable data-protection legislation in the jurisdiction under which bpexc operates its licence, the requirements of applicable law will take precedence over any conflicting provision in this document.
For the purposes of this Policy, the following terms carry the meanings set out below:
We collect Personal Data that you provide voluntarily when you:
When you access the Platform, we automatically collect certain technical and usage data, including:
We may receive Personal Data about you from third-party service providers involved in identity verification, fraud screening, payment processing or responsible-gambling risk assessment. Such data is used solely for the purposes described in this Policy and is handled in accordance with applicable data-protection standards.
Minimum Data Principle: bpexc collects only the Personal Data that is necessary for the specific purpose for which it is collected. We do not collect data speculatively or beyond what is required by our operational, compliance and legal obligations.
We process your Personal Data on one or more of the following legal bases:
| Processing Purpose | Legal Basis |
|---|---|
| Account registration and management | Performance of contract (providing the Platform service) |
| Identity and age verification (KYC) | Legal obligation (AML/CFT regulations); legitimate interests |
| Transaction processing | Performance of contract |
| Fraud detection and prevention | Legitimate interests; legal obligation |
| Responsible gambling monitoring | Legal obligation; legitimate interests (user welfare) |
| Customer support communications | Performance of contract; legitimate interests |
| Platform analytics and improvement | Legitimate interests |
| Marketing communications (where opted in) | Consent (withdrawable at any time) |
| Regulatory reporting and record-keeping | Legal obligation |
Your Personal Data is used primarily to create and manage your Account, authenticate your identity on login, process deposits and withdrawal requests denominated in PKR, and deliver the betting and gaming services you have requested.
bpexc is required by its operating licence and applicable anti-money laundering (AML) and counter-financing-of-terrorism (CFT) regulations to verify user identities, monitor transactions and maintain detailed records. KYC documents — such as CNIC copies or passport scans — are processed exclusively for these compliance purposes and are stored with access controls appropriate to their sensitivity.
We analyse Account activity, transaction patterns and device data to detect and prevent fraud, account takeover attempts, bonus abuse and other prohibited conduct. Automated risk-scoring tools may flag unusual patterns for manual review. Where fraud is confirmed, we may share relevant data with law enforcement or regulatory authorities.
We use Account activity data to monitor for indicators of problem gambling behaviour. Where our systems or staff identify concerning patterns, we may proactively reach out with responsible-gambling information or apply account-level limits as required by our operating standards. This processing is carried out in the interest of user welfare and regulatory compliance.
Where you have provided explicit consent, we may send you promotional communications about Platform offers, new products and relevant updates. You can withdraw your consent and opt out of marketing communications at any time by adjusting your Account notification settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
No Data Selling: bpexc does not sell, rent or trade your Personal Data to third-party advertisers or data brokers under any circumstances.
We share your Personal Data only in the following limited circumstances and only to the extent strictly necessary for the relevant purpose:
We engage third-party processors to assist in delivering the Platform's services, including identity verification and KYC providers, payment processing partners, cloud infrastructure and hosting providers, fraud-screening and risk-analytics services, and customer support tooling. All processors are bound by data-processing agreements that impose confidentiality obligations and restrict use of your data to the specific service purpose.
References to payment services familiar to Pakistani users — Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah — are for contextual information only. These entities' involvement as payment processors on this Platform is subject to availability and their own terms. They are not data processors for bpexc unless a specific agreement is in place. Their own privacy policies govern any data they independently collect.
bpexc will disclose Personal Data to competent legal or regulatory authorities — including law enforcement agencies and, where applicable under AML obligations, the Financial Monitoring Unit of Pakistan (FMU) — where we are required to do so by applicable law, court order, regulatory direction or where we believe disclosure is necessary to prevent serious harm or criminal activity.
In the event of a merger, acquisition, sale of assets or restructuring of the Platform's operating entity, Personal Data held by bpexc may be transferred to the successor entity. Users will be notified of any such transfer in advance where practicable, and any successor entity will be bound by this Policy or an equivalent data-protection framework.
We may use and share aggregated or anonymised data — data that cannot reasonably be used to identify any individual — for analytics, platform improvement and industry reporting purposes without restriction.
bpexc may store and process Personal Data on servers located outside Pakistan. Where Personal Data is transferred to a jurisdiction that does not provide a level of data protection equivalent to internationally recognised standards, we apply appropriate safeguards — such as standard contractual clauses or equivalent data transfer mechanisms — to ensure your data remains protected.
By using the Platform, you acknowledge that your Personal Data may be processed and stored in jurisdictions outside Pakistan. bpexc will take reasonable steps to ensure that such transfers comply with applicable data-protection requirements.
We retain Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations and to resolve any disputes or enforce our agreements. Key retention periods include:
| Data Category | Retention Period |
|---|---|
| Account registration data | Duration of Account + 5 years post-closure (AML obligation) |
| KYC / identity documents | 5 years from Account closure or last transaction |
| Transaction records | 5 years from the date of each transaction |
| Support communications | 3 years from the date of last interaction |
| Session and device logs | 13 months (rolling) |
| Marketing consent records | Until withdrawal of consent + 1 year |
Upon expiry of the applicable retention period, Personal Data is either securely deleted or anonymised such that it can no longer be linked to any identifiable individual.
The bpexc Platform uses cookies and similar technologies (local storage, session storage, pixel tags) to ensure core Platform functionality, maintain your login session, remember your preferences, and analyse how users navigate the site.
You can control and delete cookies through your browser settings. Disabling strictly necessary cookies will affect Platform functionality. Disabling analytics or marketing cookies will not affect your ability to use core Platform features. Please consult your browser's help documentation for specific instructions on managing cookies.
bpexc implements a range of technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration or destruction. These include:
Your Role in Security: The security of your Account also depends on you. Use a strong, unique password. Enable two-factor authentication if available. Never share your login credentials with anyone. bpexc staff will never ask for your password. If you suspect unauthorised access to your Account, contact support immediately.
Depending on the data-protection legislation applicable to the jurisdiction under which bpexc operates, you may hold some or all of the following rights in relation to your Personal Data:
Request a copy of the Personal Data we hold about you and information about how it is being processed.
Request correction of any inaccurate or incomplete Personal Data we hold about you.
Request deletion of your Personal Data where it is no longer necessary for the purpose collected, subject to our legal retention obligations.
Receive a structured, machine-readable copy of data you have provided to us, where processing is based on consent or contract.
Request that we limit processing of your Personal Data in certain circumstances — for example, while you contest its accuracy.
Object to processing of your Personal Data for direct marketing or where we rely on legitimate interests as our legal basis.
To exercise any of the above rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within a reasonable timeframe and respond substantively within 30 days, subject to identity verification requirements.
Where we are unable to fulfil a request — for example, because data must be retained to comply with AML regulations — we will explain the reason and the specific legal basis for retention.
The bpexc Platform is strictly intended for adults aged 18 years or above, or the higher minimum age required by the operator's licence jurisdiction. We do not knowingly collect Personal Data from persons below the applicable minimum age.
If we become aware that Personal Data has been collected from an underage user, we will immediately suspend the associated Account, delete the data in question and, where required, notify relevant authorities. If you believe that an underage person has registered on the Platform, please notify us immediately at [email protected].
18+ Only. bpexc applies age verification through its KYC process. Any attempt to circumvent age verification controls is a breach of our Terms & Conditions and will result in Account closure. Local laws in Pakistan may impose additional or stricter age restrictions on online gambling.
bpexc acknowledges that it serves a significant number of users located in Pakistan. The following additional information is relevant to Pakistani users:
Pakistan's data-protection landscape includes the Personal Data Protection Bill and related legislation. While this Bill's enactment status may evolve, bpexc commits to treating Personal Data of Pakistani users with standards aligned to internationally recognised data-protection principles, including purpose limitation, data minimisation, security and user rights.
As an internationally operating platform, bpexc processes Personal Data in jurisdictions outside Pakistan. Where your data is transferred abroad, we ensure appropriate safeguards are in place. Pakistani users should be aware that data stored offshore may be subject to the laws of the country where it is stored.
Where you use payment methods common in Pakistan — such as mobile wallets or bank transfers via HBL, UBL, Meezan Bank or Bank Alfalah — the transaction identifiers processed by bpexc are limited to references necessary for payment matching and AML compliance. bpexc does not store full bank account numbers or mobile wallet credentials. Each of these payment providers has its own independent privacy policy that governs data they collect directly.
bpexc does not operate under a licence issued by any Pakistani governmental authority and does not claim compliance with Pakistani gambling regulation. This Privacy Policy is provided to inform Pakistani users of their data rights under the Platform's operating framework. Nothing in this Policy constitutes legal advice regarding the lawfulness of online gambling in Pakistan.
bpexc reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify registered users via email or by a prominent notice on the Platform at least 14 days before the changes take effect. The "Last Updated" date at the top of this document will be revised with each update.
Your continued use of the Platform after the effective date of any amended Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed of how we handle your data.
For any queries, concerns or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the bpexc Data Protection team through the following channels:
Use subject line "Data Rights Request" for formal data-subject requests. Include your Account username for faster processing. Email response within 24 hours on business days.
Available 24/7 via the Platform's live chat feature. Suitable for general privacy questions and non-formal enquiries. Formal data-subject requests must be submitted in writing to the email address above.
bpexc aims to resolve all privacy-related queries promptly and fairly. If you are not satisfied with our response, you may have the right to lodge a complaint with a supervisory authority in the jurisdiction under which the Platform is licensed.
Privacy transparency is a cornerstone of how bpexc operates. Review our Terms & Conditions for the full legal agreement, or visit the FAQ if you have specific questions about how the Platform works.
Also review our Terms & Conditions and Responsible Gambling page. Adults 18+ only.