BPXchange Privacy Policy – Your Data, Your Rights, Our Responsibility

1. Overview and Scope of This Policy

This Privacy Policy applies to all services operated by bpxchange, accessible at bpxchange.app. It covers everything from the moment you land on the bpxchange website and browse our game categories, right through to account registration, gameplay, deposits and withdrawals in PKR, and any communication you have with the bpxchange support team.

bpxchange is the data controller for all personal information collected through the platform. That means we decide what data is collected, how it is used, how long it is kept and under what limited circumstances it may be shared. We take that responsibility seriously — privacy is not an afterthought for us, it is built into how bpxchange works at every level.

By creating a bpxchange account or using any of our services, you acknowledge that you have read this Privacy Policy and agree to the collection and use of your data as described here. If you have concerns about any specific aspect of how bpxchange handles your information, please contact us before proceeding — our support team at support@bpxchange.app can answer privacy questions directly.

2. Personal Data bpxchange Collects

bpxchange collects different categories of personal data depending on how you interact with the platform. Below is a clear breakdown of what is collected and at what stage.

Data You Provide Voluntarily

The majority of personal data bpxchange holds about you was provided directly by you — when you filled in the registration form, submitted verification documents, made a deposit request, contacted support or opted into a promotion. bpxchange does not collect data from you covertly or infer data you have not provided.

Data Collected Automatically

When you visit the bpxchange website or use the mobile platform, certain technical data is collected automatically. This includes your IP address (used for fraud prevention and geographic compliance checks), device information, and session activity. This data is never used to personally identify you for marketing purposes — it exists primarily to keep the bpxchange platform secure and functioning correctly.

3. How bpxchange Collects Your Data

bpxchange uses three main routes to collect player data, all of which are transparent and within your control:

Direct Input

This is the most straightforward route — data you type into bpxchange forms yourself. Registration details, payment information for PKR deposits and withdrawals, identity documents submitted for KYC verification, and support requests all fall into this category. You know exactly what you are providing and why.

Automated Technical Collection

The bpxchange platform automatically records technical data each time you connect — your IP address, session start and end times, device and browser characteristics, and in-platform navigation patterns. This data is essential for keeping bpxchange's systems running correctly, detecting fraud, and ensuring the platform is accessible across the range of devices Pakistani players use.

Third-Party Payment Processors

When you deposit or withdraw PKR via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or card, the relevant payment processor shares a transaction reference and confirmation with bpxchange. bpxchange does not receive or store your full payment account credentials — only the reference information necessary to confirm that a transaction was completed and to match it to your bpxchange account.

4. Why bpxchange Uses Your Personal Data

bpxchange does not collect data just to have it. Every piece of personal information we hold is used for a specific, legitimate purpose. Here is what those purposes are:

Account Administration

Your name, contact details and date of birth are used to create and manage your bpxchange account, verify your identity for age compliance, and communicate with you about your account status. This is the foundational purpose and cannot be opted out of — without it, bpxchange simply cannot operate as a regulated platform.

Processing PKR Transactions

Financial data is used exclusively to process your deposits and withdrawals in Pakistani Rupees. bpxchange needs to know which Easypaisa account to send your winnings to, and to verify that incoming deposits originate from a payment method registered in your name. This data is also used to generate the transaction history visible in your bpxchange account.

Fraud Prevention and Platform Security

Technical data — especially IP addresses, device fingerprints and session patterns — is used by bpxchange's security systems to detect unusual activity that may indicate fraud, account takeover attempts, multi-accounting, or bot usage. This processing protects both individual players and the overall integrity of the bpxchange platform.

Game Fairness and Regulatory Compliance

bpxchange retains gameplay and betting history for audit purposes. This data allows bpxchange to investigate disputes, verify that game outcomes were correctly settled, and demonstrate compliance with applicable gaming and financial regulations. It is also used to run bpxchange's responsible gaming tools — for example, identifying play patterns that may indicate problem gambling and triggering account-level interventions such as the cool-off reminders described in our Responsible Gaming policy.

Promotions and Personalisation

With your consent, bpxchange may use your game preferences and activity history to send you relevant promotional offers — for example, notifying you about a PSL betting promotion if your history shows cricket betting activity on bpxchange. You can opt out of marketing communications at any time via your account settings or by emailing support@bpxchange.app.

5. PKR Payments Data and Financial Privacy

Given that bpxchange handles real Pakistani Rupee transactions, financial data privacy deserves its own section. Pakistani players are rightly cautious about sharing payment account details with any online service — here is exactly how bpxchange handles yours.

What Financial Data bpxchange Holds

bpxchange stores transaction references, amounts, timestamps and the payment method type (e.g. Easypaisa, JazzCash) associated with each of your PKR deposits and withdrawals. bpxchange does not store full Easypaisa PINs, JazzCash login credentials, card numbers or bank account passwords. These sensitive credentials remain with your payment provider and never pass through bpxchange systems.

Why This Data Is Kept

bpxchange is required to maintain financial transaction records for compliance with anti-money-laundering (AML) regulations. This means your PKR transaction history on bpxchange is retained for a minimum period as required by applicable law — see Section 7 on Data Retention for the specific timeframes.

KYC Document Handling

Identity documents such as CNIC scans or passport images submitted to bpxchange for Know Your Customer (KYC) verification are stored securely with access limited to authorised bpxchange compliance staff. These documents are not shared with marketing partners, game providers or any third party except where required by law or regulation.

6. Sharing Your Data – Who Sees It and Why

bpxchange does not sell your personal data to any third party. Full stop. Here is who we do share limited data with, and only to the extent necessary for those specific purposes:

Payment Processors

To process your PKR deposits and withdrawals, bpxchange exchanges transaction data with the relevant payment service — Easypaisa, JazzCash, NayaPay, SadaPay, your bank (for IBFT) or your card network. This exchange is limited to the data needed to complete the transaction and verify it against your bpxchange account.

Game Software Providers

Some games available on bpxchange are provided by third-party game studios. These providers may receive anonymised session data to support game performance and fairness auditing. They do not receive your name, contact details, financial data or any personally identifiable information beyond a session token that bpxchange uses internally.

Fraud Prevention and Compliance Services

bpxchange works with specialist fraud prevention and identity verification services. Limited data — typically your IP address, device characteristics and, where KYC is in progress, identity document data — is shared with these services to verify your identity and detect fraudulent activity. All such providers are bound by strict data processing agreements with bpxchange.

Legal Obligations

bpxchange may be required to share player data with government authorities, financial regulators or law enforcement agencies where required by applicable law. This includes AML reporting obligations. Where bpxchange shares data under a legal obligation, we will inform the relevant player where permitted to do so by law.

Business Transfers

In the event of a merger, acquisition or significant change in bpxchange's ownership structure, player data may be transferred to the new entity. bpxchange will notify registered players of any such change and the new entity will be bound by this Privacy Policy.

7. How Long bpxchange Keeps Your Data

bpxchange keeps different types of data for different periods, based on the purpose for which it was collected and any legal requirements that apply.

• Account data (name, contact details, game history): Retained for the duration of your active bpxchange account plus five years following account closure, to meet AML and regulatory retention requirements.
• Financial transaction data (PKR deposits, withdrawals, transaction references): Retained for a minimum of seven years from the date of each transaction, in line with standard financial record-keeping requirements.
• KYC identity documents: Retained for the duration of your bpxchange account and five years after closure, with access restricted to compliance staff at all times.
• Technical and usage data (IP logs, session data): Retained for up to 12 months, after which it is anonymised or deleted. Anonymised aggregates may be retained indefinitely for platform analytics.
• Support communications: Retained for three years from the date of the interaction, to support resolution of any future disputes or complaints relating to that contact.
• Marketing preferences: Retained until you withdraw consent, at which point marketing-related data is deleted or suppressed within 30 days on bpxchange's systems.

When retention periods expire, bpxchange deletes or anonymises the relevant data in a secure manner. You may also request early deletion of certain categories of data — see Section 10 on Your Rights for details.

8. How bpxchange Protects Your Data

Security is something bpxchange invests in seriously, not just talks about. Here is what is actually in place to protect the personal data and PKR transaction data of every bpxchange player:

Encryption

All data exchanged between your device and bpxchange's servers is encrypted using TLS (Transport Layer Security). This is the same standard used by Pakistani banks for online banking — it ensures that data in transit cannot be intercepted or read by a third party. Data at rest on bpxchange's servers is stored in encrypted form using AES-256 encryption.

Access Controls

Access to bpxchange player data within the organisation is strictly controlled on a need-to-know basis. Customer support staff can see account and transaction summaries needed to assist you, but they cannot see payment PINs or full identity document images. Full financial and KYC data access is limited to a small number of compliance-cleared bpxchange staff.

Fraud Monitoring

bpxchange runs continuous automated monitoring for suspicious account activity — unusual login locations, abnormal transaction patterns, rapid sequential withdrawals and other anomalies that may indicate account compromise. If our systems flag suspicious activity on your bpxchange account, we may temporarily restrict access and contact you to verify your identity before restoring full access.

Incident Response

In the unlikely event of a data security incident affecting bpxchange that involves personal data, bpxchange will notify affected players promptly and take all appropriate remediation steps. The nature and timeline of notification will be in line with applicable legal requirements.

9. Cookies and Tracking Technologies

bpxchange uses cookies and similar technologies on its website and mobile platform. A cookie is a small text file stored on your device when you visit a website. bpxchange uses them for the following purposes:

Essential Cookies

These are necessary for bpxchange to function. They maintain your login session so you do not have to log in again every time you navigate between pages, and they support the security systems that keep your bpxchange account protected. These cookies cannot be disabled without breaking core platform functionality.

Analytics Cookies

bpxchange uses anonymised analytics to understand how players use the platform — which game categories are most popular, where players encounter friction in the deposit process, and how the mobile experience performs across different Pakistani devices and networks. This data helps bpxchange improve. It does not identify you personally.

Preference Cookies

These cookies remember your bpxchange settings between sessions — for example, your preferred language, display preferences and notification settings. They make your experience more convenient without collecting sensitive data.

Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to view, delete and block cookies on a per-site basis. Blocking essential cookies will affect your ability to use bpxchange normally, so we recommend only blocking analytics and marketing cookies if you prefer to limit data collection.

10. Your Privacy Rights as a bpxchange Player

You have genuine rights over your personal data on bpxchange, and we are committed to making those rights easy to exercise. Here is what you can do and how to do it:

To exercise any of these rights, email support@bpxchange.app from the email address registered to your bpxchange account. We will acknowledge your request within 5 working days and resolve it within 30 days.

11. Minors and Under-18 Protection

bpxchange is strictly an adults-only platform. No person under the age of 18 may register an account, deposit PKR, or play any game on bpxchange. bpxchange actively employs age-verification processes during registration and reserves the right to request identity documents confirming age at any point.

If bpxchange discovers that a player under the age of 18 has registered and played on the platform, the account will be immediately closed, all balances forfeited and any data collected from that individual will be deleted as swiftly as practically possible, subject to any legal retention obligations that may apply.

bpxchange does not knowingly collect or store personal data from individuals under 18. If you believe a minor has used bpxchange, please contact our support team immediately so appropriate action can be taken.

12. Changes to This Privacy Policy

bpxchange reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, applicable law, or the features of the bpxchange platform. When we make changes, the updated policy is published on this page with a revised "Last Updated" date at the top.

For material changes — meaning changes that significantly affect how bpxchange uses your data or your rights in relation to it — bpxchange will notify registered players via email or an in-platform notification before the changes take effect. This gives you the opportunity to review any significant update and, if you do not agree, to request account closure before the new policy applies to you.

13. Contact bpxchange About Privacy

If you have a question about this Privacy Policy, want to exercise your data rights, or have a concern about how bpxchange has handled your personal information, please reach out to our team directly. We would rather you come to us with questions or concerns than feel unsure about what happens to your data on bpxchange.

You can contact bpxchange's privacy team at: support@bpxchange.app

Please include "Privacy Request" in the subject line and provide your registered account email address so we can identify your account and respond accurately. We acknowledge all privacy-related emails within 5 working days.