1 About This Policy
This Privacy Policy explains how bpexch collects, processes, stores, and protects personal information relating to users of the bpexch platform at bpexch.run. bpexch is committed to handling your data responsibly and transparently. This policy has been written in clear, accessible English so that any member of the bpexch community in Pakistan can understand exactly how their information is being used.
bpexch operates as a data controller for the personal information you provide when using the platform. This means bpexch determines the purposes and means of processing your data. Where bpexch engages third-party service providers to process data on its behalf – for example, payment processors or identity verification services – those providers act as data processors under bpexch's direction and are contractually bound to handle your data only as instructed by bpexch.
This policy covers all products and features of the bpexch platform, including the sportsbook, cricket betting, online casino, Ludo Games, roulette, virtual sports, esports betting, and any promotions or loyalty programmes operated by bpexch.
Reading this policy in full takes around 10 minutes. If you have a specific concern, use the Contents panel on the left to jump directly to the relevant section. For questions not answered here, contact bpexch support at support@bpexch.run.
2 Personal Data We Collect
bpexch collects personal data in the following categories. The specific data collected depends on how you interact with the platform.
bpexch does not collect sensitive personal data such as biometric data, health information, or information about political or religious beliefs. Where CNIC document images are submitted for KYC, they contain only standard identity information and are handled under strict security controls.
3 How BPExch Uses Your Personal Data
bpexch processes your personal data for the following specific purposes. For each purpose, we have indicated the legal basis under which processing takes place.
3.1 Account Operation
Your registration data is used to create and maintain your bpexch account, verify your identity, process your bets and casino gameplay, display your account balance and transaction history, and enable you to log in securely. This processing is necessary for the performance of the contract between you and bpexch.
3.2 Payment Processing
Your payment method data is used to process PKR deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, and card payments. bpexch shares necessary payment details with payment processing partners for the sole purpose of completing transactions. This processing is necessary for the performance of the contract between you and bpexch.
3.3 Identity Verification and Fraud Prevention
CNIC information and payment method details are used to verify your identity, prevent fraudulent account creation, detect suspicious activity, and comply with anti-money laundering obligations. bpexch may share identity verification data with third-party KYC service providers for verification purposes. This processing is in bpexch's legitimate interests and is necessary for legal compliance.
3.4 Responsible Gaming
bpexch monitors betting and gaming activity patterns to identify members who may be showing signs of problem gambling. This includes reviewing session duration, deposit frequency, loss patterns, and self-exclusion requests. Processing for responsible gaming purposes is in the legitimate interest of protecting member welfare and is required under responsible operating standards.
3.5 Platform Improvement
Aggregated, anonymised usage data is used to analyse how members interact with bpexch, identify areas for improvement, and prioritise new features. This analysis does not involve identifying individual members and is processed in bpexch's legitimate interests as an ongoing platform improvement activity.
3.6 Marketing Communications
Where you have provided consent, bpexch will send you promotional communications about new offers, bonuses, and features. See Section 13 for full details of how marketing communications work at bpexch and how to manage your preferences.
4 Legal Basis for Processing
bpexch processes personal data under the following legal bases:
- Contract Performance: Processing necessary to fulfil the contract between bpexch and the member – covering account creation, bet settlement, and payment processing.
- Legal Obligation: Processing required by applicable law, including identity verification, anti-money laundering compliance, and responsible gaming obligations.
- Legitimate Interests: Processing in bpexch's legitimate operational interests, including fraud prevention, platform security, responsible gaming monitoring, and platform improvement, provided these interests do not override your fundamental rights.
- Consent: Processing for marketing communications, where you have provided explicit consent. Consent can be withdrawn at any time without affecting any other processing.
5 Data Sharing and Third Parties
bpexch does not sell, rent, or trade your personal data. Data is shared with third parties only in the following specific, controlled circumstances:
5.1 Payment Partners
bpexch shares necessary transaction data with Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT networks, and card payment processors to facilitate PKR deposits and withdrawals. Each payment partner operates under their own privacy policy and is responsible for data handling within their own systems.
5.2 Identity Verification Providers
bpexch may use third-party KYC and identity verification services to assist with CNIC verification and fraud detection. These providers process identity data solely for the purpose of verification and are bound by data processing agreements with bpexch.
5.3 Technology and Infrastructure Partners
bpexch uses cloud hosting and software infrastructure providers to operate the platform. These providers may process data on bpexch's servers but do not have independent access to member data and are contractually bound to process data only as instructed by bpexch.
5.4 Game Providers
Third-party casino game and virtual sports providers may receive anonymised session data necessary to operate their games within the bpexch platform. Game providers do not receive personally identifiable bpexch member data beyond what is technically necessary for game session authentication.
5.5 Legal Requirements
bpexch may disclose personal data to law enforcement, regulatory authorities, or courts where required to do so by applicable law or valid legal process. bpexch will notify affected members of such disclosures where it is legally permissible to do so.
6 Payment Data Security
Given that bpexch handles real PKR transactions, payment data security is treated with the highest priority. bpexch applies the following specific measures to payment data:
- Full card numbers are never stored on bpexch servers. Card transactions use tokenisation provided by the card payment processor, meaning bpexch only stores a secure token that references the card without exposing the actual number.
- Mobile wallet numbers (Easypaisa, JazzCash, NayaPay, SadaPay) are stored in encrypted form. They are used only for processing transactions and are not visible to bpexch support staff in plain text.
- Withdrawal requests are processed only to payment methods that match the name on the verified bpexch account. Third-party withdrawals are not permitted.
- All payment-related API communications between bpexch and payment providers use encrypted connections. No payment data passes through unencrypted channels.
- Transaction records are retained for a minimum of 5 years to comply with financial record-keeping requirements.
Phishing Warning: bpexch will never ask for your full CNIC number, bank PIN, Easypaisa/JazzCash PIN, or account password through email, SMS, WhatsApp, or any other messaging channel. If you receive a message claiming to be from bpexch asking for this information, do not respond and report it to support@bpexch.run immediately.
7 KYC and Identity Verification Data
bpexch requires identity verification (KYC) before processing withdrawals and in other circumstances where identity confirmation is necessary. The following explains how KYC data is handled by bpexch.
7.1 Documents Collected
KYC verification at bpexch involves the collection and review of your CNIC (front and back copy) and proof of your payment method. In some cases, a selfie photograph may be requested for facial matching. Documents are submitted securely through the bpexch platform and are transmitted over encrypted connections.
7.2 Storage of KYC Documents
KYC documents are stored in a secure, access-controlled document management system. Access is restricted to authorised bpexch compliance and verification staff on a need-to-know basis. Document storage is separate from the main platform database and is subject to additional security controls.
7.3 Retention of KYC Documents
KYC documents are retained for a minimum of 5 years from the date of account closure or last active use of the bpexch account, whichever is later. This retention period is required for compliance with anti-money laundering record-keeping obligations. After the retention period, documents are permanently deleted from bpexch systems.
7.4 Third-Party Verification
Where bpexch uses third-party identity verification providers, those providers receive only the data necessary for the specific verification task. They do not receive full account data and are bound by data processing agreements that restrict their use of data to the specific purpose for which it was shared.
8 Cookies and Tracking Technologies
bpexch uses cookies and similar technologies on the bpexch platform. Cookies are small text files placed on your device that help the platform function, remember your preferences, and collect usage data. Here is a plain-English breakdown of the cookies bpexch uses.
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Required for the bpexch platform to function – session management, login state, bet slip functionality, and security tokens. Without these cookies, bpexch cannot operate. | No – essential for platform operation. | |
| Anonymised data on how members navigate the bpexch platform – pages visited, features used, error occurrences. Used to improve platform performance and user experience. | Yes – via cookie preference settings. | |
| Preference storage such as language settings, previously viewed games, and display preferences on bpexch. Makes repeat visits more convenient. | Yes – disabling may affect convenience features. |
bpexch does not use third-party advertising cookies or place tracking pixels that report your bpexch activity to external advertising networks. Analytics cookies used by bpexch are processed in aggregate and do not identify individual members by name or account details.
You can manage cookie preferences through your browser settings. Most modern browsers allow you to view, manage, and delete cookies. Disabling essential cookies will prevent the bpexch platform from functioning correctly. Disabling analytics or functional cookies does not affect your ability to bet or use the casino.
9 Data Retention
bpexch does not keep your personal data longer than necessary. The following retention periods apply to different categories of data:
- Active account data: Retained for the duration of your active bpexch membership and for a minimum of 2 years after account closure.
- Transaction and betting records: Retained for a minimum of 5 years from the transaction date for financial compliance purposes.
- KYC documents: Retained for a minimum of 5 years from last account activity.
- Support communications: Email and live chat records retained for 2 years for service quality and dispute resolution purposes.
- Technical logs (IP addresses, session data): Retained for 90 days for security and fraud investigation purposes, then automatically purged.
- Marketing consent records: Retained for 3 years from the date of consent or until consent is withdrawn, whichever is earlier.
When retention periods expire, bpexch deletes data using secure deletion methods appropriate to the sensitivity of the data. Anonymised and aggregated data – from which no individual can be identified – may be retained indefinitely for statistical and platform improvement purposes.
10 Data Security Measures
bpexch implements a range of technical and organisational security measures to protect your personal data. These include:
- SSL/TLS encryption across all pages and API communications on the bpexch platform.
- Encrypted storage for sensitive fields including CNIC numbers, payment method identifiers, and passwords (stored as salted hashes, never in plain text).
- Access controls restricting internal staff access to member data on a strict need-to-know basis, with access logs maintained and reviewed.
- Two-factor authentication available for member accounts and mandatory for internal bpexch staff accessing sensitive systems.
- Regular security testing including vulnerability assessments of the bpexch platform infrastructure.
- Incident response procedures for detecting, containing, and notifying affected members of any data security incident that affects their personal information.
Despite these measures, no internet-based platform can guarantee absolute security against all possible threats. In the event of a data breach that affects member personal data, bpexch will notify affected members promptly and take all reasonable steps to contain the breach and prevent further unauthorised access.
11 Your Data Rights
As a bpexch member, you have the following rights regarding your personal data. To exercise any of these rights, contact bpexch at support@bpexch.run with the subject line "Data Rights Request" and a description of what you are requesting. bpexch will respond within 30 days.