bexch Privacy Policy — Your Data, Our Responsibility

1 Introduction

1.1 bexch ("we," "us," or "our") operates the online casino and sports betting platform accessible at bexch.pro. We are committed to protecting the privacy and personal data of every individual who interacts with our platform ("you," "your," or "Player").

1.2 This Privacy Policy has been drafted in accordance with internationally recognised data protection principles, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and accountability.

1.3 This Policy applies to all personal data we collect through:

• The bexch.pro website and any mobile-optimised versions thereof;
• The account registration and KYC verification processes;
• Deposits, withdrawals, and payment processing interactions;
• Customer support communications via email, live chat, or any other channel;
• Responsible gaming tools and self-exclusion requests;
• Marketing communications where you have provided explicit consent.

1.4 This Policy should be read in conjunction with the bexch Terms and Conditions and Responsible Gaming Policy, both of which are available on the bexch.pro platform.

2 Personal Data We Collect

2.1 bexch collects personal data in two primary ways: (a) information you provide directly to us, and (b) information collected automatically through your use of the platform.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you access bexch.pro, our systems automatically collect certain technical data including: your IP address, browser type and version, operating system, device identifiers, pages visited, session duration, click patterns, and referring URLs. This data is used for platform security, fraud detection, and anonymised analytics.

3 How We Use Your Personal Data

3.1 bexch uses the personal data we collect for the following specific purposes only:

• Account Management: To create, verify, maintain, and administer your bexch account throughout its lifecycle.
• Identity Verification: To confirm your identity and verify that you meet the 21+ age eligibility requirement before any gaming activity commences.
• Payment Processing: To process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank in accordance with your instructions.
• Anti-Money Laundering (AML) Compliance: To monitor transactions, detect suspicious activity patterns, and fulfil our obligations under applicable AML regulations.
• Platform Security and Fraud Prevention: To detect, investigate, and prevent fraudulent accounts, bonus abuse, collusion, and any other form of prohibited conduct on the platform.
• Responsible Gaming: To administer deposit limits, session reminders, cool-off periods, and self-exclusion arrangements you have requested, and to identify patterns of play that may indicate problem gambling requiring intervention.
• Customer Support: To respond to your inquiries, complaints, and support requests in a timely and effective manner.
• Legal and Regulatory Compliance: To meet our obligations under applicable gaming regulations, court orders, or lawful requests from competent regulatory or law enforcement authorities.
• Service Improvement: To analyse aggregated, anonymised usage data to improve platform performance, game offerings, and user experience for Pakistani players.
• Marketing Communications: To send you promotional materials, bonus offers, and relevant platform updates — but only where you have provided explicit consent to receive such communications, and subject always to your right to opt out at any time.

3.2 bexch will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

4 Legal Basis for Processing

4.1 bexch processes your personal data only where a valid legal basis exists under applicable data protection law. The following table summarises the legal basis for each category of processing activity:

4.2 Where bexch relies on legitimate interests as a legal basis, we have conducted a balancing assessment to confirm that our interests do not override your fundamental rights and freedoms. Details of any such assessment are available on request.

5 Data Sharing and Disclosure

5.1 bexch does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share personal data only in the following limited circumstances:

• Licensed Service Providers: We engage carefully selected third-party service providers — including payment processors, KYC/identity verification services, cloud hosting providers, fraud detection platforms, and customer support software vendors — who process data on our behalf under strict contractual data processing agreements. These providers are permitted to use your data only as directed by bexch and for no independent purpose of their own.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or lawful request from a competent regulatory or law enforcement authority, bexch will disclose personal data as required. We will, where legally permitted, notify you of such a disclosure request before complying.
• Gaming Regulators: bexch may be required to disclose player account and transaction data to the licensing authority under whose jurisdiction we operate, as part of regulatory reporting, audit, or investigation requirements.
• Self-Exclusion Registers: Where bexch participates in any shared responsible gaming self-exclusion scheme, your self-exclusion status may be shared with other participating operators for the purpose of enforcing your exclusion. No other personal data is shared through this mechanism.
• Business Transfers: In the event that bexch undergoes a corporate restructuring, merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer.

5.2 Any third-party service providers with whom bexch shares personal data are required by contract to maintain appropriate technical and organisational security measures and to process data only in accordance with bexch's documented instructions.

6 Cookies and Tracking Technologies

6.1 bexch uses cookies and similar browser-based technologies (including local storage and session tokens) on the bexch.pro platform. The following categories of cookies are deployed:

6.2 bexch does not deploy advertising, retargeting, or cross-site tracking cookies. We do not permit third-party advertising networks to place cookies on bexch.pro.

6.3 You can manage your cookie preferences at any time by adjusting your browser settings or through the bexch cookie preference centre accessible from the site footer. Please note that disabling strictly necessary or security cookies will prevent certain essential platform functions from operating correctly.

7 Data Retention

7.1 bexch retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following retention periods apply:

• Account Data and KYC Documents: Retained for a minimum of five (5) years from the date of account closure, as required by applicable AML regulations. Where a regulatory investigation is ongoing at the time of account closure, data is retained until the conclusion of that investigation.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction for AML compliance and audit purposes.
• Customer Support Records: Retained for three (3) years from the date of the last support interaction, to enable effective handling of any subsequent complaints or regulatory inquiries.
• Marketing Consent Records: Retained for the duration of your consent, plus an additional two (2) years as evidence of the consent obtained, or until you withdraw consent — whichever is earlier.
• Technical and Log Data: Retained for twelve (12) months for security and fraud detection purposes, after which it is anonymised or deleted.

7.2 Upon the expiry of applicable retention periods, personal data is securely deleted or permanently anonymised in accordance with bexch's data disposal procedures.

8 Data Security

8.1 The technical security measures deployed by bexch to protect personal data include:

• 256-bit SSL/TLS encryption for all data in transit between your device and bexch servers;
• AES-256 encryption for sensitive personal and financial data stored at rest;
• Multi-factor authentication (MFA) for all internal staff access to systems containing personal data;
• Role-based access controls ensuring that personal data is accessible only to staff with a legitimate operational need;
• Continuous intrusion detection and prevention monitoring;
• Regular penetration testing by independent certified security professionals;
• Automated anomaly detection to identify unusual access or data export patterns.

8.2 In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, bexch will notify affected Players without undue delay and will take all reasonable steps to mitigate the impact of the breach.

8.3 While bexch employs robust security measures, no system can guarantee absolute security. You play an important role in keeping your account secure by using a strong, unique password, enabling two-factor authentication, and notifying us promptly of any suspected unauthorised access to your account.

9 Your Data Protection Rights

9.1 bexch recognises and respects the following data protection rights for all Players. To exercise any of these rights, please submit a request to [email protected] with the subject line "Data Rights Request" along with your account details and a description of the right you wish to exercise.

• Right of Access: You may request a copy of all personal data bexch holds about you. We will provide this within 30 days of receiving a valid, verified request, free of charge.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account information directly within your account settings panel.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no overriding legal basis; or (c) the data has been unlawfully processed. Note that this right is subject to our legal retention obligations, particularly under AML regulations.
• Right to Restrict Processing: You may request that bexch temporarily suspends the processing of your data in certain circumstances, such as while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or a contract, you may request a structured, machine-readable copy of the personal data you have provided to bexch.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, though bexch may be able to demonstrate compelling grounds that override your objection.
• Rights Related to Automated Decision-Making: bexch may use automated systems for fraud detection and responsible gaming monitoring. Where a significant decision affecting you is made solely through automated processing, you have the right to request human review of that decision.

9.2 bexch will respond to all data rights requests within 30 days. Where the complexity or volume of requests requires additional time, we will notify you within the initial 30-day period and provide an estimated completion date.

9.3 If you believe bexch has not adequately addressed your data rights request, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.

10 Children and Age Restriction

10.1 Age verification is a mandatory step in the bexch registration process. Every new Player must confirm they are 21 years of age or older at the point of registration. bexch reserves the right to request documentary evidence of age at any point during an account's lifetime.

10.2 If you are a parent or guardian and believe that your child has registered on or accessed the bexch platform, please contact us immediately at [email protected]. We will investigate promptly and take all necessary remedial action.

10.3 bexch supports the use of parental control software to prevent underage access to online gambling platforms. A number of free parental control solutions are available and we encourage their use in households with young people under the age of 21.

11 Third-Party Links and Services

11.1 The bexch.pro website may contain links to third-party websites or services for informational purposes. Once you navigate away from bexch.pro to a third-party website, this Privacy Policy no longer applies. bexch is not responsible for the privacy practices or content of any third-party website and strongly encourages you to review the privacy policy of any external site you visit.

11.2 bexch does not endorse or make any representations about third-party websites linked from the bexch.pro platform. Any reliance on the content of third-party websites is at your own risk.

11.3 Where bexch integrates third-party technology on the platform — such as payment gateway interfaces or identity verification widgets — those integrations are subject to the third party's own terms and privacy policies in addition to this Policy. bexch selects integration partners based in part on their privacy and security standards and requires all partners to maintain adequate data protection practices by contract.

12 Marketing Communications

12.1 bexch will only send you direct marketing communications — including promotional emails, bonus offers, PSL season promotions, and platform update notifications — where you have provided explicit, freely given consent to receive such communications at the time of registration or subsequently through your account preferences.

12.2 You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "unsubscribe" link included at the bottom of every marketing email bexch sends;
• Updating your communication preferences in your bexch account settings panel;
• Contacting our support team at [email protected] and requesting immediate removal from all marketing lists.

12.3 Withdrawal of marketing consent will not affect the lawfulness of processing carried out before withdrawal, and will not prevent bexch from sending you transactional communications that are necessary for the operation of your account — such as deposit confirmations, withdrawal notifications, and security alerts.

12.4 bexch does not share your contact details with third-party marketers. Our marketing communications come exclusively from bexch and relate exclusively to bexch products and services on bexch.pro.

13 Changes to This Privacy Policy

13.1 bexch reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Any material changes to this Policy will be communicated to registered Players via email notification to the address on file and/or a prominent notice on the bexch.pro platform prior to the changes taking effect.

13.2 The date of the most recent revision is indicated at the top of this Policy under "Last Updated." We encourage you to review this Policy periodically to stay informed about how bexch is protecting your personal data.

13.3 Where changes to this Policy require your renewed consent — for example, where we propose to use your personal data for a new purpose not covered by the original consent you provided — we will seek that consent explicitly before commencing the new processing activity. Your continued use of the bexch platform following the effective date of any non-material changes constitutes your acknowledgement of those changes.

13.4 Previous versions of this Privacy Policy are available on request by contacting our support team. We maintain an internal archive of all historical Policy versions for regulatory and audit purposes.

14 Contact Us

14.1 If you have any questions, concerns, or requests relating to this Privacy Policy or to bexch's handling of your personal data, please contact our dedicated Privacy and Data Protection team using the following details:

14.2 When submitting a data rights request or privacy complaint, please include your registered account username or email address, a clear description of your request or concern, and any relevant supporting information. This will enable us to locate your records and respond as efficiently as possible.

14.3 bexch is committed to resolving all privacy-related concerns fairly and promptly. If you are not satisfied with our response, you retain the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.