228win Privacy Policy

This Privacy Policy applies to all users of the 228win platform, including the website at 228win.onl, the Android APK application and the iOS web app. It describes how 228win ("we", "us", "the platform") collects, processes, stores and protects personal data relating to registered players and visitors.

By registering an account or using the 228win platform in any capacity, you acknowledge that you have read and understood this Privacy Policy. This policy should be read alongside the Terms and Conditions, which also governs your use of the platform.

We may update this policy from time to time. When we do, the revised version will be published on this page with an updated date. For significant changes that affect how your data is handled, we will endeavour to notify registered users through in-platform messages.

228win collects personal data in two main ways: directly from you when you register and use the platform, and automatically through your interactions with the website and app. Below is a breakdown of the categories of data we collect.

The data collected by 228win is used for specific, legitimate purposes tied to operating the platform and serving players. We do not use your data for purposes you would not reasonably expect. The main uses are:

Account Management

Your registration data is used to create and maintain your account, verify your identity, manage your login credentials and communicate with you about your account status, bets and transactions. Without this, we cannot provide you with a personalised account on the platform.

Payment Processing

Payment data is used to process deposits and withdrawals via JazzCash, Easypaisa, Raast, bank transfer and other supported methods. Transaction records are kept for accounting purposes and to resolve any disputes about payment amounts or timing.

Security and Fraud Prevention

Device and technical data, alongside activity data, is used to detect and prevent fraudulent activity, multiple account creation, bonus abuse and other prohibited conduct as described in the Terms and Conditions. This helps protect all players on the platform, not just the individual concerned.

Responsible Gaming

Activity data — including deposit frequency, session length and betting patterns — is monitored to identify signs of potentially harmful gambling behaviour. This allows 228win to apply responsible gaming measures such as deposit limit prompts, cooling-off periods or account reviews where patterns of concern are identified.

Platform Improvement

Aggregated and anonymised usage data helps us understand how players use the platform, which features are most used and where the experience could be improved. This data does not identify individuals — it is used at a statistical level only.

Legal Obligations

We may process your data to comply with applicable legal requirements, including record-keeping obligations, responding to lawful requests from authorities and managing disputes or legal claims.

228win processes payments exclusively in PKR through verified payment providers. Payment-related data — including your JazzCash or Easypaisa mobile number, bank account details or card information — is handled with a high level of security and is subject to additional protections beyond standard personal data.

• Full card numbers and CVV codes are never stored by 228win directly — card transactions are processed through PCI-DSS compliant payment gateways
• Mobile wallet identifiers (JazzCash, Easypaisa numbers) are stored only in association with your account for the purpose of processing withdrawals back to the correct account
• Transaction records — amounts, dates, methods — are retained for a minimum of five years for accounting and dispute resolution purposes
• Payment data is never shared with third parties for marketing purposes

The 228win website uses cookies and similar tracking technologies to operate the platform, maintain your session and understand how visitors use the site. Cookies are small text files placed on your device when you visit the website.

Types of Cookies Used

• Strictly necessary cookies: Required for the platform to function — session management, login state, security tokens. Cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences such as language settings, preferred deposit method and notification preferences.
• Analytics cookies: Collect anonymised data about how pages are used — page views, time on site, navigation paths. Used to improve the platform experience.
• Security cookies: Help detect and prevent fraudulent login attempts, bot activity and account takeover attempts.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect the functionality of the platform and may prevent login or access to certain features.

The 228win Android app does not use browser cookies. The app uses device-level storage for session management, which serves the same functional purpose as session cookies on the website.

228win does not sell your personal data to third parties. We do not share your data with advertisers, data brokers or marketing companies. Data is shared with third parties only in the following specific, necessary circumstances:

• Payment processors: JazzCash, Easypaisa, Raast, bank networks and card processors receive the payment data required to complete your deposit or withdrawal transactions
• Identity verification providers: When KYC (Know Your Customer) verification is required, your identity documents and verification data are processed by a verified KYC service provider
• Fraud prevention services: Device fingerprinting and risk scoring services may receive technical data to assess the legitimacy of login attempts and transactions
• Game providers: When you play live casino games or slots, the relevant game provider receives the data necessary to run the game session — typically a session token and stake amount, not full personal details
• Legal and regulatory: Data may be disclosed to relevant authorities in response to lawful requests, court orders or other legal obligations

228win retains personal data for as long as necessary to fulfil the purposes for which it was collected, plus any additional period required by applicable legal or operational obligations. The general retention periods we apply are:

• Active account data: Retained for the duration of your account and for a period of at least five years after account closure
• Transaction records: Retained for a minimum of five years from the date of the transaction for accounting and dispute resolution purposes
• Identity verification documents: Retained for the duration of your account and for a period following account closure as required by applicable obligations
• Support communications: Retained for up to three years from the date of the last interaction
• Technical and device data: Retained in log form for up to 12 months and in anonymised aggregate form thereafter

Where data is no longer needed and its retention period has elapsed, it is securely deleted or anonymised such that it can no longer be associated with any individual.

As a registered user of 228win, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting the support team through your account.

228win applies a range of technical and operational security measures to protect your personal data from unauthorised access, loss, alteration or disclosure. These include:

• Encryption in transit: All data transmitted between your device and the 228win platform is encrypted using TLS (Transport Layer Security)
• Encrypted storage: Sensitive personal data and payment information stored on 228win servers is encrypted at rest
• Access controls: Access to personal data within 228win's systems is restricted on a need-to-know basis. Staff members can only access the data relevant to their specific role
• Session management: Account sessions are managed with secure tokens that expire after a period of inactivity, reducing the risk of unauthorised account access
• Fraud monitoring: Automated systems monitor for unusual login patterns, payment anomalies and other indicators of account compromise
• Password security: Passwords are stored in hashed form — 228win staff cannot see your password and will never ask you to share it

While 228win applies strong security measures, no online platform can guarantee absolute security. You also have a role in keeping your account safe — use a strong, unique password, do not share your login credentials and contact support immediately if you suspect your account has been compromised.

If we become aware that an account has been created by a person under 18, the account will be closed immediately, any funds will be returned via the original payment method and all associated personal data will be deleted. Age verification checks are applied as part of the registration and ongoing account management process.

If you are a parent or guardian and believe a minor has created an account on 228win using their details or yours, please contact support as soon as possible so the account can be reviewed and closed.

228win may update this Privacy Policy from time to time to reflect changes in how the platform operates, changes in applicable laws or improvements to our privacy practices. The date shown at the top of this page indicates when the policy was last updated.

For changes that materially affect how your personal data is used — particularly any change to the categories of data we collect, the purposes for which it is used or the parties with whom it is shared — we will notify registered users through in-platform notifications or by email where we hold a valid address.

We encourage you to review this policy periodically. Continued use of the 228win platform after any update to this policy constitutes acceptance of the revised version.

If you have any questions about this Privacy Policy, wish to exercise a data right or have a concern about how your personal data has been handled, please contact the 228win support team through your account or via the contact details below.