1 Who We Are
BP Exch is an online betting exchange operating at bpexch.wine, providing sports betting, live casino, and gaming services to players in Pakistan. When this Privacy Policy refers to "BP Exch", "we", "us", or "our", it means the operator of the BP Exch platform responsible for processing the personal data described in this document.
We take privacy seriously — not because we are required to say that, but because our players' trust is the foundation of everything we do. Pakistani players share sensitive personal and financial information when they register and transact on BP Exch, and we have a genuine obligation to handle that information with care, transparency, and purpose.
This Privacy Policy applies to all personal data collected through the BP Exch website, mobile browser interface, and any communications between you and our support team. It does not apply to third-party websites or services that may be linked from our platform — those operate under their own separate privacy practices.
By registering an account or using any BP Exch service, you confirm that you have read this Privacy Policy and agree to the data practices described herein. If you disagree with any part of this policy, please do not register or continue using the platform.
2 Data We Collect
BP Exch collects personal data through three channels: information you provide directly, information generated by your use of the platform, and information received from third-party payment processors during transaction verification. We do not collect data beyond what is necessary for these purposes.
2.1 Information You Provide Directly
- Account registration: Full legal name, Pakistani mobile number, email address, date of birth, and CNIC number for identity verification.
- KYC verification documents: A copy of your CNIC (front and back), and in some cases proof of payment method ownership (e.g. screenshot of your Easypaisa or JazzCash account).
- Support communications: Content of messages you send to our support team via live chat or email, including any attachments you choose to provide.
- Responsible gaming preferences: Settings you choose for deposit limits, session timers, and self-exclusion are recorded in your account profile.
2.2 Data Generated by Platform Use
- Betting activity: All bets placed, odds accepted, markets used, cash out decisions, and settlement outcomes across all BP Exch products.
- Transaction records: Deposit amounts, withdrawal requests, payment methods used, timestamps, and processing status for every PKR transaction.
- Device and access data: IP address, device type, operating system, browser type and version, screen resolution, and session duration logs.
- Behavioural data: Pages visited, features used, time spent on specific sections, and navigation patterns within the platform.
2.3 Data from Third Parties
When you make a deposit or request a withdrawal via Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, or card payment, the relevant payment provider shares transaction confirmation data with BP Exch. This includes transaction reference numbers, amounts, timestamps, and the registered mobile number or account holder name associated with the payment. BP Exch does not receive or store your payment account passwords or card PINs at any stage.
3 How We Use Your Data
BP Exch uses personal data for specific, defined purposes only. We do not use your data for anything beyond what is described here, and we do not sell your data to third parties under any circumstances.
- Account management: Creating, maintaining, and securing your BP Exch account. This includes login authentication, password reset processes, and security alerts for unusual access attempts.
- Transaction processing: Processing all deposits and withdrawals in PKR via your chosen payment method. Verifying that payment account ownership matches your registered identity to prevent fraud.
- Identity verification (KYC): Confirming that you are 18 or older and that your account details are accurate, as required by responsible gaming standards.
- Service delivery: Making your bet history, account balance, transaction records, and responsible gaming settings available to you within your account.
- Security and fraud prevention: Detecting multiple accounts, identifying suspicious betting patterns, and preventing money laundering, bonus abuse, and other prohibited activities.
- Customer support: Responding to your queries, resolving disputes, and maintaining records of support interactions for quality and training purposes.
- Platform improvement: Analysing aggregated, anonymised behavioural data to improve the BP Exch user interface, load times, and feature design. Individual data is not used for this purpose without anonymisation.
- Regulatory compliance: Retaining records as required by applicable verification and anti-money laundering standards.
BP Exch does not use your betting history or personal data to profile you for targeted advertising to third parties, and we do not share data with advertising networks or data brokers.
4 Legal Basis for Processing
BP Exch processes personal data under the following legal bases, each of which applies to specific processing activities:
- Contractual necessity: Processing your identity, contact, financial, and betting data is necessary to provide the services you have contracted for when registering a BP Exch account. Without this processing, we cannot operate your account or process transactions.
- Legal obligation: Retaining KYC and transaction records to comply with applicable verification, anti-money laundering, and responsible gaming requirements.
- Legitimate interests: Processing device and behavioural data for security, fraud prevention, and platform improvement, where those interests are not overridden by your rights and freedoms.
- Consent: Where we send you promotional communications about BP Exch offers or new features, we do so on the basis of your consent, which you may withdraw at any time by updating your notification preferences in your account settings or contacting support.
5 Data Sharing
BP Exch shares personal data only in the limited circumstances described below. We do not sell, rent, or trade your data to third parties for marketing or commercial purposes under any circumstances.
5.1 Payment Processors
To process your PKR deposits and withdrawals, BP Exch must share relevant transaction data with Easypaisa, JazzCash, NayaPay, SadaPay, participating banks, and card payment processors. This sharing is limited to the minimum data required to authenticate and complete each transaction and is governed by each processor's own security standards and data protection terms.
5.2 Identity Verification Services
BP Exch may use third-party identity verification providers to assist with CNIC checks and age verification. These providers process your identity documents solely for verification purposes and are contractually prohibited from using your data for any other purpose.
5.3 Technology and Infrastructure Partners
BP Exch uses trusted technology providers for hosting, database management, and security monitoring. These providers act as data processors on our behalf under strict contractual agreements and have no independent right to use your data.
5.4 Legal Requirements
BP Exch will disclose personal data where required to do so by law, regulation, or valid legal process. Where possible and legally permitted, we will notify you before disclosing your data in response to a legal request.
BP Exch will never share your data with other betting operators, advertising networks, data brokers, or any party for commercial gain. If you ever receive an approach claiming to come from BP Exch that asks for your login credentials or payment details, treat it as fraudulent and contact our support team immediately.
6 PKR Payments & KYC Data
Given that all BP Exch transactions are processed in Pakistani Rupees through local payment channels, the handling of financial and identity data deserves specific explanation. When you deposit via Easypaisa or JazzCash, your mobile wallet number and transaction reference are recorded against your BP Exch account. These details are used solely to confirm receipt of funds, reconcile your account balance, and process your withdrawal to the same verified method.
KYC documents — primarily your CNIC — are stored in an encrypted, access-controlled document system separate from your active account data. Only the compliance team at BP Exch has access to these documents, and access is logged for audit purposes. Documents are not viewable by customer support agents handling routine account queries.
Once KYC verification is complete and your account is confirmed as fully verified, the original document images are retained only as long as required by applicable record-keeping standards, after which they are securely deleted. You will be notified when your KYC status is updated.
BP Exch does not store card numbers, Easypaisa PINs, JazzCash passwords, or any credentials for your external payment accounts. We interact only with the transaction confirmation data shared by payment processors after a transaction has been authenticated on their systems.
7 Cookies & Tracking Technologies
BP Exch uses cookies and similar tracking technologies to operate the platform, maintain your session, and gather the anonymised analytics that help us improve the product. Cookies are small text files stored on your device when you access the platform. They do not contain your personal information in readable form and cannot execute code or transmit viruses.
You can control cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to use core BP Exch features, though some analytics-driven improvements may be less tailored to your usage patterns.
8 Data Retention
BP Exch retains personal data only for as long as it is necessary for the purposes described in this policy and to meet applicable record-keeping requirements. The following retention periods apply:
- Active account data (name, contact details, betting history, transaction records): Retained for the duration of your account and for 5 years following permanent account closure.
- KYC documents (CNIC copies): Retained for 5 years from verification date or from account closure, whichever is later, then securely deleted.
- Support communications: Retained for 2 years from the date of the most recent message in a thread, then deleted unless a related dispute or legal matter requires longer retention.
- Technical and device logs: Retained for 90 days for security monitoring purposes, then anonymised or deleted.
- Analytics data: Aggregated and anonymised within 30 days of collection. Anonymised data may be retained indefinitely as it no longer constitutes personal data.
If you request deletion of your account, BP Exch will initiate the deletion process within 30 days. Some data categories — specifically transaction records and KYC documents — may be retained beyond this period where required by applicable legal or regulatory obligations, even following a deletion request.
9 Data Security
BP Exch implements industry-standard technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:
- 256-bit SSL/TLS encryption for all data transmitted between your device and the BP Exch platform, including login, bet placement, and transaction requests.
- At-rest encryption for all databases containing personal and financial data, using AES-256 standard.
- Role-based access controls ensuring that employees can only access the data categories necessary for their specific function. Customer support agents, for example, cannot access KYC documents; only the compliance team can.
- Regular penetration testing and vulnerability assessments conducted by independent security professionals.
- Real-time security monitoring and automated alerting for unusual access patterns, login attempts from unrecognised devices, and high-frequency API requests that may indicate automated abuse.
- Secure destruction procedures for physical and digital data that has reached the end of its retention period.
Despite these measures, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that poses a material risk to your rights or interests, BP Exch will notify affected players within 72 hours of becoming aware of the incident, describing the nature of the breach and the steps being taken to address it.
You also play a role in keeping your account secure. Use a strong, unique password for your BP Exch account, enable any available two-factor authentication options, and never share your login credentials with anyone — including individuals claiming to represent BP Exch support.
10 Your Rights
As a player whose personal data is processed by BP Exch, you have the following rights. These apply regardless of whether your account is active or closed, subject only to the specific limitations noted below.
Right to Access
Request a copy of all personal data BP Exch holds about you. We will provide this in a readable format within 30 days of a verified request.
Right to Rectification
Request correction of any inaccurate or incomplete personal data. Contact support with the correct information and supporting evidence where relevant.
Right to Deletion
Request deletion of your personal data and account. Some categories may be retained where required by law. We will tell you what we can and cannot delete and why.
Right to Restriction
Request that BP Exch temporarily stops processing your data while a dispute about its accuracy or the lawfulness of processing is being resolved.
Right to Portability
Request your personal data in a structured, machine-readable format so that you can transfer it to another service provider if you choose.
Right to Object
Object to processing carried out on the basis of legitimate interests — particularly in relation to analytics or security profiling. We will review your objection and respond in writing.
To exercise any of these rights, contact our team at support@bpexch.wine. We will acknowledge your request within 48 hours and complete it within 30 days, or provide a written explanation if the request cannot be fulfilled in full.
11 Children's Privacy
BP Exch does not knowingly collect personal data from anyone under the age of 18. The platform is strictly for adults. Our registration process includes date of birth verification, and KYC verification confirms age against CNIC data. If we discover that a registered account belongs to a person under 18, the account will be immediately closed, all bets voided, and all deposited funds returned after identity verification. No winnings will be paid out to underage accounts under any circumstances.
If you are a parent or guardian and believe your child has registered on BP Exch, please contact us immediately at support@bpexch.wine. We take these cases seriously and act on them within 24 hours of a verified report.
12 Policy Updates
BP Exch reviews this Privacy Policy regularly to ensure it accurately reflects our data practices and any changes in applicable standards. When we make material changes — those that significantly affect how your data is used or what rights you have — we will notify all registered players via email and display a prominent notice on the platform at least 14 days before the changes take effect.
Minor updates, such as clarifications or corrections that do not change the substance of the policy, will be made without advance notice and will be reflected by an updated "Last Updated" date at the top of this page. We encourage you to review the Privacy Policy periodically. Continued use of BP Exch after an update constitutes acceptance of the revised policy.
13 Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the personal data BP Exch holds about you, please get in touch with our team. We aim to respond to all privacy-related queries within 48 hours.