Your privacy matters to us. This Privacy Policy explains exactly what personal data bpexchang collects from Pakistani players, how it is used, who it may be shared with, and what rights you have over your own information.
Privacy at bpexchang is not a checkbox exercise — it is a set of active commitments that shape every data decision the platform makes. These are the most important ones.
All data exchanged between your device and bpexchang is protected with TLS 1.3 encryption — the same standard used by Pakistan's major banks and financial institutions. No third party can intercept your account or payment data in transit.
bpexchang stores your personal data on encrypted servers with strict access controls. Only authorised personnel with a specific operational need can access player data. All access events are logged and reviewed.
bpexchang will never sell, rent, or trade your personal data to third-party marketers. Your contact details, transaction history, and gaming behaviour are yours — bpexchang uses them to operate the platform and nothing else.
bpexchang only collects data that is genuinely necessary to operate your account, process payments, and comply with applicable requirements. We do not collect data speculatively or build profiles beyond what the platform needs to function.
Data is shared only with the specific third parties required to operate bpexchang — payment processors like Easypaisa and JazzCash, identity verification providers, and platform security services. Every third party is contractually bound to handle your data securely.
bpexchang gives you genuine, exercisable rights over your data — including the right to access everything we hold on you, correct inaccuracies, request deletion, and withdraw marketing consent. These are not hollow promises — they are handled by our support team within 30 days.
This Privacy Policy ("Policy") explains how bpexchang ("we", "us", "the Platform") collects, uses, stores, and protects the personal data of players and visitors ("you") in connection with the bpexchang platform at bpexchang.com.
By registering an account or continuing to use bpexchang, you acknowledge that you have read and understood this Policy. This Policy forms part of the bpexchang Terms and Conditions. Defined terms used here carry the same meaning as in the Terms and Conditions unless stated otherwise.
bpexchang is the data controller responsible for personal data collected through the bpexchang platform. As data controller, bpexchang determines the purposes and means by which your personal data is processed.
We are a Pakistan-focused online gaming and casino platform that has been serving Pakistani players since 2019. Every data processing activity described in this Policy relates specifically to operating the bpexchang platform for players in Pakistan.
If you have any questions about this Policy, or wish to exercise your data rights, you can contact bpexchang's dedicated privacy team at:
All privacy requests are handled by bpexchang's dedicated team, not a general support queue. We aim to respond to all privacy requests within 5 working days and to complete them within 30 days.
bpexchang collects personal data through three main channels: information you provide directly, information generated by your use of the platform, and information received from third parties (such as payment processors and identity verification services).
Important: bpexchang does not collect or store full payment card numbers. Card data is processed directly by PCI-DSS compliant payment partners — bpexchang only receives a masked card reference for display purposes.
bpexchang uses the personal data it collects for clearly defined, legitimate purposes. We do not use your data for any purpose incompatible with those listed below without your explicit consent.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Registration data, identity documents | Contract performance |
| Processing deposits and withdrawals | Transaction data, payment processor data | Contract performance |
| Age and identity verification | CNIC/passport, date of birth | Legal obligation |
| Providing and improving games | Gaming activity, session data | Contract performance / Legitimate interest |
| Fraud detection and prevention | Device data, IP address, transaction history | Legitimate interest / Legal obligation |
| Customer support | Communication records, account data | Contract performance |
| Responsible gaming monitoring | Gaming activity, responsible gaming preferences | Legitimate interest / Legal obligation |
| Promotional communications | Email, mobile number | Consent (opt-in at registration) |
| Platform security | Device data, IP address, session data | Legitimate interest |
| Compliance and record-keeping | Transaction history, identity documents | Legal obligation |
bpexchang does not use automated decision-making that produces legal or similarly significant effects on players without human review. Fraud flags generated by automated systems are always reviewed by a member of the bpexchang compliance team before any account action is taken.
bpexchang processes personal data under one or more of the following legal bases:
bpexchang takes data sharing seriously. We share personal data only with the specific categories of third party listed below, and only to the extent necessary for the stated purpose. All third parties who receive your data are contractually required to handle it in accordance with applicable data protection standards.
bpexchang shares transaction data with payment processors — including Easypaisa, JazzCash, NayaPay, SadaPay, IBFT bank networks, and Visa/Mastercard card processing networks — to facilitate deposits and withdrawals. These providers receive only the data necessary to execute the transaction.
When account verification is required, bpexchang shares the relevant personal data with third-party identity verification services. These providers confirm identity and age against official records and return a verification result to bpexchang. They are contractually prohibited from using your data for any other purpose.
bpexchang uses specialist fraud detection and platform security services. These providers process certain technical data — including IP addresses and device fingerprints — to identify and prevent fraudulent activity that could harm you or other players.
bpexchang uses third-party technology partners for specific platform functions including game hosting, customer support software, and email delivery. These partners process personal data only as instructed by bpexchang and for no other purpose.
bpexchang may disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by law, legal process, or to protect the rights and safety of bpexchang, its players, or the public. We will not disclose data beyond what is strictly required for the specific legal purpose.
What bpexchang will never do: Sell your personal data, share it with advertisers or data brokers, or use it for any purpose that has not been disclosed in this Policy.
Payment security is a particular priority at bpexchang given that all transactions are processed in PKR through Pakistani financial infrastructure. The following specific protections apply to your financial data:
If you notice a transaction on your bpexchang account that you did not authorise, contact bpexchang support immediately via live chat. We will investigate and, where appropriate, coordinate with the relevant payment provider to resolve the matter.
bpexchang uses cookies and similar technologies on its platform. A cookie is a small text file placed on your device when you visit bpexchang. Cookies allow the platform to function correctly and to understand how players use the service.
You can manage non-essential cookies through the cookie preferences panel accessible from the footer of the bpexchang platform. You can also manage cookies through your browser settings — note that disabling essential cookies will prevent bpexchang from functioning correctly.
bpexchang does not use third-party advertising cookies or tracking pixels that serve advertisements on other websites.
bpexchang retains personal data only for as long as necessary for the purpose it was collected and to comply with applicable legal and regulatory requirements. The following retention periods apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Account lifetime + 7 years | Legal and compliance requirements |
| Transaction records | 7 years from transaction date | Financial record-keeping obligations |
| Identity verification documents | 5 years from verification date | Anti-money laundering requirements |
| Customer support records | 3 years from last interaction | Dispute resolution and quality |
| Gaming activity logs | 5 years from session date | Dispute resolution and responsible gaming |
| Device and session data | 13 months from collection | Security and fraud detection |
| Marketing consent records | Until consent withdrawn + 3 years | Proof of consent compliance |
When personal data reaches the end of its retention period, it is securely deleted or permanently anonymised. Anonymised data may be retained beyond these periods for statistical purposes, where it can no longer be linked to any individual player.
bpexchang respects your rights over your personal data. The following rights are available to all bpexchang players. To exercise any of these rights, contact bpexchang support via live chat or at support@bpexchang.com, clearly stating which right you wish to exercise.
Request a copy of all personal data bpexchang holds on you. We will provide a full data export within 30 days of receiving a verified request.
If any personal data bpexchang holds on you is inaccurate or incomplete, you have the right to have it corrected without undue delay.
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to retention requirements we are legally obligated to meet.
Request that bpexchang stops actively using your data while a dispute or correction request is being resolved, without requiring full deletion.
Receive your personal data in a structured, machine-readable format that you can transfer to another service provider of your choice.
Where processing is based on consent — particularly marketing communications — you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
bpexchang aims to respond to all rights requests within 5 working days and to complete them within 30 days. Complex requests may take up to 90 days — in such cases, bpexchang will notify you within 30 days and explain why additional time is required. There is no charge for exercising your data rights.
bpexchang is strictly for adults aged 18 and above. The platform does not knowingly collect personal data from anyone under 18. Age verification is a mandatory part of the bpexchang registration process, and accounts suspected of belonging to minors are suspended immediately pending verification.
If a parent or guardian believes that their child has registered a bpexchang account, please contact us immediately at support@bpexchang.com. We will investigate and close the account promptly, deleting any personal data collected from the minor in accordance with this Policy.
bpexchang uses technical and procedural safeguards to minimise the risk of under-18 access, including mandatory date-of-birth entry at registration, CNIC verification for transactions above defined thresholds, and automated age-flag systems that trigger additional verification.
bpexchang implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:
Despite these measures, no internet-based system is completely immune to security risks. bpexchang will notify affected players promptly in the event of a data breach that is likely to result in risk to their rights and freedoms, and will take all reasonable steps to contain and remediate any breach.
bpexchang may update this Privacy Policy from time to time to reflect changes in how we process personal data, changes in applicable law, or improvements to our practices. The effective date at the top of this page will always show when the Policy was last updated.
For material changes — those that significantly affect how your data is processed or your rights under this Policy — bpexchang will provide at least 14 days' advance notice via email to your registered address and via an on-platform notification. Your continued use of bpexchang following a material change constitutes acceptance of the updated Policy.
We recommend reviewing this Policy periodically. Previous versions of this Policy are available on request from the bpexchang support team.
If you have any questions about this Privacy Policy, want to exercise a data right, or have concerns about how bpexchang handles your personal data, please contact us:
If you are not satisfied with bpexchang's response to a privacy concern, you have the right to escalate the matter to the relevant data protection authority. bpexchang is committed to resolving privacy concerns directly with players before any escalation becomes necessary — our team will engage constructively with any privacy complaint raised in good faith.
For responsible gaming concerns — which may involve personal data related to your gaming activity — please also visit the Responsible Gaming page, where dedicated tools and resources are available. The FAQ page also contains answers to common questions about how bpexchang handles player data.
This Privacy Policy was last updated on 1 January 2025. The version on this page is the current governing version. All previous versions are available on request.
Your data is protected, your payments are in PKR, and your privacy is a genuine priority — not an afterthought. Create your free bpexchang account in 2 minutes and claim your welcome bonus up to Rs 50,000. 18+ only. Please play responsibly.