CoinsBack Privacy Policy — How We Protect Your Data on Pakistan's PKR Platform

CoinsBack is an online sports betting and casino platform operated at coinsback.ws. We provide Pakistani players with access to sports betting markets (cricket, football and 30+ other sports), online casino games, crash games and virtual sports — all denominated and settled in Pakistani Rupees (PKR).

For the purposes of data protection, CoinsBack is the data controller responsible for the personal information you provide when using our platform. We are the entity that decides how and why your data is processed, and we are responsible for keeping it safe.

If you have any question, concern or request relating to this Privacy Policy or the way CoinsBack handles your personal data, please contact us at:

• Email: support@coinsback.ws — please use the subject line "Privacy Request" for data-related enquiries.
• Live Chat: Available 24/7 inside the CoinsBack platform in both Urdu and English.

CoinsBack collects the minimum personal data necessary to operate your account, process PKR transactions and comply with our legal obligations. Here is a breakdown of what we collect, when and why:

CoinsBack does not collect sensitive personal data such as biometric information, health data, religious or political views. The only exception is identity documents (CNIC/passport) which are required under AML law — these are stored securely and accessed only by compliance staff for KYC purposes.

Every piece of data CoinsBack holds about you is used for a specific, legitimate purpose. Here is exactly what we do with it:

• Account operation: Your name, mobile number and email are used to create and manage your CoinsBack account, send you account notifications (withdrawals, deposits, security alerts) and verify your identity when you contact support.
• PKR payment processing: Your payment method details (Easypaisa number, JazzCash number, bank account) are used solely to process deposits into your CoinsBack account and to return winnings and withdrawals to you in PKR. We do not store full card numbers.
• KYC and AML compliance: Identity documents, date of birth and CNIC are used to verify that you are who you say you are, that you are 18 or older, and to satisfy our anti-money laundering obligations under applicable law. This is a legal requirement, not optional.
• Fraud prevention and security: IP addresses, device data and betting patterns are analysed by CoinsBack's risk systems to detect suspicious activity, bonus abuse, account sharing or fraudulent deposits. This protects both CoinsBack and legitimate players.
• Responsible gaming: Your betting history, session length and deposit patterns may be monitored to identify signs of problem gambling. If we detect concerning patterns, we may proactively reach out or apply temporary limits in accordance with our Responsible Gaming policy.
• Platform improvement: Aggregated, anonymised usage data helps CoinsBack understand how players navigate the platform, which features are popular and where the experience can be improved. This data cannot be traced back to any individual player.
• Marketing (with consent only): If you have opted in to marketing communications, your contact details are used to send you promotional offers and VIP Club updates. See Section 12 for full details and how to opt out.

CoinsBack processes your personal data only where there is a valid legal justification for doing so. The legal bases we rely on are:

• Performance of a contract: Most of the data CoinsBack processes is necessary to provide you with the services you signed up for — running your account, processing PKR deposits and withdrawals, settling bets and crediting winnings. Without this data, we simply cannot deliver the service.
• Legal obligation: KYC verification, AML monitoring, age verification and fraud reporting are required by applicable law. CoinsBack does not have discretion over whether to perform these — they are mandatory legal requirements.
• Legitimate interests: Fraud detection, platform security monitoring and responsible gaming monitoring are carried out under CoinsBack's legitimate interests in protecting its players and the platform. These interests have been assessed and do not override your privacy rights.
• Consent: Marketing communications are sent only to players who have actively opted in. You may withdraw this consent at any time without it affecting your account or any other aspect of the service.

CoinsBack does not sell, rent or trade your personal data. We share it only in the following specific, limited circumstances:

• Payment providers: Your payment details are shared with Easypaisa, JazzCash, NayaPay, SadaPay, your bank or card network solely to process your PKR deposits and withdrawals. These providers are bound by their own privacy policies and financial regulations.
• Game providers: Your account identifier (not your personal details) is shared with game providers such as Evolution Gaming, Pragmatic Play and JILI to allow you to play their games within the CoinsBack platform. These providers receive only what is necessary to run the game session.
• Identity verification services: During KYC verification, CoinsBack may use a regulated third-party identity verification service to cross-check CNIC details. These services operate under strict data processing agreements with CoinsBack.
• Regulatory and legal authorities: CoinsBack is required by law to report certain transactions and suspicious activities to relevant regulatory and law enforcement authorities. This includes AML reports and responses to lawful legal requests. We do not have discretion over whether to comply with lawful authority requests.
• IT infrastructure providers: CoinsBack uses trusted hosting, cloud storage and security infrastructure providers to run the platform. These providers act as data processors under contract with CoinsBack and are prohibited from using your data for any purpose other than providing infrastructure services to us.

Because CoinsBack operates exclusively in Pakistani Rupees and processes real money transactions through Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card networks, we are subject to financial regulation that affects how we handle payment data. Here is what that means in practice:

• CoinsBack does not store full card numbers. When you add a Visa or Mastercard, only the last four digits are retained in our system for identification. Full card data is processed entirely by the payment gateway and never passes through CoinsBack's own servers.
• Easypaisa and JazzCash wallet numbers are stored securely in your account profile and used only to process your requested transactions. We do not make any payment from your CoinsBack account to your wallet without your explicit request.
• All financial transaction records — every deposit, withdrawal, bonus credit and bet settlement — are retained for a minimum of five years in accordance with AML regulations. This is a legal requirement that cannot be waived even if you close your CoinsBack account.
• Withdrawals above Rs 50,000 trigger an enhanced KYC check. This means CoinsBack will request identity documents (CNIC or passport) before releasing funds if they have not already been provided. This process is required by financial regulations, not a discretionary CoinsBack policy.

CoinsBack uses cookies — small data files stored on your device — to keep you logged in, remember your preferences, monitor platform performance and detect suspicious login attempts. Here is a breakdown of the cookies CoinsBack uses:

Essential cookies cannot be disabled as they are required for the platform to function. Functional and analytics cookies can be managed via the cookie preferences panel accessible from the footer of any CoinsBack page. Disabling analytics cookies has no effect on your ability to bet, deposit or withdraw.

CoinsBack does not use third-party advertising cookies or tracking pixels that share your data with ad networks.

Data security at CoinsBack is not an afterthought. Given that we handle real PKR transactions and sensitive identity documents, keeping your data safe is one of the most important things we do. Here is what we have in place:

• SSL/TLS encryption: All communication between your device and CoinsBack is encrypted using TLS 1.3. This means your username, password, payment details and betting data cannot be intercepted in transit.
• Data encryption at rest: Personal data and financial records stored in CoinsBack's databases are encrypted at rest using AES-256 — the same standard used by banks and government systems.
• Access controls: CoinsBack staff access to player data is role-based and strictly limited. Only compliance and support staff have access to personal data, and only to the extent required for their job function. All access is logged.
• Regular security audits: CoinsBack's platform and infrastructure are subject to regular penetration testing and security reviews by independent third parties. Vulnerabilities identified are patched on a priority basis.
• Two-factor authentication: CoinsBack encourages all players to enable 2FA on their accounts. When enabled, any login from an unrecognised device requires a one-time code sent to your registered Pakistani mobile number.
• Incident response: In the event of a data breach that puts your personal data at risk, CoinsBack will notify you within 72 hours of becoming aware of the incident, in accordance with applicable data protection law.

CoinsBack retains different categories of data for different periods depending on the purpose for which it was collected and applicable legal requirements:

• Account data (name, contact details, account settings): Retained for the lifetime of your active account plus five years after account closure to satisfy AML record-keeping obligations.
• Financial and transaction records (deposits, withdrawals, bet history): Retained for a minimum of five years from the date of each transaction, as required by anti-money laundering regulations. This retention period cannot be shortened even if you request account deletion.
• KYC documents (CNIC, passport scans): Retained for five years from account closure. These are held in an encrypted, access-controlled document store separate from your main account profile.
• Device and session data (IP addresses, login timestamps): Retained for 12 months, after which they are automatically purged from our systems unless retained for active fraud or security investigations.
• Marketing consent records: Retained for as long as your account is active plus two years to demonstrate compliance with consent requirements. The consent record is retained even if you opt out — it shows that you previously consented and then withdrew consent.

When retention periods expire, data is deleted or irreversibly anonymised. CoinsBack conducts quarterly data retention audits to ensure that data is not held for longer than necessary.

You have meaningful rights over your personal data at CoinsBack. These rights are real and actionable — not just words in a policy. Here is what you are entitled to and how to exercise each right:

CoinsBack is strictly an adults-only platform. No person under the age of 18 is permitted to register an account, deposit funds or place any bet or casino game round on CoinsBack.

CoinsBack does not knowingly collect personal data from anyone under 18. If, during KYC verification or at any other point, we determine that an account holder is under 18, the account will be closed immediately. Any personal data collected in relation to an underage account will be deleted (subject to any mandatory legal retention requirements for the transaction record).

If you believe a minor is using a CoinsBack account, please contact support immediately at support@coinsback.ws. We take underage gambling extremely seriously and act on all such reports without delay.

CoinsBack sends promotional communications — including bonus offers, VIP Club updates, new feature announcements and sports-related promotions — only to players who have explicitly opted in during registration or at a later point through their account settings.

• Marketing messages are sent via SMS to your registered Pakistani mobile number and/or via email, based on your preferences.
• CoinsBack will never sell your contact details to third-party marketers. You will only ever receive marketing messages from CoinsBack directly.
• You may opt out of marketing communications at any time by updating your preferences in account settings, by clicking "unsubscribe" in any marketing email, or by contacting support. Opting out does not affect service-related messages such as deposit confirmations, withdrawal alerts and security notifications — these are sent regardless of marketing preferences as they are essential account communications.
• Players who have self-excluded from CoinsBack will not receive any marketing communications for the duration of their exclusion.

CoinsBack may update this Privacy Policy from time to time. When we make material changes — meaning changes that affect how we collect, use or share your personal data — we will notify registered players via in-platform notification and email before the changes take effect. Minor updates (such as clarifications of existing practices or corrections of typos) may be made without individual notification.

The current version of this Privacy Policy is always available at coinsback.ws/privacy-policy, with the "Last updated" date shown clearly at the top. If you continue to use CoinsBack after being notified of an update, you are confirming your acceptance of the revised Policy. If you do not agree with any change, please contact support to discuss your options, including account closure and return of your PKR balance.

If you want to exercise any of your data rights, ask a question about this Privacy Policy, report a concern about how your data is being handled or submit a formal privacy complaint, please contact CoinsBack through any of the following channels:

• Email: support@coinsback.ws — use the subject line "Privacy Request" and include your registered mobile number or account username. Responses within 30 days.
• Live Chat: Available 24/7 in both Urdu and English from within the CoinsBack platform. For general privacy questions, live chat is the fastest channel.
• VIP WhatsApp (Platinum & Diamond members): Contact your dedicated account manager directly for privacy-related requests.

CoinsBack will acknowledge your privacy request within five business days and provide a full response within 30 days. Where a request is complex or involves multiple data categories, we may request additional time but will notify you within the initial 30-day window.