677win Privacy Policy

This Privacy Policy ("Policy") describes how 677win ("we", "us", "our") collects, processes, stores and discloses personal data obtained from users ("you", "your") of the 677win platform, including all associated websites, mobile interfaces and digital services (collectively, the "Platform").

We recognise that privacy is a fundamental concern for users across Pakistan and internationally. This Policy is designed to be transparent, accessible and written in plain English — not obscure legal language. We encourage you to read it fully before registering an Account or submitting any personal data.

By using the Platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform immediately.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy.

The following terms have specific meanings throughout this Policy:

For the purposes of applicable data protection legislation, the Data Controller responsible for your personal data is 677win, operating the Platform at https://677win.cam.

677win does not hold or claim a Pakistani data protection registration, a Pakistani gambling licence or any endorsement from the Government of Pakistan, the Pakistan Telecommunication Authority (PTA) or the State Bank of Pakistan. Data protection practices are conducted in accordance with the laws of the jurisdiction in which the operator holds its primary operating licence.

For all privacy-related enquiries, users may contact 677win's support team via the contact details set out in Section 16 of this Policy.

677win collects personal data through multiple points of interaction with the Platform. The categories of data we collect are set out in the table below:

We do not knowingly collect sensitive special-category personal data (such as health information or biometric data for identification purposes) beyond what is strictly required for regulatory KYC compliance — specifically, liveness checks where the operator's compliance programme requires them.

677win processes your personal data only where a valid lawful basis exists under applicable data protection legislation. The lawful bases we rely on are:

• Contractual Necessity: Processing required to enter into and perform the contract with you — including account creation, transaction processing and service delivery.
• Legal Obligation: Processing required to comply with applicable law — including AML/KYC obligations, tax reporting and regulatory requirements.
• Legitimate Interests: Processing necessary for 677win's legitimate business interests — including fraud prevention, security monitoring and platform improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing for marketing communications and non-essential analytics cookies, where you have provided explicit, informed consent. You may withdraw consent at any time without affecting prior lawful processing.

677win uses your personal data for the following purposes:

• To create, verify and manage your Account and provide Platform services.
• To conduct identity and age verification (KYC) as required by our compliance obligations.
• To process deposits, withdrawals and in-platform financial transactions.
• To detect, investigate and prevent fraud, money laundering, collusion and other prohibited conduct.
• To comply with anti-money laundering (AML), counter-terrorism financing (CTF) and other applicable regulatory obligations.
• To administer bonuses, promotions and the VIP loyalty programme in accordance with their applicable terms.
• To provide customer support and respond to complaints and disputes.
• To enforce our Terms & Conditions and protect the rights of 677win and its users.
• To send you transactional communications (account updates, security alerts, withdrawal confirmations) — these are not optional and form part of the service.
• To send promotional and marketing communications — only where you have provided explicit consent, and only for as long as that consent remains active.
• To monitor and improve Platform performance, usability and stability using aggregated, anonymised analytics data.
• To fulfil responsible gambling obligations, including monitoring for problem gambling indicators and actioning self-exclusion requests.

677win does not sell, rent or trade your personal data to any third party for their own marketing purposes. We share data only in the following limited circumstances, and only to the extent necessary for the specified purpose:

• Identity Verification Providers: Third-party KYC services that process your identity documents and liveness data under data processing agreements with equivalent protections to this Policy.
• Payment Processors: Authorised payment service providers that handle deposit and withdrawal processing. Payment method names referenced on this Platform — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are familiar local references only and do not represent data-sharing partnerships or endorsements of gambling.
• Fraud & Security Providers: Third-party fraud prevention and cybersecurity services that assist in protecting the Platform and its users from malicious activity.
• Regulatory & Law Enforcement Bodies: Where we are legally compelled to disclose data by a court order, regulatory authority or law enforcement agency in a jurisdiction with appropriate legal authority.
• Corporate Transactions: In the event of a merger, acquisition or sale of assets, personal data may be transferred as part of the business transaction. You will be notified in advance where such a transfer materially affects your rights.

All third-party Data Processors engaged by 677win are required to maintain appropriate technical and organisational security measures and to process personal data only on documented instructions from 677win.

As an online platform with international operations, 677win may transfer your personal data to countries outside your country of residence, including to countries that may have different data protection standards.

Where such transfers occur, 677win ensures that appropriate safeguards are in place — such as standard contractual clauses, adequacy decisions or equivalent legally recognised transfer mechanisms — to protect your personal data at a standard equivalent to this Policy.

Users in Pakistan should note that Pakistan does not currently have a comprehensive data protection law equivalent to, for example, the EU GDPR. However, 677win applies consistent data protection standards across all jurisdictions in which it operates, regardless of local legal requirements.

677win retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by Applicable Law. The general retention periods we apply are:

• Account & Identity Data: Retained for the duration of the Account and for a minimum of five (5) years following Account closure, in line with AML/KYC regulatory obligations.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Betting & Gaming Data: Retained for the duration of the Account and a minimum of two (2) years post-closure for dispute resolution purposes.
• Support Communications: Retained for three (3) years from the date of the communication.
• Marketing Consent Records: Retained for as long as consent remains active, plus two (2) years following withdrawal of consent.
• Technical & Log Data: Retained for twelve (12) months in standard operations; up to five (5) years where a security incident investigation is ongoing.

On expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised so that it can no longer identify you.

677win implements a comprehensive range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction or alteration. These measures include:

• HTTPS / TLS encryption for all data transmitted between your device and the Platform.
• Encryption at rest for sensitive data categories including identity documents and payment identifiers.
• Role-based access controls limiting internal data access to authorised personnel only.
• Regular third-party penetration testing and vulnerability assessments.
• Audit logging of access to sensitive data systems.
• Staff training on data protection obligations and information security procedures.
• Incident response procedures for the detection, containment and notification of data breaches.

Notwithstanding these measures, no transmission over the internet or electronic storage system is completely secure. Users are responsible for maintaining the security of their own login credentials and for notifying 677win immediately upon becoming aware of any suspected unauthorised Account access.

In the event of a personal data breach that poses a risk to your rights and freedoms, 677win will notify affected users and relevant authorities in accordance with applicable data protection law.

677win uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you access a website. They enable the Platform to function correctly and to recognise returning users.

The categories of cookies we use are:

• Strictly Necessary Cookies: Essential for basic Platform functionality — user authentication, session management and security. These cannot be disabled without significantly impairing your use of the Platform.
• Performance / Analytics Cookies: Used to collect anonymised information about how users interact with the Platform — pages visited, time on site, error events. This data is aggregated and cannot identify individual users. These are only deployed where you have provided consent.
• Functional Cookies: Used to remember your preferences — such as language settings and notification preferences — to improve your experience.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect Platform functionality. Consult your browser's help documentation for guidance on cookie management.

Subject to applicable data protection law and certain limitations, you have the following rights in relation to your personal data held by 677win:

To exercise any of these rights, please contact 677win's support team using the details in Section 16. We will respond within 30 days of receiving a valid request. We may need to verify your identity before processing a request to protect against unauthorised data access.

Some rights are subject to limitations — for example, we may be unable to delete data that we are legally required to retain under AML/KYC obligations. We will always explain any limitation that applies to your specific request.

If you are dissatisfied with 677win's response to a privacy request, you have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction where the operator is licensed.

677win does not knowingly collect personal data from individuals under the age of 18. Our registration process and KYC verification are specifically designed to detect and prevent underage registration.

If we become aware that personal data has been collected from a minor, we will immediately close the associated Account, delete the personal data in question (subject to any regulatory retention obligations) and take appropriate remedial action.

If you believe that a minor may have registered on the Platform, please contact our support team immediately so that we can investigate and act promptly.

677win serves a significant number of users from Pakistan. The following information is relevant specifically to Pakistani users:

• No Pakistani Data Registration: 677win is not registered with any Pakistani data protection authority and does not claim compliance with any specific Pakistani data protection legislation. Data protection obligations are governed by the laws of the operator's primary licensing jurisdiction.
• Payment Method References: Payment providers referenced on this Platform — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are mentioned as familiar local payment context only. Their mention does not represent a data-sharing partnership, endorsement of gambling, or confirmed integration with 677win.
• No Government Endorsement: 677win does not claim approval, regulation or endorsement by the Government of Pakistan, the PTA, the State Bank of Pakistan or any provincial authority.
• Legal Responsibility: Pakistani users are solely responsible for determining whether accessing and using the Platform is lawful in their jurisdiction. Nothing in this Policy constitutes legal advice.
• Document Security: KYC documents — including CNICs and passports — must be submitted only through the Platform's official secure HTTPS verification portal. Never send such documents via unsecured email, chat or third-party tools.

677win reserves the right to modify this Privacy Policy at any time to reflect changes in Applicable Law, our data processing practices or the structure of the Platform. The "Last updated" date at the top of this document indicates the most recent revision.

Where amendments are material — for example, changes to the categories of data collected, new third-party data sharing arrangements, or changes to the lawful basis for processing — we will notify registered users by email or via a prominent Platform notification at least 14 days before the changes take effect.

Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the changes, you must discontinue use of the Platform and may request Account closure and applicable data deletion.

For all privacy-related enquiries, data subject requests and complaints, please contact 677win using the details below. We aim to acknowledge all privacy requests within 5 business days and provide a substantive response within 30 days.

677win does not provide legal advice. If you require independent legal guidance on data protection matters, please consult a qualified legal professional in your jurisdiction.