This Privacy Policy ("Policy") applies to all personal data processed by 287win ("we", "us", "our", "the Platform") in connection with your use of 287win.pro and all associated services. "Personal data" means any information that identifies or could identify you as a natural person. By registering a 287win account, making a deposit, or accessing any part of the Platform's services, you acknowledge that you have read this Policy and consent to the data practices described herein. If you do not agree, you must not use the Platform. This Policy should be read alongside the 287win Terms and Conditions, which govern your use of the Platform more broadly.
Who We Are — The Data Controller
287win operates the online gaming platform available at 287win.pro. For the purposes of applicable data protection legislation, 287win is the data controller in respect of all personal data collected through the Platform. As data controller, 287win determines the purposes for which and the means by which your personal data is processed.
287win holds an internationally recognised gaming licence. As a condition of that licence, the Platform is required to implement, maintain, and demonstrate compliance with appropriate data protection standards — including the collection of only the data necessary for the legitimate operation of a licensed gaming platform, the secure storage of all player data, and the honouring of player rights over that data.
287win serves a player base that is predominantly based in Pakistan, including major cities such as Karachi, Lahore, Islamabad, Faisalabad, and Rawalpindi. The personal data of Pakistani players is treated with the same rigour as player data in any other jurisdiction in which 287win operates. Your data is not treated differently because of where you are located.
Categories of Personal Data We Collect
287win collects personal data across several categories. The specific data collected depends on how you interact with the Platform. Below is a comprehensive account of the categories of personal data 287win processes.
| Category | Specific Data Points | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, CNIC number, nationality, gender | Registration & KYC verification |
| Contact Data | Pakistani mobile number, email address (if provided) | Registration |
| Account Data | Username, hashed password, account preferences, responsible gaming settings | Registration & ongoing account use |
| Financial Data | JazzCash / EasyPaisa mobile number, bank account details (last four digits), USDT wallet address, deposit and withdrawal transaction history, PKR balances | Deposit & withdrawal transactions |
| KYC Documents | CNIC copy (front and back), utility bill or bank statement for address proof, selfie photograph for liveness verification | KYC verification process |
| Gaming Activity Data | Bet history, game sessions, wager amounts, winnings, bonus usage, responsible gaming tool activations | Ongoing platform use |
| Technical Data | IP address, device type and model, operating system, browser type, session timestamps, geolocation (city level) | Each platform visit and session |
| Communications Data | Live chat transcripts, support email correspondence, promotional opt-in status | Customer support interactions & marketing |
How We Collect Your Personal Data
287win collects personal data through the following channels and mechanisms:
- Direct Submission. Data you provide directly when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or opting into promotional communications.
- Automated Technical Collection. Data collected automatically when you visit 287win.pro, including IP address, device identifiers, session data, browser type, and cookies. See Section 09 for full cookie details.
- Platform Activity Logging. Data generated by your gaming activity — bet placement, game sessions, bonus activations, and account settings changes — are logged automatically by the 287win platform as part of its normal operation and audit requirements.
- Payment Processor Data. When you deposit or withdraw via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or USDT, the relevant payment processor confirms transaction details to 287win. The payment processor's own privacy policy governs how they handle your data during the payment process.
- Identity Verification Partners. Where third-party KYC service providers are used to verify identity documents, those providers share the verification result and relevant data extracts with 287win. Any such providers are contractually bound to process your data only for the purpose of KYC verification and in accordance with applicable data protection standards.
Purpose & Legal Basis for Processing
287win processes your personal data for the purposes described below. For each purpose, we identify the legal basis on which that processing relies. Applicable legal bases include: (a) contract performance — processing necessary to deliver the services you have contracted with us for; (b) legal obligation — processing required by our gaming licence and applicable AML regulations; (c) legitimate interests — processing serving a genuine and proportionate interest of 287win or of third parties; and (d) consent — processing you have actively opted into.
| Processing Purpose | Data Used | Legal Basis |
|---|---|---|
| Account registration & management | Identity, contact, account data | Contract |
| KYC identity verification | Identity, KYC documents | Legal obligation |
| Processing deposits & withdrawals | Financial, identity data | Contract |
| Delivering gaming services | Gaming activity, technical data | Contract |
| Anti-money laundering monitoring | Financial, gaming activity, identity | Legal obligation |
| Responsible gaming enforcement | Gaming activity, account data | Legal obligation + Contract |
| Fraud prevention & security | Technical, financial, identity data | Legitimate interests |
| Customer support | Communications, account data | Contract |
| Platform improvement & analytics | Technical, gaming activity (anonymised) | Legitimate interests |
| Promotional communications | Contact, account preferences | Consent |
| Legal compliance & regulatory reporting | All categories as required | Legal obligation |
Disclosure & Sharing of Personal Data
287win does not sell your personal data to any third party. We do not share your information with advertisers, data brokers, or any commercial third party for their independent marketing purposes. Your data is shared only in the specific circumstances described below, and always subject to contractual data protection obligations.
Permitted Disclosures
- Payment Processors. JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and our cryptocurrency processing partner receive the minimum data necessary to process your deposit or withdrawal transaction — typically your account reference, transaction amount, and your payment method identifier.
- KYC & Identity Verification Providers. Third-party identity verification services receive your KYC documents and personal data solely for the purpose of verifying your identity as required by our gaming licence. These providers act as data processors under written agreements with 287win.
- Game Content Providers. Game studios and providers whose games appear on 287win (such as Pragmatic Play and PG Soft) may receive anonymised session and gaming data for the purpose of technical integration, game performance monitoring, and RNG auditing. These providers do not receive your name, contact details, or financial data.
- Regulatory & Law Enforcement Authorities. 287win is legally obligated to disclose player data to competent regulatory and law enforcement authorities where required by valid legal process, court order, or our gaming licence conditions. 287win cannot notify players of such disclosures where doing so would compromise an investigation or is prohibited by law.
- Professional Advisers. Legal counsel, auditors, and accountants who are subject to professional confidentiality obligations may have access to your data where necessary for 287win to obtain professional advice or comply with audit requirements.
- Business Transfers. In the event of a merger, acquisition, or sale of all or a substantial portion of 287win's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy practices of the acquiring entity prior to any change in how your data is handled.
International Data Transfers
287win operates infrastructure and engages service providers that may be located outside of Pakistan. Where your personal data is transferred to, stored in, or accessed from a jurisdiction outside Pakistan, 287win takes appropriate measures to ensure that such transfers comply with applicable data protection standards and that your data is afforded an equivalent level of protection to that which applies within Pakistan.
Such measures may include: contractual data protection clauses (standard contractual clauses or equivalent) between 287win and the recipient entity; verification that the recipient jurisdiction has an adequate legal framework for data protection; and technical measures such as encryption during transfer and at rest.
If you wish to obtain more information about the safeguards 287win applies to international data transfers, or to obtain a copy of the relevant contractual protections, please contact 287win using the details provided in Section 15 of this Policy.
Data Retention Periods
287win retains personal data only for as long as necessary to fulfil the purpose for which it was collected or as required by applicable legal and regulatory obligations. The following retention schedules apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account & Identity Data | 5 years post-closure | Gaming licence & AML legal obligation |
| KYC Documents | 5 years post-closure | Regulatory verification records |
| Financial Transaction Records | 7 years post-transaction | AML statutory records obligation |
| Gaming Activity Logs | 5 years post-closure | Licence audit & dispute resolution |
| Support Communications | 3 years post-interaction | Dispute resolution & quality assurance |
| Technical / Session Logs | 13 months | Security monitoring & fraud prevention |
| Marketing Preferences | Until opt-out + 6 months | Consent record keeping |
Upon expiry of the applicable retention period, personal data is either securely deleted or anonymised such that it can no longer be linked to any individual. Anonymised data may be retained for statistical and analytical purposes indefinitely, as it no longer constitutes personal data.
Security Measures
287win implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures are proportionate to the sensitivity of the data processed and the risks associated with online gaming platform operations.
- 256-bit SSL Encryption. All data transmitted between your browser or mobile device and the 287win platform is encrypted using Transport Layer Security (TLS 1.2 or higher). This is the same encryption standard used by Pakistan's major commercial banks.
- Password Hashing. Account passwords are never stored in plain text. They are processed through industry-standard one-way cryptographic hashing algorithms. Even 287win's internal systems cannot retrieve your original password.
- Access Controls. Access to player personal data within 287win's internal systems is restricted on a strict need-to-know basis. Each employee's access level is determined by their role and is reviewed regularly.
- Two-Factor Authentication. OTP-based two-factor authentication is available and strongly encouraged for all 287win accounts. Players who enable 2FA significantly reduce the risk of unauthorised account access.
- Intrusion Detection & Monitoring. 287win's infrastructure is monitored continuously for anomalous activity, intrusion attempts, and indicators of compromise. Automated alerting systems trigger immediate investigation of any suspected security incident.
- Data Breach Response. In the event of a personal data breach that poses a risk to your rights, 287win will notify affected players and relevant regulatory authorities within the timeframes required by our licence obligations.
Cookies & Similar Tracking Technologies
287win uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and support security and fraud prevention functions. Cookies are small text files stored on your device by your browser when you visit 287win.pro.
Cookie Categories Used by 287win
- Strictly Necessary Cookies. These cookies are essential for the 287win platform to function. They maintain your login session, store your account preferences, enable the cashier to function, and support security features. These cookies cannot be disabled without impairing core platform functionality.
- Analytical / Performance Cookies. These cookies collect anonymised data about how players use 287win.pro — which pages are visited most frequently, how long sessions last, and where technical errors occur. This information is used to improve the platform experience. No personally identifiable information is collected by these cookies.
- Functional Cookies. These cookies remember your language preferences, display settings, and responsible gaming tool configurations. Disabling them may result in a degraded user experience.
- Security Cookies. These cookies support 287win's fraud detection and account security systems, including the detection of unusual login locations and the identification of suspicious session activity. They do not contain personally identifiable information in readable form.
You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from using the 287win platform. Instructions for managing cookies are available in the help documentation of all major browsers including Chrome (most commonly used among 287win's Pakistani player base), Firefox, and Safari.
Your Rights Over Your Personal Data
Subject to applicable data protection legislation and the conditions of 287win's gaming licence (which may in some circumstances restrict or delay the exercise of certain rights), you hold the following rights in respect of your personal data processed by 287win:
You may request a copy of all personal data 287win holds about you, along with information about how it is processed.
You may request correction of any inaccurate personal data. You can update most contact information directly from your account settings.
You may request deletion of your personal data where it is no longer necessary for its original purpose and no overriding legal obligation requires its retention.
You may request that 287win restricts processing of your data while a rectification or objection request is being resolved.
You may request your personal data in a structured, commonly used, machine-readable format where the processing was based on your consent or a contract.
You may object to processing carried out on the basis of legitimate interests. Processing will cease unless 287win can demonstrate compelling legitimate grounds that override your interests.
To exercise any of these rights, submit a written request to 287win via live chat or email (see Section 15). 287win will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where a request is complex or numerous, this period may be extended by a further 30 days with prior notice to you.
Children's Privacy — 21+ Strict Policy
287win operates a strict minimum age policy. No person under the age of 21 may register a 287win account or access any real-money gaming service on the Platform. This policy is actively enforced through identity verification during the KYC process.
287win does not knowingly collect personal data from individuals under the age of 21. If 287win becomes aware that personal data has been collected from a person who is under 21, all data associated with that account will be deleted immediately and any associated deposits will be returned to the payment method used, after verification of the refund recipient's identity.
If you are a parent or guardian and believe that a minor in your care has accessed or registered on the 287win platform, please contact 287win support immediately via live chat or email. 287win will treat such reports as a priority and take immediate action to close the account and remove all associated data.
Marketing Communications
287win may send you promotional communications — including bonus offers, PSL cricket betting promotions, new game announcements, and VIP programme updates — where you have provided your consent to receive such communications at the time of registration or subsequently through your account settings.
- Promotional SMS messages may be sent to your registered Pakistani mobile number where you have opted in to SMS marketing.
- Promotional email communications may be sent to your registered email address where you have opted in to email marketing.
- You may withdraw your consent to marketing communications at any time by updating your preferences in your 287win account settings or by contacting 287win support. Opt-out requests are processed within 5 business days. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.
- Withdrawal of marketing consent does not affect your ability to receive transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts — which are necessary for the performance of the service and do not require your marketing consent.
Third-Party Services & Links
The 287win platform integrates third-party services including game content providers, payment processors, and identity verification partners. Each of these third parties operates under their own privacy policies which govern how they process data during your interaction with their services — for example, when you complete a JazzCash deposit or when your CNIC is processed through the KYC verification service.
287win is not responsible for the privacy practices of third-party service providers beyond the data protection obligations imposed on them through our contractual arrangements. We encourage you to review the privacy notices of any third-party payment platform or service you use in connection with your 287win account.
287win.pro does not contain embedded third-party advertising or social media tracking pixels that would allow social media platforms or advertising networks to build a profile of your gaming activity. 287win does not participate in behavioural advertising networks.
Changes to This Privacy Policy
287win reserves the right to amend this Privacy Policy at any time. Where amendments materially change the way we collect, use, or share your personal data, 287win will provide at least 14 days' prior notice of the changes. Notice will be provided by: (a) a prominent notification displayed on the 287win platform when you next log in; and (b) an SMS notification to your registered Pakistani mobile number where practicable.
If you do not agree with the changes to this Policy, you should close your 287win account before the effective date of the amended Policy. Continued use of the Platform after the effective date constitutes your acceptance of the revised Policy. The current version of this Policy, always bearing the "Last Reviewed" date displayed in the hero section above, is accessible from the footer of every page on 287win.pro. In the event of conflict between any previous version and the current version, the current version governs.
Contact, Data Requests & Complaints
For any questions or concerns regarding this Privacy Policy, to exercise your data rights, or to raise a data protection complaint, please contact 287win through the following channels:
- Live Chat: Available 24 hours a day, 7 days a week, directly on the 287win platform. Live chat is the fastest channel for urgent account or security concerns.
- Email: [email protected] — For formal data subject access requests, please mark your email with the subject line "Data Request". 287win will acknowledge within 5 business days.
If you are not satisfied with 287win's response to a data protection complaint, you have the right to escalate your complaint to the relevant supervisory authority in the jurisdiction governing 287win's gaming licence. Details of the applicable supervisory authority are available on request. 287win will cooperate fully with any regulatory investigation arising from a player data complaint.
This Privacy Policy was last updated on 1 January 2026. The version published at 287win.pro/privacy-policy is always the governing version. 287win — 287win.pro.