22vin Privacy Policy — How We Handle Your Personal Data

Introduction & Scope

This Privacy Policy ("Policy") is issued by 22vin ("22vin", "we", "us", "our") and governs the collection, use, storage, sharing, and protection of personal data in connection with the 22vin platform, accessible at 22vin.bio. This Policy applies to all individuals who interact with the 22vin platform in any capacity — including registered players, visitors who browse without registering, and individuals who contact our support team.

22vin is committed to handling personal data lawfully, transparently, and in accordance with internationally recognised data protection principles. Our practices are aligned with the General Data Protection Regulation (GDPR) as a globally recognised standard of data protection excellence, as well as the requirements of our international gaming licence. Where local Pakistani law imposes additional or different data obligations, we apply the standard that best protects the individual.

This Policy should be read alongside the 22vin Terms & Conditions, which form the primary contractual basis for your relationship with 22vin. In the event of any inconsistency between this Policy and the Terms regarding data matters, this Policy governs.

Data We Collect

22vin collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the platform, and occasionally from verified third-party sources during KYC and fraud prevention checks. The categories of data we collect are described below.

We do not collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, or health information, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request — in which case it is processed solely for that purpose.

Legal Basis for Processing

Every data processing activity conducted by 22vin is grounded in one of the following recognised legal bases. We do not process personal data without a valid lawful basis, and we document the applicable basis for each processing activity in our internal data processing register.

• Contractual Necessity: The majority of personal data processing by 22vin is necessary for the performance of the contract between 22vin and the player — specifically, the Terms & Conditions governing your account. This includes processing identity data for account creation, financial data for deposits and withdrawals, and contact data for account communications.
• Legal Obligation: Certain processing activities are required by law, including KYC identity verification, anti-money-laundering record keeping, transaction monitoring, and reporting obligations to our licensing authority. We have no discretion to waive these requirements.
• Legitimate Interests: 22vin processes certain data categories on the basis of legitimate business interests, including fraud detection and prevention, platform security monitoring, responsible gaming pattern analysis, and technical performance analytics. In each case, we have assessed that our legitimate interests are not overridden by the individual's privacy interests.
• Consent: Marketing communications — including promotional emails, SMS notifications, and bonus alerts — are sent only on the basis of your explicit opt-in consent. Consent is recorded with a timestamp at the point of registration and can be withdrawn at any time through your account settings or by contacting support.

How We Use Your Data

Personal data held by 22vin is used exclusively for the purposes described in this Policy. We apply a strict internal purpose limitation principle — data collected for one purpose is not repurposed for an unrelated use without a fresh legal basis and, where required, your renewed consent.

• Account Registration and Management: Creating and maintaining your 22vin account, verifying your identity, processing login authentication, and managing account settings including responsible gaming tools.
• Transaction Processing: Facilitating PKR deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank; processing withdrawal requests; maintaining a record of your financial history on the platform for audit and dispute resolution purposes.
• KYC and Compliance: Verifying that you meet the minimum age requirement of 21 years, confirming your identity against CNIC or passport records, and conducting ongoing transaction monitoring for anti-money-laundering compliance.
• Fraud Prevention and Security: Monitoring login activity for unauthorised access attempts, detecting multi-account patterns, identifying bonus abuse, and investigating reports of prohibited conduct.
• Responsible Gaming: Analysing play patterns to identify potential signs of problem gambling, applying self-exclusion and deposit limit settings, and facilitating referrals to responsible gaming support resources where appropriate.
• Customer Support: Responding to your enquiries via live chat, email, and Messenger/Viber; maintaining support interaction records for quality assurance and dispute resolution.
• Platform Improvement: Using anonymised and aggregated behavioural and technical data to improve the 22vin platform, optimise game performance, and enhance the user experience for Pakistani players.
• Marketing (Consent-Based Only): Sending personalised promotional offers, PSL and cricket betting alerts, bonus notifications, and loyalty programme updates to players who have opted in to marketing communications.

Data Sharing & Disclosure

22vin does not sell or commercially transfer your personal data to third parties. Sharing occurs only in the limited circumstances described below, and in each case is subject to contractual data protection obligations that bind the receiving party to standards no less protective than those applied by 22vin.

• Licensed Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum transaction data necessary to process your deposits and withdrawals. These institutions are independently regulated and operate under their own data protection frameworks.
• Certified Game Providers: Third-party game studios — including providers of our slot, live casino, and crash game libraries — may receive anonymised session data for fairness auditing and RTP verification purposes. No directly identifiable personal data is shared with game studios for marketing purposes.
• KYC and Identity Verification Services: Where 22vin uses a third-party KYC provider to verify CNIC or passport documents, that provider receives only the data strictly necessary for the verification process and is bound by a data processing agreement prohibiting any secondary use.
• Fraud Detection and AML Services: We may share transaction data with specialist anti-fraud and anti-money-laundering screening services. These services process data on 22vin's behalf and do not retain it for independent purposes.
• Regulatory and Legal Disclosure: 22vin will disclose personal data to regulatory authorities, law enforcement agencies, or courts where required to do so by law or by a lawful order. We will notify affected players of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of 22vin's assets, player data may be transferred to the successor entity. Players will be notified in advance of any such transfer and given the option to close their accounts if they do not wish their data to be transferred.

Payment Data & PKR Transactions

Given that 22vin operates exclusively in Pakistani Rupees (PKR) and processes transactions through Pakistani mobile wallet and banking infrastructure, the handling of payment data deserves specific attention. Pakistani players entrust 22vin with sensitive financial information, and we take this responsibility seriously.

• No Storage of Full Payment Credentials: 22vin does not store complete JazzCash account numbers, EasyPaisa wallet numbers, or full bank account details on our platform servers. Payment processing is handled by our licensed payment gateway partners, who are PCI-DSS compliant. 22vin retains only a tokenised reference and transaction metadata.
• Transaction Records: Full PKR transaction records — including deposit and withdrawal amounts, timestamps, and payment method references — are retained for a minimum of five years from the date of transaction in compliance with our AML obligations and licensing requirements.
• Withdrawal Verification: When you submit a withdrawal request, 22vin may cross-reference the destination payment method against your registered payment method and KYC records. This is an anti-fraud measure and does not constitute additional data collection.
• Currency Conversion: 22vin does not process foreign currency transactions or apply exchange rate conversions. All financial data is held in PKR denomination, eliminating a category of financial data risk associated with multi-currency platforms.

Cookies & Tracking Technologies

22vin uses cookies and similar tracking technologies on the 22vin.bio platform. Cookies are small text files stored on your device that allow the platform to recognise your browser, maintain your session, and improve your experience. The following cookie categories are in use on 22vin.

You can manage your cookie preferences through your browser settings or through the 22vin cookie preferences panel accessible from the platform footer. Disabling strictly necessary cookies will impair platform functionality and may prevent you from accessing your account. 22vin does not use third-party advertising cookies or cross-site tracking pixels.

Data Retention

22vin applies defined retention periods to all categories of personal data. Data is not retained beyond the period necessary for the purpose for which it was collected, or beyond any minimum retention period required by our licensing obligations or applicable law. The following retention schedule applies.

• Active Account Data: Retained for the full duration of your account's existence plus five years following permanent account closure. This covers identity, contact, financial, and KYC data.
• Transaction Records: Retained for a minimum of five years from the date of each transaction in compliance with AML record-keeping obligations. This applies to all PKR deposit and withdrawal records.
• Support Communications: Live chat transcripts, email correspondence, and support ticket records are retained for three years from the date of the interaction, unless the interaction is associated with an open dispute or investigation, in which case retention is extended until final resolution plus two years.
• Marketing Consent Records: Opt-in consent timestamps and withdrawal records are retained indefinitely to provide an auditable consent trail. This is not the same as retaining marketing content — only the consent record itself is kept long-term.
• Analytics and Behavioural Data: Aggregated and anonymised analytics data may be retained indefinitely as it cannot be used to identify individuals. Non-anonymised behavioural data is retained for 12 months from collection and then anonymised or deleted.
• Verification Documents: CNIC scans, passport photographs, and payment method proof documents submitted for KYC are retained for five years following account closure, then securely deleted.

When retention periods expire, data is deleted using industry-standard secure deletion methods, or anonymised in a manner that renders re-identification impossible. 22vin conducts periodic data retention audits to ensure compliance with this schedule.

Security Measures

22vin implements a layered security architecture designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security posture is regularly reviewed and updated in response to the evolving threat landscape.

• Encryption in Transit: All data transmitted between your device and 22vin's servers is protected by TLS 1.2 or higher. Our SSL certificate is maintained by a recognised certificate authority and renewed proactively ahead of expiry.
• Encryption at Rest: Personal data stored on 22vin's servers — including KYC documents, financial records, and account data — is encrypted at rest using AES-256 encryption. Encryption keys are managed under a strict key management policy with access limited to authorised security personnel.
• Access Controls: Internal access to personal data is governed by a strict role-based access control policy. Only staff members who require access to specific data categories to perform their designated job functions are granted that access. All internal access is logged and auditable.
• Two-Factor Authentication: 22vin's player-facing platform supports OTP-based two-factor authentication. Players are strongly encouraged to enable 2FA to add an additional layer of protection to their accounts beyond username and password.
• Penetration Testing: 22vin's platform undergoes regular third-party penetration testing. Any vulnerabilities identified are remediated on a priority basis according to severity classification.
• Data Breach Response: 22vin maintains a documented data breach response plan. In the event of a breach that poses a risk to players' rights and freedoms, we will notify affected individuals and the relevant regulatory authority within 72 hours of becoming aware of the breach, where required by applicable law.

Your Privacy Rights

As a player whose personal data is processed by 22vin, you hold the following rights. These rights can be exercised by contacting 22vin's support team via email at [email protected] or through live chat. All requests are acknowledged within 48 hours and responded to in full within 30 calendar days. There is no charge for exercising any of these rights.

• Right of Access: You have the right to request a copy of all personal data that 22vin holds about you, together with information about how it is being used and who it has been shared with. We will provide this in a structured, readable format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Contact support with the specific correction required and supporting documentation where applicable.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent and no other legal basis applies, or where the data has been unlawfully processed. This right is subject to our legal obligation to retain certain data categories for defined minimum periods.
• Right to Restrict Processing: In certain circumstances — for example, where you contest the accuracy of data we hold — you may request that we restrict processing of that data while the matter is resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests, including profiling for responsible gaming monitoring. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Marketing Consent: You may withdraw consent to receive marketing communications at any time by adjusting your account preferences or by contacting support. Withdrawal takes effect within 24 hours for digital communications.

Minors & Age Restriction

The 22vin platform is strictly restricted to individuals aged 21 years and above. 22vin does not knowingly collect, process, or retain any personal data from individuals below the minimum age. Age verification is a mandatory step in the KYC process, and accounts where the registered player is found to be under 21 are closed immediately, with all associated data deleted or retained only to the extent required to document the closure.

22vin does not direct any marketing or promotional content at individuals who have not confirmed their age as 21 or above. No behavioural profiling for marketing purposes occurs prior to completion of the age verification step.

Changes to This Privacy Policy

22vin reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our licensing obligations. Material changes — meaning changes that affect your rights or the way we use your personal data in a significant way — will be communicated to you via the email address registered on your 22vin account at least 14 days before the revised Policy takes effect.

Non-material changes, such as corrections of typographical errors, clarifications that do not alter the substance of our practices, or updates to contact details, may be made without prior notice. The effective date displayed at the top of this page will reflect the date of the most recent update in all cases.

Your continued use of the 22vin platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you should cease using the platform and contact support to arrange account closure and return of any verified balance.

Contact & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or need to report a data security concern, please contact 22vin through the following channels. All contact details are provided as plain text for display purposes.

• Privacy Enquiries Email: [email protected] — please use the subject line "Privacy Request" for all data protection related correspondence. Written responses are provided within 30 days.
• Live Chat: Available 24 hours a day, 7 days a week via the 22vin platform. Urdu and English speaking agents are available. For formal privacy rights requests, we recommend following up in writing via email to create a documented record.
• Messenger / Viber: Available 24/7 for general privacy queries and guidance on how to submit a formal request.

22vin has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with applicable data protection law. The DPO can be contacted through the email address above with "DPO" in the subject line. The DPO is independent of commercial operations and reports directly to 22vin's senior management.