bmax Privacy Policy – How We Protect Your Data in Pakistan

1. Introduction

This Privacy Policy explains how bmax ("we", "us", "the Platform"), operating at bmax.wine, collects, processes, stores, and protects the personal data of players and visitors to our platform ("you"). It covers all services provided by bmax, including account registration, game play, PKR payment processing, the VIP Club, customer support, and marketing communications.

We understand that handing over personal information — especially financial data — requires trust. Our approach to privacy at bmax is straightforward: collect only what we need, use it only for the purpose it was collected, protect it properly, and give you control over it. This policy is written in plain English so that Pakistani players can understand exactly how their information is handled, without having to parse dense legal language.

This Privacy Policy should be read alongside our Terms and Conditions and our Responsible Gaming policy. If there is any conflict between those documents and this Privacy Policy on matters of data handling, this Privacy Policy takes precedence.

2. Personal Data We Collect

bmax collects personal data through three main channels: information you provide directly, information generated automatically by your use of the platform, and information received from third-party service providers such as identity verification services.

Information you provide directly:

• Full legal name and date of birth (for account registration and age verification)
• Mobile phone number (for account access, SMS verification, and support)
• Email address (for account communications and support)
• National identity details (for KYC verification at higher withdrawal tiers)
• Payment method details — including your registered Easypaisa/JazzCash phone number, bank account or card details used for deposits and withdrawals in PKR
• Communications you send to bmax support, including chat transcripts and email correspondence

Information collected automatically:

• IP address and approximate geolocation at the time of login and deposit
• Device type, operating system, and browser version
• Session data — login times, session duration, pages visited within bmax
• Game play records — bets placed, games accessed, outcomes, transaction history
• Cookie and local storage data (see Section 6)

Information received from third parties:

• Identity verification results from our KYC provider, including document status and match confidence scores
• Payment transaction status and reference numbers from payment processors such as Easypaisa, JazzCash, NayaPay, and banking networks
• Fraud and risk signals from our fraud detection service providers

3. How bmax Uses Your Data

Every piece of personal data bmax processes has a defined purpose. We do not collect data speculatively or hold data without a clear use for it. The primary purposes for which bmax processes personal data are:

Where bmax wishes to use your data for any purpose not listed above, we will seek your explicit consent before doing so.

4. Payment Data and PKR Transactions

All bmax transactions are denominated in Pakistani rupees (PKR). Payment data receives the highest level of protection applied to any category of data we hold, because we understand that your financial information is sensitive and that any mishandling has direct, practical consequences for you.

How bmax handles payment data:

• Easypaisa and JazzCash: Your registered mobile number and transaction reference are passed to the relevant provider's API to initiate and verify transactions. bmax retains only the transaction reference and status — not your PIN or wallet credentials.
• Card payments: bmax does not store full card numbers. Card transactions are tokenised by our payment processor — we hold only the token and last four digits for reference purposes.
• IBFT transfers: Bank account details provided for IBFT withdrawals are used solely to process the requested transfer and are held only for the legally required record-keeping period.
• Transaction records: All deposit and withdrawal records in PKR are retained for 5 years following the transaction date, in compliance with financial record-keeping requirements.

bmax applies a name-matching requirement — your payment method must be registered in the same name as your bmax account. This is both a fraud-prevention measure and an AML control. Transactions that fail name matching are held for verification and will not be processed until the discrepancy is resolved.

5. Sharing Your Personal Data

bmax does not sell, rent, or trade your personal data. We share personal data only in the following circumstances, and only to the minimum extent necessary for the stated purpose:

All third-party service providers who receive bmax player data are contractually obligated to process that data only for the specified purpose, to maintain appropriate security standards, and to delete or return data when the engagement ends. bmax does not permit any service provider to use your data for their own commercial purposes.

In the event of a merger, acquisition, or sale of assets, player data may be transferred to the acquiring entity subject to equivalent privacy protections. bmax will notify affected players in advance of any such transfer.

6. Cookies and Tracking Technologies

bmax uses cookies and similar technologies to make the platform function correctly, keep your session secure, and understand how players use the site so we can improve it. We do not use cookies for cross-site advertising or behavioural profiling.

The categories of cookies used at bmax:

• Strictly Necessary Cookies: These are required for bmax to function. They manage your login session, maintain your game state, and prevent cross-site request forgery. They cannot be disabled without breaking core functionality.
• Functional Cookies: These remember your preferences — language settings, preferred payment method, and game lobby view preferences — so you do not have to reset them every session.
• Analytics Cookies: These collect anonymised, aggregated data about how bmax is used — most visited pages, average session length, game category preferences. No individual player is identified in this data. This helps us identify where the platform can be improved.
• Security Cookies: Device fingerprinting and session integrity tokens used to identify suspicious login patterns and protect your bmax account from unauthorised access.

Most browsers allow you to manage or delete cookies through your browser settings. Disabling strictly necessary cookies will prevent bmax from functioning correctly. Disabling functional or analytics cookies will not prevent you from playing but may reduce the personalisation of your experience.

7. Data Security

Protecting the personal and financial data of Pakistani players is one of bmax's core operational responsibilities. The security measures bmax applies to player data include:

• TLS Encryption in Transit: All data transmitted between your device and bmax servers is encrypted using TLS 1.2 or higher. This applies to all platform pages, game sessions, and payment requests.
• Encryption at Rest: Sensitive data fields — including payment identifiers, identity document metadata, and authentication credentials — are encrypted at rest in our database infrastructure.
• Access Controls: Access to player data within bmax's systems is restricted to staff who require it for their specific role. All access is logged and audited. No bulk export of player data is possible without multi-party authorisation.
• Penetration Testing: bmax's platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: bmax maintains a documented data breach response procedure. In the event of a breach affecting player data, affected players will be notified within 72 hours of bmax becoming aware of the incident, and the nature of the breach and recommended protective steps will be communicated clearly.

While bmax applies robust security measures, no digital system can guarantee absolute security. We recommend that players protect their own account by using a strong, unique password for bmax, enabling any available two-factor authentication, and never sharing their login credentials with anyone.

8. Data Retention

bmax retains personal data for as long as it is needed for the purpose it was collected, or as required by applicable law. The following retention periods apply:

When a retention period expires, data is securely deleted or irreversibly anonymised. "Securely deleted" means data is purged from live systems, backups, and logs within 90 days of the deletion instruction being triggered. bmax does not retain data beyond legally mandated periods simply for convenience.

9. Your Data Rights

As a player on bmax, you have the following rights over your personal data. These rights are real and exercisable — not just listed for appearance. To exercise any of them, contact support@bmax.wine with the subject line "Data Rights Request".

bmax will respond to all data rights requests within 30 days. Where a request is complex or numerous, this period may be extended by a further 30 days — in which case we will notify you of the extension and the reason within the initial 30-day window. There is no charge for exercising your data rights.

10. Children's Privacy

bmax is strictly an 18+ platform. We do not knowingly collect or process personal data from anyone under 18 years of age. Age verification checks are applied at registration and at the withdrawal stage specifically to enforce this.

If bmax becomes aware that personal data has been collected from a person under 18, the account will be suspended immediately, all data will be deleted as soon as legally permissible, and any funds in the account will be returned to the source payment method after investigation.

If you are a parent or guardian and believe your child has registered a bmax account, please contact support@bmax.wine immediately with the account details you are aware of. We will investigate and action such reports as a priority.

11. Marketing Communications

bmax may send you promotional communications about new games, bonuses, VIP Club offers, and platform updates. These communications are sent only to players who have not opted out, and only through channels you have actively used to communicate with bmax (your registered email address or mobile number via SMS).

Opting out of bmax marketing communications:

• Email: Use the unsubscribe link at the bottom of any marketing email. Takes effect within 48 hours.
• SMS: Reply STOP to any marketing SMS from bmax. Takes effect immediately.
• Account Settings: Update your communication preferences in your bmax account settings at any time.
• Support: Contact support@bmax.wine to request removal from all marketing lists.

Opting out of marketing communications does not affect transactional communications — you will still receive messages about your deposits, withdrawals, account security, and support tickets. Transactional messages cannot be disabled as they are necessary for the safe operation of your account.

bmax does not sell or share your contact details with third-party marketers. All marketing you receive from bmax comes from bmax directly, not from affiliated or partner businesses using our data.

12. Changes to This Privacy Policy

bmax may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we provide. When material changes are made, bmax will:

• Display a notification on the bmax platform for a minimum of 14 days before the changes take effect.
• Update the "Last Updated" date at the top of this page.
• Send an email notification to your registered address where the changes are significant.

Continued use of bmax after the effective date of updated Privacy Policy terms constitutes your acceptance. If you do not agree with a change to how your data is handled, you may close your account and request deletion of your data (subject to legal retention requirements) before the effective date.

Minor clarifications — such as correcting typographical errors or adding more detail to an existing section without changing the substance — may be made without formal notification, though the document date will always reflect the latest revision.

13. Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data bmax holds about you, please contact our privacy team through the following channels:

• Email: support@bmax.wine — use the subject line "Privacy Policy Query" or "Data Rights Request" for faster routing
• Live Chat: Available 24/7 on bmax.wine — ask to be connected to the privacy or data team
• VIP Members: Your dedicated account manager can route privacy requests to the appropriate team

bmax acknowledges all privacy-related communications within 48 hours and provides a substantive response within 30 days. Where a request requires more time — for example, a complex data export — we will communicate this and provide a realistic revised timeline.

For complaints about how bmax has handled your personal data that we have not been able to resolve to your satisfaction, you have the right to escalate through our formal complaints process. Details are available from our support team on request.