Privacy Policy

Milwin ("Milwin", "we", "us", "our") is committed to protecting and respecting the privacy of every individual who accesses or uses the Milwin online sports betting and casino platform, accessible at milwin.cam ("Platform"). This Privacy Policy ("Policy") describes how we collect, use, store, share and protect personal data in connection with your use of the Platform and all related services.

This Policy applies to all visitors, registered users and former users of the Platform, wherever they are located, subject to applicable local laws. It should be read in conjunction with our Terms & Conditions, which govern the contractual relationship between you and Milwin. In the event of any conflict between this Policy and the Terms & Conditions on matters of data privacy, this Policy shall prevail.

Milwin operates under applicable international licensing frameworks and applies data protection principles that are consistent with recognised international standards, including those reflected in the General Data Protection Regulation (GDPR) where applicable. Milwin does not represent that this Policy satisfies the requirements of any specific Pakistani data protection law, including the Personal Data Protection Bill (currently in legislative progress). Pakistani users are responsible for understanding their own applicable local data protection requirements.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, postal address, financial information and device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Data Controller" means Milwin, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party that processes personal data on behalf of Milwin, under a written data processing agreement.
• "User" / "You" means any individual who visits, registers with, or uses the Platform in any capacity.
• "KYC" means Know Your Customer — the identity verification and age-checking process required before withdrawal processing or as required for ongoing compliance obligations.
• "Cookies" means small text files placed on your device by the Platform that store session information, preferences and analytical data.
• "Sensitive Data" means a subset of personal data that warrants heightened protection, including government-issued identification numbers, payment card data and information about problem gambling interventions.

Milwin collects personal data through several channels, depending on how you interact with the Platform. The categories of data we may collect are set out in the table below:

Where you interact with the Platform without registering an account, we may still collect Technical Data and Usage Data through cookies and server logs as described in Section 7.

Milwin processes your personal data only where we have a valid legal basis for doing so. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing that is necessary to perform our obligations under the Terms & Conditions you have accepted — for example, creating your account, processing deposits and withdrawals, settling wagers and providing customer support.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money laundering (AML) requirements, Know Your Customer (KYC) obligations imposed by our licence conditions, and obligations to report suspicious activity to relevant authorities.
• Legitimate interests: Processing carried out for purposes that are in the legitimate interests of Milwin or third parties, where those interests are not overridden by your rights — for example, platform security monitoring, fraud detection, abuse prevention and aggregate analytics to improve our services.
• Consent: Processing based on your freely given, specific and informed consent — for example, sending you marketing communications about promotions, new sports markets or casino offers. You may withdraw this consent at any time without affecting other processing activities.

Where we rely on legitimate interests as the legal basis for processing, we carry out a balancing assessment to ensure that our interests do not override your fundamental rights and freedoms. You may request further information about this assessment by contacting us as described in Section 14.

Milwin uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining and administering your Account, including processing login authentication, managing your balance and recording your wagering activity.
• Identity and age verification: Conducting KYC checks to confirm your identity, age and eligibility to use the Platform, in compliance with our licence obligations. This is a mandatory process for all withdrawal requests and may be triggered at other times at our discretion.
• Transaction processing: Processing deposits, withdrawals and any associated currency conversions, including PKR-denominated transactions where applicable through your selected payment method.
• Responsible gambling: Monitoring account activity to identify potential indicators of problem gambling, applying responsible gambling tools you have requested (deposit limits, loss limits, self-exclusion), and where required, proactively contacting you with responsible gambling information.
• Fraud prevention and security: Detecting and investigating suspicious activity, preventing multi-accounting, identifying potential match manipulation, and protecting the integrity of the Platform and its users.
• Customer support: Responding to your queries, complaints and escalations through live chat, email and other support channels, and maintaining records of interactions for quality assurance purposes.
• Legal and regulatory compliance: Meeting our obligations under applicable licensing frameworks, AML regulations and any lawful requests from authorities.
• Platform improvement: Analysing aggregate, anonymised usage data to improve Platform performance, user experience, game offerings and betting market availability.
• Marketing communications: Sending you promotional offers, bonus notifications and event updates — but only where you have opted in to receive such communications and only through the channels you have authorised.

Milwin does not sell, rent or otherwise commercially transfer your personal data to third-party marketers or data brokers. We share personal data with third parties only in the circumstances described below, and always subject to appropriate contractual safeguards:

• Service providers and data processors: We engage carefully selected third-party providers to support the operation of the Platform, including payment processing, KYC and identity verification services, cloud hosting, fraud detection, customer support tooling and email delivery. These providers act as data processors under written agreements that restrict their use of your data to the specific services they provide.
• Gaming software licensors: Casino game providers and sportsbook data suppliers may receive limited technical data (such as session tokens and game activity logs) necessary to deliver their services within the Platform. They are not permitted to use this data for their own independent purposes.
• Regulatory and law enforcement authorities: Where required by applicable law or our licence conditions, or in response to a lawful request from a competent authority, we may disclose personal data to regulators, law enforcement agencies or financial intelligence units. This includes reporting obligations under AML frameworks.
• Corporate transactions: In the event of a merger, acquisition, restructuring or sale of all or part of Milwin's business, personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

Milwin uses cookies and similar technologies (such as local storage and session tokens) on the Platform. The categories of cookies we use are as follows:

Milwin does not use third-party advertising cookies or permit advertising networks to place tracking technologies on the Platform. You can control cookie settings through your browser preferences. Note that disabling strictly necessary cookies will impair or prevent your ability to use the Platform.

Milwin retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory or contractual obligations. Our general retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with AML and licensing obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by financial record-keeping obligations under applicable licensing frameworks.
• KYC documents: Retained for a minimum of five (5) years following the end of the business relationship, in line with standard AML retention requirements.
• Responsible gambling records: Self-exclusion records and responsible gambling intervention logs are retained for a minimum of five (5) years after the relevant intervention to prevent re-registration during active exclusion periods.
• Support communications: Retained for up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Technical and usage data: Retained in anonymised or aggregated form for up to twenty-four (24) months for analytical purposes.
• Marketing consent records: Retained for as long as your consent remains active and for a reasonable period thereafter as evidence of compliance.

When personal data is no longer required and no legal obligation requires its retention, we will securely delete or anonymise it in accordance with our internal data disposal procedures.

As an international online platform, Milwin may transfer personal data to countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. Where such transfers occur, Milwin takes appropriate steps to ensure that your personal data is protected to a standard consistent with this Policy.

Safeguards we implement for international transfers include: contractual clauses with data processors requiring equivalent data protection standards; transfer only to service providers in jurisdictions with adequate data protection frameworks or where processor-specific safeguards are in place; and internal policies that restrict access to personal data to authorised personnel on a need-to-know basis.

If you are accessing the Platform from Pakistan, please be aware that your personal data may be transferred to and processed in countries outside Pakistan. By using the Platform, you acknowledge this. If you have questions about specific transfer mechanisms, please contact us as described in Section 14.

Subject to applicable law and certain exceptions, you have the following rights in relation to the personal data Milwin holds about you:

• Right of access: You may request a copy of the personal data we hold about you, along with information about how it is processed. We will respond to verified access requests within thirty (30) days.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain information directly through your Account dashboard.
• Right to erasure: You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to overriding legal obligations, including our AML and licence-related retention requirements.
• Right to restrict processing: In certain circumstances, you may ask us to pause processing of your personal data — for example, while an accuracy dispute is being resolved.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used and machine-readable format.
• Right to object: You may object to processing based on legitimate interests or carried out for direct marketing purposes. Where you object to marketing, we will cease processing for that purpose immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our support team via live chat or at [email protected]. We may require you to verify your identity before processing a rights request. We will respond within thirty (30) days of receipt of a verified request; in complex cases, this period may be extended by a further thirty (30) days with notice.

The Platform is strictly intended for adults aged 18 years and over, or the higher minimum age required by the applicable operator or licence jurisdiction. Milwin does not knowingly collect personal data from individuals under the age of 18.

Where Milwin has reasonable grounds to believe that an Account is held by, or has been accessed by, a person under the minimum age requirement, we will suspend the Account, initiate KYC age verification, and where the minor's age is confirmed, close the Account and return any eligible balance in accordance with our Terms & Conditions and applicable law.

Milwin implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include:

• 256-bit TLS encryption for all data transmitted between your device and our servers;
• One-way cryptographic hashing for stored passwords — Milwin employees cannot view your password in plain text;
• Role-based access controls ensuring that only authorised personnel can access personal data, limited to what is necessary for their function;
• Continuous monitoring of Platform infrastructure for intrusion attempts, anomalous activity and vulnerability indicators;
• Regular internal security reviews and, where appropriate, third-party penetration testing;
• Secure document handling procedures for KYC materials, including encrypted storage and controlled access logging.

While Milwin takes data security seriously and implements robust measures, no internet-based system can guarantee absolute security. You also have a responsibility to keep your login credentials confidential and to notify us immediately at [email protected] if you suspect your Account has been accessed without your authorisation.

Milwin may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements or the services we offer. Where changes are material, we will notify registered Account holders by email and/or via a prominent notice on the Platform at least fourteen (14) days before the changes take effect.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acknowledgement of the changes. If you do not agree to the revised Policy, you must cease using the Platform and may request Account closure in accordance with the process described in our Terms & Conditions. We encourage you to review this Policy periodically so you remain informed about how we protect your data.

If you have any questions, concerns or requests relating to this Privacy Policy or the way Milwin handles your personal data, please contact our Data Privacy team through the following channels:

• Live Chat: Available 24/7 directly within the Platform — the fastest channel for urgent privacy queries.
• Email: [email protected] — for formal data subject requests, complaints and written privacy enquiries. Please mark the subject line as "Privacy Request" or "Data Subject Request" to ensure prompt routing.

We aim to acknowledge all privacy-related contacts within two (2) business days and to resolve requests within thirty (30) days, as noted in Section 10. Support is available in English; Urdu assistance is available on request.