DarazPlay Privacy Policy – How We Protect Your Data in Pakistan

This Privacy Policy explains how DarazPlay ("we", "us", "the platform"), operating at darazplay.run, collects, stores, uses, and protects the personal information of users who register and interact with the platform. DarazPlay is designed for users in Pakistan, and this policy is written with that context in mind.

By creating an account on DarazPlay, you agree to the collection and use of your information as described in this policy. If you do not agree, you should not register or use the platform. This policy should be read alongside the DarazPlay Terms and Conditions, which govern the overall use of the platform.

DarazPlay collects several categories of personal information during the course of your use of the platform. The table below sets out what we collect and why:

DarazPlay does not collect any special category data (such as health information, religious beliefs, or political opinions) unless you voluntarily provide it in a support conversation context, and even then it is not stored as a data category.

DarazPlay collects information through three primary channels:

• Directly from you: When you register an account, complete your identity verification, make a deposit or withdrawal, place a bet, contact support, or respond to a survey or promotion. The information you provide is collected in real time.
• Automatically through platform use: When you browse or use DarazPlay, our systems automatically log technical data including your IP address, device type, browser, pages visited, and session duration. This is standard for any web platform and is used for security and performance purposes.
• Through third-party payment processors: When you use Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or card payments, the transaction confirmation data is passed back to DarazPlay to confirm the deposit or withdrawal. We receive transaction reference numbers and amounts — not your full payment credentials.

DarazPlay uses the personal information we collect for the following purposes only:

• Account management: Creating and maintaining your account, verifying your identity, communicating important account updates, and processing password reset requests.
• Processing bets and payments: Settling your bets correctly, processing deposits and withdrawals to your registered payment methods, and keeping accurate transaction records.
• Security and fraud prevention: Detecting suspicious login attempts, monitoring for duplicate accounts, flagging unusual transaction patterns, and protecting you from unauthorised access to your account.
• Legal and regulatory compliance: Verifying your age, conducting anti-money laundering (AML) checks where required, and maintaining records that may need to be produced in response to legal obligations.
• Responsible gaming: Monitoring account activity for signs of problematic gambling behaviour and applying limits or interventions as described in the DarazPlay Responsible Gaming policy.
• Customer support: Responding to your queries, resolving complaints, and maintaining records of support interactions for quality assurance purposes.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how the platform is used and where it can be improved. This analysis does not identify you individually.
• Marketing communications: Sending you information about DarazPlay promotions and bonuses by SMS or email — but only if you have not opted out. You can unsubscribe at any time through your account settings or by contacting support.

DarazPlay does not sell your personal information. We do not share your data with third parties for their own marketing or commercial purposes. There are, however, limited circumstances in which data is shared with trusted parties for specific operational reasons:

• Payment processors: When you make a deposit or withdrawal, transaction data is shared with the relevant payment processor (Easypaisa, JazzCash, NayaPay, SadaPay, your bank or card network). Only the minimum necessary data is shared.
• Game providers: DarazPlay's casino games are supplied by licensed third-party providers. When you play their games, basic session data (such as a player ID and stake amounts) is shared with the provider to run the game correctly. These providers operate under their own data protection agreements with DarazPlay.
• Identity verification services: To verify your CNIC and confirm your age and identity, DarazPlay may use a third-party verification service. Your documents are shared with that service for the purpose of verification only and are not used for any other purpose.
• Legal authorities: If DarazPlay is required by law, court order, or regulatory authority to disclose information about a specific user, we will comply with that requirement. We will notify the affected user if legally permitted to do so.
• Business transfers: In the unlikely event that DarazPlay undergoes a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. Affected users will be notified before their data is subject to a different privacy policy.

Given that DarazPlay handles real-money transactions in Pakistani Rupees, payment data security deserves specific attention. Here is exactly how it works.

When you make a deposit via Easypaisa or JazzCash, the transaction is authorised within those platforms' own secure environments. DarazPlay receives a confirmation of the transaction along with a reference number and the amount — not your mobile wallet PIN or login credentials. Your wallet credentials never pass through DarazPlay's systems.

For Visa and Mastercard payments, card details are entered on a payment page operated by our certified payment gateway partner. Full card numbers are not stored on DarazPlay's servers at any point. DarazPlay retains only the last four digits of your card number for the purpose of identifying your payment method in your account history.

Bank account details provided for IBFT withdrawals (such as your IBAN) are stored securely and used only for processing your withdrawals to that account. They are not accessible to DarazPlay staff in plain form and are not used for any purpose other than sending you your money.

DarazPlay retains your personal information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations and resolve any disputes that may arise after account closure. Specific retention periods are set out below:

• Account information (name, contact details, CNIC): Retained while your account is active and for a minimum of five years after closure for regulatory compliance purposes.
• Transaction records (deposits, withdrawals, bet history): Retained for a minimum of five years to meet anti-money laundering and financial record requirements.
• Support communications: Retained for up to three years from the date of the interaction.
• Technical log data (IP addresses, session logs): Retained for up to 12 months for security and fraud investigation purposes.

Once the relevant retention period has expired and there is no legal basis for continued storage, DarazPlay deletes or anonymises the data securely. If you request account deletion before a retention period expires and we are legally required to retain certain records, we will retain only what is required by law and delete everything else.

DarazPlay uses cookies — small text files stored in your browser — to keep the platform working properly and to understand how it is being used. We use three categories of cookies:

• Essential cookies: These are required for the platform to function. They keep you logged in during a session, remember your language and display preferences, and protect forms against cross-site request forgery. You cannot opt out of these without stopping the platform from working properly.
• Analytics cookies: DarazPlay uses basic, privacy-respecting analytics to understand which parts of the platform are used most frequently, how long users spend on pages, and where technical issues occur. This data is aggregated and does not identify you as an individual. You can opt out through your browser settings.
• Preference cookies: These remember settings you have changed on the platform — such as odds format preferences or notification settings — so you don't have to reset them every time you log in.

DarazPlay does not use third-party advertising cookies or cross-site tracking pixels. You will not be followed around the internet by DarazPlay advertisements based on cookies from this site.

Most modern browsers give you control over which cookies you accept. You can delete existing cookies and block new ones through your browser settings. Be aware that disabling all cookies will affect the platform's functionality, particularly the essential session cookies.

DarazPlay takes data security seriously and has implemented a range of technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, or disclosure.

• Encryption in transit: All data transmitted between your browser or app and DarazPlay's servers is protected with 256-bit TLS/SSL encryption. Anyone intercepting the connection sees only unreadable encrypted data.
• Encryption at rest: Sensitive stored data — including identity documents and financial records — is encrypted in our databases. Database access is restricted to authorised systems only.
• Access controls: DarazPlay staff access to user data is limited strictly to what is necessary for their specific role. All internal access is logged and audited.
• Two-factor authentication: Available for all user accounts. We strongly encourage all DarazPlay members to enable 2FA — it is one of the single most effective steps you can take to protect your account.
• Intrusion detection: DarazPlay's systems are monitored around the clock for unusual activity. Automated alerts trigger immediate investigation of potential security incidents.
• Incident response: In the event of a data breach affecting your personal information, DarazPlay will notify affected users promptly and take immediate steps to contain and remediate the breach.

DarazPlay respects your rights over your own personal information. Here is what you are entitled to ask for, and how to exercise each right:

To exercise any of these rights, contact DarazPlay at support@darazplay.run. We will respond within a reasonable period. Identity verification may be required before processing your request to ensure we are disclosing or modifying data to the correct person.

DarazPlay is strictly for users aged 18 and above. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe that your child has created an account on DarazPlay, please contact us at support@darazplay.run immediately. We will close the account and delete the associated personal data as quickly as possible.

Age verification is a required step before any withdrawal is processed on DarazPlay. This process also serves as our primary mechanism for confirming that users are of legal age.

DarazPlay may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When changes are made, the "Last updated" date at the top of this page is revised.

For significant changes to how we handle your personal data, we will notify registered users via email or an in-account notice before the changes take effect. We recommend revisiting this page periodically to stay informed. Continued use of DarazPlay after a privacy policy update constitutes acceptance of the revised policy.

If you have any question about this Privacy Policy, want to exercise one of your data rights, or have a concern about how DarazPlay is handling your personal information, please get in touch. Our support team handles privacy queries with the same attention as any other account matter.