CoinsBack Privacy Policy – How We Protect Your Data

01 Who We Are — The Data Controller

CoinsBack operates coinsback.app, an online gaming platform serving Pakistani players across a range of casino, live dealer and sports betting products. In the context of this Privacy Policy, CoinsBack is the data controller — the entity responsible for determining how and why your personal data is processed.

We take our responsibilities as data controller seriously. Every decision about how personal data is handled at CoinsBack starts from the principle of collecting only what is genuinely necessary and protecting what we collect to the highest standard that is practical within our infrastructure.

If you have any question about how CoinsBack handles your personal data, or if you wish to exercise any of the rights described in this policy, please contact us at support@coinsback.app. We respond to all privacy-related enquiries within 72 hours during normal business operations.

02 What Personal Data We Collect

CoinsBack collects personal data across three broad categories. The table below sets out what we collect, why each category is needed, and whether it is mandatory or optional.

03 How We Collect Your Data

CoinsBack collects personal data through the following means:

• Registration form: When you create a CoinsBack account you provide your name, date of birth, mobile number and email address directly through the sign-up form.
• Deposit and withdrawal transactions: When you make a payment via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or bank card, the payment provider sends a transaction reference to CoinsBack. CoinsBack never sees your full mobile wallet PIN or full card details — only tokenised references are passed to CoinsBack systems.
• KYC verification uploads: If CoinsBack requests identity verification (which may happen before processing larger withdrawals or if account activity triggers a review), you upload documents through a secure form within your account dashboard.
• Cookies and tracking technologies: When you browse coinsback.app your browser exchanges cookie data and technical signals with our servers. The full details of what cookies we use are set out in Section 7.
• Customer support interactions: When you contact CoinsBack via live chat, email or WhatsApp, the content of that communication is logged and associated with your account record.
• Gaming activity logs: Every bet placed, game played, session started and session ended generates a log entry that is stored against your account. This is technically necessary for the platform to function and for disputes to be resolvable.

04 Why We Use Your Personal Data

CoinsBack only uses your personal data for the purposes listed below. We do not process your data for any undisclosed purpose. The legal basis for each use is indicated in brackets.

• Account creation and operation — We use your name, contact details and date of birth to create and maintain your CoinsBack account. (Contract performance)
• Identity and age verification — We verify that you are who you say you are and that you are at least 18 years old. This protects minors and meets our obligations as a responsible gaming platform. (Legal obligation, legitimate interest)
• Processing deposits and withdrawals — We use your payment method details to process PKR transactions in and out of your account. (Contract performance)
• Fraud prevention and account security — Device data, IP addresses and gaming activity patterns are analysed to detect and prevent fraud, account takeovers and money laundering. (Legitimate interest, legal obligation)
• Customer support — Communication records are used to resolve disputes, respond to queries and improve service quality. (Contract performance, legitimate interest)
• Responsible gaming monitoring — Gaming activity and session data are used to identify patterns that may indicate problem gambling, to deliver responsible gaming alerts and to enforce any limits you have set. (Legitimate interest, legal obligation)
• Platform improvement — Aggregated, anonymised data about how members use the platform is used to improve game selection, UI design and payment processes. No individual profile is used for this purpose without anonymisation. (Legitimate interest)
• Marketing and promotions — Where you have opted in to marketing communications, we use your contact details to inform you of relevant offers and promotions at CoinsBack. You can opt out at any time. (Consent)
• Legal compliance — We may use and retain data to comply with applicable legal requirements, respond to lawful regulatory requests or enforce our Terms and Conditions. (Legal obligation)

05 Sharing Your Personal Data

CoinsBack does not sell your personal data to any third party, ever. We share data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking partners and card-processing networks receive the minimum transaction data necessary to process deposits and withdrawals. These processors have their own data protection obligations under their own privacy policies and applicable Pakistani financial regulations.
• Game software providers: For live dealer games hosted in external studios and for RNG game software provided by third-party developers, your account identifier and bet data are transmitted to the game provider's systems to enable the game to function. Game providers do not receive your personal identity or payment data.
• Identity verification services: When CoinsBack requests identity documents, those documents may be processed through a certified KYC verification service. Such services are bound by contractual data processing terms with CoinsBack and may only use your data for the verification purpose.
• Anti-fraud and security vendors: CoinsBack uses industry-standard fraud detection services that process device and behavioural signals. These vendors act as data processors and are contractually prohibited from using your data for any purpose other than fraud prevention on CoinsBack's behalf.
• Legal and regulatory authorities: CoinsBack will disclose personal data to law enforcement, regulatory bodies or courts where required to do so by applicable law, by a valid legal order or to protect the rights and safety of CoinsBack members and staff.
• Business transfers: In the event that CoinsBack is acquired by or merged with another entity, your data may be transferred as part of that transaction. You will be notified in advance if such a transfer would result in a material change to how your data is handled.

All third-party data processors engaged by CoinsBack are bound by data processing agreements that prohibit them from using your data for their own commercial purposes and require them to maintain appropriate security standards.

06 Payment Data Security

Given that CoinsBack handles real PKR transactions for hundreds of thousands of Pakistani players, payment data security receives particular attention in our security architecture. The key principles are:

• Tokenisation: CoinsBack does not store your full Easypaisa or JazzCash account PIN, your full bank card number or your full IBAN. When you register a payment method, the provider issues a secure token — a unique reference string — that CoinsBack stores in place of the underlying credential. This means that even in the event of a security breach of CoinsBack's systems, your actual payment credentials are not exposed.
• Encrypted transmission: All payment data transmitted between your device and CoinsBack's servers is encrypted using TLS 1.3 — the current industry standard for transport layer security.
• Access controls: Access to payment transaction records within CoinsBack is restricted to staff who require it for operational purposes. Access is logged and audited regularly.
• PCI-DSS alignment: CoinsBack's card payment processing follows PCI-DSS aligned practices through our certified payment gateway partners.
• Fraud monitoring: All payment transactions are monitored by automated fraud detection systems that flag and hold unusual patterns for manual review before processing.

07 Cookies and Tracking Technologies

CoinsBack uses cookies and similar technologies on coinsback.app. A cookie is a small text file placed on your device by the platform when you visit. Cookies help us keep you logged in, remember your preferences, detect fraud and understand how the platform is used. The types of cookies we use are described below:

CoinsBack does not use advertising or third-party tracking cookies. We do not allow ad networks to place cookies on coinsback.app or to track CoinsBack users across external websites. You can control cookie preferences through your browser settings — note that disabling essential cookies will prevent you from logging into your account.

08 How Long We Keep Your Data

CoinsBack retains your personal data only for as long as is necessary for the purposes for which it was collected, and for as long as required by applicable legal obligations. The retention periods below apply as a general guide:

• Account data (name, date of birth, contact details): Retained for the lifetime of your Account and for a period of five years after Account closure. This period is required to fulfil financial record-keeping and anti-money laundering obligations.
• Payment transaction records: Retained for seven years from the date of each transaction in accordance with standard financial record-keeping requirements.
• Gaming activity logs: Retained for five years to support dispute resolution and responsible gaming monitoring.
• Identity verification documents: Retained for the duration of your Account plus five years post-closure, after which documents are securely deleted.
• Support communications: Retained for three years from the date of the interaction.
• Marketing preferences: Retained until you opt out, after which opt-out records are kept for three years to prevent inadvertent re-subscription.
• Cookies and analytics data: Session cookies expire when you close your browser. Persistent cookies are set with a maximum lifespan of 12 months.

When data reaches the end of its retention period, CoinsBack permanently deletes or irreversibly anonymises it. Deletion is carried out through secure data destruction processes that prevent recovery.

09 Your Privacy Rights

As a CoinsBack Member, you have the following rights with respect to your personal data. To exercise any of these rights, contact us at support@coinsback.app — we will respond within 30 days and will not charge any fee for handling your request in normal circumstances.

10 Children's Privacy

CoinsBack is strictly an 18+ platform. We do not knowingly collect personal data from anyone under 18 years of age. The registration form requires confirmation that the registrant is 18 or older, and CoinsBack actively verifies age where there is any doubt.

If a parent or guardian becomes aware that a minor has created a CoinsBack account using false date of birth information, they should contact us immediately at support@coinsback.app. CoinsBack will:

• Immediately suspend the account upon receipt of a credible report.
• Investigate the registration and gaming history.
• Return any deposited funds (net of any winnings) to the original payment method.
• Delete the personal data associated with the underage account from live systems, subject to any legal obligations to retain records for a defined period for investigation purposes.

11 Security Measures

CoinsBack implements technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. The key elements of our security posture include:

• Transport encryption: TLS 1.3 is enforced on all CoinsBack web traffic. HTTP connections are automatically redirected to HTTPS. Certificate transparency monitoring is active.
• Data-at-rest encryption: Databases containing personal and payment data are encrypted using AES-256. Encryption keys are managed separately from the data they protect.
• Access controls: Staff access to systems containing personal data is role-based and granted on a need-to-know principle. All access is logged, and access patterns are reviewed regularly.
• External security audits: CoinsBack engages independent security firms to conduct periodic penetration tests and vulnerability assessments. Critical findings are resolved before the next audit cycle.
• Responsible disclosure programme: Security researchers who identify potential vulnerabilities in CoinsBack's systems are encouraged to report them to support@coinsback.app. Reports are acknowledged within 48 hours and investigated thoroughly.
• Incident response: CoinsBack maintains a documented data breach response procedure. In the event of a breach that is likely to affect Members, CoinsBack will notify affected individuals promptly — and in any case within 72 hours of confirming the breach — with details of what happened, what data was affected and what steps are being taken.

While CoinsBack implements strong security measures, no online system can guarantee absolute security. You also play a role in protecting your account: use a strong, unique password for CoinsBack, do not share your login credentials and contact us immediately if you suspect unauthorised account activity.

12 Changes to This Privacy Policy

CoinsBack may update this Privacy Policy from time to time as the platform evolves, as legal requirements change or as our data practices are refined. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Display a notification banner on the CoinsBack platform for a minimum of 14 days informing Members of the update.
• Send an email notification to your registered address for changes that materially affect your rights or how your data is used.

Your continued use of CoinsBack after a policy update has been notified constitutes acceptance of the updated Privacy Policy. If you do not agree with any changes, you should stop using the platform and close your Account before the changes take effect. On account closure, CoinsBack will handle your data in accordance with the retention requirements set out in Section 8.

We encourage you to review this Privacy Policy periodically even if you have not received a notification — minor clarifications and non-material corrections may be made without formal notification.

13 Contact Us and Data Requests

For any question, concern or request related to this Privacy Policy or to the personal data CoinsBack holds about you, please contact the CoinsBack privacy team through the following channels:

• Email (preferred for formal requests): support@coinsback.app — use subject line "Privacy Request" for data access, correction or deletion requests. We respond within 72 hours and complete formal requests within 30 days.
• Live Chat: Available within your Account dashboard. Suitable for general privacy questions and for initiating more complex requests that will be followed up by email.
• FAQ: Common questions about account data and privacy are addressed at /faq.

When submitting a formal data request, please include: your registered mobile number or email address, the nature of your request (access / correction / deletion / other), and any relevant context that will help us locate the correct data quickly. We may need to verify your identity before fulfilling data requests — this is to protect you from fraudulent requests made by someone else claiming to be you.