BMAX Privacy Policy — How Your Data Is Used and Protected

BMAX operates the online gaming and betting platform accessible at bmax.ws. For the purposes of this Privacy Policy, BMAX is the data controller responsible for the personal information collected from users who register, browse or interact with the platform.

BMAX is built specifically for the Pakistani market. Our services are directed at adults aged 18 and over who are based in Pakistan. All accounts are denominated in PKR and all payment integrations are designed around Pakistani payment methods — Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT and Visa/Mastercard. This local focus means the data we collect and process is closely tied to Pakistani banking infrastructure and identity verification norms.

If you have any questions about this Privacy Policy or about how BMAX handles your personal data, you can reach us at any time via the contact details in Section 12 of this document.

BMAX collects personal data through several channels: directly from you during registration and account use, automatically through your use of the platform and from third-party services used to verify your identity or process your payments. The categories of data collected are set out in the table below.

BMAX uses the personal data described in Section 2 for the following specific purposes. Each purpose is linked to a legal basis described in Section 4.

• Account creation and management: Your identity data, contact data and verification documents are used to create your BMAX account, confirm your eligibility to play and maintain your account records.
• Processing transactions: Your financial data and transaction history are used to process deposits from Pakistani payment methods (Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, Visa/Mastercard), settle bets and process withdrawals back to your chosen method.
• Identity verification (KYC): BMAX verifies the identity of players as part of standard platform practice. Your CNIC and any supporting documents provided are used solely for verification and are not shared with any third party except the identity verification service BMAX uses to process checks.
• Responsible gaming monitoring: Transaction data and usage patterns are analysed to identify signs of problem gambling. Where BMAX's responsible gaming tools flag unusual patterns, a support agent may make contact to check in with the player concerned. This is done to fulfil BMAX's duty of care, not for commercial purposes.
• Fraud prevention and security: Technical data and transaction records are monitored to detect fraudulent activity, multi-accounting, bonus abuse and unauthorised access. This protects both BMAX and honest players on the platform.
• Customer support: Communications data from support interactions is retained to ensure continuity of service and to review the quality of BMAX customer support.
• Marketing communications: With your consent, BMAX may send you information about promotions, new games and offers via your registered mobile number or email. You can withdraw marketing consent at any time from your account settings without affecting your platform access.
• Platform improvement: Aggregated and anonymised usage data is used to understand how players navigate the BMAX platform and to make improvements to the interface, game offering and betting experience.

BMAX relies on one or more of the following legal grounds when processing your personal data. The applicable ground depends on the specific processing activity.

• Contractual necessity: Processing your identity data, financial data and transaction records is necessary to deliver the BMAX service you signed up for. Without this processing, BMAX cannot create your account, verify your identity, accept deposits or pay out winnings.
• Legitimate interests: BMAX has legitimate interests in preventing fraud, maintaining platform security and monitoring for responsible gaming concerns. These interests are weighed against your privacy rights before any processing takes place, and do not override your fundamental rights.
• Consent: Marketing communications — including SMS, WhatsApp messages and email promotions — are sent only where you have given explicit consent during registration or subsequently through your account settings. You may withdraw consent at any time.
• Legal obligation: Certain data processing — including transaction records and identity verification documents — may be required for a period determined by applicable regulations. BMAX retains this data for as long as required to satisfy those obligations.

BMAX does not sell your personal data. Data is shared only with third parties that play a direct role in delivering BMAX's services. Every such third party is bound by a data processing agreement that limits their use of your data strictly to the purpose for which it was shared.

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT networks and Visa/Mastercard's processing systems receive the financial data necessary to complete your deposit or withdrawal. These processors are governed by their own privacy and security frameworks as well as their agreements with BMAX.
• Identity verification services: Third-party KYC providers receive the identity documents you submit for verification. These services are used solely to confirm that you are who you say you are and that you meet BMAX's age and eligibility requirements. They do not use your data for any other purpose.
• Customer support software: BMAX uses support platform tools that store chat transcripts and support tickets. These tools are configured to hold data only as long as is necessary for the support function.
• Platform analytics providers: Aggregated, anonymised usage data may be processed by analytics tools to help BMAX understand how the platform is used. This data does not identify you personally.
• Legal and regulatory disclosures: BMAX may be required to share your data with regulatory authorities or law enforcement agencies in response to a lawful request, court order or investigation. In such cases, BMAX will share only the minimum data required to satisfy the request.

Given that BMAX handles real PKR transactions for Pakistani players, payment data security is treated as a top priority. The following standards apply to all payment-related data on the platform.

• Full payment card numbers are never stored on BMAX servers. Card details are tokenised by the payment gateway at the point of entry and the token — not the raw card number — is what BMAX holds in its records.
• Easypaisa and JazzCash account numbers linked to your BMAX account are stored in encrypted form and are visible only to authorised members of the payments team when needed to process a withdrawal query.
• All financial data transmitted between your device and BMAX is encrypted using TLS. This applies to deposits, withdrawal requests and all account balance-related transactions.
• BMAX monitors transaction patterns for signs of fraudulent activity — including unusual deposit volumes, rapid deposit-then-withdrawal patterns and payment method changes shortly before large withdrawals. These checks protect your funds as well as the integrity of the platform.
• If BMAX detects a potentially fraudulent transaction, your account may be temporarily frozen pending investigation. You will be notified immediately via your registered mobile number and asked to provide clarifying information.

BMAX uses cookies — small text files stored on your device — and similar technologies to make the platform work correctly and to understand how it is being used. The table below describes the types of cookies BMAX uses and whether you can turn them off.

You can manage cookie preferences through your browser settings. Disabling optional cookies will not prevent you from using BMAX, but some preference features may not work as expected. Essential and security cookies cannot be disabled as they are required for the platform to function.

BMAX retains personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable obligations. The following retention periods apply as a general guide:

• Active account data: Held for the duration of your account and for up to five years after account closure, to allow for dispute resolution and statutory record-keeping requirements.
• Transaction records: Financial transaction records (deposits, withdrawals, bet settlements) are retained for a minimum of five years from the date of the transaction.
• Identity verification documents: CNIC copies and verification documents are retained for the duration of your account and for up to five years following closure.
• Support communications: Chat transcripts and support tickets are retained for two years from the date of the interaction, after which they are deleted unless they are part of an ongoing dispute.
• Marketing consent records: Records of your consent to receive marketing communications are kept for as long as you are a registered BMAX user plus a further two years, to allow for audit purposes.

When data is no longer required and no legal obligation requires its retention, BMAX deletes it securely. Electronic records are deleted and overwritten; physical documents containing personal data are shredded.

As a BMAX player based in Pakistan, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting BMAX support at support@bmax.ws. BMAX will respond within 30 days of receiving a valid request.

BMAX is an adult platform. Services are directed exclusively at individuals aged 18 and over. BMAX does not knowingly collect personal data from anyone under 18 years of age. If a minor has registered on BMAX using false date-of-birth information, the account will be closed immediately upon discovery and all records associated with that account will be deleted, with the exception of the fraud record used to prevent re-registration.

If you believe a minor has registered on BMAX or has accessed your BMAX account, please contact support@bmax.ws immediately so that the account can be reviewed and appropriate action taken. BMAX takes under-age access seriously and works proactively to prevent it through date-of-birth verification at registration and CNIC verification during the KYC process.

BMAX may update this Privacy Policy from time to time to reflect changes in how the platform operates, new features that affect data collection or updated obligations. When changes are made, the revised policy is published on this page with an updated "last updated" date at the top of the document.

For material changes — those that significantly affect how your data is used or your rights under this policy — BMAX will notify you directly via your registered mobile number or email address before the change takes effect. This gives you the opportunity to review the change and, if you do not agree with it, to exercise your right to close your account and request deletion of your data before the new terms apply.

Your continued use of BMAX after the effective date of any update to this Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically so that you are always aware of the current policy.

If you have a question about this Privacy Policy, want to exercise any of your data rights or need to report a suspected data security issue, please get in touch with the BMAX privacy team using any of the methods below. All privacy-related requests are acknowledged within 48 hours and resolved within 30 days.

• Email: support@bmax.ws — mark your subject line with "Privacy Request" for faster routing to the right team
• Live chat: Available 24/7 through the BMAX platform in both Urdu and English
• Account settings: For marketing opt-out, cookie preferences and communication preferences, you can update these directly in your account settings without needing to contact support

For responsible gaming queries — including self-exclusion requests and deposit limit adjustments — please visit the BMAX Responsible Gaming page for specific tools and contact options. For general platform terms, see the BMAX Terms and Conditions.