Daraz Play Privacy Policy — How We Handle Your Personal Data

1Introduction

Daraz Play ("we," "us," "the Platform") is an online gaming platform operated for players based in Pakistan. We understand that the people using our platform are trusting us with personal and financial information, and we take that responsibility seriously. This Privacy Policy sets out in plain language what information Daraz Play collects, how we use it, who we share it with (and under what limited circumstances), and what rights you have over your own data.

Privacy at Daraz Play is not a compliance checkbox. It is built into how we designed the platform from the ground up. We collect the minimum data required to run your account and process PKR transactions correctly. We don't build advertising profiles on our players, we don't sell data to third parties, and we don't use your information in ways that aren't directly connected to providing you with the gaming service you signed up for.

This policy is written for Pakistani players in everyday English. If any part of it is unclear or you want to understand something in more detail, our support team is available 24/7 via live chat in both Urdu and English, and can be reached by email at support@darazplay.link.

2Personal Data We Collect

Daraz Play collects personal data through two main channels: information you provide to us directly, and information we collect automatically when you use the platform. Here is a breakdown of both categories.

Information You Provide

• Registration data — your full name, mobile number or email address, and date of birth when you create your account.
• Identity verification data — a copy of your CNIC (Computerised National Identity Card) submitted during the KYC verification process required before withdrawals.
• Payment information — transaction records associated with your Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or card transactions. We do not store full card numbers — card payments are processed through third-party payment gateways that handle sensitive card data under their own PCI-DSS compliance.
• Support communications — records of your interactions with our customer support team, whether via live chat or email.

Information Collected Automatically

• Device and browser data — device type, operating system, browser version, and screen resolution used to access Daraz Play.
• IP address and location — used for fraud prevention, duplicate account detection, and regulatory compliance purposes.
• Session and gameplay data — game history, bet amounts, session durations, and account activity logs. This is essential for dispute resolution, responsible gaming monitoring, and platform security.
• Cookies and similar technologies — detailed in Section 6 of this policy.

3Why We Collect Your Data

Every piece of data that Daraz Play collects serves a specific purpose connected to operating your account and delivering the service. Here is why we need each category of information:

• To operate your account — your name, contact details, and login credentials are necessary to create and maintain your account, process login requests, and send account-related notifications such as deposit confirmations and withdrawal receipts.
• To process PKR transactions — payment records are required to credit deposits, process withdrawals to your JazzCash or Easypaisa wallet, and maintain accurate account balances.
• To verify your identity — CNIC data is collected solely to fulfil Know Your Customer (KYC) obligations and prevent fraud, underage gambling, and money laundering. This is a regulatory requirement, not a commercial choice.
• To prevent fraud and abuse — technical data including IP addresses, device identifiers, and session logs are used to detect duplicate accounts, identify suspicious betting patterns, and protect other players on the platform.
• To support responsible gaming — gameplay data and session history allow Daraz Play to monitor for patterns that may indicate problem gambling and to apply any limits or restrictions you have set on your account.
• To resolve disputes — game logs and transaction records are retained so that any disputed outcome or payment can be investigated accurately and fairly.
• To improve the platform — aggregated, anonymised usage data helps us understand which games are popular, where the platform performs well, and where it needs improvement. This analysis does not use individually identifying information.

4Payment Data and PKR Transactions

All financial transactions at Daraz Play are conducted in Pakistani Rupees (PKR). This means there is no currency conversion at any point in the transaction chain, and no exchange rate information is processed or stored. Your deposits and withdrawals are in PKR from start to finish.

For Easypaisa and JazzCash transactions, Daraz Play receives transaction confirmation data from the mobile money provider — typically a transaction reference number, the amount in PKR, and the registered mobile number associated with the wallet. This is the minimum information needed to credit your account and verify the payment. The underlying wallet credentials and PINs are handled entirely by Easypaisa and JazzCash and are never seen or stored by Daraz Play.

For bank transfers (IBFT), Daraz Play receives confirmation of the incoming transfer amount and the originating bank account details to the extent provided by the banking system. For Visa and Mastercard card transactions, payments are processed through a PCI-DSS compliant third-party payment gateway. Daraz Play does not store, transmit, or have access to full card numbers. We receive a tokenised reference that allows us to process future transactions to the same card without handling the raw card data.

5KYC Verification and CNIC Data

Daraz Play operates a Know Your Customer (KYC) verification process as required by anti-money laundering obligations. Account verification is completed once and is a prerequisite for processing any withdrawal from your account. The verification process requires submission of a copy of your CNIC — Pakistan's national identity document.

How CNIC Data is Handled

Your CNIC information is used for one purpose only: to confirm your identity and verify that you are the person who created the account. It is accessed only by authorised compliance staff within Daraz Play who have a specific need to review it as part of the verification workflow. It is not shared with marketing teams, game providers, or any other department that does not have a direct compliance function.

CNIC documents are stored in an encrypted format within Daraz Play's secure data infrastructure. Access is logged and audited. Once your account is verified, the CNIC copy is retained for the period required by applicable anti-money laundering regulations — typically five years from account closure — after which it is securely deleted.

6Cookies and Tracking Technologies

Daraz Play uses cookies and similar technologies to make the platform function correctly and to understand how it is being used. Cookies are small text files stored in your browser when you visit a website. They are widely used and generally harmless — they do not contain executable code and cannot access other files on your device.

Types of Cookies We Use

• Essential cookies — required for the platform to function. These include session cookies that keep you logged in during a session, security tokens that protect against cross-site request forgery, and cookies that remember your language and display preferences. These cannot be disabled without breaking core platform functionality.
• Analytics cookies — used to understand aggregate usage patterns such as which pages are most visited, where users drop off in registration, and how game categories perform. This data is anonymised and not linked to individual accounts.
• Functional cookies — remember preferences you have set, such as game display options or notification settings, so you don't have to set them again each visit.

Daraz Play does not use third-party advertising cookies, social media tracking pixels, or any cookie technology designed to build cross-site advertising profiles on individual players. You can manage cookie preferences through your browser settings. Blocking essential cookies will affect platform functionality — blocking analytics or functional cookies will not prevent you from using the platform but may affect some personalisation features.

7When We Share Your Data

Daraz Play does not sell your personal data. We do not share personal data with third parties for their own marketing purposes. The circumstances in which your data is shared with any third party are limited and specific:

• Payment processors — minimum necessary transaction data is shared with Easypaisa, JazzCash, NayaPay, SadaPay, and card payment gateways to process your deposits and withdrawals. These parties process your data under their own privacy policies and are bound by their own regulatory obligations.
• Game providers — when you play a casino game, your gameplay session data (bet amount, game outcome, session ID) is shared with the relevant game provider for technical and regulatory purposes. Game providers do not receive your personal identity data (name, CNIC, phone number) as part of this.
• Identity verification services — in some cases, CNIC verification may be supported by a third-party identity verification service provider. Any such provider is bound by contractual data processing obligations that require them to handle your data to the same standard as Daraz Play.
• Legal and regulatory obligations — Daraz Play will disclose personal data when required to do so by a valid legal order, court order, or regulatory directive from a competent Pakistani authority. We will disclose only the minimum information required to satisfy the legal obligation and will notify the affected player where we are legally permitted to do so.
• Fraud prevention — in cases of suspected fraud or criminal activity affecting multiple players, aggregated or specific data may be shared with fraud prevention services or law enforcement on a confidential basis.

8Data Security

Daraz Play implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we hold. These measures are designed to protect your data against unauthorised access, accidental loss, alteration, and disclosure.

Technical Measures

• All data transmitted between your device and Daraz Play is encrypted using TLS (Transport Layer Security). This prevents interception of your login credentials, payment data, and personal information during transmission.
• Sensitive data at rest — including CNIC documents and payment records — is stored in encrypted form using industry-standard encryption algorithms.
• Access to personal data within Daraz Play's systems is restricted on a need-to-know basis. Employees with no legitimate need to access player data cannot do so. Access is logged and audited.
• Our platform infrastructure is protected by firewalls, intrusion detection systems, and regular security monitoring.

Organisational Measures

• Staff who handle personal data receive training on data protection obligations and the specific procedures Daraz Play applies to personal data handling.
• Third-party service providers who process personal data on our behalf are subject to contractual data processing agreements that require them to maintain equivalent security standards.
• In the event of a data security incident that affects your personal data, Daraz Play will notify affected players promptly and take immediate steps to contain and remediate the breach.

9Data Retention

Daraz Play retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The retention periods that apply to the main categories of data we hold are as follows:

• Account and identity data — retained for the duration of your active account plus five years following account closure. The five-year post-closure retention period is required by anti-money laundering regulations.
• Transaction records — retained for a minimum of five years from the date of the transaction, again in accordance with financial record-keeping obligations.
• Gameplay logs — retained for 12 months from the date of the session by default, unless a dispute is open that requires the records to be retained for longer.
• Support communications — retained for 24 months from the date of the last message in a support conversation, unless the conversation is connected to an ongoing dispute.
• Cookie data — session cookies expire when you close your browser. Persistent cookies used for analytics and functional purposes expire between 30 days and 12 months depending on the specific cookie.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to you as an individual. Where anonymisation is applied rather than deletion, the resulting data may be retained indefinitely for statistical and analytical purposes.

10Your Data Rights

As a player at Daraz Play, you have a number of rights in relation to the personal data we hold about you. These rights are described below along with how to exercise each one.

To exercise any of these rights, contact Daraz Play support via live chat or at support@darazplay.link. We may need to verify your identity before processing a data rights request. We will not charge a fee for handling data rights requests unless requests are manifestly unfounded or excessive.

11Children and Minors

Daraz Play is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. Our registration process includes a date of birth requirement, and age verification is performed during the KYC process using CNIC data.

If Daraz Play becomes aware that personal data has been collected from a minor, the account will be immediately closed, all data associated with the account will be deleted, and any funds deposited will be returned to the originating payment method where possible.

12Changes to This Privacy Policy

Daraz Play may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we provide. When material changes are made, we will update the "last updated" date at the top of this page. Where changes are significant — for example, if we introduce a new category of data collection or change how we share data with third parties — we will notify registered players via email or in-platform notification before the changes take effect.

Your continued use of Daraz Play after changes to this Privacy Policy are published constitutes acceptance of the updated policy. If you do not agree with a material change to this policy, you have the right to request account closure and deletion of your personal data, subject to our legal retention obligations described in Section 9.

We recommend reviewing this page periodically to stay informed of the current version of our privacy practices. The date at the top of the policy indicates when it was last updated.