OneExch Privacy Policy — How We Collect, Use and Protect Your Personal Data

1. Who We Are

OneExch operates the online gaming and sports betting platform accessible at oneexch.net. In this Privacy Policy, "OneExch", "we", "us" and "our" refer to the operating entity behind the platform. "You" or "the player" refers to anyone who visits, registers with, or uses any part of the OneExch platform.

OneExch is the data controller for personal information collected and processed through the platform. This means we determine the purposes and means of processing your data and are responsible for keeping it safe. If you have any questions about how your data is handled, contact us at support@oneexch.net.

2. Personal Data We Collect

OneExch collects different categories of personal data depending on how you interact with the platform. Here is a straightforward breakdown:

2.1 Account Registration Data

• Full legal name (as it appears on your CNIC)
• Date of birth (to verify you are 18 or older)
• CNIC number (for identity verification and higher-tier withdrawals)
• Pakistani mobile number (used for account OTPs and communication)
• Email address (for account notifications and support)
• City and province of residence

2.2 Payment & Financial Data

• Mobile wallet identifiers (Easypaisa, JazzCash, NayaPay, SadaPay account numbers used for deposits and withdrawals)
• Bank account details provided for IBFT transactions
• Card details (masked — full card numbers are never stored by OneExch; they are processed directly by our PCI-DSS compliant payment gateway)
• Transaction history: deposit amounts, withdrawal amounts, dates, and references — all in PKR

2.3 Identity Verification Data

• Scanned or photographed copy of your CNIC (front and back)
• Selfie or live verification photo (for liveness checks on high-value accounts)
• Proof of payment method (e.g., a screenshot of your Easypaisa account showing the matching mobile number)

2.4 Gaming & Betting Activity Data

• Bet history, game session records, wager amounts, outcomes and winnings
• Bonus usage and wagering progress
• Games accessed, time spent, and session frequency

2.5 Technical & Device Data

• IP address at time of registration and login
• Device type, operating system and browser version
• Unique device identifiers
• Geolocation at a city level (not precise GPS coordinates)
• Session timestamps and login history

2.6 Communications Data

• Records of live chat conversations with OneExch support
• Email correspondence with our team
• Any information you voluntarily share when submitting a complaint or feedback

3. How We Collect Your Data

OneExch collects personal data through the following channels:

• Directly from you — when you complete the registration form, submit a verification document, make a deposit or withdrawal request, contact support, or respond to a promotional survey.
• Automatically as you use the platform — through cookies, session tracking technology and server logs that record device information, IP addresses and gaming activity. See Section 6 for full cookie details.
• From payment service providers — Easypaisa, JazzCash, NayaPay, SadaPay and banking partners confirm transaction references and amounts to allow us to credit your account correctly.
• From identity verification partners — where third-party KYC tools are used for document or liveness verification, those partners return a pass/fail result along with the extracted data to OneExch.
• From game providers — integrated game studios (e.g., Evolution Gaming, Pragmatic Play, Ezugi) return game session results and RTP data associated with your OneExch account ID.

4. Why We Use Your Personal Data

OneExch processes personal data only for specific, legitimate purposes. The table below sets out our main processing activities, the data category involved, and the legal basis for processing:

OneExch will not use your personal data for purposes other than those listed above without first informing you and, where required, obtaining your consent.

5. Who We Share Your Data With

OneExch does not sell your data to anyone. We share it only in the following limited circumstances and only to the extent necessary:

• Payment processors and wallet providers — Easypaisa, JazzCash, NayaPay, SadaPay, banks handling IBFT, and card processors receive the minimum transaction data needed to process your deposit or withdrawal.
• Identity and KYC verification partners — third-party services used to verify document authenticity and confirm that you are who you say you are. These partners operate under strict data processing agreements and may not retain your documents beyond the verification process.
• Game providers — your OneExch account ID and session data are shared with integrated studios (Evolution Gaming, Pragmatic Play, Ezugi, PG Soft and others) to enable game functionality. These providers do not receive your name, CNIC or payment details.
• Regulatory and law enforcement authorities — OneExch complies with valid legal requests from authorities, including anti-money laundering (AML) reporting obligations. We share data in these situations because we are legally required to, not voluntarily.
• Platform infrastructure providers — cloud hosting, security monitoring and analytics services that process data on our behalf under data processing agreements that prohibit them from using your data for their own purposes.
• Fraud and security services — device fingerprinting and risk-scoring tools that help identify suspicious login attempts or account takeover activity. These services receive device data and IP addresses only.

6. Cookies & Tracking Technologies

OneExch uses cookies and similar tracking technologies on the platform. A cookie is a small text file stored on your device when you visit a website. Here is how we use them:

Essential Cookies

These are required for the platform to function. They keep you logged in between pages, maintain your session security, and remember your language preference. You cannot opt out of essential cookies while using OneExch — without them, the platform simply does not work.

Analytics Cookies

We use anonymised analytics data to understand how players navigate the OneExch platform — which pages are visited most, where sessions drop off, how long games are played. This data is aggregated and cannot be traced back to an individual. Analytics cookies help us improve the product.

Security Cookies

These support fraud detection — flagging unusual session patterns, detecting bot activity, and identifying anomalous login behaviour. They do not track you across other websites.

Preference Cookies

These remember choices you have made — such as your notification preferences or UI settings — so you do not have to re-enter them every visit.

OneExch does not use third-party advertising cookies or install any tracking technology that follows you across unrelated websites. You can manage cookie preferences through your browser settings. Note that blocking essential cookies will prevent you from logging into your OneExch account.

7. How We Keep Your Data Secure

Security is not an afterthought at OneExch — it is built into the platform from the ground up. The measures we have in place include:

• TLS encryption on all data transmitted between your device and our servers — the same technology used by banks.
• Encryption at rest for all sensitive stored data including CNIC details and payment information.
• Multi-factor authentication for all internal staff accessing production systems.
• Role-based access controls — support staff can only see the data they need to resolve your specific query. No OneExch employee has blanket access to the full player database.
• PCI-DSS compliant payment processing — full card numbers are never stored on OneExch servers. They flow directly to our certified payment gateway.
• Regular penetration testing by independent security firms.
• Automated anomaly detection that flags unusual data access patterns within our systems.

Despite these measures, no internet transmission or digital storage system is 100% impenetrable. In the unlikely event of a data breach that affects your personal information, OneExch will notify affected players without undue delay and will take all steps to contain the breach and prevent recurrence.

You also have a role to play in keeping your account secure. Use a strong, unique password for your OneExch account. Do not share your login details with anyone. If you suspect your account has been accessed without your permission, contact support@oneexch.net immediately.

8. How Long We Keep Your Data

OneExch retains personal data for as long as your account is active and for such additional period as is required by applicable regulatory obligations or legitimate operational needs. In practice:

• Account and identity data — retained for the lifetime of your account plus a minimum of 5 years after account closure, in line with standard AML record-keeping obligations.
• Transaction records — PKR deposit and withdrawal records are retained for a minimum of 5 years from the date of each transaction.
• CNIC documents and KYC records — retained for the duration of your active account plus 5 years post-closure.
• Gaming activity logs — bet history and session data retained for 3 years from the date of each session.
• Support communications — live chat and email records retained for 2 years from the date of the conversation.
• Marketing preference records — kept for as long as you have an active account to honour your opt-out choices.

When data reaches the end of its retention period, it is either permanently deleted from our systems or anonymised so that it can no longer be linked to you as an individual. Anonymised, aggregated data may be retained indefinitely for platform analytics purposes.

9. Your Rights Over Your Personal Data

You have the following rights in relation to your personal data held by OneExch. To exercise any of these rights, contact us at support@oneexch.net with the subject line "Data Rights Request":

OneExch will respond to all data rights requests within 30 calendar days. For complex requests, we may extend this by a further 30 days with prior notice. We do not charge a fee for data rights requests unless they are manifestly unfounded or repetitive.

10. Children's Privacy

OneExch strictly prohibits anyone under the age of 18 from registering or using the platform. We do not knowingly collect personal data from children under 18. Age is verified at registration through date of birth entry and, for higher-tier accounts, through CNIC verification — which in Pakistan only exists for adults.

If OneExch becomes aware that personal data from a minor has been collected — for example because a falsified date of birth was provided — the account will be closed immediately and all data deleted except for records required for AML compliance. We also encourage parents and guardians to use device-level parental controls to prevent minors from accessing online gaming platforms.

11. Marketing Communications & Opt-Out

With your consent, OneExch sends promotional communications including bonus offers, free spin notifications, cricket betting promotions, and OneExch tournament announcements. These may be sent via SMS to your registered Pakistani mobile number or via email to your registered address.

You can opt out of marketing communications at any time through any of the following methods:

• Click the "Unsubscribe" link in any OneExch promotional email.
• Reply STOP to any OneExch promotional SMS.
• Update your notification preferences in the Account Settings section of the platform.
• Email support@oneexch.net with the subject "Unsubscribe from marketing".

Opting out of promotional communications does not affect transactional messages — you will still receive OTPs for login and withdrawal, withdrawal confirmation notices, and important account security alerts. These are necessary for the operation of your account and cannot be turned off without closing your account entirely.

OneExch will not send promotional communications to accounts that have set deposit limits below specified thresholds under the Responsible Gaming policy. We consider it inappropriate to market further gambling activity to players who have chosen to restrict their own spending.

12. Third-Party Links & Embedded Content

The OneExch platform may from time to time contain links to other websites or embedded third-party content — for example, live score data feeds or game provider interfaces. This Privacy Policy applies only to the OneExch platform. Once you leave our platform and visit a third-party site, that site's own privacy policy governs the data it collects from you.

OneExch does not control the privacy practices of third-party game providers beyond the data processing agreements we have in place with them. We recommend reviewing the privacy policies of any third-party services you interact with, particularly if you are directed off the OneExch domain. For clarity, our game providers do not receive your name, CNIC or payment details — only your anonymised OneExch session ID.

13. Changes to This Privacy Policy

OneExch may update this Privacy Policy from time to time — for example, to reflect changes in the law, changes in the way we process data, or changes to the platform that involve new data processing activities. When we make a material change to this policy, we will:

• Update the "Last Updated" date shown at the top of this page.
• Send a notification to your registered email address at least 14 calendar days before the changes take effect.
• Where the change involves a new use of your data that requires consent, request that consent explicitly before the new processing begins.

Your continued use of the OneExch platform after the effective date of any policy update constitutes acceptance of the revised Privacy Policy. If you do not agree with the updated policy, you may request account closure before the effective date by emailing support@oneexch.net.

Previous versions of the OneExch Privacy Policy are available on request. The version on this page is always the current, in-force version.

14. How to Contact Us About Privacy

If you have any questions about this Privacy Policy, want to exercise one of your data rights, believe your data has been mishandled, or want to report a privacy concern, please contact the OneExch data team:

If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter to the relevant data protection authority applicable under OneExch's licensing jurisdiction.