Plain language commitment: This Privacy Policy applies to Bad Rupees (badrupees.com) and all related services. By registering an account or using the platform, you confirm that you have read this policy and consent to the data practices described. If anything is unclear, email support@badrupees.com before you proceed.
1. Introduction — Who We Are and What This Policy Covers
Bad Rupees is an online gaming and sports betting platform built specifically for players in Pakistan. We operate entirely in Pakistani Rupees (PKR) and our services include PSL betting, live casino games, roulette, poker, Ludo, jackpot slots, and sports betting odds. Everything on this platform was designed from the ground up for Pakistani players — and that same Pakistan-first approach applies to how we handle your personal data.
This Privacy Policy explains what personal information Bad Rupees collects from you, why we collect it, how we store and protect it, who we may share it with, how long we keep it, and what control you have over it. It applies to all data collected through our website, any mobile interface, customer support communications, and payment processing related to your Bad Rupees account.
We do not collect data for the sake of it. Every piece of information we hold about you serves a specific purpose — running your account, processing your payments in PKR, keeping the platform secure, meeting our legal obligations, or improving the experience for Pakistani players. We never sell your personal data to any third party for marketing or commercial purposes.
Data Controller: Bad Rupees is the data controller responsible for personal data collected through this platform. For all data-related queries, contact us at support@badrupees.com with "Privacy" in the subject line.
2. Data We Collect at Bad Rupees
The personal data Bad Rupees collects falls into three categories: information you provide directly when registering or using the platform, information generated automatically by your use of the platform, and information we receive from third parties such as payment providers in the course of processing your transactions.
2.1 Information You Provide Directly
- Registration details: Your full legal name, date of birth, mobile number, and email address collected when you create your Bad Rupees account.
- Identity verification documents: CNIC, passport, or other government-issued ID that we request to verify your identity and age in compliance with our responsible gaming obligations.
- Payment information: Your Easypaisa or JazzCash mobile wallet number, NayaPay or SadaPay account details, IBFT bank account information, or Visa/Mastercard card details used for deposits and withdrawals. Full payment card numbers are never stored by Bad Rupees — see Section 5 for full details.
- Address information: We may request your residential address in Pakistan for identity verification or compliance purposes.
- Customer support communications: The content of any messages you send to our support team via email or live chat, including attachments you submit to support a query or complaint.
- Responsible gaming information: Any self-exclusion requests, deposit limits, or session time preferences you set on your account, which are recorded to ensure we honour your instructions accurately.
2.2 Information Collected Automatically
- Device and browser information: Your device type, operating system, browser version, screen resolution, and language settings collected when you access Bad Rupees.
- IP address and approximate location: Your IP address, which we use to verify that you are accessing the platform from Pakistan and to detect potentially fraudulent access patterns.
- Session data: Login times, session duration, pages visited within the Bad Rupees platform, and features used during each session.
- Gaming activity: Records of every bet placed, game played, stake amount, win or loss amount, and market selected. This data is required for account management, dispute resolution, and responsible gaming monitoring.
- Transaction history: A complete record of all deposits and withdrawals on your account, including timestamps, amounts in PKR, and payment method identifiers.
- Cookie and tracking data: See Section 8 for a full explanation of how Bad Rupees uses cookies and what you can do to manage them.
2.3 Information from Third Parties
- Payment confirmation data received from Easypaisa, JazzCash, NayaPay, SadaPay, your bank, or your card issuer when a transaction is processed.
- Identity verification confirmation from third-party identity check services we use to meet age verification requirements.
- Fraud screening information from payment security systems used to protect Bad Rupees players from unauthorised transactions.
3. Why Bad Rupees Collects and Uses Your Data
Every category of data that Bad Rupees collects has a specific, defined purpose. We do not collect information speculatively or hold data beyond the period it is needed. The following table sets out our primary purposes and the legal basis under which we process your data for each.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Creating and managing your Bad Rupees account | Name, DOB, mobile number, email | Contract performance |
| Processing deposits and withdrawals in PKR | Payment method details, transaction records | Contract performance |
| Verifying your identity and age (18+) | CNIC / passport, DOB | Legal obligation |
| Detecting and preventing fraud | IP address, device data, transaction patterns | Legitimate interest |
| Responsible gaming monitoring and intervention | Gaming activity, session data, limit settings | Legal obligation |
| Customer support and dispute resolution | Support communications, bet records | Contract performance |
| Platform security and access control | IP address, login data, device identifiers | Legitimate interest |
| Improving platform features and game offerings | Anonymised usage data, session patterns | Legitimate interest |
| Service communications (account notices, payment alerts) | Email, mobile number | Contract performance |
Bad Rupees will only send you promotional communications — offers, bonuses, PSL betting tips — if you have opted in to receive them. You can opt out at any time by updating your communication preferences in your account settings or by emailing support@badrupees.com.
4. Who Bad Rupees Shares Your Data With
Bad Rupees does not sell, rent, or trade your personal data to any third party for commercial purposes. Full stop. We share your data only in the specific circumstances described below, and only to the extent necessary for the stated purpose.
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and banking partners receive the payment details required to process your deposits and withdrawals. Each provider operates under their own privacy and security standards and is responsible for data they hold independently of Bad Rupees.
- Identity verification providers: Third-party identity verification services receive the documents you submit for age and identity checks. These providers are contractually prohibited from using your data for any purpose beyond completing the verification.
- Fraud prevention services: Anonymised transaction and behavioural data may be shared with fraud detection systems to identify and prevent fraudulent account activity that could harm other Bad Rupees players.
- Legal and regulatory authorities: Bad Rupees will disclose personal data to law enforcement, regulatory authorities, or courts where required to do so by applicable law in Pakistan, or where we believe disclosure is necessary to protect the safety of players or the integrity of the platform.
- Platform infrastructure providers: Hosting and cloud storage providers that hold Bad Rupees data on our behalf under strict data processing agreements that prohibit them from accessing or using player data for any independent purpose.
- Business transfers: In the unlikely event that Bad Rupees is involved in a merger, acquisition, or asset sale, player data may be transferred as part of that transaction. You will be notified in advance of any such transfer and your rights under this Privacy Policy will continue to apply.
Bad Rupees will never share your personal data with advertisers, data brokers, or any third party for the purpose of targeting you with advertising unrelated to your Bad Rupees account.
5. How Bad Rupees Handles Payment Data
All financial transactions on Bad Rupees are processed in PKR. We take the security of payment data extremely seriously and have designed our payment handling to minimise the amount of sensitive financial information stored on our systems.
- Card data: Bad Rupees does not store full card numbers, CVV codes, or card expiry dates on its own servers. Card payment processing is handled by PCI-DSS compliant payment processors. We retain only a masked card identifier (last four digits) for the purpose of identifying your preferred payment method and processing refunds.
- Mobile wallet data: Easypaisa and JazzCash wallet numbers are stored in encrypted form and used solely to process deposits to and withdrawals from your registered Bad Rupees account. They are not visible in full to Bad Rupees staff and are never shared with third parties except the wallet provider itself to process your transaction.
- IBFT bank account data: Bank account numbers provided for IBFT withdrawals are stored encrypted and used only to process the specific withdrawal transactions you initiate.
- Transaction records: A complete record of all deposits and withdrawals — amounts in PKR, timestamps, payment method type, and transaction status — is maintained for a minimum of five years to meet financial record-keeping obligations and support dispute resolution.
All payment data transmission between your device and Bad Rupees servers uses 256-bit SSL/TLS encryption. The padlock in your browser address bar confirms this encryption is active during your session.
6. How Long Bad Rupees Retains Your Data
Bad Rupees retains personal data for as long as it is needed to fulfil the purpose for which it was collected, or for as long as required by law. The following retention periods apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration information | Duration of account + 5 years | Legal and compliance obligations |
| Identity verification documents | Duration of account + 5 years | Anti-money laundering requirements |
| Transaction and payment records | 5 years from transaction date | Financial record-keeping obligations |
| Gaming activity records | Duration of account + 3 years | Dispute resolution, responsible gaming |
| Customer support communications | 3 years from last communication | Dispute resolution |
| Responsible gaming limit history | Duration of account + 5 years | Regulatory compliance |
| Closed account data (no breach) | 5 years post-closure | Legal obligations |
| Closed account data (breach of terms) | Indefinite (anonymised after 7 years) | Prevention of re-registration by excluded players |
After the applicable retention period, your data is either permanently deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised data may be retained indefinitely for statistical analysis and platform improvement purposes.
7. How Bad Rupees Protects Your Personal Data
The security of your personal information is a core commitment at Bad Rupees, not an afterthought. We implement technical and organisational measures designed to protect your data against unauthorised access, accidental loss, alteration, and disclosure.
- Encryption in transit: All data transmitted between your device and Bad Rupees servers is encrypted using TLS 1.2 or higher with 256-bit AES encryption.
- Encryption at rest: Sensitive data fields — including identity documents, payment method identifiers, and account passwords — are encrypted within our database using industry-standard encryption.
- Access controls: Access to player data within Bad Rupees is restricted on a strict need-to-know basis. Staff who do not require access to personal data to fulfil their role do not have it.
- Password security: Account passwords are stored as salted cryptographic hashes. Bad Rupees staff cannot see your password and will never ask you for it.
- Security monitoring: Our systems are monitored for unusual activity, attempted unauthorised access, and other security events on a continuous basis.
- Regular security assessments: Bad Rupees conducts periodic internal security reviews and engages third-party assessors to test the security of our platform infrastructure.
Your role in keeping your account secure: Bad Rupees technical measures can only go so far. You play an important role by keeping your password confidential, not sharing account access with others, logging out after sessions on shared devices, and reporting any suspected unauthorised access to support@badrupees.com immediately.
8. Cookies and Tracking on Bad Rupees
Bad Rupees uses cookies and similar tracking technologies on our platform. A cookie is a small text file placed on your device by a website. We use them to keep you logged in during a session, remember your platform preferences, detect fraudulent activity, and understand how players use the platform so we can improve it.
Types of cookies used by Bad Rupees:
- Strictly necessary cookies (always active): These are required for the platform to function. They keep you logged in, maintain your session between pages, and preserve security tokens. You cannot opt out of these without disabling the platform entirely.
- Functional cookies (active by default): These remember your preferences — your preferred game view, language settings, saved betslip state. You can disable these in your browser settings without breaking core functionality.
- Analytics cookies (optional): These help Bad Rupees understand how players navigate the platform — which pages are most visited, where players spend time, which features are underused. All analytics data is anonymised and used only to improve the platform for Pakistani players.
You can manage cookies through your browser settings. Most browsers allow you to view, delete, and block cookies from specific websites. Note that blocking strictly necessary cookies will prevent you from using Bad Rupees.
9. Your Data Rights at Bad Rupees
As a Bad Rupees player, you have meaningful rights over the personal data we hold about you. These are not token rights — we have built the processes to honour them.
Right of Access
You can request a copy of all personal data Bad Rupees holds about you. We will provide this in a readable format within 30 days of your request at no charge.
Right to Rectification
If any personal data Bad Rupees holds about you is inaccurate or incomplete, you can request that we correct it. For account details, most updates can be made directly in your account settings.
Right to Erasure
You may request deletion of your personal data. Where we have a legal obligation to retain specific data — such as transaction records — we cannot delete it, but we can restrict processing of data that is not legally required to be retained.
Right to Data Portability
You can request your personal data in a structured, machine-readable format. This allows you to transfer your data history to another service if you choose. Contact support to request a data export.
Right to Object
You can object to Bad Rupees processing your data for direct marketing or for purposes based on our legitimate interests. Opt out of marketing in your account settings or email us directly.
Right to Restrict Processing
In certain circumstances — for example, while a data accuracy dispute is being resolved — you can request that Bad Rupees restrict processing of your personal data.
To exercise any of these rights, email support@badrupees.com with "Data Rights Request" in the subject line. Include your registered account details so we can identify your account. We will respond within 30 days. Where a request is complex or numerous, we may extend this period by up to 60 days and will notify you accordingly.
10. Responsible Gaming and Your Personal Data
At Bad Rupees, responsible gaming data receives special treatment. Information about your self-exclusions, deposit limits, and session time settings is processed not just for operational compliance — it is treated as sensitive personal information that we handle with particular care.
When you set a deposit limit or self-exclusion on your Bad Rupees account, that instruction is recorded in a restricted system that requires elevated access permissions. The purpose is to ensure that your responsible gaming choices are followed accurately and that access to or amendment of that record is strictly controlled.
If you have requested self-exclusion from Bad Rupees, your contact details are retained in our exclusion register even after account closure. This is necessary so that we can identify and refuse any future registration attempt by the same individual during the exclusion period. This retention is a responsible gaming obligation, not marketing activity, and the data is processed on the basis of legal and regulatory compliance obligations.
We do not use your responsible gaming data to profile you for marketing purposes. The fact that you have set limits or requested self-exclusion at Bad Rupees is never used to target you with promotional content. Full details of the responsible gaming tools available to you are described on our Responsible Gaming page.
11. Children's Privacy — Under-18 Policy
Bad Rupees is strictly an 18+ platform. We do not knowingly collect personal data from individuals under the age of 18. All account registrations require confirmation that the applicant is 18 or older, and all accounts are subject to age verification.
If we become aware that personal data has been collected from an individual under 18 — whether through a misrepresentation during registration or for any other reason — we will immediately suspend the account, erase the personal data, and forfeit any balance associated with that account.
If you believe that an individual under 18 has accessed Bad Rupees or submitted personal data to our platform, please notify us immediately at support@badrupees.com. We take every such report seriously and will investigate and act without delay.
12. Changes to This Privacy Policy
Bad Rupees reviews and updates this Privacy Policy periodically to reflect changes in our data practices, changes in applicable law, or improvements to how we explain our practices in plain language. The date at the top of this page shows when the policy was last updated.
When we make material changes to this Privacy Policy — meaning changes that meaningfully affect how we collect, use, or share your personal data — we will notify you by email to your registered address and by displaying a notice within the platform at least 14 days before the changes take effect.
Minor updates — such as clarifications to existing descriptions, corrections of typographical errors, or changes that are more protective of your privacy — may be made without advance notice. The version of this policy displayed on this page at any given time is the current and applicable version.
Your continued use of Bad Rupees after the effective date of any change constitutes your acceptance of the updated Privacy Policy. If you do not agree with any change, please stop using the platform and contact us to close your account and arrange withdrawal of your balance before the change takes effect.
13. How to Contact Bad Rupees About Your Data
If you have questions about this Privacy Policy, want to exercise any of your data rights, have a concern about how your personal data has been handled, or want to report a potential data breach, please get in touch with us directly:
- Email: support@badrupees.com — use "Privacy" or "Data Rights Request" in the subject line for data-related queries
- Live Chat: Available inside your logged-in Bad Rupees account dashboard, 365 days per year
- Languages: English and Urdu
- Response time: Data rights requests receive a written response within 30 days. General privacy queries are typically answered within 5 business days.
Related policies: This Privacy Policy should be read alongside our Terms and Conditions and our Responsible Gaming Policy, all of which form part of your agreement with Bad Rupees.