22atm Privacy Policy

1. Who We Are

22atm operates the online gaming and sports betting platform accessible at 22atm.pro. For the purposes of this Privacy Policy, 22atm acts as the data controller in respect of the personal information collected through the platform. As data controller, 22atm determines the purposes and means by which your personal data is processed.

22atm is licensed under an international gaming authority. Our licensing details, including the name of the regulatory body, are published on our About Us page. Our licensing obligations include strict data protection requirements that we are bound to uphold at all times.

If you have any questions about how 22atm processes your personal data, the primary point of contact is our support team, reachable via live chat inside your account dashboard or at [email protected]. We are committed to responding to all privacy-related enquiries within 5 business days.

2. Legal Basis for Processing Your Data

22atm processes your personal data on the following legal grounds, depending on the specific purpose of the processing activity:

3. How We Use Your Personal Data

22atm uses the personal data we collect about you for the following specific purposes:

3.1 Account Management

Your identity and contact data are used to create and maintain your 22atm account, authenticate your logins, manage your PKR balance, and communicate important account-related updates such as deposit confirmations, withdrawal approvals, and security alerts. These communications are transactional in nature and cannot be opted out of while your account remains active.

3.2 Identity Verification and KYC

As part of our licensing obligations, 22atm is required to verify the identity and age of all players before permitting withdrawals. Your CNIC, selfie, and supporting documents are used exclusively for this verification process. KYC documentation is stored securely and is only accessible to trained compliance staff on a need-to-know basis.

3.3 Payment Processing

Your payment data is used to process deposits from and withdrawals to your registered JazzCash, EasyPaisa, or bank account. We retain transaction records as required by our licensing authority and anti-money-laundering obligations. These records may be requested by regulatory bodies and cannot be deleted upon request where a legal retention obligation applies.

3.4 Fraud Prevention and Platform Security

22atm analyses technical and usage data to detect and prevent fraudulent activity, bonus abuse, money laundering, and other prohibited conduct outlined in our Terms and Conditions. Automated systems and human review teams may both be involved in this analysis. Where fraud is suspected, your account may be suspended pending investigation, and data may be shared with relevant authorities.

3.5 Responsible Gaming Obligations

22atm monitors player behaviour patterns — including deposit frequency, session duration, and betting volume — to identify indicators of problem gambling. This monitoring is a legal requirement under our gaming licence. If our systems flag an account as potentially at risk, a member of our responsible gaming team may reach out proactively. This processing cannot be opted out of as it is conducted in the public interest.

3.6 Marketing and Promotions

Where you have provided explicit consent, 22atm may use your contact details to send you promotional communications including bonus offers, new game announcements, PSL betting specials, and seasonal campaigns. You can withdraw your marketing consent at any time by visiting your account settings or contacting support at [email protected]. Withdrawal of consent will take effect within 48 hours.

3.7 Platform Improvement and Analytics

Aggregated and anonymised usage data is used to understand how players interact with 22atm, identify popular features, diagnose technical issues, and plan product development. Where possible, this analytics processing uses data that cannot be traced back to any individual player.

4. Data Sharing and Disclosure

22atm does not sell, rent, or share your personal data with third parties for their own marketing purposes. We share your data only in the limited circumstances described below:

4.1 Service Providers

We engage trusted third-party service providers to assist in operating the 22atm platform. These include payment processors (JazzCash, EasyPaisa, and our banking partners), KYC verification providers, cloud hosting and infrastructure partners, customer support software vendors, and fraud detection service providers. Each provider is bound by a data processing agreement and is only permitted to process your data for the specific purpose for which they have been engaged.

4.2 Game Software Providers

Certain game titles on 22atm are powered by third-party game studios. These providers may receive anonymised session data necessary to render games correctly and process game outcomes. They do not receive your name, CNIC, or financial details. Game providers are contractually required to handle even anonymised data in accordance with applicable data protection standards.

4.3 Regulatory and Legal Disclosure

22atm may disclose your personal data to our licensing authority, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where we are legally required to do so. Such disclosures are made strictly in compliance with applicable law and, where permitted, we will notify you of any such disclosure. We cannot provide notice where doing so would compromise an investigation or is prohibited by law.

4.4 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of 22atm's assets, your personal data may be transferred to the acquiring entity as part of that transaction. In such cases, 22atm will provide notice through the platform and the acquiring entity will be required to honour the commitments made in this Privacy Policy.

5. International Data Transfers

22atm's primary server infrastructure is hosted in data centres that meet international security standards. Some of our third-party service providers may process data in jurisdictions outside Pakistan. Where such transfers occur, 22atm ensures that appropriate safeguards are in place, which may include standard contractual clauses, binding corporate rules, or reliance on the service provider's certification under a recognised data protection framework.

By using the 22atm platform, you acknowledge that your personal data may be transferred to, stored in, and processed in a country other than Pakistan. In all such cases, 22atm takes steps to ensure that your data receives a level of protection consistent with this Privacy Policy and our licensing obligations.

6. Data Retention

22atm retains your personal data only for as long as is necessary for the purposes described in this Policy, or as required by law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with 22atm, plus a minimum of 5 years following account closure, as required by our licensing authority and anti-money-laundering regulations.
• KYC documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction in accordance with financial record-keeping requirements.
• Marketing consent records: Retained for the duration of your consent, plus 2 years following withdrawal of consent, to demonstrate compliance in the event of a complaint.
• Technical and usage data: Typically retained in identifiable form for up to 24 months from collection, after which it is anonymised or deleted.
• Support correspondence: Retained for up to 3 years from the date of the last communication, or longer if the correspondence relates to an unresolved dispute or regulatory enquiry.

Where 22atm is under a legal obligation to retain data for a specific period, that obligation overrides any request for earlier deletion. Upon expiry of the applicable retention period, data is securely deleted or anonymised in accordance with our internal data disposal procedures.

7. Cookies and Tracking Technologies

22atm uses cookies and similar tracking technologies (including local storage, session tokens, and pixel tags) to operate and improve the platform. Cookies are small text files placed on your device when you visit the site. They do not contain executable code and cannot access other files on your device.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function correctly — including session authentication, remembering items in your activity queue, and maintaining your logged-in state. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method display, and responsible gaming limit reminders. These can be disabled, but doing so may affect your experience.
• Analytics Cookies: Help us understand aggregate patterns of platform usage so we can identify and fix issues and prioritise feature development. The data collected is anonymised where possible.
• Security Cookies: Used in conjunction with our fraud detection systems to identify unusual access patterns and protect your account from unauthorised login attempts.

7.2 Managing Cookies

You can control cookie settings through your web browser's privacy settings. Most modern browsers allow you to block third-party cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling certain cookies may prevent some features of 22atm from working correctly. Instructions for managing cookies in major browsers are available in each browser's help documentation.

8. Your Data Rights

As a 22atm player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact us via live chat or at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving a valid request.

9. Children and Minors

22atm is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes age verification steps, and our KYC process requires submission of a valid CNIC confirming date of birth before any withdrawal is permitted.

If 22atm becomes aware that an account has been registered by or on behalf of an individual under 21 years of age, we will immediately close that account, reverse any deposits where possible, and delete the associated personal data except where retention is required by law. If you suspect that a minor has accessed 22atm using your account or any other means, please contact us immediately at [email protected].

10. Security Measures

22atm implements a layered approach to data security designed to protect your personal and financial information against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and 22atm servers is encrypted using up-to-date TLS protocols, ensuring that your login credentials, payment details, and personal data cannot be intercepted in transit.
• At-Rest Encryption: Sensitive personal data stored on 22atm servers — including CNIC data and payment account numbers — is encrypted at rest using industry-standard algorithms.
• Access Controls: Access to personal data held by 22atm is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of system access required to perform their role. All access is logged and audited.
• Two-Factor Authentication: 22atm offers optional 2FA for player accounts and enforces 2FA for all internal administrative access to systems holding personal data.
• Regular Security Audits: 22atm conducts periodic security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses in our infrastructure.
• Incident Response: 22atm maintains a data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players and relevant regulatory authorities within the timeframes required by applicable law.

While 22atm takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You also have a responsibility to keep your login credentials secure and to notify us immediately of any suspected unauthorised access to your account.

11. Third-Party Links and Integrated Services

The 22atm platform may reference or integrate with third-party services such as game studios, payment gateways, and identity verification providers. While we take care to work only with reputable partners, 22atm is not responsible for the privacy practices of third-party organisations.

Each of our third-party service providers operates under its own privacy policy and data protection framework. We encourage you to review the relevant policies of any third-party service you interact with, particularly your payment provider (JazzCash, EasyPaisa, or your bank), as their handling of transaction data is governed by their own terms independently of this Policy.

12. Updates to This Privacy Policy

22atm may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our platform features. When material changes are made, we will notify registered players via a prominent notice on the platform and, where appropriate, via email to your registered address, at least 7 days before the changes take effect.

The "Last Reviewed" date displayed at the top of this page indicates when the Policy was most recently updated. We encourage you to revisit this page periodically. Your continued use of the 22atm platform following the effective date of any revision constitutes your acceptance of the updated Policy.

13. Contact and Complaints

If you have any questions about this Privacy Policy or wish to exercise any of your data rights, please contact the 22atm privacy team through the following channels:

• Live Chat: Available 24/7 from your account dashboard. Use the subject "Privacy / Data Rights" when initiating the chat.
• Email: [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" so your message is routed to the correct team.

22atm will acknowledge all privacy-related enquiries within 2 business days and will provide a substantive response within 30 calendar days. For complex requests requiring additional verification steps, we may extend this period by a further 30 days, in which case we will inform you of the extension and the reason for it.

If you are unsatisfied with our response to a privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction, or to the dispute resolution body designated by 22atm's licensing authority. Details of these bodies are available upon request from our support team.

We take all privacy complaints seriously and are committed to resolving them fairly, transparently, and in a timely manner. Your trust in 22atm depends on us handling your personal data responsibly — and that is a commitment we do not take lightly.