This Privacy Policy describes how b max ("b max", "we", "us") collects, uses, stores and protects the personal information of players and visitors at bmax.bio. It applies to all b max accounts, including those of players based in Pakistan. By registering an account or using the b max platform, you confirm that you have read and understood this policy. This policy forms part of the overall agreement between you and b max, alongside the Terms and Conditions and Responsible Gaming policy. If anything here is unclear, contact our support team at support@bmax.bio before registering.
01Who We Are
b max is an online gaming and sports betting platform accessible at bmax.bio, operated for the benefit of players in Pakistan. For the purposes of this Privacy Policy, b max is the data controller — meaning we decide what personal data is collected and how it is used.
We take the responsibility of handling your personal information seriously. Pakistan's digital economy is growing rapidly and players increasingly share sensitive financial and identity data with online platforms. b max has built its data practices around the principle that your information should only be collected when necessary, used only for stated purposes and protected to a standard that matches the sensitivity of the data involved. We do not treat your personal data as a commodity.
Our primary contact for all privacy-related enquiries is support@bmax.bio. If you have a specific data request — access, correction, deletion or a complaint — please use that address with "Privacy Request" in the subject line and our team will respond within five business days.
02Data We Collect
b max collects personal data in three ways: information you provide directly when registering and using the platform, information generated automatically through your use of the platform, and information obtained from third parties such as payment processors in the course of verifying your identity or processing transactions.
Information you provide directly:
- Full legal name (as on your CNIC or passport)
- Date of birth
- Pakistani mobile phone number
- Email address
- CNIC number (requested when identity verification is required)
- Residential address
- Payment method details (mobile wallet numbers, bank account details where relevant — see Section 5)
- Communications you send to us through support channels
- Self-reported information provided when setting responsible gaming preferences
Information collected automatically:
- IP address and approximate location derived from it
- Device type, operating system and browser version
- Pages visited on bmax.bio, time spent and navigation paths
- Session duration and login timestamps
- Betting and gameplay history — games played, bets placed, results, amounts wagered
- Deposit and withdrawal transaction records
- Cookies and similar tracking technologies (see Section 6)
Minimum data principle: b max only asks for data that is genuinely needed for a specific purpose. We do not collect data speculatively "in case it might be useful later." If we ask for your CNIC details, it is because identity verification for that account has been triggered — not as a default requirement for all registrations.
03How We Use Your Data
b max uses personal data for the following purposes. Each purpose has a clear legal basis — either your consent (given at registration), the performance of our contract with you, a legitimate business interest or a legal obligation:
- Providing the platform: Your account data is needed to operate your b max account, process bets, credit winnings to your balance and process withdrawals in PKR. Without this, the service cannot function.
- Identity verification: b max is required to verify that players are who they say they are, that they meet the minimum age requirement of 18 years, and that they are not subject to any exclusion or restriction that would prevent them from using the platform. We use your identity data for this verification — either automatically via our systems or through manual document review.
- Fraud prevention and security: We monitor transaction patterns, login behaviour and gameplay data for signs of fraudulent activity, account compromise, money laundering or platform abuse. This monitoring is a legitimate interest — it protects both b max and honest players from those who would exploit the platform.
- Responsible gaming obligations: We use gameplay and transaction data to monitor for patterns that may indicate problem gambling, to enforce self-imposed limits and to comply with responsible gaming obligations. This is an important use of data that is specifically in players' interests.
- Customer support: Communication data from your support interactions is used to resolve your queries and to improve the quality of our support responses over time.
- Platform improvement: Aggregated, anonymised usage data helps us understand how b max is used, which features are popular, where the mobile experience could be improved and what games players in Pakistan prefer. This analysis does not identify you individually.
- Marketing communications: Where you have opted in to marketing at registration, we may send you information about b max promotions, new games and offers via email or SMS. You can opt out of marketing at any time via your account settings or by contacting support@bmax.bio.
- Legal compliance: b max retains certain records to comply with legal and regulatory obligations, including anti-money laundering requirements and dispute resolution obligations.
No automated profiling for high-impact decisions: b max does not use automated decision-making that produces legal or similarly significant effects on players without human review. If your account is flagged by automated systems for investigation, a human review is part of the process before any material action is taken.
04Who We Share Your Data With
b max does not sell your personal data to third parties. We share data only where necessary to provide you with the platform and services, and only with parties who have agreed to handle your data securely. The categories of third parties we share data with are:
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT networks and Visa/Mastercard processing networks receive the minimum data necessary to process your deposit or withdrawal transaction. They do not receive your full b max account details or betting history.
- Identity verification services: Where automated or manual KYC (Know Your Customer) verification is required, a third-party verification service may process your identity documents. These providers are contractually bound to data security standards and are prohibited from using your data for any purpose other than the specific verification task.
- Game providers: The software providers whose games are featured on b max may receive anonymised session data for technical performance purposes. They do not receive your name, contact details or financial information.
- IT and infrastructure providers: Cloud hosting and IT service providers who support the technical operation of b max operate under strict data processing agreements. They may process data in the course of providing infrastructure but do not have independent access to use your data.
- Legal and regulatory authorities: b max will disclose personal data to law enforcement or regulatory bodies where required by law, a court order or to prevent imminent harm. We cannot notify you in advance of such disclosures in all circumstances, but will do so where legally permitted.
No data brokering: b max does not share your personal data with marketing agencies, data brokers or any party for the purpose of targeting you with third-party advertising. Your data stays within the b max ecosystem except where sharing is strictly necessary for the purposes listed above.
05Payment Data and PKR Transactions
All financial transactions on b max are conducted in Pakistani Rupees (PKR). This means your b max account balance is denominated in Rs, deposits are received in Rs and withdrawals are paid in Rs. There is no currency conversion and your financial data is not exposed to third-party currency exchange systems.
When you make a deposit via Easypaisa, JazzCash, NayaPay or other supported methods, b max receives a transaction confirmation from the payment provider that includes the amount in PKR and a reference number. Your full mobile wallet PIN, bank account password or card details are entered directly into the payment provider's secure interface — b max does not see or store these credentials.
For withdrawal processing, b max transmits your destination wallet number or bank account details to the relevant payment processor. This data is transmitted over encrypted connections and is not retained by b max beyond the period necessary for transaction reconciliation and the legal record-keeping periods described in Section 8.
Large transactions may be subject to additional verification under anti-money laundering obligations. Where this applies, b max may request source-of-funds information. This is a legal requirement and not a discretionary policy. Providing false information in response to such a request constitutes a breach of the Terms and Conditions.
06Cookies and Tracking Technologies
b max uses cookies and similar technologies to make the platform work properly, understand how it is used and occasionally to personalise your experience. A cookie is a small text file stored on your device by your browser when you visit bmax.bio. It is not a program and cannot execute code or deliver viruses.
b max does not use third-party advertising cookies or tracking pixels that send your data to external advertising networks. You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging into your b max account.
07Data Security
b max implements security measures proportionate to the sensitivity of the personal data we hold. The following controls are in place to protect your data:
- Encryption in transit: All data transmitted between your device and bmax.bio is encrypted using TLS (Transport Layer Security). You can verify this by the padlock icon in your browser's address bar when visiting the site.
- Encryption at rest: Sensitive personal data — including identity documents, payment details and authentication credentials — is encrypted when stored on b max servers.
- Access controls: Internal access to personal data is restricted on a need-to-know basis. Support agents have access to the account data required to assist you. They do not have access to raw payment credentials or unmasked financial data beyond what is necessary for their role.
- Password hashing: Your b max login password is never stored in a readable format. It is hashed using industry-standard algorithms. This means that even if our database were accessed without authorisation, your password could not be read directly.
- Two-factor authentication: 2FA is available for all b max accounts and we strongly encourage you to enable it. This requires a one-time code in addition to your password when logging in from an unrecognised device.
- Intrusion monitoring: b max systems are monitored for unauthorised access attempts. Unusual activity — including failed login patterns, unusual transaction volumes and suspicious device changes — is flagged for investigation.
b max Security Implementation Status
Your responsibility: Technical security measures only go so far. Use a strong, unique password for your b max account. Enable 2FA. Never share your login credentials. If you receive a suspicious message claiming to be from b max asking for your password, treat it as a scam — b max will never ask for your password by email, SMS or chat.
08Data Retention
b max retains personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable legal obligations. The general retention periods applied by b max are as follows:
- Active account data: Retained for the full duration of your account being open, plus a period after closure for legal and dispute resolution purposes.
- Transaction records (deposits and withdrawals in PKR): Retained for a minimum of five years from the date of the transaction, consistent with anti-money laundering record-keeping requirements.
- Identity verification documents: Retained for the duration of your account and for five years after account closure, or longer if required by law.
- Communication records (support chat and email): Retained for three years from the date of the communication, to support dispute resolution and quality assurance.
- Gameplay and betting history: Retained for the duration of your account and for two years post-closure, unless a legal obligation requires longer retention.
- Responsible gaming records (limit settings, exclusion history): Retained for the life of the account plus five years, to support the enforcement of self-exclusion and limit obligations.
After these retention periods expire, personal data is either deleted or anonymised so that it can no longer be linked back to you. b max does not retain personal data indefinitely.
09Your Rights
As a b max player, you have rights over your personal data. b max respects these rights and has processes in place to handle requests promptly. Your rights are:
Right of Access
You can request a copy of the personal data b max holds about you. We will provide this in a readable format within 30 days of a verified request. Contact support@bmax.bio with "Data Access Request" in the subject line.
Right to Rectification
If any personal data b max holds about you is inaccurate or out of date, you can ask us to correct it. For most account data — name, contact details — you can update this directly in your account settings. For identity documents, contact support.
Right to Erasure
You can request deletion of your personal data. This right is subject to our legal obligations — we cannot delete financial transaction records that we are required to retain by law. For everything not covered by a legal obligation, we will process deletion within 30 days.
Right to Object
You can object to b max processing your data for marketing purposes at any time. Opt out through your account settings under notification preferences, or contact support@bmax.bio directly. Marketing opt-outs are processed within 48 hours.
Right to Portability
You can request your personal data in a structured, machine-readable format for transfer to another service. This applies to data you have actively provided (account data, contact details) rather than data derived through your use of the platform.
Right to Restriction
You can ask b max to temporarily restrict processing of your data in certain circumstances — for example while a dispute about the data's accuracy is being resolved. During a restriction, we will continue to store the data but will limit active processing.
10Children's Privacy
b max operates a strict minimum age policy of 18 years. The platform is not directed at, and does not knowingly collect data from, anyone under the age of 18. Every registration is subject to age verification checks. If b max becomes aware that a person under 18 has registered an account, that account will be closed immediately, access will be revoked and data handled appropriately under our minor safeguarding obligations.
If you are a parent or guardian and believe your child has accessed or registered on b max, please contact support@bmax.bio immediately with details. We will investigate and take action as quickly as possible. b max takes underage access seriously and treats any report in this category as an urgent priority.
Parental controls: If you are concerned about a minor accessing online gaming platforms in general, we recommend using parental control software on family devices and keeping gaming account credentials private. b max is always willing to discuss responsible safeguarding with concerned parents — contact us at support@bmax.bio.
11Updates to This Privacy Policy
b max may update this Privacy Policy from time to time. Changes may be made to reflect updates to the platform, new legal requirements, new payment methods added for Pakistani players or improvements to our data practices. The "Last updated" date at the top of this page reflects the date of the most recent revision.
Where a change is material — for example, a change to the types of data we collect, the purposes for which we use it, or the parties we share it with — b max will notify active players via email or in-platform notification at least 14 days before the change takes effect. Minor clarifications and non-substantive edits may be made without advance notice.
The version of this policy displayed on bmax.bio is always the current, in-force version. If you disagree with any update to this policy, you may close your b max account before the change takes effect and request deletion of your data subject to the retention obligations described in Section 8.
12Contact Us
If you have any questions about this Privacy Policy, want to exercise any of your data rights, have a complaint about how your data has been handled or want to report a potential data breach, please contact b max at:
Subject line for privacy requests: "Privacy Request – [Your Request Type]"
Response time: Within 5 business days for privacy requests. Urgent data breach or child safety reports are treated as immediate priorities and responded to as quickly as possible.
b max takes all privacy enquiries seriously. If you raise a concern and feel it has not been resolved adequately, you have the right to escalate your complaint through the appropriate regulatory channels applicable in your jurisdiction.