xp666 Privacy Policy

1. Scope & Data Controller

This Privacy Policy applies to all personal data collected, processed, or stored by xp666 in connection with the operation of the xp666.org platform and all related services, including sports betting, online casino gaming, customer support, and marketing communications.

xp666 acts as the data controller in respect of personal data provided by users of the platform. For the purposes of this Policy, references to "xp666", "we", "us", or "our" mean the xp666 platform operator. References to "you" or "your" mean any registered or prospective user of the xp666 platform.

By registering an account on xp666, you acknowledge that you have read this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not register or continue to use the xp666 platform.

2. Personal Data We Collect

xp666 collects personal data through various means, including information you provide directly, data generated through your use of the platform, and information received from third-party verification services. The categories of personal data collected by xp666 include:

2.1 Registration & Identity Data

• Full name as it appears on your CNIC or official identity document.
• Date of birth (for age verification purposes).
• Pakistani mobile number used for account registration and two-factor authentication.
• Username chosen during registration.
• Account password (stored in encrypted, hashed form — never in plain text).

2.2 Verification & Compliance Data

• Copy of CNIC or other government-issued identity document (requested at KYC stage).
• Proof of address documentation where required by compliance obligations.
• Payment method verification documents (e.g., screenshot of JazzCash or Easypaisa account holder name).
• Source of funds information where required for enhanced due diligence.

2.3 Financial Transaction Data

• Deposit and withdrawal amounts, dates, times, and payment method identifiers.
• Transaction reference numbers.
• Payment method details (mobile wallet numbers, bank account identifiers) — card numbers are never stored directly by xp666.

2.4 Platform Usage Data

• Betting and gaming activity, including bets placed, games played, wager amounts, and results.
• Login timestamps and session durations.
• Device type, operating system, browser version, and screen resolution.
• IP address and approximate geolocation derived therefrom.
• Referral source and marketing attribution data.

2.5 Communications Data

• Records of live chat interactions, emails, and any other communications you send to xp666 support.
• Feedback, complaints, and dispute correspondence.

xp666 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where health-related information is voluntarily provided in the context of a responsible gaming self-exclusion request.

3. How We Use Your Personal Data

xp666 uses the personal data collected for the following purposes:

4. Legal Basis for Processing

xp666 processes personal data only where a lawful basis exists. The primary legal bases relied upon are:

• Contract Performance: Processing necessary to provide the services you have registered for and to fulfil obligations under your account agreement with xp666.
• Legal Obligation: Processing required by applicable law, including anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and responsible gaming obligations.
• Legitimate Interests: Processing for the purposes of fraud prevention, platform security, and improving xp666 services, where such interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications and personalised promotions, where you have provided explicit consent. You may withdraw consent at any time by contacting xp666 support or using the unsubscribe mechanism in any marketing communication.

5. Cookies & Tracking Technologies

The xp666 platform uses cookies and similar tracking technologies to enable core platform functionality, improve user experience, and support analytics. The categories of cookies used by xp666 include:

• Strictly Necessary Cookies: Required for the platform to function. These cannot be disabled and do not require consent. They include session management, authentication state, and security tokens.
• Performance & Analytics Cookies: Used to understand how users interact with the xp666 platform in aggregate. Data collected is anonymised and used only for platform improvement.
• Functional Cookies: Store user preferences such as language settings, last-visited game lobby section, or preferred deposit method to personalise the xp666 experience.
• Marketing Cookies: Used with your consent to attribute registrations to marketing campaigns and to serve relevant promotional content. You may opt out at any time.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to use core xp666 features including the login system and bet placement.

6. Third-Party Data Sharing

xp666 does not sell, rent, or disclose personal data to third parties for their own commercial purposes. However, xp666 may share personal data with the following categories of third parties in the course of operating the platform:

• Payment Processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, and USDT processing services receive transaction data necessary to process deposits and withdrawals.
• Identity Verification Providers: Third-party KYC service providers process identity documents and verification data on xp666's behalf under strict data processing agreements.
• Game Technology Providers: Casino and slots software providers (e.g., Evolution Gaming, Pragmatic Play, PG Soft) receive the minimum account data necessary to provide game services. These providers are bound by their own privacy and security obligations.
• Regulatory & Law Enforcement Authorities: xp666 will disclose personal data to competent authorities where required to do so by applicable law, court order, or regulatory demand.
• Fraud Prevention Services: Third-party fraud detection providers may receive device fingerprinting and behavioural data in anonymised or pseudonymised form.

All third-party processors engaged by xp666 are required to process personal data only on xp666's instructions and to maintain appropriate technical and organisational security measures.

7. Data Retention

xp666 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal retention obligations. In general:

• Active account data is retained for the duration of your xp666 account and for a minimum of five (5) years following account closure, to comply with AML and financial record-keeping obligations.
• Identity verification documents are retained for a minimum of five (5) years from the date of verification, consistent with regulatory requirements.
• Transaction records are retained for a minimum of five (5) years.
• Customer support and communications records are retained for three (3) years from the date of the interaction.
• Marketing preferences and consent records are retained until consent is withdrawn or for three (3) years following last interaction, whichever is earlier.

After applicable retention periods expire, xp666 securely deletes or anonymises personal data in accordance with its internal data destruction procedures.

8. Data Security

xp666 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the xp666 platform.
• Encryption of sensitive data fields at rest within xp666's database infrastructure.
• Password hashing using industry-standard algorithms — plaintext passwords are never stored.
• Role-based access controls limiting internal access to personal data to authorised personnel with a legitimate operational need.
• Regular security assessments and penetration testing of the xp666 platform infrastructure.
• Two-factor authentication (2FA) available to all users, and mandatory for staff access to administrative systems.
• Automated intrusion detection and anomalous login monitoring.

Despite these measures, no internet-based system can guarantee absolute security. xp666 will notify affected users and relevant authorities promptly in the event of a material data security breach, as required by applicable law.

9. Your Data Rights

Subject to applicable law, you have the following rights in respect of your personal data held by xp666:

• Right of Access: You may request a copy of the personal data xp666 holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data in certain circumstances, subject to xp666's legal retention obligations.
• Right to Restriction: You may request that xp666 restrict processing of your data in certain circumstances.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing.
• Right to Data Portability: Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact xp666 via live chat or email at [email protected]. xp666 will respond to verified requests within thirty (30) calendar days.

10. Children's Privacy

The xp666 platform is strictly intended for adults aged 18 and above. 18+ xp666 does not knowingly collect, process, or store personal data relating to individuals under the age of 18. Where xp666 becomes aware that personal data of a minor has been collected, such data will be deleted immediately and the associated account closed. If you believe a minor has registered on the xp666 platform, please contact support immediately.

11. International Data Transfers

xp666 may transfer personal data to third-party service providers and technology partners located in jurisdictions outside Pakistan. Where such transfers occur, xp666 ensures that appropriate safeguards are in place, including data processing agreements incorporating standard contractual clauses or equivalent protections, to ensure that your personal data receives a level of protection consistent with applicable data protection standards.

By using the xp666 platform and agreeing to this Privacy Policy, you acknowledge and consent to the transfer of your personal data to recipients in other countries where necessary to provide the services you have requested.

12. Changes to This Privacy Policy

xp666 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data practices, or the services we offer. Material changes will be communicated to registered users via their registered mobile number or displayed prominently on the xp666 platform prior to taking effect. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision.

Your continued use of the xp666 platform following notification of any amendment constitutes acceptance of the revised Privacy Policy. We encourage you to review this Policy periodically.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or xp666's data practices, please contact us through the following channels:

• Live Chat: Available 24/7 from your xp666 account dashboard. Average response time: under 2 minutes.
• Email: [email protected] — Average response time: under 4 hours.

For formal data subject access requests or erasure requests, please email us with the subject line "Data Rights Request" along with your registered mobile number and a description of your request. We will acknowledge your request within 5 working days and respond in full within 30 calendar days.