xp777 Privacy Policy

This Privacy Policy ("Policy") describes how xp777 ("xp777", "we", "us", "our") collects, uses, stores, discloses and protects the personal data of individuals ("you", "your", "Player") who access or use the xp777 website at https://xp777.pro and all associated services, including casino games, sports betting markets, live dealer tables, payment processing, customer support and promotional communications.

xp777 is committed to handling your personal data with the highest standards of transparency, integrity and security. This Policy is written in plain, accessible English so that every player — whether based in Karachi, Lahore, Islamabad, Faisalabad or elsewhere — can clearly understand how their information is used. Where we are required to act as a data controller, we take that responsibility seriously.

By registering an account on xp777 or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you must not use the xp777 platform. This Policy should be read in conjunction with the xp777 Terms and Conditions available at /terms-conditions.

xp777 acts as the data controller in respect of all personal data collected from players who use the xp777 platform. As data controller, xp777 determines the purposes for which personal data is collected and the manner in which it is processed. Where xp777 engages third-party service providers to process data on its behalf, those providers act as data processors and are bound by contractual data processing agreements that restrict their use of your data to the specific purposes authorised by xp777.

xp777 operates under an international gaming licence. The legal jurisdiction governing data protection obligations applicable to xp777's operations is determined by that licence. All players, including those based in Pakistan, have the data rights described in Section 10 of this Policy regardless of their location.

xp777 collects personal data from you directly when you register, verify your account, make deposits or withdrawals, contact support, participate in promotions or use our platform. We also collect certain data automatically through the technical operation of our website. The categories of personal data xp777 collects are as follows:

xp777 uses the personal data it collects for specific, legitimate purposes directly related to the operation of a licensed online gaming platform. We do not use your data for purposes that are incompatible with those stated below:

• Account Management: To create, maintain and secure your xp777 account, authenticate your identity at login, and enforce our one-account-per-player policy.
• Payment Processing: To process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, SadaPay, 1LINK, USDT TRC20 and Cash OTC channels. Minimum deposit processing requires accurate financial data.
• Identity & Age Verification: To verify that all players are aged 21 or older and to confirm the identity of players as required by our gaming licence's KYC obligations. xp777 enforces a strict 21+ age policy.
• Regulatory Compliance: To fulfil our anti-money laundering (AML), counter-terrorism financing (CTF) and responsible gaming obligations under our international gaming licence. This includes monitoring transaction patterns and reporting suspicious activity to relevant authorities.
• Platform Operations: To deliver, maintain, troubleshoot and improve the xp777 gaming platform, including personalising your experience, managing PSL betting markets and ensuring fair gameplay.
• Bonus & Promotions: To administer bonus offers, including PSL season promotions, reload bonuses and free spins, and to detect and prevent bonus abuse across the xp777 platform.
• Customer Support: To respond to your enquiries, resolve disputes and manage formal complaints through our 24/7 live chat and email support channels.
• Security & Fraud Prevention: To detect, investigate and prevent fraudulent transactions, unauthorised account access, collusion and any other prohibited conduct on xp777.
• Marketing Communications: To send you promotional emails and platform notifications about xp777 offers, new games and PSL betting events — but only where you have given explicit consent to receive such communications. You may withdraw this consent at any time.

Every instance of personal data processing by xp777 is underpinned by a valid legal basis. The primary legal bases on which xp777 relies are:

• Contractual Necessity: Processing that is necessary for the performance of the contract between you and xp777 — specifically account creation, payment processing and gameplay facilitation — is carried out on the basis of contractual necessity.
• Legal Obligation: xp777 is required to process certain data — including identity verification, transaction monitoring and suspicious activity reporting — to comply with its obligations under its international gaming licence and applicable AML/CTF regulations.
• Legitimate Interests: xp777 processes technical and usage data on the basis of its legitimate interests in maintaining platform security, preventing fraud and improving the quality of our gaming services for Pakistani players.
• Consent: Marketing communications and non-essential cookies are processed only on the basis of your explicit, freely given and revocable consent. You may withdraw consent at any time without affecting the legality of prior processing.

xp777 does not sell or rent your personal data to third parties. We share your data only in the specific, controlled circumstances described below, and only to the minimum extent necessary for each purpose:

• Payment Processors: We share your financial data with the payment service providers you use to deposit or withdraw funds from your xp777 account, including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, SadaPay and 1LINK. These providers process your data only to execute the specific transaction and are bound by their own regulatory obligations.
• Identity Verification Providers: We may share your identity documents with third-party KYC verification service providers who assist xp777 in confirming the identity and age of players as required by our gaming licence.
• Game Software Providers: The third-party game suppliers whose titles are available on xp777 may receive gameplay data (such as bet amounts and game outcomes) necessary to resolve game-related disputes. These providers do not receive your identity or financial data.
• Regulatory & Law Enforcement Authorities: xp777 may disclose your personal data to competent regulatory bodies, financial intelligence units or law enforcement agencies where required to do so by applicable law, court order or regulatory instruction. xp777 has no discretion to withhold data in such circumstances.
• Group Companies: Where xp777 operates as part of a group of companies, data may be shared with affiliate entities within the group for the purpose of consolidated compliance reporting, fraud prevention and platform operations. All intra-group data transfers are governed by internal data sharing agreements.
• Business Transfers: In the event of a merger, acquisition or sale of all or part of xp777's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and your rights in relation to the transferred data will be preserved.

xp777 retains your personal data for as long as your account remains active and for a defined period thereafter, as required by our gaming licence and applicable regulatory obligations. The retention periods applicable to different categories of data are summarised below:

Upon expiry of the applicable retention period, xp777 will securely and permanently delete or anonymise your personal data so that it can no longer be associated with your identity. Where anonymisation is not technically feasible, data will be destroyed using industry-standard secure deletion methods.

xp777 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and xp777's servers is encrypted using 256-bit SSL/TLS protocols, preventing interception by third parties.
• Encryption at Rest: Personal and financial data stored on xp777's servers is encrypted at rest using AES-256 encryption. Access to encrypted data requires authenticated, role-based authorisation.
• Access Controls: Access to personal data within xp777's organisation is strictly limited to personnel who require access to perform their specific job functions. All access is logged and audited regularly.
• Regular Security Audits: xp777 engages independent security firms to conduct regular penetration tests and security audits of our platform infrastructure. Identified vulnerabilities are remediated on a priority basis.
• Incident Response: xp777 maintains a documented data breach response plan. In the event of a data breach affecting your personal data, xp777 will notify affected players and relevant regulatory authorities within the timeframes required by applicable law.
• Secure Development Practices: All xp777 platform updates and new features undergo security review before deployment. Our development team follows secure coding standards and conducts code reviews that include security checks.

xp777 uses cookies and similar tracking technologies to operate essential platform functions, remember your preferences, analyse usage patterns and (where you have consented) deliver relevant promotional content. The types of cookies used on xp777 are described below:

• Essential Cookies: Required for the xp777 platform to function. These include session cookies that keep you logged in during your visit, security cookies that prevent cross-site request forgery attacks, and cookies that remember your language and currency preferences. These cookies cannot be disabled without impairing platform functionality.
• Analytics Cookies: Used to collect anonymised data about how players navigate and use xp777, including which games are most popular, where players encounter errors and how long sessions typically last. This data helps us improve the platform. Analytics cookies are only set where you have provided consent.
• Functional Cookies: Enable enhanced personalisation features on xp777, such as remembering your preferred game categories, notification preferences and responsible gaming limit settings. These are set with your consent.
• Marketing Cookies: Used to track your interactions with xp777 promotional content and to measure the effectiveness of our marketing campaigns. Marketing cookies are only set where you have explicitly consented. xp777 does not use third-party advertising networks that track you across unrelated websites.

You can manage or withdraw your cookie consent at any time through your xp777 account settings or through your browser's cookie management tools. Note that disabling essential cookies will affect your ability to use the xp777 platform.

As a data subject whose personal data is processed by xp777, you have the following rights in relation to your personal data. To exercise any of these rights, contact xp777 support via live chat or at support@xp777.pro:

• Right of Access: You have the right to request a copy of all personal data xp777 holds about you. We will provide this within 30 days of a valid request, at no charge for the first request in any 12-month period.
• Right to Rectification: If any personal data xp777 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Basic contact and profile data can be updated directly within your xp777 account settings.
• Right to Erasure: You may request that xp777 delete your personal data where it is no longer necessary for the purposes for which it was collected. Note that this right is subject to xp777's legal obligation to retain certain data for regulatory compliance purposes as set out in Section 7.
• Right to Restriction: You may request that xp777 restrict the processing of your data in certain circumstances — for example, while we investigate a dispute about the accuracy of your data.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for responsible gaming purposes. xp777 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

The xp777 platform is strictly for adults aged 21 years and above. xp777 does not knowingly collect personal data from individuals under the age of 21. During the registration process, all applicants are required to confirm that they are at least 21 years of age. xp777 may request documentary proof of age — such as a valid CNIC, passport or driver's licence — at any point during the account lifecycle.

If xp777 discovers or has reasonable grounds to suspect that an account holder is under 21 years of age, the account will be suspended immediately and any personal data associated with the underage individual will be securely deleted in accordance with our obligations. Any funds deposited by an underage player will be returned to the payment source where technically possible, following an investigation.

As xp777 operates under an international gaming licence and uses globally distributed infrastructure, your personal data may be transferred to and processed in countries outside Pakistan. Where such transfers occur, xp777 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections described in this Policy.

Safeguards used for international data transfers include contractual data processing agreements with all third-party processors, requiring them to implement security measures consistent with those maintained by xp777. Where data is transferred to payment processors such as JazzCash or EasyPaisa that operate primarily within Pakistan, those transfers are governed by applicable Pakistani financial regulations in addition to our contractual safeguards.

By using xp777, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Pakistan where such transfers are necessary for the operation of your account or for compliance with our licensing obligations.

xp777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulatory requirements, or material changes to the xp777 platform. The "Last Updated" date at the top of this Policy will be revised whenever a change is made.

For material changes that significantly affect how we use your personal data, xp777 will notify registered players via email to the address on file and/or via a prominent notice within the xp777 platform prior to the change taking effect. Your continued use of xp777 following the effective date of any amendment constitutes your acceptance of the revised Policy.

We encourage all players — whether based in Karachi, Lahore, Islamabad or anywhere else in Pakistan — to review this Privacy Policy periodically so that you remain informed about how xp777 protects your personal data. If you have any questions about a specific change, contact us at the details provided in Section 14 below.

If you have any questions, concerns or requests relating to this Privacy Policy or xp777's handling of your personal data, please reach out to our Data Protection team using the contact details below. We are committed to responding to all privacy-related enquiries promptly and thoroughly.

xp777 aims to acknowledge all privacy-related communications within 2 business days and to provide a full response within 30 calendar days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority under the applicable data protection framework.