xp77 Privacy Policy
How We Protect Your Data

1 Introduction

xp77 ("we", "us", "our") is committed to protecting and respecting the privacy of everyone who uses our platform. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by xp77.

This policy applies to all users of xp77 across Pakistan, including players accessing the platform from Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, Multan, and any other location. It covers data collected through our website at xp77.ws, our mobile-optimised platform, and any related communications including email, live chat, and customer support interactions.

By registering an account or otherwise using the xp77 platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection, use, and processing of your personal data as described herein. If you do not agree with any part of this policy, please discontinue use of xp77 and contact our support team to request account closure.

2 Data Controller

xp77 acts as the data controller in respect of personal data collected through and in connection with the xp77 platform. As data controller, xp77 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable data protection law.

All data protection queries, access requests, and complaints should be directed to the xp77 Data Protection contact through our standard support channel. Contact details are provided in Section 15 of this policy.

3 Personal Data We Collect

xp77 collects personal data in the following categories, depending on how you interact with our platform:

xp77 does not collect special category data (such as health information, religious beliefs, or biometric data) unless specifically required by applicable law for responsible gaming purposes, in which case we will seek your explicit consent.

4 How We Use Your Personal Data

xp77 processes your personal data for the following purposes:

• Account Management: To create, maintain, and administer your xp77 player account, including processing your xp77 login credentials and ensuring account security.
• KYC & Identity Verification: To verify your identity and age (21+) in compliance with our legal and regulatory obligations, including review of your CNIC and other supporting documents.
• Payment Processing: To process deposits and withdrawals in PKR via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency channels.
• Fraud & Security: To detect, prevent, and investigate fraud, money laundering, cheating, and other prohibited activities on the xp77 platform.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling and to enforce responsible gaming tools such as deposit limits, cool-off periods, and self-exclusion.
• Service Improvement: To analyse platform usage patterns, improve our products, fix technical issues, and personalise your xp77 experience.
• Legal Compliance: To comply with applicable laws, regulations, court orders, and requests from regulatory or law enforcement authorities.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may withdraw consent at any time.

5 Legal Basis for Processing

xp77 processes your personal data on one or more of the following legal grounds:

• Contractual Necessity: Processing is required to perform the contract between you and xp77 — specifically, to provide you with access to the platform and to process your gaming and financial transactions.
• Legal Obligation: Processing is necessary for xp77 to comply with applicable anti-money laundering (AML), Know Your Customer (KYC), and responsible gaming regulations.
• Legitimate Interests: Processing is necessary for xp77's legitimate interests in fraud prevention, platform security, and service improvement, provided those interests are not overridden by your fundamental rights.
• Consent: For marketing communications and optional data uses, xp77 will rely on your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Third Parties

xp77 does not sell, rent, or trade your personal data to any third party for independent commercial use. We may share your data with the following categories of trusted partners, strictly as necessary to operate the xp77 platform:

• Payment Service Providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency processors to facilitate your deposits and withdrawals.
• Identity Verification Partners: Third-party KYC and anti-fraud service providers who assist xp77 in verifying player identities and detecting suspicious activity.
• Game Studios & Software Providers: Licensed third-party game providers whose titles are accessible through the xp77 casino and sports book. These providers may receive limited gameplay data for the purpose of game performance and fairness auditing.
• Customer Support Platforms: Technology providers that power xp77's live chat and email support systems, who process support interaction data on our behalf.
• Regulatory & Law Enforcement Authorities: Where xp77 is legally required or compelled by court order to disclose your information to government bodies, regulatory authorities, or law enforcement agencies in Pakistan or other relevant jurisdictions.

All third-party service providers who process personal data on behalf of xp77 are required to do so under appropriate data processing agreements and are contractually obligated to maintain the security and confidentiality of your data.

7 Cookies & Tracking Technologies

xp77 uses cookies, web beacons, pixel tags, and similar tracking technologies on the xp77.ws platform. These technologies help us deliver a functional, secure, and personalised experience.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies, security tokens, and load balancing cookies. These cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how players interact with xp77, which pages are most visited, and where errors occur. This data helps us improve the platform.
• Functionality Cookies: Used to remember your preferences such as language settings, preferred payment methods, and display options for a smoother xp77 experience.
• Marketing Cookies: Used to track whether promotional content has been seen and to measure the effectiveness of xp77's marketing campaigns. These are only placed with your consent.

You can control and manage cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the xp77 platform. For detailed cookie management instructions, refer to your browser's help documentation.

8 Data Retention

xp77 retains your personal data for as long as your account is active and for such additional periods as are required by our legal and regulatory obligations. The following retention principles apply:

• Active Accounts: Personal data is retained for the full duration of your relationship with xp77, including periods of account inactivity up to the threshold set by our inactive account policy.
• Post-Closure Retention: Following account closure, xp77 retains identity, financial, and transaction records for a minimum period as required under applicable anti-money laundering and financial regulations. This period is typically five years from the date of account closure.
• Responsible Gaming Records: Self-exclusion requests and responsible gaming intervention records are retained indefinitely to prevent re-registration by excluded players.
• Marketing Data: Where you have withdrawn your marketing consent, your opt-out preference is retained permanently to ensure no future marketing communications are sent.

When personal data is no longer required for any legitimate purpose, xp77 will securely delete or anonymise it in accordance with our data disposal procedures.

9 Data Security

xp77 takes the security of your personal data very seriously. We have implemented a range of technical and organisational security measures to protect your information from unauthorised access, disclosure, alteration, or destruction.

• All data transmitted between your device and xp77's servers is encrypted using industry-standard TLS (Transport Layer Security) protocols.
• Sensitive data including financial information and CNIC details is encrypted at rest using AES-256 encryption.
• Access to personal data within xp77 is restricted on a strict need-to-know basis and is subject to regular access review.
• xp77 conducts regular security assessments and vulnerability testing of its platform infrastructure.
• Our payment processing integrations with JazzCash, EasyPaisa, and banking partners are conducted through secured, certified API connections.

While xp77 takes all reasonable precautions to protect your data, no internet transmission or electronic storage system can be guaranteed to be 100% secure. In the event of a data breach that affects your rights and freedoms, xp77 will notify affected users as required by applicable law.

10 Your Data Protection Rights

As an xp77 player, you have a number of rights in relation to the personal data we hold about you. xp77 is committed to facilitating the exercise of these rights promptly and transparently.

• Right of Access: You have the right to request a copy of the personal data that xp77 holds about you. We will provide this within a reasonable timeframe following identity verification.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by xp77 be corrected without undue delay.
• Right to Erasure: In certain circumstances, you may request that xp77 delete your personal data. Note that this right is subject to our legal data retention obligations and cannot override retention requirements imposed by applicable financial regulation.
• Right to Restriction: You may request that xp77 restrict the processing of your personal data in specific circumstances, such as while a dispute about data accuracy is being resolved.
• Right to Object: You have the right to object to xp77 processing your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to our overriding legitimate grounds.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that your data be provided to you in a structured, machine-readable format.
• Right to Withdraw Consent: Where xp77 processes your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact the xp77 support team using the details in Section 15. We will respond to all valid requests within a reasonable period. We may need to verify your identity before processing your request.

11 Marketing Communications

xp77 may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, cricket betting offers, PSL season promotions, and other xp77 offers where you have provided your consent to receive such communications at the point of registration or subsequently through your account settings.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link at the bottom of any xp77 marketing email.
• Updating your communication preferences within your xp77 account settings.
• Contacting xp77 customer support and requesting removal from all marketing lists.

Please note that opting out of marketing communications does not affect service communications such as transaction confirmations, security alerts, and account status notifications, which xp77 may still send as they are necessary for the operation of your account.

xp77 will never send marketing materials to accounts that have been self-excluded or that are under an active responsible gaming restriction.

12 Minors & Age Protection

The xp77 platform is strictly intended for adults aged 21 years and above. xp77 does not knowingly collect or process personal data belonging to any individual under the age of 21. xp77's registration process requires applicants to confirm their date of birth and to submit identity documentation confirming they meet the minimum age requirement.

If xp77 becomes aware that it has inadvertently collected personal data from an individual under the age of 21, we will immediately suspend the associated account, delete the collected data, and refund any deposits made to the original payment source after forfeiting any associated winnings.

13 Third-Party Links

The xp77 platform may contain references to third-party services such as payment providers. xp77 is not responsible for the privacy practices of third-party websites or services that operate independently of the xp77 platform. We encourage you to review the privacy policies of any third-party services you interact with in connection with your xp77 account, including your mobile banking app and mobile wallet provider.

xp77 does not embed third-party advertising networks or social media tracking pixels on the xp77.ws platform. Any data shared with payment providers such as JazzCash and EasyPaisa is governed by those providers' own privacy policies and terms.

14 Updates to This Privacy Policy

xp77 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. When we make material changes to this policy, we will notify registered players via email or a prominent notice on the xp77 platform prior to the changes taking effect.

The date at the top of this page reflects when the policy was last updated. We encourage you to review this Privacy Policy periodically. Your continued use of the xp77 platform following any update constitutes acceptance of the revised policy.

If you have concerns about any updates to this Privacy Policy, please contact our support team before continuing to use the platform.

15 Contact Us

For all data protection enquiries, access requests, marketing opt-outs, or privacy complaints, please contact the xp77 support team. We aim to respond to all data-related requests within a reasonable period.

When submitting a data rights request, please include your registered xp77 username and the email address associated with your account so we can locate your records and verify your identity efficiently.