xp777 Privacy Policy

xp777, operating through the website xp777.club ("Platform", "we", "us", "xp777"), is the data controller responsible for personal data collected through the xp777 platform. This Privacy Policy applies to all personal data processed in connection with your registration, use, and termination of any xp777 account or service.

By registering an account or otherwise using the xp777 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not consent, you must not register or use the xp777 platform.

xp777 collects the following categories of personal data in connection with your use of the platform:

xp777 does not intentionally collect special category personal data (such as health data, racial or ethnic origin, or political opinions) as part of normal platform operation. If such data is incidentally provided in communications, it is not used for any profiling or decision-making purpose.

xp777 collects personal data through the following mechanisms:

• Direct registration: Data you provide when creating your xp777 account, including name, email, mobile number, and date of birth.
• KYC submissions: Identity and address documents you upload as part of the verification process before withdrawals above specified thresholds.
• Payment processing: Transaction data generated when you deposit or withdraw funds via JazzCash, Easypaisa, or bank transfer in PKR.
• Platform activity: Automatically generated data from your use of xp777 games, sportsbook, and casino features — including bet amounts, game sessions, and navigation patterns.
• Cookies and analytics: Technical data collected via first-party cookies and analytics tools as described in Section 8 of this Policy.
• Customer support interactions: Information you share when contacting xp777 via live chat or email, including any attachments or transaction details provided in support of a query.

xp777 processes your personal data for the following purposes, each supported by a corresponding legal basis:

• Account operation and service delivery — Processing is necessary for the performance of the contract between you and xp777. This covers game access, betting, PKR wallet management, and support.
• Age and identity verification (KYC) — Processing is necessary to comply with legal obligations applicable to gaming operators, including anti-money-laundering and age verification requirements.
• Fraud prevention and security — Processing is based on xp777's legitimate interest in protecting the platform, its players, and the integrity of financial transactions from fraudulent activity.
• Responsible gaming enforcement — Processing is necessary to comply with xp777's responsible gaming obligations, including enforcing self-exclusion requests and deposit limits.
• Marketing communications — Where you have expressly opted in to receiving promotional communications from xp777, we process your contact data on the basis of your consent. You may withdraw consent at any time from your account settings.
• Analytics and platform improvement — Processing is based on xp777's legitimate interest in improving the platform experience for Pakistani players, using aggregated and anonymised usage data where possible.

Financial transactions on xp777 are processed in Pakistani Rupees (PKR) via third-party payment processors including JazzCash, Easypaisa, HBL, UBL, Meezan Bank, and Bank Alfalah. xp777 does not store full payment credentials (such as full bank account numbers or mobile wallet PINs) on its own servers. Where partial payment data is retained — such as masked account numbers for transaction reconciliation — it is stored in encrypted form.

Transaction data is retained for the minimum period required to fulfil legal and regulatory obligations applicable to financial record-keeping. All PKR transaction records at xp777 are subject to the security measures described in Section 9 of this Policy.

xp777 does not sell your personal data to third parties. xp777 shares personal data only in the following circumstances:

• Game providers and platform vendors: Licensed game software providers who supply casino games and sportsbook data to the xp777 platform may receive limited technical data (such as session tokens) necessary to deliver their services. They are contractually prohibited from using this data for any purpose beyond service delivery.
• Payment processors: JazzCash, Easypaisa, and banking partners receive the transaction data necessary to process your PKR deposits and withdrawals. This sharing is necessary to perform the payment contract.
• Fraud prevention and security services: xp777 may share data with specialist fraud prevention and identity verification providers as part of KYC and security operations. These providers act as data processors under xp777's instruction.
• Legal and regulatory obligations: xp777 will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory demand. xp777 will, where legally permissible, notify the affected player of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or transfer of all or part of the xp777 business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections.

xp777 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following principles:

• Active account data is retained for the full duration of the account relationship plus a post-closure period sufficient to meet legal and regulatory retention obligations (typically five to seven years for financial records).
• KYC and identity documents are retained for the minimum period required by applicable anti-money-laundering and gaming regulations, after which they are securely deleted or anonymised.
• Marketing consent records are retained for the period during which consent is active, plus a reasonable period thereafter to demonstrate compliance in the event of a dispute.
• Technical and usage data that cannot be attributed to an identified individual is retained in anonymised or aggregated form for analytics purposes and is not subject to the same deletion obligations as personal data.

Upon request for account closure, xp777 will delete or anonymise personal data beyond what is required to be retained by applicable law. Deletion requests that conflict with active legal hold obligations will be fulfilled once the legal hold is lifted.

The xp777 platform uses cookies and similar tracking technologies to support the operation, security, and improvement of the platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without preventing use of the xp777 platform.
• Functional cookies: Store your preferences — such as language, preferred payment method, and display settings — so the xp777 platform remembers your choices between sessions.
• Analytics cookies: First-party analytics tools used by xp777 to understand aggregated usage patterns — page views, session length, feature engagement — for the purpose of improving the platform. Data is not shared with third-party ad networks.

xp777 does not use third-party advertising or behavioural tracking cookies. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the xp777 platform.

xp777 implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the xp777 platform, including all PKR transaction data.
• Encryption at rest for sensitive data fields, including identity documents, financial data, and account credentials stored on xp777 servers.
• Access controls ensuring that personal data is accessible only to xp777 staff and systems with a documented need — no broad internal access to raw player data.
• Regular security assessments and penetration testing of the xp777 platform infrastructure.
• Multi-factor authentication options for player accounts to mitigate credential compromise risks.
• Incident response procedures for detecting, containing, and notifying affected players of personal data breaches where required by applicable law.

Notwithstanding xp777's security measures, no online platform can guarantee absolute security. Players are encouraged to use a strong, unique password for their xp777 account, enable MFA, and promptly report any suspected unauthorised access to [email protected].

Subject to applicable law, you have the following rights in relation to your personal data held by xp777:

• Right of access: You may request a copy of the personal data xp777 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some corrections can be made directly from your xp777 account settings.
• Right to erasure: You may request deletion of your personal data where xp777 no longer has a legal basis to retain it. This right is subject to xp777's legal retention obligations for financial and gaming records.
• Right to restriction: You may request that xp777 restricts processing of your data in certain circumstances, such as where you contest its accuracy.
• Right to data portability: You may request a machine-readable export of personal data you have provided to xp777 under a consent or contractual basis.
• Right to withdraw consent: Where processing is based on your consent — such as marketing communications — you may withdraw consent at any time from your xp777 account settings or by contacting support. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to object: You may object to processing based on xp777's legitimate interests. xp777 will assess whether its legitimate interests override your objection on a case-by-case basis.

To exercise any of these rights, please contact xp777 at [email protected] with the subject line "Privacy Rights Request" and your registered account email address. xp777 targets a response within 30 days. Identity verification will be required before personal data is disclosed or amended.

The xp777 platform is strictly for individuals aged 18 and above. xp777 does not knowingly collect personal data from persons under 18. If xp777 becomes aware that personal data has been collected from a person under 18, that data will be deleted and the associated account closed immediately.

If you are a parent or guardian and believe that a person under 18 has registered or used an xp777 account, please notify xp777 immediately at [email protected] with the registered account details. xp777 will investigate and take appropriate action promptly.

xp777 reserves the right to update this Privacy Policy at any time. Where amendments are material — such as introducing new data processing activities or changing the basis on which data is shared — xp777 will provide advance notice via email to your registered address or a prominent notice on the xp777 platform. The "Last updated" date at the top of this Policy will reflect the most recent revision. Continued use of xp777 following the effective date of an updated Policy constitutes your acceptance of the revised terms.

For all privacy-related queries, requests, or concerns regarding your personal data held by xp777, please contact:

• Email: [email protected] (subject line: "Privacy Policy Query" or "Privacy Rights Request")
• Live Chat: Available 24/7 from the xp777 platform — response time typically under 5 minutes

xp777 takes privacy queries seriously and commits to acknowledging all written privacy requests within 2 business days, with a substantive response within 30 days. For requests involving disclosure of personal data, identity verification will be required before any data is shared.