xp789 Privacy Policy — Your Data, Your Rights, Our Responsibility

1 Who We Are

xp789 (referred to in this Privacy Policy as "xp789", "we", "us", or "our") is the operator of the online casino and sports betting platform accessible at xp789.pro. xp789 is the data controller responsible for the personal data of individuals who register accounts and use Services on the Platform.

This Privacy Policy applies to all users of xp789.pro, including prospective members who browse the site without registering, registered Members who hold active accounts, and former Members whose accounts have been closed. By using xp789.pro in any capacity you acknowledge that you have read this Privacy Policy.

If you have questions about this policy or about how xp789 handles your personal data, you can contact our Data Protection team at [email protected] at any time.

2 Data We Collect

xp789 collects personal data in the following categories:

xp789 does not collect special category data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data processed for the purpose of unique identification, health data, or data concerning sexual orientation.

3 How We Collect Your Data

xp789 collects personal data through the following channels:

• Direct interactions: Data you provide when you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, or contact our support team.
• Automated technologies: Technical and usage data collected automatically when you browse or interact with xp789.pro, including via cookies, server logs, and session tracking technologies.
• Third-party payment providers: Transaction confirmation data received from payment processors including Easypaisa, JazzCash, Raast, and partner banks when you initiate a deposit or withdrawal in PKR.
• Identity verification services: Where xp789 uses a third-party KYC or fraud-prevention service to assist in verifying the identity of Members, data may be cross-referenced with external databases. xp789 will notify you if such a check is being performed.

4 Why We Use Your Data

xp789 uses your personal data for the following purposes:

• Account creation and management: To register your Account, maintain your PKR wallet, and provide access to xp789 Services.
• Identity verification and fraud prevention: To verify that you are who you say you are, that you meet the 18+ age requirement, and that no fraudulent activity is associated with your Account.
• Payment processing: To process deposits and withdrawals in PKR through your chosen payment method (Easypaisa, JazzCash, Raast, HBL, UBL, MCB Bank, Meezan Bank, or USDT TRC20).
• Responsible gaming compliance: To monitor betting patterns for signs of problem gambling and to administer deposit limits, cool-off periods, and self-exclusion arrangements.
• Customer support: To investigate and resolve queries, complaints, or disputes raised through our English-language support channels.
• Legal and regulatory obligations: To comply with anti-money-laundering (AML) requirements, record-keeping obligations, and any other applicable legal duties.
• Platform improvement: To analyse usage patterns and technical performance data in order to improve the xp789 platform for all Pakistan-based Members.
• Marketing communications (with your consent): To send promotional emails or SMS messages about bonuses, new games, and platform features where you have opted in to receive such communications.

5 Legal Basis for Processing

xp789 processes your personal data on the following legal bases:

• Contractual necessity: Processing your identity, contact, financial, and transaction data is necessary to perform the contract between you and xp789 (i.e., to operate your account and deliver Services).
• Legal obligation: Processing for KYC, AML compliance, and record-keeping is required by applicable law and cannot be waived.
• Legitimate interests: Processing technical data, usage data, and communications data for fraud prevention, security monitoring, and platform improvement serves the legitimate interests of xp789 and its Members, provided those interests are not overridden by your rights and freedoms.
• Consent: Processing for optional marketing communications is based on your explicit consent. You may withdraw this consent at any time by unsubscribing or contacting [email protected].

6 Sharing Your Data

xp789 does not sell your personal data. We share data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment service providers: Your financial data and transaction details are shared with the relevant payment provider (e.g., Easypaisa, JazzCash, partner banks) solely to process your PKR deposit or withdrawal.
• Identity verification partners: Where a third-party KYC service is used, your identity documents and personal details may be shared for verification purposes only.
• Game and platform technology providers: Technical data necessary for game delivery, live casino streaming, or platform performance may be processed by contracted technology suppliers under strict data processing agreements that prohibit secondary use of your data.
• Fraud prevention and security services: Anonymised or pseudonymised transaction patterns may be shared with specialist fraud-prevention services to protect xp789 Members.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory instruction, xp789 will disclose personal data to the relevant authority. xp789 will notify you of any such disclosure unless prohibited from doing so by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of xp789's business, personal data held by xp789 may be transferred to the successor entity. You will be notified of any such transfer and the privacy practices of the successor entity.

7 International Data Transfers

Your personal data may be processed by xp789 or its service providers on servers located outside Pakistan. Where such transfers occur, xp789 takes steps to ensure that your data receives a level of protection equivalent to that applied within Pakistan, including through the use of standard contractual clauses and data processing agreements with all third-party recipients.

xp789 will not transfer your personal data to any country or territory that does not provide an adequate level of data protection without first implementing appropriate safeguards.

8 Cookies & Tracking Technologies

xp789 uses cookies and similar tracking technologies on xp789.pro to support the operation of the Platform and to improve your experience. Cookies are small text files stored on your device when you visit a website.

xp789 uses the following types of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens that keep you logged in to your xp789 Account. You cannot opt out of these cookies without preventing xp789 from functioning correctly.
• Functional cookies: Remember your preferences such as language settings and game view options. These improve your experience but are not essential to Platform operation.
• Analytics cookies: Collect anonymised data about how Members use xp789.pro, which pages are visited most frequently, and where technical errors occur. This data helps xp789 improve the Platform for Pakistan-based Members.
• Fraud-detection cookies: Assist in identifying suspicious activity, including repeated failed login attempts and unusual navigation patterns associated with automated bot activity.

You can manage cookie preferences through your browser settings. Note that disabling cookies beyond the strictly necessary category may affect some Platform features but will not prevent you from accessing your Account or placing bets.

9 Data Retention

xp789 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law.

• Active accounts: Personal and transaction data is retained for the full duration of your account membership.
• Closed accounts: Following account closure, xp789 retains identity and transaction data for a minimum of five years to satisfy AML record-keeping obligations. After this period, data is securely deleted or anonymised.
• KYC documents: Verification documents (e.g., CNIC copies) are retained for the duration of the account plus five years following closure.
• Support communications: Live chat transcripts and email exchanges are retained for up to two years following the resolution of the relevant matter.
• Cookie data: Analytics cookie data is aggregated and anonymised within 26 months of collection.

When data is no longer required, xp789 deletes it using secure erasure methods or anonymises it irreversibly so that it can no longer be associated with any individual.

10 Security Measures

xp789 applies appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and xp789 servers.
• Encryption at rest for sensitive stored data including payment details and identity documents.
• Role-based access controls ensuring that xp789 staff can only access the data they need to perform their specific job function.
• Multi-factor authentication requirements for xp789 staff accessing systems that hold Member personal data.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Real-time fraud-detection monitoring for unusual transaction patterns or access behaviour on Member accounts.

In the event of a personal data breach that is likely to result in a risk to your rights or freedoms, xp789 will notify affected Members without undue delay via the registered email address held on file.

11 Your Data Rights

As a Member whose personal data is processed by xp789, you hold the following rights in relation to your data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". xp789 will respond within 30 days of receiving a verified request.

• Right of access: You may request a copy of the personal data xp789 holds about you.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected.
• Right to erasure: In certain circumstances you may request deletion of your personal data. Note that xp789 may be required to retain some data by law even following an erasure request.
• Right to restrict processing: You may request that xp789 limit the way your data is used while a dispute about accuracy or lawfulness is resolved.
• Right to data portability: Where processing is based on your consent or on contract, you may request a copy of your personal data in a structured, machine-readable format.
• Right to object: You may object at any time to processing of your data for direct marketing purposes. You may also object to processing based on legitimate interests, though xp789 may be able to demonstrate compelling grounds to continue processing.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

xp789 will not charge a fee for responding to a data rights request unless the request is manifestly unfounded or excessive. xp789 may ask you to verify your identity before processing a request to protect against unauthorised access to another person's data.

12 Minors

xp789 uses date-of-birth collection at registration and may conduct additional age verification checks to prevent access by minors. These checks are part of xp789's responsible gaming commitment and are applied consistently to all new registrations.

13 Changes to This Privacy Policy

xp789 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the Services we offer. When we make material changes to this policy, we will notify registered Members via the email address on file at least 14 days before the changes take effect.

The current version of this Privacy Policy will always be accessible at /privacy-policy. The "Last updated" date at the top of this page indicates when the most recent revision was made. Continued use of xp789 Services after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

14 Contact & Complaints

If you have questions about this Privacy Policy, wish to exercise a data right, or want to raise a concern about how xp789 handles your personal data, please contact us:

• Email: [email protected]
• Subject line for data matters: "Privacy Enquiry" or "Data Rights Request"
• Response time: xp789 acknowledges all privacy-related contacts within 5 business days and resolves them within 30 days.

If you are dissatisfied with xp789's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority or regulatory body in Pakistan. xp789 will cooperate fully with any such investigation.