xp999 Privacy Policy

This Privacy Policy ("Policy") describes how xp999 ("Company", "we", "us", "our") collects, uses, discloses, and safeguards personal information provided by users ("User", "you", "your") of the xp999 platform accessible at xp999.app. This Policy applies to all services offered through xp999, including the live casino, sports betting, slots, and account management features. By registering an account or otherwise using xp999, you acknowledge that you have read and understood this Policy and consent to the collection and use of your information as described herein. If you do not agree with any part of this Policy, you must not use xp999.

1.Who We Are

xp999 is an online casino and sports betting platform operating under an internationally recognised gaming licence. We are the data controller responsible for the personal information of all registered users on the xp999 platform. Our primary point of contact for data-related matters is our Data Protection Officer, reachable at [email protected].

2.Personal Data We Collect

xp999 collects the following categories of personal data from users:

• Registration Data: Full name, date of birth, email address, and country of residence provided at the time of account creation.
• Identity Verification Data: Government-issued photo identification (CNIC, passport), proof of address, and payment method documentation submitted during KYC verification.
• Financial Data: Transaction history, deposit amounts, withdrawal requests, and payment method identifiers (masked JazzCash or Easypaisa account numbers, masked bank account details). Full financial account numbers are never stored on xp999 servers.
• Usage Data: Login timestamps, IP addresses, device identifiers, browser type, operating system, pages visited, games played, bets placed, and session duration.
• Communications Data: Records of correspondence with xp999 support staff via live chat or email, including the content of messages and their metadata.
• Responsible Gaming Data: Self-exclusion requests, deposit limits set, cool-off period activations, and any self-reported problem gambling disclosures.

3.How We Use Your Personal Data

xp999 uses your personal data for the following purposes:

• To create, maintain, and administer your xp999 account and provide you with access to all platform features.
• To verify your identity and age in compliance with KYC and anti-money laundering ("AML") obligations.
• To process deposits and withdrawals in PKR via JazzCash, Easypaisa, bank transfer, or USDT.
• To detect and prevent fraud, money laundering, cheating, and other prohibited conduct as described in our Terms & Conditions.
• To administer bonuses, promotions, and loyalty programmes you have opted into.
• To provide customer support and resolve disputes.
• To comply with our legal and regulatory obligations, including reporting obligations to competent authorities.
• To send you service-related communications such as account notifications, security alerts, and deposit confirmations.
• To send you marketing communications about xp999 products, promotions, and new features, where you have given consent or where we have a legitimate interest to do so and you have not opted out.
• To enforce our Responsible Gaming commitments, including monitoring for signs of problem gambling behaviour and applying self-exclusion restrictions.
• To improve xp999 platform performance, user interface, and content based on aggregated usage analytics.

4.Legal Basis for Processing

xp999 processes your personal data under the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the user agreement with you, including account administration, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable AML, KYC, and gaming regulatory requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming enforcement, and service improvement, where these interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications and non-essential cookies, where your prior consent has been obtained.

5.Sharing Your Personal Data

5.1 xp999 does not sell your personal data to third parties. We may share your data with the following categories of recipients:

• Payment Processors: JazzCash, Easypaisa, banking partners (HBL, UBL, Meezan Bank, Bank Alfalah), and USDT network providers, strictly for the purpose of processing your transactions.
• KYC & AML Service Providers: Third-party identity verification providers engaged by xp999 to perform age and identity checks.
• Game Software Providers: Licensed game developers whose software powers games on the xp999 platform may receive session-level data for technical purposes.
• Regulatory & Law Enforcement Authorities: Where xp999 is required by law, court order, or regulatory authority to disclose your information.
• Fraud Prevention Services: Third-party providers used to detect and prevent fraudulent activity across the xp999 platform.

5.2 All third-party service providers engaged by xp999 are bound by contractual data processing agreements that prohibit them from using your personal data for any purpose other than the specific service they are providing to xp999.

6.Payment Data & PKR Banking

xp999 processes payments in Pakistani Rupees (PKR) via JazzCash, Easypaisa, and local bank transfer. When you initiate a deposit or withdrawal, the relevant payment provider processes your transaction and provides xp999 with a confirmation reference and masked account identifier. xp999 does not store your full JazzCash or Easypaisa account number, CNIC-linked mobile number, or full bank account details on our servers. Payment data is transmitted using 256-bit SSL encryption on all connections between your device and xp999.

7.Cookies & Tracking Technologies

7.1 xp999 uses cookies and similar tracking technologies to operate the platform, maintain your login session, detect fraud, and analyse usage patterns. Cookies used by xp999 fall into the following categories:

• Strictly Necessary Cookies: Required for the platform to function. These cannot be disabled.
• Analytics Cookies: Used to understand how users interact with xp999, which pages are most visited, and where technical errors occur. These are used in aggregated, anonymised form.
• Marketing Cookies: Used to deliver relevant promotional content. These are only placed with your prior consent.

7.2 You may control non-essential cookies through your browser settings. Disabling strictly necessary cookies will impair your ability to use xp999.

8.Data Retention

xp999 retains your personal data for as long as your account is active and for such additional period as is required by applicable legal and regulatory obligations. In general: account and KYC data is retained for a minimum of five (5) years following account closure to meet AML regulatory requirements; transaction records are retained for five (5) years; marketing consent records are retained for three (3) years from the date of consent or last interaction. When retention periods expire, data is securely deleted or anonymised.

9.Your Data Protection Rights

Subject to applicable law, you have the following rights in relation to your personal data held by xp999:

• Right of Access: To request a copy of the personal data xp999 holds about you.
• Right of Rectification: To request correction of inaccurate or incomplete personal data.
• Right of Erasure: To request deletion of your personal data, subject to our legal retention obligations.
• Right to Object: To object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Data Portability: To receive your data in a structured, machine-readable format where technically feasible.

To exercise any of these rights, contact xp999 at [email protected]. We will respond to verified requests within thirty (30) days.

10.Children's Privacy

xp999 is strictly a 18+ platform. We do not knowingly collect personal data from persons under the age of 18. Where xp999 identifies or has reasonable grounds to suspect that a user is under 18 years of age, the account will be immediately suspended, all personal data will be deleted, and any deposits will be returned to the source. If you believe a minor has registered on xp999, please contact us at [email protected] immediately.

11.Data Security

xp999 implements technical and organisational security measures appropriate to the risk level of the data processed, including: 256-bit SSL/TLS encryption on all data in transit; encrypted storage for sensitive data at rest; role-based access controls limiting staff access to personal data to those with a legitimate operational need; two-factor authentication for all administrative systems; regular security audits and penetration testing. No security measure is absolute, and xp999 cannot guarantee that unauthorised access will never occur. In the event of a data breach that poses a risk to your rights and freedoms, xp999 will notify affected users and relevant authorities in accordance with applicable law.

12.International Data Transfers

xp999 and some of its third-party service providers operate in jurisdictions outside of Pakistan. Where personal data is transferred internationally, xp999 ensures that appropriate safeguards are in place, such as standard contractual clauses approved by competent data protection authorities, to protect your data to a standard equivalent to that applicable in Pakistan.

13.Changes to This Policy

xp999 may update this Privacy Policy from time to time. Material changes will be notified to registered users via email or a prominent notice on the platform at least seven (7) days prior to the effective date of the change. The current version of this Policy is always available at xp999.app/privacy-policy. Continued use of xp999 following the effective date of an updated Policy constitutes acceptance of the changes.

14.Contact & Complaints

For any questions, requests, or complaints relating to this Privacy Policy or xp999's data practices, please contact:

Data Protection Officer – xp999
Email: [email protected]

We aim to respond to all data-related enquiries within 30 days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.