Privacy Policy — xp789

1 Who We Are

xp789 is an online sports betting and casino platform operating at xp789.net, providing cricket betting, live casino games, slots, and related gaming services to registered players across Pakistan. For the purposes of this Privacy Policy, xp789 is the data controller responsible for the personal data of players who register and use the xp789 platform.

xp789 takes its data protection responsibilities seriously and has implemented internal policies, technical safeguards, and staff training programmes to ensure that personal data is handled with care, transparency, and strict purpose limitation at every stage of the data lifecycle.

If you have any questions about how xp789 handles your personal data, you may contact our support team at any time using the contact details provided in Section 12 of this Privacy Policy. xp789 aims to respond to all privacy-related enquiries within five business days.

2 Data We Collect

xp789 collects personal data from players through several channels, including the account registration process, ongoing use of the platform, customer support interactions, and where applicable, through third-party identity and payment verification services. The categories of personal data xp789 may collect include the following:

xp789 does not knowingly collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where health or vulnerability indicators are relevant to responsible gaming obligations, in which case such data is handled with heightened protection and is never used for marketing purposes.

3 How We Use Your Data

xp789 uses the personal data we collect for specific, clearly defined purposes only. We do not use your data in ways that go beyond the original purpose for which it was collected without providing you with additional notice and, where required, obtaining your consent. The primary purposes for which xp789 processes player data are:

• Creating and managing your xp789 account, including verifying your identity and eligibility to use the platform.
• Processing deposits and withdrawals through JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, and maintaining accurate transaction records in PKR.
• Detecting and preventing fraud, money laundering, account takeovers, and other prohibited conduct as defined in the xp789 Terms and Conditions.
• Monitoring gameplay activity for indicators of problem gambling and applying responsible gaming tools where appropriate, including proactive account restrictions where xp789 has reasonable concern for player wellbeing.
• Responding to customer support enquiries, resolving disputes, and maintaining records of player communications for quality assurance purposes.
• Sending transactional communications, including account verification emails, deposit confirmations, withdrawal notifications, and security alerts.
• Sending promotional and marketing communications about xp789 offers, cricket betting promotions, and new platform features, where you have provided consent or where xp789 has a legitimate interest and you have not opted out.
• Complying with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements and lawful requests from regulatory authorities.
• Analysing aggregated, anonymised usage data to improve the xp789 platform, fix technical issues, and develop new features and products.

4 Legal Basis for Processing

xp789 processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing that is required to fulfil the contract between you and xp789, including creating your account, processing transactions, and providing access to platform products.
• Legal Obligation: Processing required to comply with applicable law, including anti-money laundering regulations, age verification obligations, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out for xp789's legitimate business interests where those interests are not overridden by your fundamental rights and freedoms, including fraud prevention, platform security, and product analytics.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, primarily in the context of marketing communications and certain optional personalisation features.

Where xp789 relies on legitimate interests as the legal basis for processing, we carry out a balancing assessment to ensure that our interests do not disproportionately override your privacy rights. The results of these assessments are documented internally and are available on request.

5 Sharing Your Data

xp789 does not sell or rent your personal data to any third party. xp789 may share your personal data with carefully selected third parties only in the following limited circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the transaction data strictly necessary to process your deposits and withdrawals. These partners operate under their own privacy policies and regulatory obligations.
• Identity Verification Providers: Third-party KYC and age verification services may receive copies of identity documents and personal details necessary to confirm player eligibility under our 21+ age policy and AML compliance requirements.
• Technology & Infrastructure Partners: Cloud hosting providers, content delivery networks, and platform analytics services may process technical and usage data as part of operating the xp789 platform, strictly under data processing agreements with xp789.
• Regulatory & Law Enforcement Authorities: xp789 may be legally required to disclose player data to regulatory bodies, financial intelligence units, or law enforcement agencies. Such disclosures will be made without prior notice to the player where required or permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of xp789's business, player data may be transferred to the relevant successor entity. You will be notified of any such transfer and any changes to applicable privacy terms.

6 Cookies & Tracking Technologies

The xp789 platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to remember your session preferences, and to analyse how players interact with the site. The categories of cookies xp789 uses are as follows:

• Essential Cookies: Required for core platform functionality, including maintaining your logged-in session, processing transactions, and enforcing security policies. These cookies cannot be disabled without impairing your ability to use the xp789 platform.
• Functional Cookies: Used to remember your preferences such as language settings, display options, and responsible gaming limit configurations so that your settings persist between sessions.
• Analytics Cookies: Used by xp789's internal analytics tools to understand how players navigate the platform, which products are most popular, and where technical issues may be occurring. Analytics data is processed in aggregated, anonymised form wherever possible.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot traffic, credential stuffing attempts, and unusual login patterns that may indicate account compromise.

You may manage your cookie preferences through your browser settings at any time. Note that disabling essential or security cookies may significantly impair your experience on the xp789 platform and may prevent certain features from functioning correctly. xp789 does not use third-party advertising or social media tracking cookies.

7 Data Retention

xp789 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or our regulatory and licensing obligations. The general data retention framework applied by xp789 is as follows:

• Active account data is retained for the full duration of the player account and for a minimum period of five years following permanent account closure, in compliance with anti-money laundering record-keeping requirements.
• Financial transaction records, including deposit and withdrawal history in PKR, are retained for a minimum of five years from the date of each transaction.
• KYC and identity verification documents are retained for a minimum of five years from the date of verification or the date of account closure, whichever is later.
• Customer support and live chat communications are retained for a minimum of two years from the date of the interaction, or longer where a communication is relevant to an ongoing dispute or investigation.
• Technical and usage data, including IP address logs and session records, is retained for a maximum of twelve months from the date of collection, after which it is either deleted or fully anonymised.

When the applicable retention period expires, xp789 will securely delete, anonymise, or pseudonymise the relevant personal data in accordance with our data disposal procedures. Anonymised data from which no individual player can be identified may be retained indefinitely for statistical and product development purposes.

8 Security Measures

xp789 has implemented a comprehensive set of technical and organisational security measures to protect player personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• TLS 1.2 or higher encryption on all data in transit between player devices and xp789 servers.
• AES-256 encryption for sensitive data fields stored in xp789 databases, including passwords, payment references, and identity document data.
• Role-based access controls ensuring that xp789 employees and contractors can only access player data that is strictly necessary for the performance of their job responsibilities.
• Multi-factor authentication requirements for all xp789 staff accessing internal systems that contain player personal data.
• Regular independent security audits and penetration testing of the xp789 platform infrastructure.
• Automated monitoring systems that detect and alert on anomalous data access patterns or potential breach indicators in real time.
• A documented data breach response procedure, including player notification protocols, in the event that a security incident affecting personal data is identified.

9 Your Data Rights

As a registered xp789 player, you hold the following rights in respect of the personal data xp789 holds about you. You may exercise any of these rights at any time by contacting xp789 support through the channels listed in Section 12:

• Right of Access: You have the right to request a copy of all personal data xp789 holds about you, along with information about how that data is processed and stored.
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data xp789 holds about you. Corrections to identity and payment data may require supporting documentation.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to xp789's legal retention obligations.
• Right to Restriction: You have the right to request that xp789 restricts the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to a particular processing activity.
• Right to Object: You have the right to object to xp789's processing of your personal data where that processing is based on legitimate interests, including the right to opt out of direct marketing communications at any time.
• Right to Data Portability: Where processing is based on your consent or on a contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

xp789 will respond to all verified data rights requests within 30 days of receipt. Where a request is complex or involves a large volume of data, xp789 may extend this period by a further 60 days, with notice to the requesting player. xp789 will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive.

10 Minors & Age Policy

The xp789 platform is strictly intended for adults aged 21 years and above. xp789 does not knowingly collect personal data from individuals under the age of 21 and does not permit minors to register for or use any xp789 product or service.

xp789 implements a mandatory age verification process at registration, which requires all new players to confirm their date of birth and to provide valid identity documentation confirming they are 21 years of age or older. Accounts found to be registered by players under 21 will be immediately suspended, all funds will be frozen, and the account will be referred for further investigation.

Where xp789 discovers that personal data has been inadvertently collected from an individual under 21, we will take immediate steps to delete that data in its entirety from our systems without retention.

11 Updates to This Policy

xp789 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the features and products available on the xp789 platform. The most current version of this Privacy Policy will always be accessible at xp789.net/privacy-policy and will display the effective date of the current version at the top of the document.

Where xp789 makes material changes to this Privacy Policy — changes that significantly affect your privacy rights or how your personal data is processed — xp789 will provide notice to registered players by email to the address on record and by a prominent notice on the xp789 platform upon next login. Your continued use of the xp789 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

If you do not agree with any material change to this Privacy Policy, your remedy is to cease using the xp789 platform and request account closure and data deletion in accordance with Section 9 above.

12 Contact Us — Privacy Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xp789 handles your personal data, please contact our support team through the following channels. All privacy and data protection enquiries are handled by a dedicated team with appropriate expertise.

For data access, rectification, erasure, or portability requests, please include your registered xp789 username and the email address associated with your account in your communication so that we can verify your identity before processing your request.

This Privacy Policy was last reviewed and updated on 1 January 2026. xp789 reserves all rights not expressly granted in this document.