Privacy Policy —
How xp789 Handles Your Data

xp789 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all users who access xp789.cam. This Privacy Policy ("Policy") sets out in clear terms what personal information we collect, the lawful bases on which we process it, how we use and protect it, and the rights you hold as a data subject.

This Policy applies to all users of the xp789 Platform, including visitors who browse without registering, registered account holders, and users who contact our support team. It applies regardless of the device or location from which the Platform is accessed, including users based in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and other cities across Pakistan.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your information as described herein. If you do not agree with this Policy, you must discontinue use of the Platform immediately.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including name, email address, IP address, device identifiers and similar identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, xp789.
• "Data Processor" means any third party that processes Personal Data on behalf of xp789 under a data processing agreement.
• "User" means any individual who accesses, browses or registers on the Platform.
• "Cookies" means small text files stored on a user's device by a web browser to record preferences, session data and analytics information.
• "KYC" means Know Your Customer — identity verification processes used to confirm user identity, age and address.
• "Consent" means a freely given, specific, informed and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.

xp789, operating the Platform at xp789.cam, acts as the Data Controller for all personal data collected through the Platform. As Data Controller, xp789 determines the purposes for which personal data is collected and the means by which it is processed.

xp789 does not hold a Pakistan gambling license and does not claim regulatory endorsement from the Government of Pakistan, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan, any provincial authority, or any Pakistani financial institution. Data protection practices described in this Policy are implemented by xp789 in accordance with the applicable laws of the jurisdiction in which xp789 operates.

Where xp789 engages third-party Data Processors to handle personal data on its behalf — such as hosting providers, analytics services or support tool providers — those parties act only on xp789's documented instructions and are bound by appropriate data processing agreements.

xp789 collects personal data in the following categories, depending on how you interact with the Platform:

xp789 processes personal data only where a lawful basis exists. Depending on the purpose of processing, the applicable legal basis may include one or more of the following:

• Contractual Necessity: Processing required to perform the contract between xp789 and the user — for example, maintaining account records and providing platform access.
• Legitimate Interests: Processing necessary for xp789's legitimate interests, such as fraud prevention, platform security, abuse detection and internal analytics, provided those interests are not overridden by your rights and freedoms.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including identity verification, anti-money laundering (AML) obligations and data retention requirements.
• Consent: Where xp789 has obtained your explicit consent for a specific processing activity — for example, sending optional marketing or newsletter communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

xp789 uses the personal data collected for the following purposes:

• To create, manage and maintain your registered account on the Platform.
• To verify your identity and age in compliance with applicable KYC and age-gating requirements.
• To respond to support enquiries and resolve account-related issues.
• To send essential transactional communications such as account confirmations, security alerts and policy update notices.
• To detect, prevent and investigate fraudulent activity, security breaches and abuse of the Platform.
• To comply with applicable legal obligations, including AML regulations and data retention requirements.
• To analyse usage patterns and improve the performance, content and usability of the Platform.
• To administer responsible gambling tools including deposit limits, loss limits and self-exclusion requests.
• With your prior consent only, to send optional marketing communications about xp789 products, promotions or relevant updates. You may opt out at any time.

xp789 does not sell, rent or trade your personal data to any third party. We may share your personal data only in the following limited circumstances:

• Service Providers / Data Processors: Third-party providers who assist us in operating the Platform — such as cloud hosting providers, analytics services and customer support platforms — may access personal data strictly as required to perform their services. All such providers are bound by appropriate data processing agreements.
• Operators: Where you are referred to or interact with a third-party gambling Operator through xp789, that Operator is a separate data controller subject to its own privacy policy. xp789 is not responsible for the data practices of third-party Operators.
• Legal and Regulatory Requirements: xp789 may disclose personal data to law enforcement, regulatory authorities, courts or other public bodies where required to do so by applicable law, court order or to protect the legal rights of xp789 or its users.
• Business Transfers: In the event of a merger, acquisition, restructuring or sale of all or part of xp789's assets, personal data may be transferred to the successor entity, subject to this Policy continuing to apply to transferred data.

Payment provider names referenced on the Platform — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — appear as familiar Pakistani payment references only. xp789 does not share user personal data with these providers, and their mention does not imply any data-sharing arrangement or gambling endorsement.

xp789 uses cookies and similar tracking technologies to enable core Platform functionality, remember your preferences, and collect anonymised usage analytics that help us improve the user experience.

Most web browsers allow you to control cookies through their settings. You can set your browser to refuse cookies, delete existing cookies or alert you when cookies are being set. Please note that disabling strictly necessary cookies may impair your ability to use certain features of the Platform.

xp789 does not use cookies for cross-site tracking, fingerprinting or for any purpose beyond those described in this section.

Subject to applicable law and any overriding legal retention obligations, you have the following rights in relation to your personal data held by xp789:

• Right of Access: You may request a copy of the personal data xp789 holds about you. We will respond within a reasonable timeframe as required by applicable law.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request that it be corrected or completed.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no longer a lawful basis for retention — for example, where data is no longer necessary for the purpose for which it was collected. This right may be limited where legal retention obligations apply.
• Right to Restriction of Processing: You may request that xp789 restrict the processing of your data in certain circumstances, such as where you contest its accuracy or object to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your personal data in a structured, commonly used and machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or carried out for direct marketing purposes. Where you object to direct marketing, xp789 will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us using the details in Section 16. We may need to verify your identity before processing a data rights request. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

xp789 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory or contractual obligations. When data is no longer required, it is securely deleted or anonymised.

General retention guidelines applied by xp789 include:

• Active account data is retained for the duration of the account relationship plus any legally mandated post-closure retention period.
• KYC documentation may be retained for a minimum of five years following account closure, in accordance with applicable AML and identity verification regulations.
• Support and correspondence records are retained for a reasonable period to facilitate ongoing dispute resolution and quality review.
• Analytics and log data is retained in anonymised or aggregated form for Platform improvement purposes.
• Consented marketing data is retained until consent is withdrawn, after which it is promptly removed from active marketing lists.

xp789 may transfer personal data to servers or service providers located outside of Pakistan, including in jurisdictions where data protection laws may differ from those in Pakistan. Where such transfers occur, xp789 takes reasonable steps to ensure that personal data receives an appropriate level of protection.

These steps may include relying on adequacy decisions where applicable, implementing standard contractual clauses approved for international data transfers, or requiring third-party service providers to maintain appropriate technical and organisational security measures.

The xp789 Platform is strictly intended for adults aged 18 years and over, or the higher minimum age required by the applicable Operator and license jurisdiction. xp789 does not knowingly collect, process or retain personal data from any person under the age of 18.

If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and, where appropriate, terminate the associated account. If you believe a minor has registered on the Platform or submitted personal data, please contact us immediately using the details in Section 16.

Being 18+ does not alone make online gambling lawful in Pakistan. Users are responsible for understanding and complying with applicable local law regarding age-restricted activities.

xp789 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, alteration or destruction. These measures include:

• HTTPS/TLS encryption for all data transmitted between your browser and our Platform.
• Password hashing using industry-standard one-way algorithms — passwords are never stored in plain text.
• Access controls restricting personal data to authorised personnel on a need-to-know basis.
• Regular security reviews and vulnerability assessments of the Platform infrastructure.
• Secure deletion procedures for data no longer required under applicable retention policies.

Despite these measures, no method of electronic transmission or storage is completely secure. xp789 cannot guarantee absolute security of personal data and shall not be liable for security breaches beyond our reasonable control. You are responsible for maintaining the security of your own account credentials. Report any suspected unauthorised account access immediately to our support team.

The xp789 Platform may contain references to, or contextual information about, third-party gambling Operators, payment services and sports leagues. These third parties operate independently and have their own privacy policies and data processing practices, for which xp789 is not responsible.

If you choose to register with, deposit with or otherwise interact with a third-party Operator accessed via or referenced on xp789, your personal data submitted to that Operator will be processed under that Operator's own privacy framework. xp789 strongly encourages you to read the privacy policy of any third-party platform before submitting personal or financial information.

References to payment services such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah on this Platform are contextual references familiar to Pakistani users only. xp789 does not share data with these providers, and their mention does not constitute a data-sharing arrangement, partnership or endorsement of gambling by those entities.

xp789 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or Platform functionality. When material changes are made, we will update the "Effective Date" noted in the Table of Contents and take reasonable steps to notify registered users where practicable.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of that updated Policy. We recommend reviewing this page periodically to stay informed of how xp789 protects your data.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or would like to raise a privacy concern or complaint, please contact the xp789 data team using the details below. All contact information is provided as plain text only — we do not accept enquiries by telephone at this time.

For general platform support, visit our FAQ page or review our Terms & Conditions. For responsible gambling information, visit our Responsible Gambling page.