xq777 Privacy Policy — How We Handle Your Personal Data

This Privacy Policy is issued by xq777 ("the Company", "we", "us", "our"), an online casino and gaming platform operating under an international gambling licence and serving players in Pakistan.

xq777 is the data controller responsible for the personal data of registered players collected through the xq777 website and all associated services (collectively, "the Platform").

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the xq777 Data Privacy team:

• Email: [email protected]
• Response time: Under 2 hours, 24/7
• Language: English

xq777 collects only the personal data necessary to operate the Platform, verify player identities, process Pakistani Rupee (PKR) transactions, and comply with our international licensing obligations. The categories of data we collect include:

xq777 collects personal data through the following channels:

• Directly from you — when you complete the xq777 registration form, submit KYC documents, make a deposit or withdrawal, contact our support team, or update your account settings;
• Automatically — through cookies, server logs, and similar technologies when you access and use the Platform (see Section 7 for full cookie details);
• From payment providers — Easypaisa, JazzCash, SadaPay, Raast, and our banking partners (HBL, UBL, MCB Bank) may share transaction confirmation data with xq777 to reconcile payments;
• From identity verification services — third-party KYC providers used to verify the authenticity of identity documents submitted during account verification;
• From fraud prevention services — data shared by anti-fraud and AML screening partners to help xq777 identify and prevent prohibited activities.

xq777 processes your personal data only where a valid legal basis exists. The principal legal bases we rely on are:

• Contractual necessity — processing required to register your account, manage your player profile, process deposits and withdrawals, and deliver gaming services under the xq777 Terms & Conditions;
• Legal obligation — processing required to comply with xq777's international licence obligations, including KYC verification, AML screening, age verification (18+), and responsible gaming record-keeping;
• Legitimate interests — processing for fraud prevention, platform security, abuse detection, and service improvement, where these interests are not overridden by your data protection rights;
• Consent — for optional marketing communications only. You may withdraw consent at any time (see Section 11).

xq777 uses your personal data for the following purposes:

• To create and manage your xq777 account and verify your identity in compliance with KYC requirements;
• To process PKR deposits and withdrawals via Easypaisa, JazzCash, SadaPay, Raast, and linked bank accounts in Pakistan;
• To deliver the gaming services, including providing access to slots, live casino, Cockfighting, Jackpot Slots, Wolf Gold, and other platform content;
• To apply and enforce responsible gaming tools including deposit limits, loss limits, session timers, and self-exclusion requests;
• To provide English-language customer support and respond to your queries and complaints;
• To detect and prevent fraud, bonus abuse, money laundering, and other prohibited activities in accordance with the Terms & Conditions;
• To send you service communications relating to your account, including verification emails, withdrawal confirmations, and security alerts;
• To send you promotional and marketing communications where you have consented to receive them;
• To maintain records required under xq777's international gaming licence;
• To improve the Platform, analyse usage patterns, and develop new features — using aggregated or anonymised data where possible.

xq777 does not sell your personal data. We share personal data with third parties only in the following circumstances and only to the minimum extent necessary:

• Payment processors — Easypaisa, JazzCash, SadaPay, Raast, HBL, UBL, and MCB Bank receive the financial data necessary to process your specific transaction;
• KYC and identity verification providers — third-party services that verify the authenticity of identity documents provided during account registration or enhanced due diligence;
• AML and fraud screening services — providers that screen transactions and account activity against international sanctions lists and fraud databases;
• Game content providers — certified game studios whose titles are hosted on xq777 receive anonymised game session data for technical purposes only;
• Regulatory and law enforcement authorities — where xq777 is legally obligated to disclose information to its licensing authority or a competent law enforcement body in response to a lawful request;
• Professional advisors — legal, accounting, and auditing firms under confidentiality obligations where required for xq777's business operations.

xq777 uses cookies and similar tracking technologies to provide a functional, secure, and personalised platform experience. The types of cookies we use include:

• Essential cookies — strictly necessary for the Platform to function. These cannot be disabled. They include session authentication tokens, security cookies, and load-balancing cookies;
• Functional cookies — remember your preferences such as language settings, game lobby filters, and last-used payment method to improve your experience across sessions;
• Analytics cookies — collect anonymised data about how players use the Platform, which pages are visited most frequently, and where technical errors occur, to help us improve the service;
• Marketing cookies — track your engagement with promotional content on the xq777 Platform to help us deliver more relevant offers, where you have consented to receive marketing.

xq777 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by our international licensing obligations and applicable law. The principal retention periods are:

• Account and transaction records — retained for a minimum of 5 years from the date of account closure or the last transaction, in accordance with AML and licensing requirements;
• KYC documents — retained for a minimum of 5 years following account closure or the completion of the KYC process;
• Support communications — retained for 3 years from the date of the conversation;
• Technical logs — retained for up to 12 months for fraud and security purposes;
• Marketing consent records — retained for 3 years from the date consent was granted or last confirmed.

Once the applicable retention period has expired and there is no legal or regulatory obligation to continue holding your data, xq777 will securely delete or anonymise it. You may request earlier deletion in the circumstances set out in Section 10.

xq777 applies a multi-layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• TLS encryption — all data in transit between your device and xq777's servers is encrypted using Transport Layer Security (TLS 1.2 or higher);
• AES-256 encryption at rest — sensitive stored data, including payment information and KYC documents, is encrypted using AES-256;
• Access controls — access to personal data within xq777 is restricted on a strict need-to-know basis, with role-based permissions and audit logging;
• Two-factor authentication — SMS-based 2FA is available for all xq777 player accounts and is strongly recommended;
• Penetration testing — xq777's platform undergoes regular third-party security testing to identify and remediate vulnerabilities;
• Incident response — a formal incident response plan is in place. In the event of a breach affecting your personal data, xq777 will notify impacted players without undue delay.

No internet-based platform can guarantee absolute security. You also have a role to play — maintaining the confidentiality of your xq777 login credentials and enabling 2FA on your account significantly reduces the risk of unauthorised access.

As an xq777 player in Pakistan, you have the following rights in relation to your personal data held by xq777:

• Right of access — you may request a copy of all personal data xq777 holds about you, free of charge, within 30 days of a valid request;
• Right to rectification — if any personal data xq777 holds about you is inaccurate or incomplete, you have the right to ask us to correct it;
• Right to erasure ("right to be forgotten") — you may request that xq777 delete your personal data where: (a) it is no longer needed for the purpose it was collected; (b) you withdraw consent and there is no other legal basis for processing; or (c) you object to processing and xq777 has no overriding legitimate interest. Note that legal retention obligations (Section 8) may limit erasure of certain data;
• Right to restrict processing — you may ask xq777 to limit the processing of your personal data in certain circumstances, for example while a rectification request is being resolved;
• Right to data portability — for data processed on the basis of contract or consent, you may request a structured, machine-readable copy of your personal data;
• Right to object — you have the right to object to processing based on legitimate interests, and to processing for direct marketing purposes at any time.

To exercise any of these rights, contact the xq777 support team at [email protected] with the subject line "Data Privacy Request". We will respond within 30 days and may need to verify your identity before processing the request.

xq777 may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, and special offers — but only where you have provided explicit consent to receive such communications during registration or at a later point.

You may withdraw consent to marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email from xq777;
• Updating your communication preferences in your xq777 account dashboard;
• Contacting our support team at [email protected] with the request.

Withdrawing consent to marketing will not affect the delivery of essential service communications such as account verification, withdrawal confirmations, security alerts, or responsible gaming notifications, which xq777 sends based on contractual or legal necessity rather than marketing consent.

xq777 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, we will notify registered players by email or by a prominent notice on the Platform at least 7 days before the updated policy takes effect.

The "Last updated" date displayed on this page will always reflect the date of the most recent revision. We encourage you to review this page periodically. Continued use of the xq777 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised terms.

If you have questions about any change to this policy, please contact us at [email protected] before continuing to use the Platform.