xp999 Privacy Policy

This Privacy Policy ("Policy") is issued by xp999 ("xp999", "we", "us", "our"), the operator of the online sports betting and casino platform accessible at xp999.pro. This Policy describes how xp999 collects, uses, stores, shares, and protects personal data relating to registered players, prospective players, and visitors to the xp999 platform.

This Policy applies to all personal data collected through the xp999 website, mobile applications, customer support channels, and any other xp999 service touchpoints. It should be read alongside our Terms and Conditions and our Responsible Gaming Policy, both of which form part of your overall agreement with xp999.

By registering an xp999 account or continuing to use the xp999 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using xp999 and may request account closure by contacting our support team.

xp999 collects personal data through several channels depending on how you interact with the platform. The categories of personal data we collect include:

xp999 does not collect sensitive personal data such as biometric data, religious beliefs, political opinions, or medical records. Where age verification requires confirmation of date of birth against your CNIC, this data is used solely for the purpose of confirming that you meet the 21+ age requirement and is stored securely in encrypted form.

xp999 uses the personal data it collects for the following clearly defined purposes:

• Account Management: To create, maintain, and administer your xp999 account, including verifying your identity, processing your registration, and managing your account settings and preferences.
• Transaction Processing: To process deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, 1LINK, and USDT TRC20, and to maintain accurate records of all financial transactions on your account.
• Identity & Age Verification: To verify that you meet the mandatory 21+ age requirement and to confirm your identity in compliance with our Know Your Customer (KYC) obligations under applicable anti-money laundering regulations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and other prohibited conduct as defined in our Terms and Conditions.
• Customer Support: To respond to your queries, complaints, and support requests submitted via live chat or email to [email protected], and to maintain records of communications for quality and training purposes.
• Responsible Gaming: To monitor your gambling behaviour and apply responsible gaming tools including deposit limits, loss limits, session reminders, and self-exclusion where requested or where required by our responsible gaming obligations.
• Legal Compliance: To comply with applicable laws, regulations, licensing requirements, and court orders, including reporting obligations under anti-money laundering legislation.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, security, and user experience of the xp999 platform. This analysis does not identify individual players.
• Communications: To send you account-related notifications, transaction confirmations, security alerts, and — where you have opted in — promotional communications about xp999 bonuses and offers.

xp999 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight. Where automated tools are used to flag unusual account activity (for example, for fraud detection), any resulting action on your account is reviewed by a member of the xp999 compliance team before being implemented.

xp999 processes your personal data on the following legal bases:

• Contractual Necessity: Processing your identity data, contact data, and financial data is necessary to perform our contract with you — specifically to operate your xp999 account, process bets and transactions, and provide the services you have requested.
• Legal Obligation: Certain processing activities — including KYC identity verification, transaction record-keeping, and suspicious activity reporting — are required by applicable anti-money laundering laws and our international gaming licence conditions. xp999 cannot waive these obligations.
• Legitimate Interests: xp999 processes technical data and usage data on the basis of its legitimate interest in operating a secure, fraud-free gaming platform and in improving its services. This processing is balanced against your privacy interests and does not override your rights.
• Consent: Where xp999 sends you optional marketing communications about bonuses, promotions, or new games, this is done on the basis of your explicit consent, which you may withdraw at any time by updating your communication preferences in your account settings or by contacting [email protected].

xp999 does not sell, rent, or trade your personal data to any third party. We share your data only in the following limited and clearly defined circumstances:

• Payment Processors: To process your deposits and withdrawals, xp999 shares necessary financial data with payment service providers including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, and 1LINK. These providers operate under their own privacy policies and are bound by contractual data protection obligations.
• Identity Verification Services: To meet our KYC obligations, xp999 may share identity documents and personal data with certified third-party identity verification providers. All such providers are contractually bound to process your data solely for verification purposes.
• Game Providers: To facilitate gameplay, xp999 shares a limited player identifier with third-party game providers (including providers of slots, live casino, and fishing games). Game providers do not receive your full identity data or financial details.
• Regulatory & Law Enforcement Authorities: xp999 will disclose personal data to relevant regulatory bodies, licensing authorities, financial intelligence units, and law enforcement agencies where required by applicable law or where we reasonably believe disclosure is necessary to prevent serious harm, fraud, or criminal activity.
• Group Companies & Successors: In the event of a merger, acquisition, or sale of xp999's business or assets, your personal data may be transferred to the successor entity, which will be bound by privacy obligations no less protective than those in this Policy.

In all cases where xp999 shares data with third-party service providers, we require those providers to maintain appropriate technical and organisational security measures and to process data only for the specified purposes under a formal data processing agreement.

xp999 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit xp999. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the xp999 platform. These cookies enable you to log in, maintain your session, and use core platform features. They cannot be disabled without rendering the platform non-functional.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised information about how players use xp999 — including which pages are visited most frequently and how long sessions last. This data helps us identify and resolve performance issues and improve the overall user experience.
• Functional Cookies: Enable xp999 to remember your preferences — such as your language settings, preferred deposit method, and game lobby filters — so that you do not need to re-enter them on each visit.
• Security Cookies: Used to detect and prevent fraudulent activity, including identifying unusual login patterns or suspicious betting behaviour that may indicate account compromise or multi-accounting.

xp999 does not use third-party advertising cookies or cross-site tracking cookies. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the xp999 platform.

xp999 employs comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes:

• AES-256 Encryption: All personal data — including identity documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption.
• TLS 1.3 in Transit: All data transmitted between your device and xp999 servers is encrypted using TLS 1.3 protocols, ensuring that your data cannot be intercepted during transmission.
• Access Controls: Access to personal data within xp999's systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required for their specific role, and all access is logged and audited.
• Two-Factor Authentication: xp999 offers and strongly encourages all players to enable two-factor authentication (2FA) on their accounts to provide an additional layer of protection against unauthorised access.
• Penetration Testing: xp999 conducts regular independent security assessments and penetration tests to identify and address potential vulnerabilities in the platform before they can be exploited.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, xp999 will notify affected players without undue delay and take all necessary steps to contain and remediate the breach.

While xp999 takes all commercially reasonable steps to secure your personal data, no system is completely immune to security threats. You are responsible for maintaining the security of your own account credentials. xp999 will never ask for your password via email, live chat, or any other channel.

xp999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to any overriding legal retention obligations. Our retention schedule is as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Data that has been anonymised may be retained for statistical and analytical purposes indefinitely.

As an xp999 player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request. xp999 will respond within 30 days.

xp999 strictly prohibits the use of its platform by any person under 21 years of age. xp999 does not knowingly collect personal data from individuals under the age of 21. Our registration process includes mandatory age verification steps designed to prevent underage access.

If xp999 becomes aware that personal data has been collected from a person under 21 years of age, that account will be immediately suspended and the data will be permanently deleted from our systems. Any funds deposited by an underage player will be returned to the originating payment method after identity verification confirms the player's age.

xp999 operates under an international gaming licence, and as a result, some of your personal data may be transferred to, stored in, or processed in countries outside Pakistan. This may occur when, for example, our third-party game providers or payment infrastructure providers operate servers located in jurisdictions such as Malta, Isle of Man, Gibraltar, or data centres across Southeast Asia.

Whenever xp999 transfers your personal data internationally, we take all reasonable steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required in your home jurisdiction. These safeguards include:

• Contractual clauses in data processing agreements with all international service providers that impose binding data protection obligations consistent with this Policy.
• Transfer only to service providers operating in jurisdictions that maintain adequate data protection frameworks, or under contractual mechanisms that compensate for any inadequacy.
• Regular review of our international data transfers to ensure ongoing compliance as regulatory requirements evolve.

By using xp999 and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to countries outside Pakistan as described in this section, subject always to the protections described above.

xp999's Responsible Gaming programme relies on the responsible use of player data to identify and support players who may be experiencing gambling-related harm. The following data processing activities are carried out in support of our responsible gaming obligations:

• Behavioural Monitoring: xp999 analyses patterns in your betting activity — including session frequency, deposit velocity, bet size escalation, and chasing behaviour — to identify indicators of problem gambling. This analysis is carried out on a continuous basis and is separate from and additional to any limits you set yourself.
• Self-Exclusion Records: If you request self-exclusion from xp999, your self-exclusion status is permanently recorded and flagged across all xp999 systems. xp999 retains self-exclusion records indefinitely even after account closure to prevent circumvention through new account registration.
• Deposit & Loss Limit Data: Records of your voluntarily set deposit limits, loss limits, session time limits, and cooling-off periods are retained and enforced at the system level. These records are maintained separately from general account data to ensure they cannot be inadvertently overwritten.
• Third-Party Sharing for Responsible Gaming: Where xp999 participates in industry-wide responsible gaming programmes or multi-operator self-exclusion schemes, limited data — typically a hashed identifier and self-exclusion status — may be shared with the scheme operator. This sharing is carried out on the basis of our legal obligations and legitimate interests in preventing harm.

For further information about xp999's responsible gaming tools, self-exclusion options, and links to support organisations, please visit our Responsible Gaming page.

xp999 reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes to the services we offer, or improvements to our data protection practices. The effective date at the top of this page will always reflect the date of the most recent revision.

Where changes to this Policy are material — meaning they significantly affect your rights or the way in which xp999 processes your personal data — xp999 will notify registered players via email or via a prominent notice on the platform prior to the changes taking effect. For minor or administrative changes, the updated Policy will be published on this page without separate notification.

We encourage all xp999 players to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of the xp999 platform following the publication of any revised Policy constitutes your acceptance of those changes.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way xp999 handles your personal data, please contact our Data Protection team using the following details:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the xp999 platform
• Response Time: xp999 aims to respond to all data-related requests within 30 calendar days of receipt

When submitting a data rights request, please include your registered email address, your account username, and a clear description of your request so that we can verify your identity and process your request efficiently. xp999 may request additional verification information to confirm that a request is being made by the legitimate account holder.

If you are not satisfied with xp999's response to your data rights request, or if you believe that xp999 has processed your personal data in breach of applicable law, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. xp999 will cooperate fully with any such regulatory investigation.