Privacy Policy

Welcome to the Privacy Policy of xp786 ("the Platform", "we", "us", "our"). This Privacy Policy describes how xp786 collects, processes, stores, shares and protects personal data provided by users ("you", "your") when you access or use the website at xp786.cam, including all associated services, games, promotions and features.

xp786 is an English-language online gaming information and wagering platform that serves users across Pakistan — including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar — as well as international users. By registering an account, depositing funds, placing a wager, or otherwise using any part of the Platform, you acknowledge that you have read, understood and agree to the data practices described in this Privacy Policy.

This Privacy Policy is incorporated by reference into, and forms part of, our Terms and Conditions. Words defined in the Terms and Conditions carry the same meaning here unless defined separately below.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information that identifies or can reasonably identify a living individual, including name, email address, phone number, IP address, payment details and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, erasure or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For users of xp786, the Data Controller is the Operator as disclosed in the Platform's licence information.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller under a contractual arrangement (e.g., a KYC verification provider or payment processor).
• "Consent" — a freely given, specific, informed and unambiguous indication by a User that they agree to the processing of their Personal Data for a stated purpose.
• "Cookies" — small text files placed on a User's device by the Platform to store session information, preferences and analytical data.
• "KYC" — Know Your Customer verification: the identity and age verification process required under the Operator's compliance obligations.

xp786 collects the following categories of personal and technical data from users:

Registration Data

• Full name as it appears on your government-issued identification
• Date of birth (for age verification purposes)
• Email address and mobile phone number
• Username and encrypted password
• Country and city of residence (e.g., Karachi, Lahore, Islamabad)
• Preferred currency (e.g., PKR)

KYC & Verification Data

• Scanned copies or photographs of government-issued photo identification (national identity card, passport or driving licence)
• Proof of residential address (utility bill or bank statement dated within 90 days)
• Proof of payment method ownership (where required)
• Source-of-funds documentation (where required by compliance obligations)

Financial Data

• Deposit and withdrawal transaction records
• Payment method identifiers (masked card numbers, mobile wallet account references)
• Transaction amounts, dates and currency

Technical & Usage Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, browser type and version
• Pages visited, time on page, links clicked and session duration
• Betting and gaming activity logs (markets accessed, wagers placed, game history)
• Login timestamps and session identifiers

Communications Data

• Support chat transcripts and email correspondence with the xp786 team
• Feedback, complaints or dispute records submitted by or about you
• Marketing preference records (opt-in/opt-out status)

xp786 collects personal data through the following channels:

• Direct Submission: Data you provide voluntarily when registering an account, completing KYC, making deposits or withdrawals, contacting support, or submitting any form on the Platform.
• Automated Collection: Technical and usage data collected automatically through cookies, web beacons, server logs and similar technologies when you browse or interact with the Platform.
• Third-Party Providers: Data received from identity verification services, fraud prevention platforms, payment processors and analytics providers that process data on our behalf.
• Publicly Available Sources: In limited circumstances, xp786 may supplement your profile with data from publicly available sources (such as sanctions watchlists) for fraud prevention and AML compliance purposes.

xp786 processes your personal data for the following purposes:

xp786 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise permitted by applicable law.

xp786 processes personal data on the following legal bases, as applicable to each processing activity:

• Contractual Necessity: Processing required to perform the contract between xp786 and the User — for example, managing your account, processing deposits and withdrawals, and providing access to betting and gaming services.
• Legal Obligation: Processing required to comply with applicable legal obligations, including KYC/AML requirements, responsible gambling obligations and regulatory reporting to the Operator's licensing authority.
• Legitimate Interests: Processing carried out to pursue xp786's legitimate business interests, including fraud prevention, platform security, abuse detection and improvement of services, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific and informed consent — in particular, sending you marketing communications about promotions, PSL T20 offers, cricket betting markets and other platform features. You may withdraw consent at any time.

xp786 does not sell, rent or trade your personal data to third parties for their own commercial purposes. We may share your data with the following categories of recipients, strictly as required to operate the Platform and comply with our obligations:

• KYC & Identity Verification Providers: Licensed third-party services that verify your identity, age and address on our behalf. These providers act as Data Processors under contractual data processing agreements.
• Payment Processors: Entities that facilitate deposits and withdrawals on the Platform. References to Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah represent familiar Pakistan market payment channels — xp786 shares only the minimum transaction data required for payment processing and does not imply these providers endorse gambling activities.
• Fraud Prevention & AML Services: Specialist services that screen transactions and user activity against fraud indicators and sanctions watchlists.
• Regulatory & Licensing Authorities: The Operator's licensing authority and any other competent regulatory body to which disclosure is legally required.
• Law Enforcement: Where xp786 is required by a valid legal order, court order or law enforcement request to disclose personal data.
• Group Companies: Other entities within the xp786 corporate group, where relevant to operating the Platform and providing services to users.
• Business Transfers: In the event of a merger, acquisition, restructuring or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections.

xp786 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account & Registration Data: Retained for the duration of your Account and for a minimum of five (5) years following account closure, in line with standard AML and regulatory retention requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by the Operator's licensing obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer Support Records: Retained for three (3) years from the date of the final communication, unless retention for a longer period is required to resolve an ongoing dispute.
• Marketing Consent Records: Retained for as long as your Account is active plus one (1) year following account closure, to enable us to demonstrate compliance with consent obligations.
• Technical & Usage Data: Typically retained in raw form for up to thirteen (13) months for analytical purposes, after which it is aggregated or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with xp786's data disposal procedures.

xp786 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

• TLS encryption for all data transmitted between your device and the Platform
• Encryption of sensitive data at rest, including KYC documents and payment credentials
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis
• Multi-factor authentication for administrative access to data systems
• Regular security assessments, vulnerability scanning and penetration testing
• Documented incident response procedures for detecting, reporting and managing data breaches

While xp786 employs robust security practices, no internet-based system can guarantee absolute security. You are responsible for keeping your Account password confidential and for notifying xp786 immediately if you suspect unauthorised access to your Account. Contact support at [email protected] for any security concerns.

xp786 uses cookies and similar technologies (including web beacons and local storage) to operate and improve the Platform. By continuing to use the Platform, you consent to the use of cookies as described in this section.

Types of Cookies Used

Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. Most modern browsers — including Chrome, Firefox, Safari and Edge — provide cookie management options under their Privacy or Security settings.

Subject to applicable data protection law and the Operator's legal retention obligations, you have the following rights in relation to your personal data held by xp786:

• Right of Access: You may request a copy of the personal data xp786 holds about you, together with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. You can update basic profile information directly in your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to xp786's legal retention obligations.
• Right to Restriction: You may request that xp786 restrict processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, commonly used and machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, and you may withdraw consent for marketing communications at any time through your Account settings or by contacting support.
• Right to Lodge a Complaint: You may lodge a complaint with the relevant data protection supervisory authority in the Operator's licensing jurisdiction.

xp786 operates internationally and your personal data may be transferred to, and processed in, countries outside your country of residence, including countries that may have different data protection standards than those in your home jurisdiction.

Where personal data is transferred outside the Operator's primary jurisdiction, xp786 implements appropriate safeguards to ensure that your data receives an adequate level of protection. These safeguards may include:

• Standard contractual clauses approved by a relevant data protection authority
• Data processing agreements with Data Processors that include binding privacy and security obligations
• Transfers to jurisdictions that have received an adequacy determination from a relevant supervisory authority

By using the xp786 Platform, you acknowledge that your personal data may be transferred internationally as described above.

The xp786 Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the Operator's licence jurisdiction. xp786 does not knowingly collect personal data from individuals under the applicable minimum age.

We implement age verification checks during the registration and KYC process to prevent underage users from accessing the Platform. If xp786 discovers that personal data has been collected from a minor, that data will be deleted promptly and the associated Account will be closed.

If you believe that a minor has registered on the Platform or that their data has been collected by xp786, please contact us immediately at [email protected]. Being 18 years of age does not in itself make gambling lawful under Pakistani law — users bear responsibility for understanding applicable local legislation.

xp786 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, data processing practices or Platform features. When material changes are made, xp786 will notify users by posting a prominent notice on the Platform and, where appropriate, by sending a notification to the email address associated with your Account.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how xp786 protects your personal data. Your continued use of the Platform following the posting of a revised Privacy Policy constitutes your acceptance of the updated terms.

If you do not agree with any amendment to this Privacy Policy, you should cease using the Platform and may request account closure by contacting support. Requests to close your account do not affect xp786's right to retain data for the periods required by law or regulatory obligation.

If you have any questions, concerns or requests relating to this Privacy Policy or the way xp786 handles your personal data, please get in touch with our support team. We are here to assist users across Pakistan — whether you are based in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar — and we aim to respond to all data-related enquiries promptly.

Support is available in English, with Urdu assistance available upon request.

For formal legal notices relating to data protection matters, please address your correspondence in writing to the registered address of the Operator, as disclosed in the Platform's licence information section.