xs666 Privacy Policy — How We Handle Your Personal Data

1.1 This Privacy Policy ("Policy") is published by xs666, the operator of the online casino and sports betting platform accessible at xs666.lat ("Platform"). This Policy describes how xs666 collects, processes, stores, and — where applicable — shares the personal data of individuals who visit, register on, or use the xs666 Platform.

1.2 By registering an xs666 account and/or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy forms part of the xs666 Terms and Conditions, which are incorporated by reference.

1.3 xs666 is committed to processing personal data in a manner that is lawful, fair, and transparent. xs666's data practices are aligned with internationally recognised data protection principles, including those reflected in the General Data Protection Regulation (GDPR) framework, which xs666 voluntarily applies as a benchmark for data handling standards.

1.4 If you have any questions about this Policy or about how xs666 handles your data, please contact the xs666 support team using the contact information provided in Section 15.

2.1 xs666 collects personal data across the following categories, depending on how you interact with the Platform:

2.1.1 Registration & Identity Data

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify you are aged 21 or over)
• Pakistani mobile number (CNIC-linked, used for account authentication)
• Email address (for account communications and notifications)
• City of residence (e.g. Karachi, Lahore, Faisalabad, Islamabad)
• Username and password (password stored in hashed, irreversible form)

2.1.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents (e.g. CNIC, passport)
• Proof of address documents where required
• Selfie or live photograph for identity matching purposes
• Mobile wallet verification data (JazzCash, EasyPaisa account confirmation)

2.1.3 Financial & Transaction Data

• Deposit and withdrawal transaction records (amount, date, payment method)
• JazzCash / EasyPaisa account reference numbers (not full wallet credentials)
• Bank account name and partial account details (HBL, UBL, Meezan Bank transfers)
• PKR balance history and bonus credit/debit records

2.1.4 Gaming & Activity Data

• Game session records (games played, wager amounts, results, duration)
• Sports betting activity (markets wagered on, bet amounts, outcomes)
• Bonus utilisation records and wagering requirement progress
• Responsible gaming tool settings (deposit limits, cool-off periods, self-exclusion status)

2.1.5 Technical & Device Data

• IP address and approximate geolocation data
• Device type, operating system version, and browser type
• Session duration, click and navigation patterns within the Platform
• Cookie identifiers and analytics session tokens

3.1 xs666 collects personal data through the following channels:

• Directly from you: Information you provide when registering your xs666 account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automatically during Platform use: Technical and activity data collected via server logs, cookies, and analytics tools as you navigate and use the xs666 Platform.
• From payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank in connection with deposits and withdrawals.
• From KYC and identity verification providers: Results and data received from third-party KYC service providers to whom xs666 submits identity documents for verification, as described in Section 6.
• From fraud prevention services: Risk signals and verification data from fraud detection systems used to protect xs666 and its players.

3.2 xs666 does not purchase personal data lists or obtain player data from social media platforms or third-party data brokers for marketing profiling purposes.

4.1 xs666 uses collected personal data for the following purposes:

5.1 xs666 processes personal data under the following legal bases, consistent with internationally recognised data protection frameworks:

• Contractual necessity: Processing required to perform the xs666 Terms and Conditions — including account management, payment processing, game operation, and bonus administration.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC/AML obligations, age verification, responsible gaming obligations, and financial record-keeping requirements.
• Legitimate interests: Processing undertaken in xs666's legitimate business interests, including fraud detection and prevention, platform security, and analytics for service improvement — where these interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — principally for marketing communications. You may withdraw consent at any time as described in Section 11.

6.1 xs666 does not sell, rent, or trade your personal data. xs666 may share personal data with the following categories of third parties, strictly on a need-to-know basis and under contractual data protection obligations:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum transaction data required to process your deposits and withdrawals. These entities are independently regulated financial institutions.
• KYC and identity verification providers: Third-party services contracted by xs666 to verify player identity and age documentation. These providers are contractually bound to process KYC data only for verification purposes and to apply appropriate data security standards.
• Fraud detection and risk management providers: Services used to assess and prevent fraudulent activity, money laundering, and other prohibited conduct on the Platform.
• IT infrastructure and hosting providers: Secure server and cloud infrastructure providers that host xs666 platform data under strict data processing agreements.
• Regulatory and law enforcement authorities: xs666 will disclose personal data to competent authorities where required to do so by applicable law, court order, or regulatory demand.
• Game software providers: Game providers (such as Pragmatic Play, NetEnt, and Play'n GO) may receive session data necessary to operate their certified games within the xs666 lobby. Game providers do not receive full player registration or financial data.

6.2 xs666 does not transfer personal data to third parties for their own independent marketing, profiling, or advertising purposes without your explicit prior consent.

7.1 xs666 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including the period during which your xs666 account remains active, and thereafter for a further period required for legal, regulatory, and compliance purposes.

7.2 The following general retention periods apply:

• Account and registration data: Retained for the duration of your active xs666 account plus a minimum of five (5) years after account closure, to satisfy regulatory and anti-money-laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years following the date of the transaction, consistent with international financial compliance standards.
• KYC verification documents: Retained for a minimum of five (5) years following account closure or the date of the most recent verified transaction, whichever is later.
• Gaming activity data: Retained for the duration of account activity plus five (5) years for compliance purposes. Anonymised or aggregated gaming data may be retained indefinitely for statistical analysis.
• Marketing consent records: Retained for the duration of active consent and for up to two (2) years following withdrawal of consent, for evidence purposes.
• Support communications: Retained for two (2) years from the date of the most recent communication in a thread, or longer where a formal complaint or investigation remains ongoing.

7.3 Following the expiry of applicable retention periods, xs666 will securely delete or anonymise personal data so that it can no longer be associated with any individual player.

8.1 xs666 implements comprehensive technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and xs666 servers;
• Encrypted storage for sensitive personal data at rest;
• Role-based access controls — only authorised xs666 personnel may access personal data, and only to the extent required for their specific duties;
• Secure hashing of account passwords using industry-standard algorithms (passwords are never stored in plain text);
• Regular security audits, penetration testing, and vulnerability assessments of the xs666 platform;
• Multi-factor authentication options for player accounts;
• Continuous monitoring of the platform for suspicious access patterns and potential data breach indicators.

8.2 While xs666 applies rigorous security standards, no digital system can guarantee absolute security against all threats. xs666 will notify affected players and relevant authorities of any data breach that is likely to result in a high risk to player rights and freedoms, in accordance with applicable notification obligations.

8.3 You have an important role in account security. You must keep your xs666 Login credentials strictly confidential and must not share them with any third party. Contact xs666 support immediately if you believe your account has been accessed without your authorisation.

9.1 xs666 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device by your browser when you visit a website. xs666 uses the following categories of cookies:

• Essential / Session Cookies: Required for the Platform to function correctly. These cookies maintain your login session, remember your account preferences, and enable secure navigation between pages. These cookies cannot be disabled without impairing Platform functionality.
• Analytics Cookies: Used to collect anonymised information about how players interact with the xs666 Platform — such as which pages are visited most frequently and where players encounter difficulties. This data is used solely to improve Platform design and player experience.
• Functional Cookies: Remember your preferences, such as language or display settings, to provide a personalised experience on return visits.
• Security Cookies: Assist in detecting and preventing fraudulent activity and protecting account integrity.

9.2 You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect Platform functionality. For detailed browser-level cookie management, consult your browser's help documentation.

9.3 xs666 does not use third-party advertising tracking cookies for the purpose of serving behavioural advertisements on third-party websites.

10.1 As an xs666 player, you have the following rights in respect of your personal data. To exercise any of these rights, contact xs666 support using the details in Section 15:

10.2 xs666 will respond to data rights requests within 30 days of receipt. Where a request is complex or xs666 receives a high volume of requests, this period may be extended by a further 60 days, and you will be notified accordingly.

10.3 Please note that certain data rights are subject to limitations. xs666 may decline a deletion request, for example, where retention of the data is required to comply with a legal or regulatory obligation (such as AML record-keeping requirements). Where xs666 declines a request, we will explain the reason clearly.

11.1 xs666 may send you promotional communications about bonuses, new games, VIP offers, and platform news by SMS, email, or push notification, where you have provided your consent to receive such communications at registration or subsequently.

11.2 You may withdraw your marketing consent and opt out of all promotional communications at any time by:

• Updating your communication preferences directly within your xs666 account settings;
• Clicking the unsubscribe link included in any xs666 marketing email; or
• Contacting xs666 support and requesting removal from all marketing lists.

11.3 Opting out of marketing communications will not affect your receipt of transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — which xs666 may send regardless of marketing preferences as they relate to the operation of your account.

11.4 xs666 does not share player data with third-party marketing companies for the purpose of those companies sending you their own marketing communications.

12.1 If xs666 discovers or reasonably suspects that personal data has been collected from a person under the age of 21, xs666 will immediately suspend the associated account, delete or anonymise the collected data to the extent permitted by applicable law, and — where funds are involved — take appropriate steps as described in the xs666 Terms and Conditions.

12.2 Parents and guardians who believe that a minor may have accessed the xs666 Platform and provided personal data are encouraged to contact xs666 support immediately. xs666 will investigate all such reports promptly and act accordingly.

13.1 The xs666 Platform does not contain links to third-party websites or services that are not part of the xs666 operation. In the limited circumstances where any such reference appears — for example, references to payment provider platforms — those third parties operate under their own independent privacy policies, for which xs666 accepts no responsibility.

13.2 xs666 recommends that you review the privacy policies of any third-party services you use in connection with your xs666 account, including your JazzCash, EasyPaisa, or banking application, to understand how those services handle your data.

14.1 xs666 reserves the right to update or amend this Privacy Policy at any time. Updated versions will be published on this page with a revised effective date displayed at the top of the document. Where changes are material, xs666 will use reasonable efforts to notify registered players via email or an on-platform notification prior to the changes taking effect.

14.2 Your continued use of the xs666 Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised Policy. If you do not accept a revised Policy, you must cease using the Platform and contact support to initiate account closure.

14.3 xs666 recommends that you review this page periodically to stay informed of any updates to our data practices.

15.1 If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 10, or have concerns about how xs666 handles your personal data, you may contact the xs666 support team through the following channels:

• Live Chat: Available 24/7 via the xs666 Platform — average response time 3–5 minutes with Urdu and English support agents. Select "Privacy & Data Request" as your enquiry topic for fastest routing.
• Email: [email protected] — please include "Privacy Enquiry" or "Data Rights Request" in the subject line. Responses provided within one business day for general enquiries; data rights requests acknowledged within 48 hours.

15.2 For formal data subject rights requests, xs666 may require you to verify your identity before acting on the request, to ensure personal data is disclosed only to the rightful account holder.

15.3 xs666 is committed to resolving all privacy and data protection concerns promptly and transparently. If you are not satisfied with xs666's response to a privacy concern, you have the right to escalate the matter through the dispute resolution process described in the xs666 Terms and Conditions, or to lodge a complaint with the relevant data protection authority in your jurisdiction.