xx777 Privacy
Policy

Introduction & Scope

This Privacy Policy ("Policy") is issued by the operator of the xx777 Platform ("xx777", "we", "us", "our") and governs the collection, use, storage, sharing, and protection of personal data relating to all individuals who visit the website at xx777.io, register a Member account, or otherwise interact with the xx777 Platform or services.

By accessing the xx777 Platform, creating an account, or submitting personal information to us in any form, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not access or use the xx777 Platform.

This Policy should be read alongside the xx777 Terms & Conditions and Responsible Gaming Policy, which are incorporated by reference. Where a conflict arises between this Policy and the Terms & Conditions, the Terms & Conditions shall prevail unless the conflict specifically concerns data protection obligations, in which case this Policy shall govern.

Data Controller

For the purposes of applicable data protection law, xx777 — operating at xx777.io under an international gaming licence — acts as the data controller in respect of the personal data of Members and visitors described in this Policy. As data controller, xx777 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable legal obligations.

Contact details for data protection enquiries are provided in Section 15 of this Policy. Where xx777 engages third-party processors (such as payment service providers, identity verification agencies, or cloud hosting providers), those parties act as data processors under written data processing agreements that obligate them to handle personal data only in accordance with xx777's documented instructions and applicable law.

Data We Collect

xx777 collects the following categories of personal data, depending on your interaction with the Platform:

3.1 Identity & Registration Data

• Full legal name as per government-issued identity documentation
• Date of birth (for age verification purposes — 21+ policy enforcement)
• Residential address
• Nationality and country of residence
• CNIC number or passport number (provided during verification)
• Copies of identity documents submitted for KYC verification

3.2 Contact Data

• Mobile telephone number (Pakistani mobile number used for OTP and account communications)
• Email address

3.3 Financial & Transaction Data

• JazzCash or EasyPaisa wallet identifiers
• Bank account details (where bank transfer is used)
• Deposit history, withdrawal history, and transaction timestamps
• PKR balance history and bonus balance records
• Source of funds documentation (where required by AML obligations)

3.4 Gaming & Behavioural Data

• Game session logs (games played, bets placed, outcomes, session duration)
• Sports betting selections and settlement records
• Responsible gaming settings and limit history
• Login timestamps and session activity logs

3.5 Technical & Device Data

• IP address at time of registration and each login event
• Device type, operating system, and browser type/version
• Screen resolution and device identifiers (where applicable)
• Geographic location data derived from IP address

3.6 Communications Data

• Contents of support chat transcripts, emails, and other communications with xx777
• Complaint and dispute records
• Marketing consent preferences and communication history

How We Collect Your Data

xx777 collects personal data through the following means:

1. Direct provision by you — when you register an account, complete verification, make a deposit or withdrawal, use live chat support, or submit a complaint or feedback.
2. Automated collection — through cookies, session tracking technology, and server logs as you interact with the xx777 Platform.
3. Third-party identity verification services — when you submit identity documents, those documents may be processed through a third-party verification provider acting under xx777's instruction.
4. Payment processors — transaction data is shared with xx777 by JazzCash, EasyPaisa, Raast, and other payment service providers as part of processing your deposit or withdrawal.
5. Anti-fraud and AML screening services — xx777 may receive risk signals or data flags from fraud prevention services to protect the integrity of the platform.

Purposes & Legal Basis for Processing

The table below sets out the primary purposes for which xx777 processes personal data, together with the legal basis relied upon for each processing activity:

Data Sharing

xx777 does not sell or rent your personal data. We share personal data only in the following limited and controlled circumstances:

• Payment service providers (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, MCB, Raast, 1LINK) — to process deposits and withdrawals in PKR. These providers receive only the minimum data necessary to complete a transaction.
• Identity and age verification providers — to verify documents submitted during the KYC process. These providers process documents under strict contractual data processing obligations.
• Fraud prevention and AML screening services — to screen transactions and account activity against fraud and money laundering indicators. Data shared is limited to what is necessary for screening purposes.
• Cloud infrastructure and hosting providers — xx777's platform is hosted on secure cloud infrastructure. Hosting providers access personal data solely to provide infrastructure services and are bound by data processing agreements.
• Gaming software and live studio providers — game outcome and session data may be processed by third-party game providers whose RNG systems xx777 integrates. These providers process game data in accordance with their certification and contractual obligations.
• Regulatory and law enforcement authorities — xx777 will disclose personal data to competent authorities when required by applicable law, court order, or regulatory instruction. xx777 will notify affected Members where legally permissible to do so.
• Professional advisers — lawyers, auditors, and compliance consultants may access personal data as necessary to provide professional services to xx777, subject to professional confidentiality obligations.

All third parties who receive personal data from xx777 are required to maintain appropriate technical and organisational security measures and to use the data solely for the purposes for which it was shared.

International Data Transfers

As an internationally licensed platform, xx777 may process or store personal data on servers or through service providers located in jurisdictions outside Pakistan. Where personal data is transferred internationally, xx777 ensures that appropriate safeguards are in place, including:

• Transfers only to countries or service providers that provide an adequate level of data protection as assessed by reference to internationally recognised frameworks;
• Standard contractual clauses or equivalent contractual safeguards binding the recipient to protect the data in accordance with applicable standards; and
• Operational and technical controls ensuring that data is not accessible beyond what is necessary for the service in question.

You may request further information about the specific safeguards applicable to any international transfer involving your personal data by contacting the xx777 privacy team at the address in Section 15.

Data Retention

xx777 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to any legal or regulatory retention obligations that may require a longer period. The following indicative retention periods apply:

• Active account data — retained for the duration of the active account relationship.
• Identity and KYC documentation — retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering regulatory obligations.
• Transaction and financial records — retained for a minimum of five (5) years following the date of each transaction.
• Gaming session logs — retained for a minimum of three (3) years following account closure for dispute resolution and regulatory audit purposes.
• Communications and support records — retained for three (3) years following resolution of the relevant matter.
• Marketing consent records — retained for the period of consent plus three (3) years following withdrawal of consent.

Following the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for aggregate statistical and analytics purposes.

Security Measures

xx777 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key security controls include:

• Transport Layer Security (TLS 1.3) for all data in transit between the Member's device and xx777 servers
• AES-256 encryption for sensitive data at rest within xx777's storage infrastructure
• Password hashing using bcrypt or equivalent cryptographic algorithms — plaintext passwords are never stored
• Role-based access controls ensuring that internal staff access only the minimum personal data necessary for their specific function
• Multi-factor authentication requirements for administrative access to backend systems
• Regular security assessments, penetration testing, and vulnerability scanning
• Incident response procedures including notification protocols in the event of a data security breach

Notwithstanding xx777's security measures, no method of data transmission or storage is entirely risk-free. Members are encouraged to use strong, unique passwords for their xx777 account and to enable two-factor authentication to further protect their account and associated data.

Cookies & Tracking Technologies

The xx777 Platform uses cookies and similar technologies to enable essential platform functionality, improve performance, and maintain account security. The following cookie categories are used:

1. Essential / Strictly Necessary Cookies — required for the Platform to function. These include session authentication cookies, CSRF protection tokens, and load balancing cookies. These cannot be disabled without breaking core functionality.
2. Performance & Analytics Cookies — used to understand how Members use the Platform, which pages generate errors, and how navigation flows can be improved. Data collected is aggregated and not linked to individual Member identities for this purpose.
3. Security Cookies — used to detect and mitigate fraudulent login attempts, session hijacking, and other security threats. These cookies record login events, device fingerprints, and session validity signals.

xx777 does not use third-party advertising cookies, social media tracking pixels, or behavioural retargeting technologies. The cookies deployed on xx777.io are limited to those required to operate the Platform securely and effectively.

Minors & 21+ Age Policy

The xx777 Platform is strictly intended for individuals aged 21 and above. xx777 does not knowingly collect, process, or store personal data from individuals under the age of 21. Age verification is a mandatory step in the account lifecycle, and xx777 deploys both automated age-checking mechanisms at registration and document-based verification before withdrawal processing.

If xx777 identifies or is informed that personal data has been collected from an individual under the age of 21, the account will be immediately suspended, all personal data associated with that account will be securely deleted (subject to any statutory retention obligations in respect of fraudulent or prohibited transactions), and any Real-Money Funds deposited will be returned to the originating payment method after verification.

Parents, guardians, and household members who believe that a minor has accessed the xx777 Platform should contact the support team immediately using the contact details in Section 15 of this Policy.

Your Data Rights

Subject to applicable law and certain conditions, xx777 Members and visitors have the following rights in respect of their personal data held by xx777:

To exercise any of the rights above, please submit a written request to the xx777 privacy team using the contact details in Section 15. xx777 will respond within thirty (30) calendar days of receiving a valid request. In complex or high-volume cases, this period may be extended by a further sixty (60) days, in which case xx777 will notify you of the extension and the reason for it.

Certain rights are subject to conditions and exceptions. For example, the right to erasure does not apply where xx777 is required by law to retain the data (such as AML record-keeping obligations). Where xx777 is unable to fulfil a request in full, we will explain the reason in writing.

Marketing Preferences

xx777 may send you promotional communications about bonuses, new games, PSL betting specials, and other Platform features — but only where you have given explicit consent to receive such communications at registration or through your account settings.

Marketing communications are sent via SMS to your registered Pakistani mobile number and/or to your registered email address. You may withdraw consent for marketing communications at any time by:

• Updating your communication preferences directly in your xx777 account settings under the "Notifications" section;
• Clicking the unsubscribe link included in any email marketing communication; or
• Contacting the xx777 support team and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect your ability to use the xx777 Platform or your account in any way. xx777 will continue to send you essential transactional communications (such as deposit confirmations, withdrawal status notifications, and security alerts) regardless of marketing preferences, as these are necessary to operate your account.

Changes to This Privacy Policy

xx777 reviews and updates this Privacy Policy periodically to reflect changes in applicable law, regulatory guidance, platform functionality, or data processing practices. When material changes are made, xx777 will:

• Update the "Effective Date" displayed at the top of this Policy;
• Display a prominent notice on the xx777 Platform informing Members of the change; and
• Where practicable, send a notification to Members' registered email addresses or mobile numbers summarising the nature of the change.

Continued use of the xx777 Platform following the effective date of any revised Policy constitutes acceptance of the updated terms. If you do not agree to a revised Policy, you should cease use of the Platform and close your account. The current version of this Policy, as published on xx777.io, supersedes all prior versions.

Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by xx777, please contact the xx777 privacy team using the following details:

• Email: [email protected]  (plain text — not a clickable link)
• Subject line: Please include "Privacy Request" or "Data Protection" in the subject line of your email to ensure prompt routing to the correct team.
• Response time: xx777 aims to acknowledge all privacy-related enquiries within 72 hours and to provide a substantive response within 30 calendar days.
• Live Chat: Available 24/7 via the Platform for general queries; formal data subject requests should be submitted in writing by email.

If you are not satisfied with xx777's response to a privacy complaint, you have the right to escalate the matter to the supervisory authority or dispute resolution body designated under xx777's international gaming licence jurisdiction. Details of the relevant authority are available upon request from the xx777 privacy team.