This Privacy Policy ("Policy") describes how xp666 ("we", "us", "our", "the Company") collects, processes, stores, shares and protects the personal information of registered players and visitors to the xp666.biz platform. Your privacy is a fundamental commitment at xp666 — not a legal formality. We ask that you read this Policy carefully alongside our Terms & Conditions before registering or using any xp666 service.
These are the principles underpinning how xp666 handles your personal data. Full legal detail is in the policy sections below.
xp666 collects the minimum personal data necessary to provide you with a secure gaming account, process PKR transactions via JazzCash and EasyPaisa, and comply with our licensing obligations. We do not collect personal data for its own sake.
All personal and financial data transmitted between your device and xp666 servers is protected by 256-bit SSL encryption. Payment details, CNIC information, and login credentials are never stored or transmitted in plain text on the xp666 platform.
xp666 does not sell, rent, or trade your personal information to third-party marketers or data brokers. Data shared with third parties is limited to what is strictly necessary for payment processing, identity verification, and regulatory compliance purposes only.
xp666 players have the right to access, correct, restrict, and request deletion of their personal data. You can exercise these rights by contacting xp666 support. Requests are processed within 30 days and handled with full transparency as detailed in Section 10 of this Policy.
xp666 does not retain personal data indefinitely. Retention periods are defined by regulatory requirements, contractual necessity, and legitimate gaming interest. Data that no longer serves a defined purpose is deleted or anonymised in accordance with Section 11 of this Policy.
Data collected for xp666's responsible gaming tools — including self-exclusion registrations, deposit limit settings, and session duration records — is treated with heightened sensitivity and is never used for marketing profiling or shared beyond what licensing regulations require.
This Policy was last updated January 2026. Your continued use of xp666 following any update constitutes acceptance of the revised Policy.
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
xp666 is the Data Controller responsible for Personal Data collected and processed through the xp666.biz platform. xp666 operates under an international gaming licence and is subject to the data protection obligations of the licensing jurisdiction as well as applicable data protection laws relevant to its players, including Pakistani players whose data is collected on this platform.
All data protection enquiries, subject access requests, and privacy-related complaints should be directed to the xp666 Data Protection contact as specified in Section 16 of this Policy. xp666 will respond to all privacy-related requests within 30 calendar days of receipt.
xp666 collects the following categories of Personal Data from players and platform visitors:
xp666 collects Personal Data through the following channels and mechanisms:
xp666 processes your Personal Data for the following defined purposes:
| Purpose | Data Categories Used | Retention Reference |
|---|---|---|
| Account creation and management | Identity, mobile number, password hash | Section 11.1 |
| Age and identity verification (21+ / KYC) | CNIC, date of birth, identity documents | Section 11.2 |
| Processing PKR deposits and withdrawals | Financial identifiers, transaction history | Section 11.3 |
| Gaming service provision | Game activity, session data, PKR balance | Section 11.1 |
| Anti-money laundering (AML) compliance | Financial data, identity, transaction patterns | Section 11.2 |
| Fraud prevention and platform security | IP address, device data, login history | Section 11.4 |
| Responsible gaming tool administration | Limit settings, self-exclusion records | Section 11.2 |
| Customer support and dispute resolution | Communications data, account data | Section 11.3 |
| Platform analytics and improvement | Anonymised usage data, session logs | Section 11.4 |
| Marketing communications (opt-in only) | Mobile number, email, preferences | Section 14 |
xp666 processes Personal Data on one or more of the following legal bases:
xp666 uses the following categories of cookies on the xp666.biz platform:
You may manage cookie preferences through your browser settings. Disabling certain cookies may impair the functionality of the xp666 platform, including the ability to log in or maintain an active session. xp666 does not use third-party advertising cookies or behavioural retargeting technologies on the platform.
xp666 does not sell Personal Data to any third party. Data is shared with third parties only in the following limited and necessary circumstances:
Financial transaction data is shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency network processors as required to execute deposits and withdrawals initiated by you. These providers process data under their own privacy policies and applicable financial regulations.
CNIC data and identity documents are shared with authorised third-party KYC verification services as required by xp666's licensing obligations. These providers operate under strict data processing agreements with xp666 and are not permitted to use your data for any purpose beyond identity verification.
xp666 may disclose Personal Data to gaming regulators, financial intelligence units, law enforcement agencies, or other competent authorities where required by law, court order, or xp666's licensing conditions. Such disclosures are made only to the extent required and are not subject to prior player notification where disclosure would compromise a regulatory or law enforcement process.
Anonymised, aggregated usage data may be shared with analytics providers to support platform improvement activities. No personally identifiable information is shared in this context.
xp666 operates infrastructure across multiple jurisdictions to deliver gaming services to Pakistani players. Your Personal Data may be transferred to and processed in countries other than Pakistan, including the jurisdiction in which xp666 holds its gaming licence.
Where Personal Data is transferred outside Pakistan, xp666 takes the following measures to ensure appropriate protections are in place:
By using the xp666 platform, you acknowledge that your Personal Data may be processed in jurisdictions outside Pakistan and consent to such processing as described in this Section.
xp666 recognises and supports the following rights with respect to your Personal Data. You may exercise any of these rights by contacting xp666 support as specified in Section 16.
You have the right to request a copy of the Personal Data xp666 holds about you. Access requests are fulfilled within 30 calendar days and provided in a structured, commonly used format.
You have the right to request correction of inaccurate or incomplete Personal Data held by xp666. Corrections are processed within 14 days and may require re-submission of verification documents where the corrected data relates to identity or payment details.
You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, where consent has been withdrawn, or where processing is unlawful. Note that xp666 may retain certain data for regulatory compliance purposes notwithstanding erasure requests.
Where you contest the accuracy of your data, or where processing is unlawful but you prefer restriction over deletion, you may request that xp666 restrict further processing pending resolution of the relevant issue.
Where processing is based on consent or contractual necessity and carried out by automated means, you may request your Personal Data in a machine-readable format for transfer to another data controller.
You have the right to object to processing based on xp666's legitimate interests, including direct marketing. Objections to marketing communications are actioned immediately. Objections to other processing will be reviewed within 30 days.
xp666 retains Personal Data only for as long as is necessary for the purposes for which it was collected, in accordance with the following retention schedule:
Account data and gaming activity records are retained for the duration of your active xp666 account plus a post-closure period of five (5) years, as required by xp666's gaming licence and applicable financial record-keeping obligations.
CNIC documents, identity verification records, and responsible gaming configurations (including self-exclusion registrations) are retained for a minimum of five (5) years following account closure to comply with anti-money laundering regulations and licensing requirements.
Deposit and withdrawal transaction records are retained for a minimum of seven (7) years in line with standard financial record-keeping obligations applicable to licensed gaming operators.
IP address logs and device data are retained for up to twelve (12) months unless required for longer periods by an active fraud investigation or regulatory inquiry. Anonymised analytics data may be retained indefinitely as it contains no personally identifiable information.
Personal Data that has exceeded its retention period is deleted securely or anonymised so that it can no longer be attributed to an identifiable individual. xp666 conducts periodic data audits to ensure retention compliance across all data categories.
xp666 implements the following technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction:
xp666 is strictly an adult gaming platform. The minimum age for xp666 registration and participation is 21 years. xp666 does not knowingly collect or process the Personal Data of individuals under 21 years of age.
CNIC verification is mandatory at account registration precisely to enforce this age restriction. Where xp666 identifies or has reasonable grounds to believe that a user is under 21, the account is immediately suspended, any collected data is reviewed under our underage access procedures, and — where technically feasible — data relating to the underage individual is deleted or returned in accordance with xp666's responsible gaming and data protection obligations.
If a parent or guardian becomes aware that a minor has provided Personal Data to xp666, they should contact xp666 support immediately using the contact details in Section 16.
xp666 may send promotional communications — including bonus offers, game launch announcements, PSL-season betting promotions, and platform update notifications — to Pakistani players who have opted in to receive such communications at the time of registration or subsequently through account preference settings.
Marketing communications from xp666 may be delivered via SMS to your registered Pakistani mobile number. xp666 does not send marketing emails to personal email addresses unless specifically opted in during account setup.
You may opt out of xp666 marketing communications at any time by:
Opt-out requests are processed within 5 business days. Opting out of marketing communications does not affect transactional and account-related communications which are required for the operation of your xp666 account.
xp666 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or platform features. When material changes are made to this Policy:
Your continued use of the xp666 platform following the publication of an updated Privacy Policy constitutes your acceptance of the amended terms. If you do not agree with the changes, you should cease using xp666 and request account closure in accordance with the procedures described in xp666's Terms and Conditions.
We recommend bookmarking this page and reviewing it periodically. The "Effective Date" at the top of this Policy always reflects the most recent revision.
For all privacy-related enquiries, data subject access requests, marketing opt-out requests, or privacy complaints, please contact the xp666 Data Protection team through the following channels:
Available 24/7 on xp666.biz. Urdu-speaking agents available around the clock. Best for urgent account security matters and data access requests requiring rapid response.
Send written privacy requests, subject access requests, and formal privacy complaints to: [email protected] (plain text — not a clickable link). Please include your registered xp666 mobile number in all correspondence.
xp666 is committed to responding to all privacy-related requests within 30 calendar days of receipt. Complex requests involving large volumes of data may require an extension of up to a further 60 days, in which case xp666 will notify you of the extended timeline within the initial 30-day period.
xp666 handles your personal data responsibly and securely. Your PKR wallet, CNIC information, and JazzCash details are protected at every level. Access Pakistan's premier online casino with full confidence in your data security.