xo786 Privacy Policy — Your Data, Your Rights

xo786 ("xo786", "we", "us", "our") is an internationally operated online casino and sports betting platform. The xo786 platform, accessible at xo786.org, is the data controller responsible for the personal information you provide when registering an account, placing bets, making deposits or withdrawals, or contacting our support team.

xo786 operates its platform specifically to serve English-speaking Pakistani players, offering a full suite of gaming services — including PSL cricket betting, live dealer casino tables, and a curated high-RTP slot library — all accessible through PKR-native payment methods: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.

For all data-related queries, the designated point of contact is the xo786 Data Protection team, reachable via the support email listed in Section 12 of this policy. All correspondence regarding this Privacy Policy should clearly reference "Data Privacy" in the subject line or opening message to ensure prompt routing.

xo786 collects personal data through multiple touchpoints across the platform lifecycle. The categories of data collected, and the context in which each category is gathered, are set out below.

xo786 does not collect or store full payment card numbers. All financial data is processed via tokenised references provided by the relevant payment provider (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) and xo786 holds only the minimum reference data required for transaction reconciliation and withdrawal routing.

xo786 does not purchase third-party marketing data lists and does not collect personal data from social media platforms without explicit player consent.

xo786 processes your personal data only for defined, legitimate purposes. We do not process personal data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which xo786 uses your data are:

• Account Management: Creating and maintaining your xo786 account, authenticating your xo786 Login sessions, and managing account security;
• KYC and Age Verification: Verifying that you are 21 or older, and that your identity matches the payment methods linked to your account, in compliance with our age-gating obligations;
• Transaction Processing: Processing deposits from and withdrawals to your JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank account, and maintaining accurate PKR wallet balance records;
• Service Delivery: Enabling your access to the xo786 sportsbook, live casino, slot games, and all other platform features;
• Fraud Prevention and Security: Detecting and investigating suspected fraud, money laundering, duplicate accounts, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions;
• Responsible Gaming Compliance: Monitoring account activity patterns to identify potential problem gambling behaviour and applying responsible gaming interventions where appropriate;
• Customer Support: Responding to your queries, complaints, and dispute submissions via live chat and email;
• Legal and Regulatory Compliance: Fulfilling obligations under applicable law, including data retention requirements and law enforcement cooperation;
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the xo786 platform, game recommendations, and user experience;
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates — only where you have provided explicit consent or where a legitimate interest exists and you have not opted out.

For each category of personal data processing, xo786 relies on one or more of the following legal bases, consistent with GDPR-aligned principles:

• Contractual Necessity: Processing required to fulfil our obligations under the xo786 Terms & Conditions — including account creation, transaction processing, bet settlement, and xo786 Login functionality;
• Legal Obligation: Processing required to comply with applicable law — including KYC and age verification, anti-money-laundering checks, and responding to court orders or law enforcement requests;
• Legitimate Interests: Processing carried out in pursuit of xo786's legitimate business interests, where those interests are not overridden by your rights — including fraud detection, security monitoring, platform analytics, and responsible gaming monitoring;
• Consent: Processing that relies on your freely given, specific, informed, and unambiguous consent — including direct marketing communications and non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

xo786 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Data sharing occurs only in the limited, controlled circumstances described below:

• Payment Providers: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum personal and financial data required to process your deposits and withdrawals. Each provider operates under its own privacy policy and applicable Pakistani financial regulation;
• KYC and Identity Verification Partners: Third-party identity verification services may process your CNIC details and supporting documents solely for the purpose of age and identity verification on xo786's behalf. These partners are contractually bound to process data only as instructed by xo786 and may not use your data for any independent purpose;
• Technology and Infrastructure Providers: Cloud hosting, platform software, and security monitoring providers who process data on xo786's behalf as data processors under binding data processing agreements;
• Fraud and Anti-Money-Laundering Services: Specialist screening services used to verify that player identities do not appear on sanctions lists or politically exposed persons (PEP) databases;
• Legal and Regulatory Authorities: Law enforcement agencies, courts, or regulatory bodies where xo786 is legally required to disclose data. xo786 will notify you of such disclosures where legally permitted to do so;
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of xo786's business, player data may be transferred as part of that transaction. You will be notified in advance of any such transfer that materially affects your rights under this policy.

All third-party data processors engaged by xo786 are required to maintain appropriate technical and organisational security measures and are prohibited from processing your data beyond the scope of the instructions provided by xo786.

xo786 uses cookies and similar tracking technologies (including local storage tokens and session identifiers) to operate the platform, maintain your login session, and understand how players use xo786 so we can improve it. The categories of cookies used on xo786.org are:

• Strictly Necessary Cookies: Essential for the platform to function — including session authentication tokens that keep you logged in via xo786 Login and secure your wallet session. These cannot be disabled without breaking core functionality;
• Performance Cookies: Collect anonymised data on page load times, error rates, and navigation paths to help xo786 identify and fix technical issues;
• Functional Cookies: Remember your preferences — such as language settings, preferred game categories, and responsible gaming reminder intervals — to provide a personalised experience;
• Analytics Cookies: Used in aggregate to understand which games, betting markets, and platform features are most used, informing xo786's product development decisions. Data collected via analytics cookies is anonymised before analysis;
• Marketing Cookies: Used only with your explicit consent to record which promotional offers you have viewed, to avoid showing you the same promotion repeatedly and to assess campaign effectiveness.

You may withdraw consent for non-essential cookies at any time via your browser settings or the xo786 cookie preference centre. Withdrawing cookie consent will not affect your ability to use the core xo786 platform, though some personalised features may become unavailable.

xo786 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (from which you cannot be re-identified) may be retained indefinitely for aggregate statistical and product analytics purposes.

As a data subject, you hold the following rights with respect to personal data that xo786 holds about you. xo786 will respond to all valid rights requests within 30 days of receipt. Complex requests may require up to an additional 60 days, in which case xo786 will notify you of the extension and the reason for it.

• Right of Access: You may request a copy of all personal data xo786 holds about you, together with information about how it is processed and for what purpose;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. For account details, many fields can be updated directly within your xo786 account settings;
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to xo786's legal retention obligations. Note that KYC and financial records must be retained for the periods specified in Section 7 and cannot be erased on request during those periods;
• Right to Restrict Processing: You may request that xo786 restricts processing of your data in certain circumstances — for example, while a rectification request is being assessed;
• Right to Data Portability: You may request a machine-readable copy of the personal data you have provided to xo786, for transfer to another controller, where technically feasible;
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes at any time. Objecting to marketing will result in immediate removal from all xo786 promotional communications;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

xo786 implements technical and organisational security measures appropriate to the sensitivity of the personal data we process. Our security infrastructure includes:

• Encryption in Transit: All data transmitted between your browser and xo786.org is encrypted via TLS 1.3. Connections over older, insecure protocols are rejected;
• Encryption at Rest: Sensitive personal data stored on xo786 infrastructure — including identity documents and financial references — is encrypted at rest using AES-256;
• Access Controls: Access to personal data within xo786 is restricted on a need-to-know basis. Staff with access to player data are subject to confidentiality obligations and regular security training;
• Two-Factor Authentication: Internal xo786 systems access is protected by multi-factor authentication. Players are encouraged to enable 2FA on their own xo786 accounts via the account security settings;
• Penetration Testing: xo786's platform undergoes regular third-party security assessments to identify and remediate vulnerabilities;
• Incident Response: xo786 maintains a documented data breach response procedure. In the event of a breach likely to result in a risk to your rights, xo786 will notify affected players without undue delay.

While xo786 takes all reasonable precautions to protect your personal data, no internet transmission or storage system is 100% secure. Players are responsible for maintaining the security of their own xo786 Login credentials. Do not share your password with anyone, and contact xo786 support immediately if you suspect unauthorised access to your account.

xo786 strictly prohibits use of its platform by any person under the age of 21. The xo786 platform is not directed at, and does not knowingly collect personal data from, individuals under 21 years of age. Age verification is a mandatory step during the xo786 registration process, and xo786 employs both technical controls and manual KYC review to enforce this restriction.

If xo786 becomes aware that personal data has been collected from a person under the age of 21 — whether through a fraudulent registration or any other means — the following actions will be taken immediately:

• The account will be suspended and all access to the platform terminated;
• Any winnings generated during the period of underage access will be voided;
• All personal data associated with the account will be reviewed and, where not subject to legal retention obligations, permanently deleted;
• The matter may be reported to relevant authorities where required by applicable law.

xo786 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. When material changes are made, xo786 will take the following steps to ensure you are informed:

• The "Last Updated" date at the top of this page will be revised to reflect the date of the most recent amendment;
• A prominent notice will be displayed on the xo786 platform for a minimum of 14 days following the publication of any material change;
• Where the change materially affects how we process your personal data or your rights, xo786 will send a direct notification to the email address registered on your account;
• The previous version of the Privacy Policy will be archived and made available on request for a period of 12 months following the update.

Your continued use of the xo786 platform following notification of a material policy change constitutes your acknowledgement of the updated terms. If you do not accept the revised policy, you may close your account by contacting xo786 support. Account closure requests submitted within 14 days of a material policy change notification will be processed with priority.

For all matters relating to this Privacy Policy — including data rights requests, consent withdrawals, questions about how your personal data is processed, or complaints about xo786's data handling practices — please contact the xo786 Data Protection team through the following channels:

• Live Chat: Available 24/7 directly on xo786.org. Average first response under 2 minutes. Please state "Data Privacy" at the start of your message to ensure routing to the correct team;
• Support Email: [email protected] — please use the subject line "Privacy Policy Request" or "Data Rights Request" as appropriate. Email responses are provided within 12 hours (PKT) for general support, and within 30 days for formal data rights requests.

xo786 takes all privacy complaints seriously. If you submit a complaint, xo786 will acknowledge receipt within 5 business days and provide a substantive response within 30 days. Where a complaint cannot be resolved within 30 days, xo786 will notify you of the reason for the delay and provide an updated resolution timeline.

If you are not satisfied with xo786's response to your privacy complaint, you have the right to escalate the matter to an appropriate supervisory authority or data protection regulator in the jurisdiction applicable to your situation. xo786 will cooperate fully with any such regulatory inquiry.