This Privacy Policy explains how xp786 collects, uses, stores, protects and — where necessary — shares your personal data when you register and use the xp786 online casino and sportsbook platform. Your privacy is taken seriously at every level of how xp786 operates.
The cards below summarise xp786's six core data principles. The full binding text follows in the policy document below.
xp786 collects only the personal data that is strictly necessary for account operation, KYC compliance, and payment processing. We do not collect data for its own sake or to build advertising profiles.
xp786 does not sell, rent, or commercially transfer your personal data to third parties for their own marketing or advertising purposes — full stop. Your data is not a product at xp786.
All xp786 personal data — including KYC documents, transaction records, and login credentials — is stored using AES-256 encryption at rest and 256-bit TLS in transit.
JazzCash, EasyPaisa, HBL, UBL, Meezan and Raast payment data is processed through PCI-DSS compliant channels. xp786 does not store full card or mobile wallet credentials on its own servers.
xp786 honours data subject rights — access, correction, erasure, portability and objection — for all registered players, subject to applicable legal retention requirements.
xp786 operates under an international gaming license. Data processing activities — particularly KYC and AML records — comply with the data retention requirements of our licensing regime.
This Privacy Policy ("Policy") is issued by xp786 ("xp786", "we", "us", or "our") and applies to all personal data processed in connection with the xp786 online casino and sportsbook platform accessible at xp786.bid and associated subdomains (the "Platform").
xp786 is committed to protecting the privacy and personal data of everyone who registers on and uses the Platform, including players in Pakistan — in Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, Multan, and beyond — as well as international users. This Policy explains in plain terms what data xp786 collects about you, why it is collected, how it is used, how it is protected, and what rights you have over it.
This Policy should be read alongside the xp786 Terms & Conditions, which contain additional provisions governing your use of the Platform.
For the purposes of applicable data protection law, xp786 acts as the data controller in respect of personal data collected from players through the Platform. This means xp786 determines the purposes for which and the means by which your personal data is processed.
xp786 is operated by an internationally licensed gaming operator. The operating entity details are available to verified account holders upon a written request submitted to the xp786 Data Protection contact address set out in Section 16 of this Policy.
Where xp786 engages third-party service providers to process personal data on its behalf — such as KYC verification platforms, payment processors, or cloud hosting providers — those providers act as data processors under xp786's documented instructions and are contractually bound to process data only as directed by xp786 and to maintain appropriate security standards.
xp786 collects the following categories of personal data from registered players and Platform visitors:
xp786 collects personal data through the following channels and mechanisms:
You provide data directly to xp786 when you: register an account; complete KYC verification; make a deposit or request a withdrawal via JazzCash, EasyPaisa, or bank transfer; contact xp786 support; respond to a promotion; or update your account settings.
When you access and use the xp786 Platform, certain data is collected automatically through cookies, server logs, and similar technologies. This includes your IP address, device identifiers, session data, and navigation patterns within the Platform. See Section 8 for full details of xp786's cookie practices.
xp786 may receive personal data about you from the following third-party sources:
xp786 processes your personal data only where there is a valid legal basis for doing so. The table below sets out the primary purposes for which xp786 processes personal data and the corresponding legal basis:
| Processing Purpose | Legal Basis | Data Categories |
|---|---|---|
| Account creation & management | Performance of contract | Identity, contact, device |
| Age verification (21+ requirement) | Legal obligation; legitimate interest | Identity (DOB, CNIC/Passport) |
| KYC compliance | Legal obligation (AML regulations) | Identity, financial |
| Processing deposits & withdrawals | Performance of contract | Financial, identity |
| Providing gaming services | Performance of contract | Gaming activity, financial |
| Fraud detection & prevention | Legitimate interest; legal obligation | All categories |
| Responsible gaming management | Legal obligation; legitimate interest | Gaming activity, identity |
| Customer support | Performance of contract; legitimate interest | Communications, identity |
| Platform security | Legitimate interest; legal obligation | Technical, device |
| Marketing communications (opted-in players) | Consent | Contact, gaming activity |
| Regulatory reporting | Legal obligation | All categories as required |
xp786 does not sell your personal data. xp786 shares personal data only in the specific circumstances described below:
xp786 engages third-party service providers to assist in operating the Platform. These providers process personal data solely on xp786's documented instructions and are subject to contractual data processing agreements. Categories of service providers include:
xp786 may disclose personal data to regulatory authorities, gaming license supervisory bodies, financial intelligence units, tax authorities, or law enforcement agencies where required to do so by applicable law, court order, or regulatory direction. xp786 will, where legally permissible, notify affected players of such disclosures.
In the event of a merger, acquisition, restructuring, or sale of xp786's business or assets, personal data held by xp786 may be transferred to the acquiring entity as part of that transaction, subject to the acquiring entity providing equivalent data protection commitments. xp786 will notify affected players of any material change in data controllership via email or prominent Platform notice.
As an internationally licensed gaming operator, xp786 is subject to Know Your Customer ("KYC") and Anti-Money Laundering ("AML") obligations that require the collection, verification, and retention of specific personal data from all registered players.
Before accessing real-money gaming features or processing any withdrawal, all xp786 players are required to submit and pass KYC verification. For Pakistani players, accepted documents include:
KYC documents submitted to xp786 are transmitted via TLS-encrypted connection and stored using AES-256 encryption. Access to KYC documents is restricted to authorised xp786 compliance personnel and our approved KYC verification platform. KYC documents are never shared with marketing partners or used for any purpose other than identity verification and AML compliance.
xp786's licensing obligations require the retention of KYC documents and transaction records for a minimum period of five (5) years from the date of the last transaction on an account, or longer where required by specific regulatory direction. This retention obligation applies even where a player has requested account closure or data erasure during the retention period.
xp786 uses the following categories of cookies and similar technologies on the Platform:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Session management, login authentication, security tokens, CSRF protection. Required for Platform to function. | No — essential |
| Functional | Remembering your preferred language, currency display (PKR), odds format, game lobby filters, and "Remember Me" login state. | Yes (with reduced functionality) |
| Analytics | Aggregate, anonymised Platform usage data — which sections are visited, page load performance, error tracking. Used to improve xp786 for Pakistani mobile users. | Yes via cookie preferences |
| Marketing | Tracking xp786 marketing campaign effectiveness (for opted-in players only). No third-party advertising network cookies are deployed. | Yes — opt-out available |
You can manage cookie preferences through the xp786 cookie preference centre, accessible from the footer of the Platform. You may also control cookies through your browser settings — note that disabling strictly necessary cookies will impair your ability to use the xp786 Platform. xp786 does not deploy third-party advertising network cookies or cross-site tracking pixels.
xp786 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to legal and regulatory minimum retention requirements. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & identity data | Duration of account + 5 years post-closure | AML legal obligation |
| KYC documents | 5 years from last transaction | Licensing / AML requirement |
| Transaction records | 5 years minimum | Financial regulation |
| Gaming activity logs | 3 years from account closure | Licensing obligation; dispute resolution |
| Support communications | 3 years from last interaction | Legitimate interest; dispute resolution |
| Marketing consent records | Until withdrawal of consent + 1 year | GDPR-aligned best practice |
| Technical / server logs | 90 days rolling | Security; fraud detection |
| Analytics data (anonymised) | 26 months rolling | Legitimate interest; Platform improvement |
Upon expiry of the applicable retention period, xp786 will securely delete or irreversibly anonymise the relevant data.
xp786 implements a comprehensive information security programme to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:
xp786 is operated by an internationally licensed operator and may transfer personal data to countries outside your country of residence for the purposes described in this Policy. Where personal data is transferred internationally, xp786 ensures that appropriate safeguards are in place in accordance with applicable data protection law, including:
Specific service providers that may receive xp786 player data in their own jurisdictions — such as cloud hosting providers, KYC platform operators, and game software providers — are individually assessed for data protection adequacy and are bound by data processing agreements before any personal data is transferred to them.
Subject to applicable law and xp786's legal retention obligations, all registered xp786 players have the following rights in respect of their personal data:
Request a copy of the personal data xp786 holds about you (Subject Access Request / SAR).
Request correction of inaccurate or incomplete personal data in your xp786 account.
Request deletion of your personal data where it is no longer necessary — subject to AML retention requirements.
Request restriction of processing of your personal data in certain circumstances, such as during a dispute.
Receive your personal data in a structured, machine-readable format for transfer to another controller.
Object to processing of your data for direct marketing purposes or where xp786 relies on legitimate interest as the basis.
To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request" and include your registered email address and a brief description of the right you wish to exercise. xp786 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days, extendable to 60 days for complex requests with prior notification.
xp786 may be unable to fully satisfy an erasure or portability request where data must be retained to comply with AML, licensing, or other legal obligations. In such cases, xp786 will explain which data must be retained and why.
The xp786 Platform is strictly restricted to individuals who are 21 years of age or older. xp786 does not knowingly collect personal data from individuals under 21. All registering players are required to complete age verification using a Pakistani CNIC or Passport before accessing any real-money features of the Platform.
If xp786 becomes aware that personal data has been collected from a person under 21 years of age — whether through failed KYC, a report from a third party, or any other mechanism — xp786 will immediately:
xp786 sends marketing communications — including promotional offers, bonus announcements, tournament alerts, and platform updates — only to players who have affirmatively opted in to receive such communications at the point of registration or via their xp786 account settings.
You can withdraw your consent to marketing communications at any time by:
Opt-out requests for marketing communications are processed within 10 business days. You may continue to receive transactional communications (account statements, withdrawal confirmations, security alerts, and required regulatory notices) even after opting out of marketing.
xp786 does not send promotional gambling marketing to players who have active responsible gaming limits, cooling-off periods, or self-exclusion arrangements in place. Such players are automatically suppressed from marketing lists for the duration of their active restrictions.
xp786 reviews this Privacy Policy periodically and may update it to reflect changes in data processing practices, regulatory requirements, or Platform features. When material changes are made to this Policy, xp786 will:
Your continued use of the xp786 Platform after the effective date of a revised Policy constitutes your acceptance of the revised Policy. If you do not accept a revised Policy, you should cease using the Platform and request account closure as described in the xp786 Terms & Conditions.
For any questions, concerns, or rights requests relating to this Privacy Policy or the processing of your personal data by xp786, please contact:
xp786 Data Protection
Email: [email protected]
Subject line: "Privacy Policy Enquiry" or "Data Rights Request"
Response time: Acknowledgement within 5 business days; substantive response within 30 calendar days.
For non-sensitive data enquiries, you may also reach xp786's support team via live chat inside your xp786 account — available 24 hours a day, 7 days a week. The live chat team is familiar with the specific context of Pakistani players and can assist with account data questions, consent management, and directing formal data rights requests to the appropriate xp786 team.
If you are not satisfied with xp786's response to a privacy complaint, you may escalate the matter to the relevant data protection supervisory authority or gaming regulatory authority under whose jurisdiction xp786 operates. Details of the applicable supervisory authority are available to verified account holders on written request.
The xp786 support team is available 24/7 via live chat inside your account. For formal data rights requests, email us at [email protected]. Your privacy matters to us — always.