xc999 Privacy Policy —
Your Data, Your Rights, Our Obligations

1 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or can reasonably be used to identify a living natural person, directly or in combination with other available data. This includes name, email address, CNIC number, date of birth, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — the legal entity that determines the purposes and means of processing Personal Data. For all data collected via xc999.biz, the Data Controller is xc999.
• "Data Processor" — a third party that processes Personal Data on behalf of xc999 under a contractual arrangement, such as a payment processing provider or cloud hosting service.
• "Consent" — freely given, specific, informed, and unambiguous indication by you of your agreement to the processing of your Personal Data for a specific purpose.
• "KYC" — Know Your Customer; the identity and age verification procedures required by xc999 under its gaming licence obligations.
• "Cookies" — small text files placed on your device by xc999.biz that store browsing preferences, session information, and analytics data.

2 Data Controller Information

xc999 is the Data Controller responsible for all Personal Data collected through the xc999.biz platform. As a Data Controller, xc999 is obligated to ensure that your Personal Data is processed lawfully, fairly, and transparently, collected for specified and legitimate purposes, limited to what is necessary, accurate and kept up to date, retained no longer than necessary, and secured against unauthorised access, loss, or destruction.

For all data protection enquiries, you may contact xc999 using the contact information provided in Section 16 of this Privacy Policy. xc999 takes its obligations as a Data Controller seriously and has implemented technical and organisational measures commensurate with the nature and volume of Personal Data it processes.

3 Categories of Personal Data We Collect

xc999 collects the following categories of Personal Data from its users:

3.1 Identity & Registration Data

• Full legal name as it appears on government-issued identification
• Date of birth (for age verification purposes)
• National Identity Card (CNIC) number or passport number
• Gender (where provided during registration)
• Profile username or display name chosen by the Player

3.2 Contact Data

• Email address (primary account identifier and communication channel)
• Mobile phone number (for JazzCash/EasyPaisa verification and optional two-factor authentication)
• Residential address (for KYC verification and anti-money laundering compliance)
• City or region within Pakistan (e.g., Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi)

3.3 Financial & Transaction Data

• JazzCash mobile wallet number used for deposits and withdrawals
• EasyPaisa mobile account details used for transactions
• Bank account details (HBL, UBL, Meezan Bank, MCB, or other Pakistani financial institutions) where bank transfer is used
• Visa or Mastercard details where card payment is used (stored by the payment processor, not by xc999 directly)
• Full transaction history including deposit amounts, withdrawal requests, and game-by-game wagering records — all denominated in PKR
• Source-of-funds documentation provided in response to AML enquiries

3.4 Gaming Activity Data

• Game sessions, game types played, and time spent in each session
• Bet amounts, win/loss outcomes, and cumulative net gaming position
• Sports betting selections including cricket, PSL, football, and UFC markets
• Bonus and promotional participation history and wagering progress
• Responsible gaming tool settings, limit configurations, and self-exclusion status

3.5 Technical & Device Data

• IP address and approximate geolocation at time of login
• Device type, operating system, and browser version
• Unique device identifiers (where permitted)
• Session timestamps and login/logout records
• Pages visited and features accessed within the xc999 platform

3.6 Communications Data

• Content of live chat support conversations with the xc999 customer service team
• Email correspondence sent to or received from xc999
• Records of responsible gaming requests and self-exclusion applications

4 How We Collect Your Personal Data

xc999 collects Personal Data through the following means:

• Direct Provision: Data you enter during account registration, KYC verification, deposit and withdrawal requests, and when contacting xc999 customer support
• Automated Collection: Technical and device data collected automatically when you access xc999.biz, including via cookies, session tokens, and server logs
• Third-Party Verification: Identity and age verification data received from KYC verification service providers engaged by xc999 as Data Processors
• Payment Processors: Transaction confirmation data received from JazzCash, EasyPaisa, Raast, 1LINK, and banking partners confirming deposit and withdrawal completion
• Fraud Prevention Services: Risk signals and device fingerprint data received from fraud detection service providers that xc999 uses to protect the platform and its users

5 Purposes of Processing & Legal Basis

xc999 processes your Personal Data for the following specific purposes, each resting on an identified legal basis:

6 Data Sharing & Disclosure

xc999 does not sell, rent, or trade your Personal Data to unaffiliated third parties. Your data may be shared in the following strictly limited circumstances:

6.1 Data Processors

xc999 engages third-party service providers who process Personal Data on our behalf as Data Processors, under binding data processing agreements that require them to protect your data and use it only for the purposes specified by xc999. These include:

• Payment Processors: JazzCash, EasyPaisa, Raast, 1LINK, and banking partners receive only the data necessary to process your specific PKR transaction
• KYC Verification Providers: Identity verification service providers who process CNIC and biometric data for age and identity confirmation
• Cloud Hosting Providers: Infrastructure providers who store xc999 platform data on secure servers with appropriate access controls
• Fraud Prevention Services: Services that analyse technical and behavioural signals to detect and prevent fraudulent activity on the xc999 platform
• Game Providers: Third-party studios whose certified games are hosted on xc999 may receive anonymised session data necessary for game performance and RNG audit purposes

6.2 Regulatory & Legal Disclosure

xc999 may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where such disclosure is required by law, court order, or our obligations under the terms of our international gaming licence. xc999 will, where legally permitted to do so, notify affected users of such disclosures.

6.3 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of xc999's assets, Personal Data held by xc999 may be transferred to the acquiring entity. You will be notified of any such transfer and any material change to this Privacy Policy that results from it, with reasonable advance notice.

7 International Data Transfers

xc999 operates as an internationally licensed platform and may store or process Personal Data on servers located outside of Pakistan. Where Personal Data is transferred to a country that does not offer data protection standards equivalent to internationally recognised frameworks, xc999 implements appropriate safeguards including contractual data protection clauses (equivalent to Standard Contractual Clauses) with all Data Processors in such jurisdictions.

By using the xc999 platform, you acknowledge that your Personal Data may be transferred, stored, and processed in countries outside of Pakistan as described in this section, in compliance with the safeguards described above. xc999 will not transfer your data internationally in a manner inconsistent with your rights under this Privacy Policy.

8 Data Retention

xc999 retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active xc999 account plus a minimum of 5 years following account closure, in compliance with gaming licence audit requirements
• Financial and Transaction Data: Retained for a minimum of 7 years in compliance with anti-money laundering (AML) legal obligations applicable under xc999's gaming licence
• Gaming Activity Logs: Retained for 5 years from the date of each gaming session for gaming licence compliance, responsible gaming monitoring, and dispute resolution purposes
• Customer Support Records: Retained for 3 years from the date of last communication in that support thread
• Technical and Device Data: Session logs retained for 90 days; aggregated anonymised analytics data may be retained indefinitely
• Marketing Consent Records: Retained for the duration of your consent plus 3 years following withdrawal, to evidence the lawful basis for any communications sent

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with xc999's data destruction procedures. Where deletion is not immediately possible due to backup cycle considerations, data is isolated from active processing pending secure deletion.

9 Cookies & Tracking Technologies

9.1 Types of Cookies Used

xc999.biz uses the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Essential for the operation of the xc999 platform — these include session authentication tokens, login state cookies, and security cookies that prevent cross-site request forgery. These cannot be disabled without significantly impairing xc999's functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how users interact with xc999.biz, including which pages are visited most frequently and how users navigate between sections. This data is used to improve platform performance and user experience.
• Functional Cookies: Store your platform preferences such as language settings, preferred game categories, and display configurations. These enhance your xc999 experience without being strictly required for the platform to operate.
• Fraud Prevention Cookies: Technical identifiers used by xc999's fraud detection systems to recognise returning devices, identify anomalous access patterns, and protect your account from unauthorised access.

9.2 Cookie Management

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the xc999 platform, including the ability to maintain your login session or remember your preferences between visits. Browser-level cookie controls are available in all major mobile browsers used by Pakistani players, including Chrome for Android, Firefox, and the Samsung Internet Browser.

10 Security Measures

xc999 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and xc999 servers is encrypted using industry-standard TLS 1.2 or higher. The presence of a valid SSL certificate is confirmed by the padlock indicator in your browser address bar.
• Encryption at Rest: Sensitive Personal Data stored on xc999 servers, including financial data and KYC documents, is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data within xc999 is restricted on a strict need-to-know basis. Staff access is role-based, logged, and subject to regular review. Administrative access requires multi-factor authentication.
• Penetration Testing: xc999 undergoes periodic third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Incident Response: xc999 maintains a data breach incident response procedure. In the event of a confirmed breach affecting your Personal Data, xc999 will notify affected users and relevant regulatory authorities within timeframes required by applicable law.

While xc999 implements these measures, no online platform can guarantee absolute security. You play an important role in protecting your own data — particularly by maintaining the confidentiality of your xc999 login credentials and using strong, unique passwords for your account.

11 Your Data Rights

As an individual whose Personal Data is processed by xc999, you hold the following rights. These rights may be subject to limitations where overriding legal obligations — such as AML record-keeping requirements — apply:

To exercise any of these rights, contact the xc999 data protection team at the address provided in Section 16. xc999 will verify your identity before processing any data rights request to protect against unauthorised requests. There is no charge for submitting a data rights request. xc999 will respond within 30 calendar days of receipt of a verified request.

12 Children's Privacy & Underage Access

xc999 employs active age verification procedures during registration, including CNIC-based KYC verification, to prevent underage access. These procedures apply to all users regardless of payment method or game type accessed on the platform.

13 Responsible Gaming & Personal Data

xc999 processes Gaming Activity Data for the specific purpose of operating its responsible gaming programme. This includes monitoring deposit patterns, session lengths, and net gaming positions to identify early indicators of problem gambling behaviour, and to power the personalised responsible gaming tools available in every xc999 account.

Where xc999 identifies a Player whose gaming patterns suggest potential gambling-related harm, xc999 may proactively contact that Player with responsible gaming resources, impose preventative limits, or in serious cases initiate a protective suspension of the account. This processing is based on both legal obligation (under our gaming licence's responsible gaming requirements) and our legitimate interest in protecting the wellbeing of our users.

Data relating to self-exclusion and responsible gaming tool usage is retained for the full duration of any self-exclusion period plus a further 5 years, to prevent circumvention of self-exclusion restrictions through new account registration attempts. For more information about xc999's responsible gaming tools and resources, please visit the Responsible Gaming page.

14 Third-Party Links & Embedded Content

The xc999 platform may contain references to third-party game providers whose software is embedded within the xc999 gaming environment. While xc999 only partners with certified and vetted providers, xc999 is not responsible for the privacy practices of these third-party studios with respect to any data they independently collect through their game software. xc999's contractual agreements with game providers require them to maintain appropriate data protection standards consistent with this Privacy Policy.

xc999.biz does not contain links to external websites in a manner that would cause you to leave the xc999 platform unexpectedly. In the event that any such links are present, xc999 does not control the privacy practices of those external sites and recommends that you review their privacy policies independently before providing any personal data.

15 Amendments to This Privacy Policy

xc999 reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, or xc999's data processing practices. Where amendments are material — meaning they substantively affect your rights or how your Personal Data is processed — xc999 will notify you in advance via your registered email address and will display a prominent notice on xc999.biz.

Non-material amendments (such as corrections to grammar, clarifications of existing practices, or changes to contact details) may be made without advance notice. The effective date displayed in the header of this Privacy Policy reflects the date of the most recent revision. xc999 recommends that Pakistani players review this page periodically to remain informed of the current policy.

Your continued use of the xc999 platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of and agreement to the revised policy. If you do not agree to any material amendment, you must cease using xc999 and may close your account by contacting the support team.

16 Contact, Complaints & Data Protection Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by xc999, you may contact us through the following channels:

• Live Chat: Available on xc999.biz during operational hours (10:00 AM – 2:00 AM PKT daily). Live chat is the fastest way to reach the xc999 support team for time-sensitive data protection matters.
• Email: [email protected] — for data rights requests, privacy complaints, or general data protection enquiries. Please include "Privacy" in your email subject line so that your message is routed to the appropriate team. Note: This is a plain text address — not a clickable link. Copy and paste it into your email client.

xc999 will acknowledge receipt of all written data protection enquiries within 5 business days and will endeavour to provide a full response within 30 calendar days. Where a request is complex or requires additional verification, xc999 will notify you of this within the initial 30-day period and provide a revised response timeline.

If you are unsatisfied with xc999's response to a privacy complaint, you may have the right to escalate your complaint to the data protection authority in your jurisdiction or to the regulatory body overseeing xc999's gaming licence. xc999 will provide guidance on the appropriate escalation route upon request.