Privacy Policy
— How xp78 Handles Your Data

xp78 ("xp78", "we", "us", "our") operates the online betting and live casino information platform accessible at xp78.cam (the "Platform"). We are committed to protecting the privacy and personal data of all users who interact with our Platform, whether by browsing content, registering an account, placing a wager or contacting our support team.

This Privacy Policy ("Policy") sets out how xp78 collects, processes, stores and protects personal data in connection with your use of the Platform. It also describes your rights in relation to that data and how to exercise them. This Policy forms part of, and should be read alongside, our Terms & Conditions.

By accessing or using the xp78 Platform, you acknowledge that you have read and understood this Policy. If you do not accept the terms of this Policy, please discontinue use of the Platform immediately.

The following terms are used throughout this Privacy Policy with the meanings set out below:

• Personal Data — any information that identifies or can identify a living individual, directly or indirectly, including name, email address, device identifiers and financial transaction data.
• Processing — any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction.
• Data Controller — the entity that determines the purposes and means of processing personal data. xp78 acts as the data controller for data collected directly through the Platform.
• Data Processor — a third party that processes personal data on behalf of xp78, under its instructions and subject to appropriate data protection agreements.
• User — any individual who accesses, registers on, or otherwise uses the xp78 Platform.
• KYC — Know Your Customer, the identity and age verification process required under anti-money laundering (AML) obligations and operator policy.
• Cookies — small text files placed on a user's device by a website for the purpose of session management, analytics, personalisation or advertising.
• Consent — a freely given, specific, informed and unambiguous indication of a user's agreement to the processing of their personal data for a stated purpose.

xp78 collects personal data through several channels: directly from you when you register or interact with the Platform; automatically through your use of the Platform (device and usage data); and from third-party sources where necessary for compliance or service delivery.

xp78 processes personal data on the following legal bases, consistent with internationally recognised data protection principles:

• Contractual Necessity — processing required to fulfil our obligations under the Terms & Conditions you have accepted, including account management, bet processing, cashier operations and KYC verification.
• Legal Obligation — processing required to comply with applicable anti-money laundering (AML) laws, regulatory requirements and lawful orders from competent authorities.
• Legitimate Interests — processing that is necessary for our legitimate business interests, including fraud detection, security monitoring, Platform analytics and improvement of services, provided those interests are not overridden by your privacy rights.
• Consent — processing based on your explicit agreement, including receipt of optional marketing communications. You may withdraw consent at any time without affecting prior processing.

xp78 uses collected personal data for the following purposes:

5.1 Account Management & Service Delivery

• Creating and maintaining your user account.
• Processing deposits and withdrawals in PKR and other supported currencies.
• Verifying your identity and age through KYC procedures.
• Providing access to betting markets, live casino products and slots.
• Communicating with you regarding your account, transactions and any support queries.

5.2 Legal & Regulatory Compliance

• Fulfilling anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
• Maintaining records required by our licensing authority.
• Responding to lawful requests from competent regulatory or law enforcement authorities.
• Enforcing our Terms & Conditions and detecting policy violations.

5.3 Security & Fraud Prevention

• Detecting, investigating and preventing fraudulent transactions, multi-accounting and bonus abuse.
• Monitoring unusual account activity that may indicate security compromise.
• Protecting the integrity of sports betting markets and casino game outcomes.

5.4 Platform Improvement

• Analysing usage patterns to improve Platform performance, navigation and content relevance.
• Testing new features and game categories based on aggregate usage data.
• Optimising the mobile experience for Pakistani users, the majority of whom access the Platform via smartphone.

5.5 Responsible Gambling

• Monitoring betting patterns to identify potential problem gambling behaviour.
• Enforcing deposit limits, loss limits and self-exclusion requests set by users.
• Contacting users proactively where responsible gambling concerns are identified.

xp78 does not sell your personal data to third parties for marketing or commercial purposes. Your data may be shared in the following limited circumstances:

• KYC & Identity Verification Partners — licensed third-party identity verification services that process your KYC documents on our behalf, under strict data processing agreements and applicable data protection standards.
• Payment Processors — financial service providers that facilitate deposit and withdrawal transactions. References to Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah on this Platform are for local context only and do not confirm active integrations or data-sharing arrangements with those specific providers.
• Technology & Hosting Partners — cloud hosting, content delivery and analytics service providers that process data in the course of delivering Platform infrastructure and analytics.
• Regulatory Authorities — xp78's licensing authority and, where legally required, competent law enforcement or regulatory bodies that issue lawful data requests.
• Corporate Transactions — in the event of a merger, acquisition, sale of assets or other corporate restructuring, personal data may be transferred to a successor entity subject to equivalent privacy protections.

All third parties with whom personal data is shared are required to maintain appropriate technical and organisational measures to protect that data and to process it only for the purposes for which it was shared.

xp78 is an international platform and your personal data may be processed in countries outside of Pakistan, including countries where xp78 operates its servers or where its service providers are located. Some of those countries may not offer the same level of statutory data protection as Pakistan.

Where personal data is transferred internationally, xp78 takes reasonable steps to ensure appropriate safeguards are in place, which may include contractual clauses requiring the recipient to apply data protection standards consistent with those described in this Policy. By using the Platform, you acknowledge and consent to the transfer of your personal data to such jurisdictions.

xp78 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory and licensing obligations. The following general retention principles apply:

• Active Account Data — retained for the duration of your account and for a minimum period thereafter as required by our licensing authority's record-keeping requirements.
• KYC & Identity Documents — retained for a minimum of five (5) years from the date of account closure or last transaction, in compliance with AML regulations.
• Financial Transaction Records — retained for a minimum of five (5) years to satisfy audit and regulatory requirements.
• Communications & Support Records — retained for a reasonable period to facilitate complaint resolution, dispute management and regulatory review.
• Marketing Preferences — retained until you withdraw consent, after which marketing communications will be ceased and preferences updated accordingly.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

The xp78 Platform uses cookies and similar tracking technologies to support session management, analytics and service personalisation. By continuing to use the Platform, you consent to the use of cookies in accordance with this section.

You may manage cookie preferences through your browser settings. Note that disabling essential cookies may prevent the Platform from functioning correctly. Browser-level cookie controls vary — consult your browser's help documentation for instructions.

xp78 implements technical and organisational security measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your browser and the Platform.
• Encrypted storage of sensitive personal and financial data at rest.
• Access controls limiting internal access to personal data on a strict need-to-know basis.
• Regular security assessments and penetration testing of Platform infrastructure.
• Secure document upload protocols for KYC submissions — never via unencrypted email or unverified third-party links.
• Incident response procedures for detecting, containing and notifying affected users in the event of a data breach.

Subject to applicable laws and our regulatory obligations, you have the following rights in relation to your personal data held by xp78. To exercise any of these rights, please contact us as described in Section 15.

xp78 will respond to verified data rights requests within a reasonable timeframe, typically within 30 days of receipt. We may need to verify your identity before processing a request. Some rights may be limited where we are required to retain data for legal or regulatory compliance purposes — we will explain any such limitation clearly.

The xp78 Platform is strictly intended for adults aged 18 years and above, or the higher minimum age required by the operator's license jurisdiction. We do not knowingly collect, process or retain personal data belonging to individuals below the minimum age threshold.

As part of our KYC process, xp78 verifies the age of all registered users using identity documents. Where an underage user is identified — whether through KYC verification, parental notification or other means — their account will be closed immediately and any funds deposited will be returned, subject to the operator's underage account closure procedures.

The xp78 Platform may contain references to third-party services including payment method names (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah) provided as familiar local context for Pakistani users. These references do not constitute active integrations, endorsements or data-sharing arrangements unless expressly stated.

Where the Platform integrates with third-party game providers, payment processors or analytics services, those third parties operate under their own privacy policies. xp78 is not responsible for the privacy practices of third parties. We encourage users to review the privacy policies of any third-party service they interact with in connection with Platform use.

xp78 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements or Platform features. When material changes are made, we will update the "Last Updated" date at the top of this page. Where required by applicable data protection standards or our licensing obligations, we will provide advance notice of significant changes through Platform notifications or by email to your registered address.

Your continued use of the Platform after any revised Policy has been published constitutes your acceptance of the updated terms. If you do not agree with a revised Policy, you must cease use of the Platform and may request account closure per Section 13.2 of our Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how xp78 handles your personal data, please contact our Data Protection team using the details below. All communications must be in English.

When submitting a data rights request, please include your registered email address, a description of the specific right you wish to exercise and, where applicable, the data categories to which your request relates. xp78 may need to verify your identity before acting on any request.