xc666 Privacy Policy — Your Data, Your Rights

For the purposes of this Privacy Policy, xc666 is the data controller — meaning we are responsible for deciding how and why your personal data is processed. The xc666 platform is operated at xc666.biz and serves players primarily based in Pakistan.

As data controller, xc666 is responsible for ensuring that any personal data collected from you is handled lawfully, fairly, and transparently. We are also responsible for the data practices of the third-party processors we engage, to the extent that those processors handle data on our behalf and under our instructions.

If you have any questions about how xc666 handles your personal data, or wish to exercise any of your rights under this policy, the correct contact point is the xc666 Data Privacy team reachable through the support channels listed in Section 15 of this document.

xc666 collects only the information that is genuinely required to operate the platform, verify your identity, process your payments, and comply with applicable legal and regulatory obligations. Below is a full list of the categories of personal data we may hold about you:

Registration Data

• Full name as it appears on your national identity document (CNIC or Passport)
• Date of birth
• Pakistani mobile number used for account creation and OTP verification
• Email address (optional but recommended for account recovery)
• Chosen username and encrypted password
• City and province of residence

Identity Verification (KYC) Data

• CNIC front and back image or Passport photo page
• Selfie photograph taken alongside your identity document
• Source of funds documentation where requested (e.g., bank statement)

Financial Data

• Easypaisa or JazzCash mobile wallet number linked to your account
• Bank account title and IBAN for IBFT withdrawals
• Masked card number (last 4 digits) for Visa/Mastercard transactions
• Transaction history: deposit amounts, dates, methods, and withdrawal records

Gameplay and Behavioural Data

• Betting history: bet amounts, selections, odds, markets, outcomes
• Casino game history: games played, stakes, session lengths, outcomes
• Login timestamps and session duration
• Bonus claims, wagering progress, and promotional participation

Device and Technical Data

• IP address at the time of registration and during sessions
• Device type, operating system version, and browser type
• Device identifiers (Android GAID or similar) if you access xc666 through a native app
• Cookie identifiers as described in Section 9

xc666 collects your personal data through the following channels:

• Directly from you: When you fill in the registration form, complete KYC verification, contact support, or update your account profile settings.
• Automatically during use: When you log in, place bets, play games, or navigate the xc666 platform — device data, IP addresses, and session data are captured automatically by our servers and analytics systems.
• From payment processors: When you make a deposit or withdrawal, our payment partners (Easypaisa, JazzCash, bank processing networks) confirm transaction status and reference data to xc666 so that your wallet can be credited or debited correctly.
• From KYC verification partners: If xc666 uses a third-party identity verification service to process your KYC documents, that service will share the verification result (pass/fail) and document metadata with xc666. The raw document images are handled by the verification partner in line with their own privacy standards.
• Through cookies and tracking technologies: As described in Section 9 of this policy, xc666 uses cookies and similar technologies to maintain your session, remember preferences, and gather aggregate analytics data.

xc666 uses the data it collects for the following specific purposes. Each purpose is matched to a legal basis in Section 5:

xc666 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you, except as part of fraud detection systems where an automated risk flag will always be reviewed by a human member of the xc666 compliance team before any account action is taken.

xc666 processes your personal data under one or more of the following legal bases:

• Contract performance: Processing your registration data, payment information, and transaction history is necessary to provide the xc666 service you signed up for. Without this data, we cannot operate your account, credit winnings, or process withdrawals.
• Legal obligation: Identity verification, anti-money laundering checks, and transaction record keeping are required by applicable laws and regulations. xc666 must collect and retain this data regardless of your preferences.
• Legitimate interest: Fraud detection, platform security, abuse prevention, and aggregate analytics serve the legitimate interests of xc666 and the broader player community — without being overridden by your privacy interests, provided we use only the minimum data necessary.
• Consent: Marketing communications — promotional SMS messages, email newsletters, and push notifications — are only sent to you if you have actively opted in. You can withdraw this consent at any time through your account settings or by contacting support.

xc666 shares personal data only where necessary and only with the categories of recipients described below. We do not sell your data. We do not share it with advertisers or marketing companies. We do not provide bulk data exports to any commercial third party.

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank networks, and card scheme processors receive transaction-specific data (amount, reference number, account identifier) to complete deposits and withdrawals. These processors are bound by their own regulatory obligations and privacy standards.
• KYC and identity verification partners: If xc666 uses a third-party service to process your CNIC or passport documents, that service receives your identity documents solely for verification purposes. They are contractually prohibited from using your documents for any other purpose.
• Fraud prevention services: xc666 may share device fingerprints, IP addresses, and account behavioural data with specialist fraud prevention tools to protect the platform against multi-accounting, bonus abuse, and financial fraud.
• Regulatory and law enforcement bodies: xc666 will disclose personal data to government or regulatory authorities when required to do so by law, court order, or regulatory directive. We will notify you of any such disclosure where legally permitted to do so.
• Sports integrity organisations: If a betting pattern on your account is flagged as potentially related to match fixing, xc666 may share relevant betting data with recognised sports integrity bodies. This disclosure is a legal and ethical obligation.

xc666 retains personal data only for as long as is necessary for the purpose it was collected, or as required by applicable law. The following retention schedule applies:

When data reaches the end of its retention period, xc666 permanently deletes it from active systems and ensures it is purged from backup systems within 90 days. Data deletion requests from players are handled subject to any mandatory legal retention obligations that override the deletion right.

xc666 takes data security seriously and has implemented technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. The key security measures in place include:

• TLS encryption in transit: All data exchanged between your browser or app and the xc666 servers is encrypted using TLS 1.2 or higher. This prevents interception of data during transmission over your mobile network or Wi-Fi connection.
• Encryption at rest: Sensitive personal data fields stored in the xc666 database — including CNIC numbers, mobile numbers, and financial identifiers — are encrypted at rest. Even if a database were somehow accessed without authorisation, encrypted fields cannot be read without the encryption keys, which are stored separately with restricted access.
• Access controls: Internal xc666 staff access to personal data is restricted on a strict need-to-know basis. Customer support agents can see the information necessary to resolve your query but cannot access payment credentials or raw KYC images. Database access is logged and monitored.
• Two-factor authentication for staff: All xc666 internal staff who access player data systems are required to authenticate with two-factor authentication. There are no exceptions to this policy.
• Regular security reviews: xc666 conducts periodic reviews of platform security including vulnerability assessments. Critical vulnerabilities are patched on an emergency basis; routine patches are applied monthly.

Despite these measures, no system can guarantee absolute security. In the event of a data breach that affects your personal information, xc666 will notify you as soon as practicably possible and explain the nature of the breach and the steps being taken to address it.

xc666 uses cookies — small text files stored on your device — and similar technologies to maintain your login session, remember your preferences, and gather aggregate data about how players use the platform. The cookies we use fall into three categories:

xc666 does not use third-party advertising cookies or tracking pixels designed to serve targeted advertisements to you on other websites. The analytics tools we use receive only aggregated, anonymised data — individual player identifiers are not shared with analytics services.

You can manage cookie preferences through your browser settings. Blocking essential cookies will prevent you from staying logged in on xc666. Blocking analytics and preference cookies will not affect your ability to play but may mean some preferences are not saved between sessions.

As a registered xc666 player, you have the following rights in relation to your personal data. To exercise any of these rights, contact the xc666 Data Privacy team using the details in Section 15. We will respond to all requests within 30 days.

xc666 is strictly an adult platform for players aged 18 and above. We do not knowingly collect, store, or process personal data from anyone under 18 years of age. If a player misrepresents their age during registration and subsequently fails age verification, their account will be closed and any deposits returned through the original payment method. Any bonus funds or winnings in such an account are forfeited.

If you believe that xc666 has inadvertently collected data from a minor, please contact our support team immediately. We will investigate and take prompt corrective action including permanent deletion of any data relating to underage individuals.

xc666 may send you promotional communications about bonuses, new games, PSL promotions, and other xc666 offers. We only send these communications if you have opted in during registration or through your account settings. We will never send unsolicited marketing messages.

The channels through which xc666 may send marketing communications (subject to your consent) include:

• SMS messages to your registered Pakistani mobile number
• Email messages if you have provided an email address
• Push notifications through the xc666 app if you have enabled them
• WhatsApp messages to your registered number if you have opted in to WhatsApp communications

To stop receiving marketing communications from xc666, you can: toggle marketing preferences off in your account settings, reply STOP to any SMS, unsubscribe through the link in any marketing email, or contact xc666 support directly. Opting out of marketing will not affect transactional messages (e.g., deposit confirmations, withdrawal notifications, or account security alerts).

The xc666 platform may contain links to third-party services — for example, payment gateway interfaces or support platform tools. Once you leave the xc666 platform and interact with a third-party service directly, that service's own privacy policy governs the handling of your data. xc666 is not responsible for the privacy practices of third-party services.

When xc666 redirects you to a payment gateway (such as an Easypaisa confirmation screen), you are interacting directly with that payment provider's secure interface. Any data you enter there is collected and processed by that provider under their own privacy terms, not by xc666.

xc666 takes care to select third-party partners whose privacy and security practices meet appropriate standards, but we cannot guarantee or take responsibility for their policies beyond our contracted obligations with them.

xc666 may update this Privacy Policy from time to time to reflect changes in the platform, new legal requirements, or updated data practices. When material changes are made — changes that affect what data we collect, how we use it, or your rights — we will notify all active xc666 account holders by SMS or in-app notification at least 7 days before the changes take effect.

The date at the top of this page reflects the most recent update. We recommend reviewing this Privacy Policy periodically. Continued use of the xc666 platform after an updated Privacy Policy has taken effect constitutes acceptance of the revised terms.

For minor clarificatory changes that do not affect the substance of the policy (e.g., correcting a typo, improving the clarity of a paragraph), we may update the document without separate notification, but the updated date will always be changed to reflect when edits were made.

If you have any questions about this Privacy Policy, want to exercise one of the rights described in Section 10, or need to report a concern about how xc666 is handling your personal data, please get in touch using any of the channels below. All privacy-related queries are handled by the xc666 Data Privacy team and will be responded to within 30 days of receipt.

• Email: support@xc666.biz — mark the subject line "Privacy Request" to ensure it is routed to the correct team.
• Live Chat: Available on every page of the xc666 platform, 24 hours a day. Ask to be escalated to the Data Privacy team for any formal rights request.
• WhatsApp: Via the number listed in your account settings. Provide your registered mobile number and a brief description of your query.

When submitting a data request, please include your registered xc666 mobile number so that we can verify your identity before processing the request. We may ask for additional verification for sensitive requests such as data deletion or full data access exports.