Privacy Policy

This Privacy Policy ("Policy") sets out the data practices of xs666 ("xs666", "we", "us", "our") with respect to the personal information of individuals ("User", "you", "your") who access or use the xs666 online gaming platform at xs666.cam and any associated mobile-optimised interfaces or services (collectively, the "Platform").

xs666 takes privacy seriously. We collect only the data that is necessary to operate the Platform safely, comply with our legal and regulatory obligations, and provide you with a secure and personalised gaming experience. We do not sell your personal data to third parties for their own commercial purposes.

By creating an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy. If you do not agree to any part of it, please discontinue use of the Platform and contact our support team to request account closure.

Within this Policy, the following terms carry the meanings given below:

• "Personal Data" — any information that identifies, or could reasonably be used to identify, a living individual, directly or in combination with other data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. xs666 acts as Data Controller for the data it collects directly from Users.
• "Data Processor" — any third party that Processes Personal Data on behalf of xs666 under a contractual arrangement, such as a KYC verification provider or cloud hosting service.
• "KYC" — Know Your Customer — identity and age verification procedures required prior to unlocking full account functionality and withdrawal access.
• "Cookies" — small text files placed on your device by the Platform to store session information, preferences and usage data.
• "Sensitive Data" — a subset of Personal Data that merits enhanced protection, including government-issued ID numbers, payment card details, biometric data and data relating to criminal records or health.
• "Retention Period" — the defined duration for which xs666 stores a specific category of Personal Data before deletion or anonymisation.

xs666 collects Personal Data across several categories depending on the nature of your interaction with the Platform. The table below summarises the main categories of data we collect and their primary purpose:

xs666 does not collect Special Category data (such as health data, religious beliefs or political views) unless it is directly relevant to a responsible gambling self-exclusion request or a legal obligation, and only with your explicit consent where required.

xs666 collects Personal Data through the following channels:

4.1 Data You Provide Directly

• Account registration form (name, email, date of birth, country, password).
• KYC document uploads (identity documents, proof of address).
• Deposit and withdrawal requests entered through the cashier interface.
• Customer support interactions via live chat or email.
• Voluntary participation in surveys, promotions or feedback forms.

4.2 Data Collected Automatically

• Session and device data gathered when you connect to the Platform, including IP address, device fingerprint, browser type and operating system version.
• Gameplay and betting activity logged by the Platform's back-end systems for audit, compliance and responsible gambling monitoring purposes.
• Cookie and tracking-pixel data as described in Section 8 of this Policy.

4.3 Data From Third Parties

• Identity verification results provided by KYC/AML service partners following document verification.
• Fraud and risk scores returned by third-party fraud-prevention systems.
• Payment confirmation data returned by payment processors (transaction reference, status and amount — xs666 does not store full card numbers).

xs666 Processes your Personal Data only where a valid legal basis exists. The primary legal bases on which we rely are:

• Contractual Necessity: Processing required to perform the contract formed when you register an account and accept the Terms & Conditions — for example, processing deposits, settling bets and managing your account.
• Legal Obligation: Processing required to comply with applicable law, including KYC verification, anti-money-laundering record-keeping, fraud reporting obligations and regulatory audit requirements.
• Legitimate Interests: Processing necessary for xs666's legitimate business interests where those interests are not overridden by your rights — for example, platform security monitoring, fraud detection, responsible gambling surveillance and service improvement analytics.
• Consent: Processing based on your freely given, specific and informed consent — primarily for direct marketing communications. You may withdraw consent at any time by updating your communication preferences in the Account dashboard or by contacting support.

xs666 uses your Personal Data for the following purposes:

• Account Management: Creating, maintaining and securing your account; processing logins; enabling password resets and two-factor authentication.
• Identity & Age Verification: Confirming that you meet the 18+ age requirement (or higher minimum where required by the applicable operator/license jurisdiction) and verifying your identity against submitted documents.
• Payment Processing: Facilitating deposits and withdrawals; reconciling transactions; detecting and preventing payment fraud.
• Regulatory Compliance: Meeting AML, KYC and other legal reporting obligations; maintaining transaction records for the retention periods required by applicable law.
• Platform Security: Detecting and investigating fraud, collusion, money laundering, bonus abuse and other prohibited activity; IP and device monitoring.
• Responsible Gambling: Monitoring gameplay patterns for signs of problem gambling behaviour; enforcing player-set deposit limits, loss limits and session limits; processing self-exclusion requests.
• Customer Support: Resolving account queries, payment disputes, technical issues and formal complaints.
• Service Improvement: Analysing aggregated usage data to identify performance issues, improve platform navigation and develop new features suited to Pakistani players.
• Marketing (where consented): Sending promotional offers, bonus notifications and news about new game releases — including coverage of Pakistan cricket, PSL T20 and ICC tournament markets — to users who have opted in to receive marketing communications.

xs666 does not sell, rent or trade your Personal Data to third parties for their own commercial use. We share data only in the limited circumstances described below:

7.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers to process data on our behalf under contractual data-processing agreements. These include:

• KYC and identity verification providers;
• Payment processors and fraud-prevention platforms;
• Cloud infrastructure and hosting providers;
• Customer support software providers;
• Analytics and performance-monitoring tools (using anonymised or aggregated data where possible).

All Data Processors are contractually prohibited from using your data for any purpose beyond the specific service they provide to xs666.

7.2 Regulatory & Legal Disclosure

xs666 may disclose Personal Data to competent authorities, regulators or law enforcement bodies where required by applicable law, court order or regulatory instruction. xs666 will notify you of such disclosure where it is legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or part of xs666's business, User data may be transferred to the acquiring entity. You will be notified of any such transfer and any material changes to data-processing practices via the email address registered to your account.

The xs666 Platform uses cookies and similar tracking technologies to support platform functionality, maintain session security and understand how users navigate the site.

8.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without breaking core platform features.
• Functional Cookies: Store your preferences such as language selection, odds format and interface layout so you do not need to reset them on each visit.
• Analytics Cookies: Collect anonymised data about page visits, session durations and error occurrences to help xs666 identify and fix performance issues.
• Marketing Cookies (where consented): Used to track interactions with promotional content and attribute conversions. Only deployed where you have given explicit consent.

8.2 Managing Cookies

You can manage or disable non-essential cookies through the cookie-preference panel accessible via the Platform's footer. You may also configure your browser to refuse or delete cookies, though doing so may impair certain Platform features. Note that strictly necessary cookies cannot be disabled through the preference panel as they are required for the secure operation of the Platform.

xs666 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal, regulatory or audit obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following permanent account closure, to satisfy AML record-keeping requirements.
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of each transaction, in line with financial compliance standards.
• KYC Documents: Retained for the period required by the applicable regulatory framework governing the operator's licence — typically five (5) years after the end of the business relationship.
• Customer Support Records: Retained for three (3) years following resolution of a support interaction, to support dispute resolution and quality assurance processes.
• Marketing Data: Retained until you withdraw consent or unsubscribe from marketing communications, after which it is suppressed or deleted within thirty (30) days.
• Technical & Log Data: Retained for up to twelve (12) months for security monitoring purposes, then routinely purged or anonymised.

Following the expiry of a retention period, data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for aggregate statistical analysis without identifying individuals.

xs666 implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, alteration, disclosure or destruction. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest within our databases;
• Role-based access controls limiting staff access to Personal Data on a strict need-to-know basis;
• Regular security audits and vulnerability assessments conducted by qualified security professionals;
• Two-factor authentication available for all user accounts;
• Formal data breach response procedures including notification protocols where applicable.

Subject to applicable law and the specific circumstances of your request, you hold the following rights in relation to your Personal Data held by xs666:

• Right of Access: You may request a copy of the Personal Data xs666 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. For minor updates (email address, phone number), this can often be done directly within the Account dashboard.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing and no overriding legitimate interest applies. Note that data subject to legal retention obligations (such as AML records) cannot be erased until the mandatory retention period expires.
• Right to Restrict Processing: You may request that xs666 restrict the processing of your data in certain circumstances — for example, while accuracy is contested or an objection is pending.
• Right to Data Portability: Where processing is based on contract or consent and is carried out by automated means, you may request that we provide your data in a structured, commonly used and machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes. Upon receipt of a valid objection to marketing, xs666 will cease marketing communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

The Platform may from time to time contain references to third-party services, software providers or payment platforms. xs666 does not control the privacy practices of third-party websites or applications and accepts no responsibility for their data-handling practices.

If you navigate away from xs666.cam to a third-party site — including the websites of payment services such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah — you do so subject to the privacy policy of that third party. These references are cited for contextual familiarity only and do not imply endorsement of or affiliation with those providers.

Age verification is conducted as part of the KYC process. If xs666 discovers that Personal Data has been collected from an individual below the minimum eligible age, that data will be permanently deleted and the associated account immediately closed. If you have reason to believe that a minor has registered on the Platform, please contact us immediately at [email protected].

xs666 reserves the right to update or revise this Privacy Policy at any time. When material changes are made — particularly changes that affect how your data is used or your rights in relation to it — xs666 will notify registered users by email to the address registered to their account and/or by a prominent notification within the Platform.

The "Last Updated" date at the top of this page reflects when the most recent revision was published. Continued use of the Platform following publication of a revised Policy constitutes acceptance of those changes. If you do not agree to a revised Policy, you must discontinue use and request account closure.

For non-material changes — such as typographical corrections, formatting updates or clarifications that do not alter the substance of our data practices — xs666 may update this page without proactive user notification.

For any questions, concerns or formal requests regarding this Privacy Policy or the Personal Data xs666 holds about you, please contact our support team through the channels below:

xs666 serves players across Pakistan — Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and beyond. Our support team understands Pakistan Standard Time and the local context of Pakistani players using the Platform.