xp78 Privacy Policy — How We Handle Your Personal Data 🔐

xp78 is committed to protecting the privacy and security of the personal information of all its users. This Policy sets out in plain and transparent terms exactly what data xp78 collects, why xp78 collects it, how xp78 uses and stores it, and what your rights are as a data subject. xp78 takes its privacy obligations seriously because Pakistani players trust the platform with sensitive personal and financial information, and that trust must be earned and maintained.

This Policy applies to all data processing activities carried out by xp78 in connection with the operation of the xp78 platform accessible at xp78.org. It covers personal data collected through the xp78 website, the xp78 mobile interface, email communications, live chat interactions, and any other channel through which xp78 interacts with its users.

xp78 acts as the data controller for personal information collected directly from users of the platform. Where xp78 engages third-party processors — such as payment service providers handling JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank transactions — those parties act as data processors under binding data processing agreements with xp78.

xp78 collects personal data that falls into the following categories:

2.1 Registration Data. When you create an xp78 account, we collect your full legal name as it appears on your Computerised National Identity Card (CNIC), your Pakistani mobile number, your date of birth, an email address, and the city of residence you provide during registration (for example, Karachi, Lahore, Islamabad, or Faisalabad).

2.2 Identity Verification Data. Prior to processing your first withdrawal, xp78 is required to verify your identity. This involves collection of a copy of your CNIC or other acceptable government-issued identification document. In some cases, xp78 may also request a selfie or short video for liveness verification purposes.

2.3 Financial Data. xp78 collects transactional data related to your deposits and withdrawals, including JazzCash wallet numbers, EasyPaisa wallet numbers, bank account details for HBL, UBL, and Meezan Bank transfers, USDT wallet addresses, and the transaction amounts and timestamps associated with each payment event on your xp78 account.

2.4 Gaming Activity Data. xp78 collects detailed records of your gaming and betting activity, including bets placed, games played, stakes, odds, outcomes, session durations, and responsible gaming tool settings where applicable.

2.5 Device and Technical Data. xp78 automatically collects technical data about the device and network you use to access the platform, including your IP address, device type, operating system version, browser type, screen resolution, and mobile network operator (such as Jazz, Telenor, Ufone, or Zong).

2.6 Communication Data. xp78 retains records of all communications between you and the xp78 support team, including live chat transcripts, email correspondence, and any other support-channel interactions.

xp78 collects personal data through the following channels:

• Direct submission: Data you enter into xp78 registration forms, verification upload tools, deposit and withdrawal request forms, and support contact channels.
• Automated collection: Data collected automatically when you access xp78.org or use the xp78 platform, including through server logs, session tracking, and device fingerprinting technologies.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT transaction broadcasts as part of the payment settlement process.
• Third-party verification services: Where xp78 uses a third-party identity verification provider to assist with CNIC validation or liveness checks, that provider may supply xp78 with a verification result and associated metadata.
• Cookies and tracking technologies: As described in Section 8 of this Policy, xp78 uses cookies and similar technologies to collect data about your browsing behaviour on xp78.org.

xp78 uses the personal data it collects for the following purposes:

4.1 Account Management. To create, maintain, and administer your xp78 user account, including processing your registration, verifying your identity, managing your PKR balance, and enabling you to place bets and play casino games on the platform.

4.2 Payment Processing. To process your deposits via JazzCash, EasyPaisa, and bank transfers, and to process withdrawal requests back to your registered payment accounts. xp78 uses your financial data exclusively for the purpose of executing transactions you have initiated.

4.3 Regulatory Compliance. To comply with applicable anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and other regulatory obligations applicable to the operation of the xp78 gaming platform under its compliance framework.

4.4 Responsible Gaming. To monitor gaming activity for patterns that may indicate problem gambling behaviour, and to enforce responsible gaming tools including deposit limits, session limits, cooling-off periods, and self-exclusion measures where applied by the user or required by xp78's responsible gaming policy.

4.5 Customer Support. To respond to your queries, investigate complaints, and provide technical assistance through the xp78 24/7 support channel.

4.6 Security and Fraud Prevention. To detect, investigate, and prevent fraudulent activity, unauthorised account access, multi-accounting, bonus abuse, and other conduct prohibited under the xp78 Terms & Conditions.

4.7 Platform Improvement. To analyse aggregated, anonymised usage data for the purpose of improving the xp78 platform, its cricket betting markets, casino game offering, and overall user experience.

4.8 Marketing Communications. Where you have opted in to receive promotional communications from xp78, we may use your contact details to send information about xp78 bonuses, promotions, and new product features. You may withdraw your marketing consent at any time by contacting xp78 support.

xp78 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to fulfil the service agreement between you and xp78, including account creation, bet settlement, and payment processing.
• Legal obligation: Processing required to comply with xp78's AML, KYC, and other regulatory compliance obligations.
• Legitimate interests: Processing carried out in xp78's legitimate interests, including fraud prevention, platform security, and service improvement, where those interests are not overridden by your rights.
• Consent: Processing based on your explicit consent, primarily for marketing communications. Consent-based processing may be withdrawn by you at any time without affecting the lawfulness of prior processing.

xp78 does not sell your personal data to third parties under any circumstances. xp78 may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

6.1 Payment Service Providers. JazzCash, EasyPaisa, SadaPay, HBL, UBL, Meezan Bank, and USDT processing infrastructure — for the sole purpose of executing deposit and withdrawal transactions initiated by you on the xp78 platform.

6.2 Identity Verification Partners. Third-party KYC and document verification services used to verify your CNIC and confirm your age and identity prior to processing withdrawals from your xp78 account.

6.3 Technology Service Providers. Cloud hosting, database management, customer support platform, and fraud detection tool providers who process data on xp78's behalf under contractual data processing agreements that restrict their use of the data to the services they provide to xp78.

6.4 Regulatory and Law Enforcement Authorities. Where xp78 is required by applicable law, court order, or lawful regulatory request to disclose user data, xp78 will comply with such requirements. xp78 will notify affected users where legally permitted to do so.

7.1 KYC Obligations. xp78 is required under its gaming compliance framework to implement Know Your Customer (KYC) procedures for all accounts. This means xp78 must collect and verify identity documents — primarily your Pakistani CNIC — before processing withdrawals and for accounts that meet certain deposit thresholds or activity profiles that trigger enhanced due diligence requirements.

7.2 AML Monitoring. xp78 applies transaction monitoring procedures to detect potential money laundering, structuring of deposits, and other financial crime red flags. Where unusual transaction patterns are detected in an xp78 account, xp78 may place the account under review, request source-of-funds documentation, suspend withdrawals, or report the activity to relevant authorities as required under applicable AML obligations.

7.3 Source of Funds. For large deposits or where xp78's risk assessment requires it, xp78 may request documentation evidencing that the funds deposited into your xp78 PKR account originate from a legitimate, lawful source. Failure to provide satisfactory source-of-funds documentation within the period specified by xp78 may result in withdrawal restrictions and account review.

xp78 uses cookies and similar tracking technologies on xp78.org to deliver and improve the platform. Cookies are small data files placed on your device when you visit a website. xp78 uses the following categories of cookies:

• Essential Cookies: Required for the xp78 platform to function, including session management, login state persistence, and security token handling. These cookies cannot be disabled without impairing core platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users navigate xp78.org — including pages visited, time spent, and features used — to help xp78 improve the platform. This data does not identify individual users.
• Functional Cookies: Used to remember your preferences on xp78, such as language settings, display preferences, and the last payment method used.
• Security Cookies: Used for fraud prevention and to detect unusual device or session activity that may indicate unauthorised access to your xp78 account.

You may configure your browser to refuse or delete cookies; however, disabling essential cookies will impair your ability to log in to and use the xp78 platform.

xp78 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, subject to applicable legal and regulatory retention obligations:

• Account data: Retained for the duration of your active xp78 account and for a minimum period of five (5) years following account closure, in compliance with applicable AML record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required for AML and financial record-keeping compliance.
• Identity verification documents: Retained for the duration of account activity and for no less than five (5) years following the final transaction on the account.
• Support communications: Retained for three (3) years from the date of the last communication, unless an ongoing dispute or investigation requires longer retention.
• Gaming activity logs: Retained for up to five (5) years to support responsible gaming monitoring, dispute resolution, and regulatory compliance.

Upon expiry of the applicable retention period, xp78 will securely delete or anonymise your personal data so that it can no longer be associated with your identity.

As a data subject, you hold the following rights in respect of your personal data held by xp78. To exercise any of these rights, contact xp78 support at the email address provided in Section 15:

10.1 Right of Access. You may request a copy of the personal data xp78 holds about you. xp78 will provide this information within thirty (30) days of receiving a verified request.

10.2 Right to Rectification. If any personal data xp78 holds about you is inaccurate or incomplete, you may request that it be corrected. For changes to identity-critical data such as your name or date of birth, xp78 may require supporting documentation.

10.3 Right to Erasure. You may request deletion of your personal data where xp78 no longer has a lawful basis for retaining it. xp78 may decline deletion requests where retention is required by applicable law, regulation, or for the resolution of outstanding disputes.

10.4 Right to Restriction. You may request that xp78 restrict processing of your data in certain circumstances, for example while the accuracy of data is being contested.

10.5 Right to Object. You may object to processing of your data carried out on the basis of xp78's legitimate interests. You may withdraw consent for marketing communications at any time.

10.6 Right to Data Portability. Where technically feasible, you may request a copy of your personal data in a structured, machine-readable format.

xp78 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or disclosure:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and xp78 servers.
• Encryption at rest for all sensitive personal data stored in xp78 databases, including CNIC data, financial account details, and password hashes.
• Multi-factor authentication (MFA) available for all xp78 accounts, providing an additional layer of protection beyond your login password.
• Role-based access controls ensuring that xp78 personnel can only access user data strictly necessary for their job function.
• Automated intrusion detection and session anomaly monitoring to identify and respond to suspicious access patterns on the xp78 platform.
• Regular security audits conducted to identify and remediate vulnerabilities in the xp78 platform infrastructure.

While xp78 takes all reasonable steps to protect your data, no internet-based platform can guarantee absolute security against all possible attack vectors. You are responsible for keeping your xp78 login credentials confidential and must notify xp78 support immediately if you suspect unauthorised access to your account.

xp78 is strictly for users aged 21 and above. xp78 does not knowingly collect or process personal data from individuals under the age of 21. The CNIC-based verification process implemented by xp78 is specifically designed to enforce this age restriction at the withdrawal stage.

If xp78 becomes aware that personal data has been collected from an individual under 21 years of age, xp78 will immediately suspend the relevant account, delete the associated personal data (except where retention is required for regulatory reasons), and refund any deposits made in accordance with the procedures set out in the xp78 Terms & Conditions.

The xp78 platform may from time to time contain references to or integrations with third-party services. This Policy applies exclusively to data processing by xp78 and does not extend to third-party websites, applications, or services. xp78 is not responsible for the privacy practices of any third party and encourages users to review the privacy policies of any external service they interact with independently of the xp78 platform.

xp78 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or xp78's data processing practices. When material changes are made, xp78 will update the effective date at the top of this Policy and, where the changes are significant, will notify registered users by email or in-platform notification prior to the changes taking effect.

Your continued use of the xp78 platform following the posting of an updated Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree to the updated Policy, you should stop using xp78 and contact support to initiate account closure.

For all privacy-related enquiries, data rights requests, or to report a data protection concern, please contact the xp78 data team through the following channel:

For general account and gaming support, xp78 live chat is available 24/7 directly on the xp78 platform.