xr786 Privacy Policy

This Privacy Policy ("Policy") describes how xr786 ("xr786," "we," "us," or "our") collects, processes, stores, shares, and protects personal data relating to individuals ("you," "your," or "the User") who access or use the xr786 online sportsbook and casino platform, including its website, mobile-optimised interface, and all associated services (collectively "the Platform").

xr786 is committed to protecting the privacy and personal data of all its users. This Policy has been prepared in accordance with internationally recognised data protection principles and the requirements of xr786's gaming licence jurisdiction. It applies to all personal data that xr786 collects — whether provided directly by you during registration and use of the Platform, gathered automatically through technical systems, or received from authorised third parties such as KYC verification providers and payment processors.

This Policy should be read alongside xr786's Terms & Conditions and Responsible Gaming Policy, both of which are published separately on the Platform and are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions on a data protection matter, this Policy shall take precedence.

For the purposes of this Privacy Policy, xr786 acts as the Data Controller in respect of all personal data collected and processed through the Platform. As Data Controller, xr786 is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is carried out lawfully, fairly, and transparently.

xr786 operates under an internationally recognised online gaming licence. The licensing authority imposes data protection obligations on xr786 as part of its regulatory framework, and compliance with those obligations forms a core part of xr786's data governance programme.

xr786 collects only the personal data that is genuinely necessary to operate the Platform, comply with our legal and regulatory obligations, and provide a safe and personalised experience for every user. The categories of personal data we collect are set out in the table below.

xr786 collects personal data through the following channels and mechanisms:

• Direct provision by you: When you register an account on xr786, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or otherwise interact with any feature of the Platform that requires you to submit information.
• Automated technical collection: When you access the Platform, our servers and analytics tools automatically collect technical and usage data including your IP address, device identifiers, browser information, session data, and interaction logs. This collection occurs whether or not you are logged into a registered account.
• Cookies and similar tracking technologies: xr786 uses cookies, pixel tags, and local storage objects to collect data about your browsing behaviour on the Platform. See Section 10 (Cookies & Tracking) for full details.
• Third-party sources: Where required for KYC verification, fraud prevention, or AML compliance, xr786 may receive personal data about you from authorised third-party service providers, including identity verification agencies, sanctions screening databases, and payment processors such as JazzCash and EasyPaisa.

xr786 uses your personal data only for the specific, legitimate purposes listed below. We do not use your data for any purpose that is incompatible with the purposes for which it was originally collected without first obtaining your explicit consent or establishing a separate lawful basis for that new use.

• Account creation and management: To register your xr786 account, maintain your account record, authenticate your login sessions, and manage your account preferences and responsible gaming settings.
• Identity verification and KYC: To verify that you meet the minimum age requirement of 21+ and to confirm your identity in accordance with our licensing obligations. KYC may be triggered at registration, first withdrawal, or at any subsequent point required by our compliance team.
• Payment processing: To process your PKR deposits via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and other supported channels, and to execute your withdrawal requests to your verified payment method.
• AML and fraud prevention: To monitor transactions and betting patterns for indicators of money laundering, fraud, match fixing, or other prohibited activities as required by our licensing obligations and applicable law.
• Responsible gaming: To monitor usage patterns for indicators of problem gambling behaviour, to enforce deposit and loss limits you have set, to administer cooling-off and self-exclusion requests, and to reach out to users who may be showing signs of gambling-related harm.
• Platform operation and improvement: To diagnose technical issues, optimise the performance and layout of the Platform, develop new features, and conduct internal analytics to better understand how our users interact with xr786 products and services.
• Customer support: To respond to your support requests, resolve disputes, process complaints, and maintain records of our communications with you for quality assurance and regulatory audit purposes.
• Legal and regulatory compliance: To comply with our gaming licence conditions, respond to lawful requests from regulatory authorities or law enforcement agencies, and meet our obligations under applicable financial crime legislation.
• Marketing communications (where consented): Where you have opted in to receive marketing communications from xr786, we may send you updates about promotions, new games, PSL betting markets, and other xr786 offers by email or on-platform notification. You may withdraw your consent at any time.

xr786 processes your personal data only where a valid legal basis exists for doing so. The legal bases upon which xr786 relies are as follows:

• Contractual necessity: Processing that is necessary to perform the contract between you and xr786 — including account management, payment processing, and delivering the betting and gaming services you have registered to use.
• Legal obligation: Processing that is required to comply with applicable law and our gaming licence conditions — including KYC identity verification, AML transaction monitoring, sanctions screening, and responding to lawful regulatory or law enforcement requests.
• Legitimate interests: Processing that is necessary for xr786's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes fraud detection, platform security, responsible gaming monitoring, and internal analytics to improve our services.
• Consent: Processing based on your freely given, informed, and specific consent — primarily in the context of optional marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

xr786 does not sell, rent, or otherwise commercially disclose your personal data to third parties. We share data only in the limited circumstances described below, and only with parties who are contractually required to protect the data they receive to the same standard as xr786.

• KYC and identity verification providers: Authorised third-party agencies engaged by xr786 to perform identity document verification and age confirmation checks. These providers are bound by strict data processing agreements and may not use your data for any purpose other than verifying your identity for xr786.
• Payment processors: JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, and other PKR payment providers that process your deposit and withdrawal transactions. These parties receive only the minimum data required to execute your specific transaction.
• AML and sanctions screening providers: Third-party compliance service providers that assist xr786 in meeting its anti-money laundering and sanctions obligations under our gaming licence. Data shared with these providers is strictly limited to that required for screening purposes.
• Regulatory authorities and law enforcement: xr786 will disclose personal data to its licensing authority or to law enforcement agencies where required to do so by law, by regulatory instruction, or where xr786 has reasonable grounds to believe that such disclosure is necessary to prevent or detect crime.
• IT infrastructure and hosting providers: Cloud hosting, database, and infrastructure service providers that form part of xr786's technical platform. These providers operate under data processing agreements and do not have independent access to your personal data for their own purposes.
• Responsible gaming organisations: In cases of serious problem gambling concern, xr786 may, with appropriate legal basis, share limited data with licensed responsible gambling organisations to facilitate support or self-exclusion across multiple platforms.

xr786 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by our gaming licence conditions and applicable legal obligations. The following retention principles apply:

• Active accounts: Personal data associated with an active xr786 account is retained for the duration of the account's active status and for a minimum period of five (5) years following account closure, in accordance with standard AML record-keeping requirements under our licence.
• KYC and identity documents: Copies of identity documents submitted for KYC verification are retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Transaction records: Financial transaction records, including deposits, withdrawals, and betting history, are retained for a minimum of five (5) years in accordance with AML legislation applicable under our licence jurisdiction.
• Support communications: Customer support transcripts and email records are retained for up to three (3) years from the date of the communication, or for the duration of any related ongoing dispute or investigation, whichever is longer.
• Marketing consent records: Records of your marketing consent or opt-out are retained for the duration of your account and for a period of three (3) years following account closure, to enable xr786 to demonstrate compliance with consent requirements.
• Technical and usage logs: Server logs, IP records, and usage analytics are retained for up to thirteen (13) months, after which they are aggregated or deleted.

xr786 takes the security of your personal data seriously and maintains a comprehensive set of technical and organisational measures designed to protect your data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• TLS (Transport Layer Security) encryption for all data in transit between your device and xr786's servers.
• Encryption at rest for all sensitive personal data stored in xr786's databases, including financial records and KYC documents.
• Role-based access controls ensuring that only authorised xr786 personnel whose job functions require access to personal data can view or process it.
• Regular security vulnerability assessments and penetration testing of the xr786 Platform and its underlying infrastructure.
• Multi-factor authentication requirements for all internal xr786 staff accounts with access to personal data systems.
• Formal incident response and data breach management procedures, including defined escalation paths and notification timelines.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, xr786 will notify you without undue delay via your registered email address, providing a clear description of the nature of the breach, the data affected, the likely consequences, and the measures xr786 is taking to address it.

xr786 uses cookies and similar tracking technologies on the Platform to provide core functionality, improve your user experience, and gather analytics data that helps us improve our services. A cookie is a small text file stored on your device by your browser when you visit a website.

You can manage your cookie preferences through your browser settings. Please note that disabling cookies that are marked as non-optional above may prevent certain features of the xr786 Platform from functioning correctly. xr786 does not use third-party advertising cookies or retargeting pixels.

Subject to applicable data protection law and xr786's legal retention obligations, you have the following rights in respect of your personal data held by xr786:

• Right of Access: You have the right to request a copy of the personal data that xr786 holds about you, along with information about how it is being processed.
• Right to Rectification: If any personal data xr786 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to Erasure: You may request that xr786 delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations.
• Right to Restriction: In certain circumstances — for example, while a data accuracy dispute is being resolved — you may request that xr786 restrict the processing of your personal data.
• Right to Data Portability: Where processing is based on your consent or on contract performance, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where xr786 relies on legitimate interests as its legal basis, unless xr786 can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent — such as for marketing communications — you may withdraw your consent at any time by contacting xr786 at [email protected] or by using the unsubscribe option in any marketing email you receive from xr786.

xr786 may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to, amended by, or deleted at the request of an unauthorised third party. Identity verification for data rights requests may require you to provide a copy of your CNIC or other government-issued identification.

xr786 operates a strict minimum age policy. The Platform is intended exclusively for use by adults who are 21 years of age or older. xr786 does not knowingly collect, process, or retain personal data from individuals under the age of 21.

If you are a parent or guardian and believe that a minor under your care may have registered on the xr786 Platform without your knowledge, please contact our support team immediately at [email protected]. xr786 will investigate and take appropriate action, which may include permanent account closure and deletion of all associated personal data to the extent permitted by law.

xr786 does not direct any marketing, promotional, or informational content towards individuals under the age of 21. Our Platform content, advertising materials, and social media communications are targeted exclusively at adult audiences.

xr786 is an internationally operated platform. To deliver our services to users across Pakistan, certain personal data may be processed by xr786 or its authorised service providers in jurisdictions outside Pakistan. These international processing activities are necessary for the operation of the Platform and for meeting our regulatory obligations.

Where personal data is transferred to or processed in a jurisdiction outside Pakistan, xr786 takes appropriate safeguards to ensure that such transfers are conducted in a manner that maintains the protection of your personal data to a standard consistent with this Policy. Such safeguards include:

• Transferring data only to jurisdictions that provide an adequate level of data protection as recognised by xr786's licensing authority.
• Entering into data processing agreements with all third-party service providers that handle personal data on xr786's behalf, incorporating standard contractual protections.
• Applying technical security measures — including encryption in transit and at rest — to all data regardless of the jurisdiction in which it is processed.

xr786 reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates to our services, changes in applicable law, guidance from our licensing authority, or improvements to our data governance practices.

When material changes are made to this Policy, xr786 will notify registered users by email to their registered address and / or via a prominent notice on the Platform prior to the change taking effect. The updated Policy will display a revised "Last Updated" date at the top of this page.

xr786 encourages all users to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Users in Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, Multan, and across Pakistan are equally subject to the current version of this Policy at all times.

If you have any questions, concerns, or complaints about this Privacy Policy or about the way xr786 processes your personal data, please do not hesitate to get in touch with our team. We are committed to addressing all data-related enquiries promptly and transparently.

You may contact xr786's data privacy team by emailing [email protected] with the subject line "Privacy Policy Enquiry". Our team aims to respond to all enquiries within 5 business days.