Privacy Policy

This Privacy Policy ("Policy") is published by XC999 ("XC999", "we", "us", "our") and applies to all users ("you", "your", "User") who access or use the website located at https://xc999.cam and any associated services, tools, features or content offered through the platform (collectively, the "Service").

XC999 is an English-language online betting information and review platform serving users in Pakistan. We are committed to protecting your personal data and handling it responsibly, transparently and in accordance with applicable data protection standards. This Policy explains the categories of personal information we collect, the purposes for which it is processed, with whom it may be shared, and the rights available to you regarding your data.

By accessing or using the Service, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you should cease using the Service immediately.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, XC999 acts as the data controller for information collected through the Service.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, CNIC number, IP address, device identifiers and financial transaction data.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer or deletion.
• "Data Subject" means the natural person to whom personal data relates — in this context, the registered User of the Service.
• "Third Party" means any person or entity other than XC999, its authorised processors and the User.
• "Cookies" means small text files placed on your device by the Service for the purposes of session management, analytics and preference storage.
• "KYC" means Know Your Customer — the identity and age verification process required by applicable regulations and platform policy.
• "Sensitive Data" means personal data requiring a higher level of protection, such as identity documents (e.g., CNIC, passport), financial account information and liveness verification data.

XC999 collects the following categories of personal data, depending on how you interact with the Service:

XC999 collects personal data through the following channels:

XC999 processes personal data only when a valid legal basis exists. The legal bases on which we rely are as follows:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms & Conditions, including account management, payment processing, and the provision of betting services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) rules, KYC requirements, tax obligations and regulatory reporting duties.
• Legitimate Interests: Processing carried out for purposes that are in our legitimate business interests and do not unduly prejudice your rights, including fraud prevention, platform security, IT system administration and business analytics.
• Consent: Processing based on your freely given, informed and specific consent, such as the use of non-essential cookies and the sending of marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

XC999 uses the personal data we collect for the following purposes:

• To create, manage and maintain your Account on the Service;
• To process deposits and withdrawals in PKR and other accepted currencies, including via payment methods familiar to Pakistani users (e.g., Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah and cryptocurrency where applicable);
• To verify your identity and age through the KYC process, and to comply with our AML and fraud prevention obligations;
• To provide customer support, respond to enquiries, manage complaints and resolve disputes;
• To monitor betting activity for signs of problem gambling and to facilitate the responsible gambling tools available on the platform (deposit limits, self-exclusion, cooling-off periods);
• To send you service-related communications, including account confirmations, security alerts, transaction notifications and policy updates;
• To send marketing and promotional communications (where you have provided consent), including information about new features, promotions and relevant sports betting news;
• To analyse usage patterns and improve the performance, security and content of the Service;
• To detect, prevent and investigate fraud, money laundering, unauthorised access and other illegal or prohibited activities;
• To comply with applicable legal and regulatory obligations, including responding to lawful requests from competent authorities.

XC999 does not sell, rent or trade your personal data to any third party for commercial purposes. We may share your data with the following categories of recipients, and only to the extent necessary for the identified purpose:

XC999 uses cookies and similar tracking technologies to operate and improve the Service. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Service to function correctly, including session management, authentication and security features. These cannot be disabled without affecting core platform functionality.
• Performance and Analytics Cookies: Used to understand how Users interact with the Service, including which pages are visited most frequently, how long sessions last and where errors occur. Data collected is aggregated and anonymised where possible.
• Functionality Cookies: Allow the Service to remember your preferences, such as language settings and display configurations, to provide a more personalised experience.
• Marketing and Targeting Cookies: Used with your consent to deliver relevant promotional content and to measure the effectiveness of marketing campaigns. You may opt out of these cookies at any time.

You can manage your cookie preferences at any time through your browser settings. Disabling certain categories of cookies may affect the functionality of the Service. For a full list of cookies used on the platform, please refer to the Cookie Preferences panel accessible from the platform footer.

XC999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Account Data: Retained for the duration of your Account and for a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements and to handle any post-closure disputes or regulatory inquiries.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with anti-money laundering legislation applicable in the operator's jurisdiction.
• KYC Documentation: Retained for the period required by applicable AML and KYC regulations — typically five (5) years from the end of the business relationship.
• Communication Records: Support correspondence and complaint records are retained for up to three (3) years from the date of the last interaction.
• Cookie and Analytics Data: Aggregated analytics data may be retained indefinitely in anonymised form. Cookie data tied to specific sessions is typically retained for no longer than thirteen (13) months.
• Marketing Consent Records: Records of your consent or opt-out preferences are retained for as long as necessary to demonstrate compliance with marketing communications obligations.

When retention periods expire, data is securely deleted or anonymised in a manner that prevents reconstruction of personal identifiers.

XC999 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• TLS/SSL encryption for all data transmitted between your device and the Service;
• Encryption of sensitive data stored at rest, including identity documents and financial records;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Two-factor authentication options for User Accounts and for internal system access by authorised personnel;
• Regular security audits, vulnerability assessments and penetration testing of platform infrastructure;
• Incident response procedures to detect, contain and notify Users of data breaches where required by applicable law.

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify affected Users without undue delay in accordance with our obligations under applicable data protection law.

XC999 operates internationally and may transfer your personal data to countries outside Pakistan where our service providers, hosting infrastructure or processing systems are located. Such transfers are carried out in accordance with applicable data protection standards and are subject to appropriate safeguards, which may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules applicable to intra-group transfers within our corporate structure;
• Adequacy decisions or equivalent frameworks recognised under applicable data protection law.

By using the Service, you acknowledge and consent to the transfer of your personal data to countries that may have different data protection laws than those in Pakistan. We ensure that all transfers are subject to contractual obligations requiring the recipient to provide protection equivalent to the standards described in this Policy.

Subject to applicable law and the specific circumstances of your request, you have the following rights in relation to your personal data:

To exercise any of the above rights, please contact us at [email protected]. We will respond to all valid requests within 30 days. We may need to verify your identity before processing your request. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

The XC999 Service is strictly intended for adults aged 18 years or over, or the higher minimum age required by the operator's license jurisdiction. We do not knowingly collect, process or retain personal data from individuals under the applicable minimum age threshold.

If you are a parent or guardian and believe that a minor under your care has provided personal data to XC999 without your consent, please contact us immediately at [email protected]. We will take prompt steps to investigate and, where confirmed, delete the relevant data and close the associated Account.

The Service may contain references to or links to third-party websites, platforms or services. XC999 does not control and is not responsible for the privacy practices of any third-party website or service. This Privacy Policy applies solely to personal data processed by XC999 through the Service.

We encourage you to review the privacy policies of any third-party service you access, including payment providers (such as Easypaisa, JazzCash, Raast and banking partners) whose own privacy practices govern the information you share with them directly. The mention of these providers in our content is for contextual reference only and does not constitute an endorsement of their data practices.

XC999 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations or the features of the Service. When material changes are made, we will notify registered Users by email or by displaying a prominent notice on the platform prior to the changes taking effect.

The "Last Updated" date shown at the top of this page will be revised whenever changes are published. We recommend that you review this Policy periodically. Your continued use of the Service following the posting of revised Terms constitutes your acceptance of those changes. If you disagree with any revision, you may close your Account and cease using the Service.

If you have any questions, concerns or requests relating to this Privacy Policy or the handling of your personal data, please contact XC999's data team using the details below:

For complaints that you feel have not been resolved satisfactorily by our internal process, you may have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to your situation.