xx66 Privacy Policy – How We Collect, Use & Protect Your Data

Last Updated: June 2026

This Privacy Policy ("Policy") describes how xx66 ("we", "us", "our", or "the Platform") collects, processes, stores, and protects the personal information of users ("you", "Player") who register an account, access, or otherwise interact with the xx66 platform at xx66.bio. By registering an account or using the xx66 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

If you have any questions about this Policy or wish to exercise any of the rights described below, please contact the xx66 support team at the details provided in Section 13.

1. Who We Are

xx66 is an online sports betting and casino platform serving English-speaking players in Pakistan. The Platform operates at xx66.bio and provides sports betting, live casino, slots, and related gaming services. xx66 acts as the data controller in respect of personal data collected from Players through the Platform.

2. Data We Collect

xx66 collects the following categories of personal data:

2.1 Identity Data. Full name, date of birth, username, copies of government-issued identification documents (e.g. CNIC, passport) where provided for KYC verification purposes.

2.2 Contact Data. Pakistani mobile phone number, email address (where provided), and correspondence address.

2.3 Financial Data. JazzCash account number or mobile wallet identifier, Easypaisa account details, bank account information (HBL, UBL, Meezan Bank, Bank Alfalah), transaction amounts, deposit and withdrawal history, and wallet balances. Full payment card numbers are never stored by xx66.

2.4 Account & Activity Data. Login history, betting and gaming activity, game session logs, bonus usage, transaction history, responsible gaming tool usage, and account settings.

2.5 Technical Data. IP address, device type and identifiers, operating system, browser type and version, approximate geolocation derived from IP, time zone, and referral URLs.

2.6 Communication Data. Records of your communications with xx66 support, including chat transcripts and email correspondence.

2.7 Verification Data. Selfies, document scans, or liveness check outputs where submitted during KYC verification.

3. How We Collect Data

xx66 collects personal data through the following means:

• Direct Provision. Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to promotions.
• Automated Collection. Data collected automatically when you access the Platform, including via cookies, server logs, and analytics tools. See Section 8 for more detail.
• Payment Processors. Transaction confirmation data received from JazzCash, Easypaisa, and banking partners following a completed deposit or withdrawal.
• Identity Verification Services. Where xx66 engages third-party KYC providers to assist with document verification, those providers may return processed identity data to xx66.

4. Why We Use Your Data

xx66 uses your personal data for the following purposes:

• To create, verify, maintain, and close your xx66 account.
• To process deposits, withdrawals, and in-platform transactions in PKR.
• To verify your identity and age (18+) as required by responsible gaming and anti-money laundering obligations.
• To deliver sports betting, casino, and other gaming services to you through the Platform.
• To apply responsible gaming tools you have requested, including deposit limits and self-exclusion.
• To provide customer support and respond to your queries and complaints.
• To send you promotional communications and bonus offers where you have consented to receive them.
• To detect and prevent fraud, cheating, money laundering, and other prohibited conduct.
• To comply with legal and regulatory obligations applicable to xx66.
• To analyse Platform usage and improve the user experience for Pakistani players.

5. Legal Basis for Processing

xx66 processes your personal data on one or more of the following legal bases:

• Contractual Necessity. Processing required to provide the services described in the xx66 Terms & Conditions, including account management and payment processing.
• Legal Obligation. Processing required to comply with applicable legal duties, including age verification, KYC, and anti-money laundering obligations.
• Legitimate Interests. Processing carried out in the legitimate interests of xx66, including fraud prevention, security, and Platform improvement, where those interests are not overridden by your rights.
• Consent. Processing of data for marketing communications, where you have provided explicit consent. You may withdraw consent at any time.

6. Sharing Your Data

xx66 does not sell, rent, or trade your personal data to third parties. We may share data in the following limited circumstances:

• Payment Processors. JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Skrill, and USDT processing partners receive the minimum data necessary to process your transaction.
• KYC Providers. Third-party identity verification services receive identity documents and verification data solely for the purpose of confirming your identity.
• Game Providers. Game software providers may receive a pseudonymous player identifier and session data to operate the game; they do not receive your name, mobile number, or financial data.
• Legal Authorities. xx66 will disclose personal data to law enforcement or regulatory authorities where required to do so by applicable law, court order, or regulatory instruction.
• Business Transfers. In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction. Affected players will be notified.

All third-party service providers engaged by xx66 are contractually required to process data only in accordance with xx66's instructions and to apply appropriate security measures.

7. Data Retention

xx66 retains personal data for as long as necessary to fulfil the purposes set out in this Policy, or as required by applicable law. In practice:

• Account and transaction data is typically retained for a minimum of five (5) years following account closure to satisfy anti-money laundering retention requirements.
• KYC documents are retained for the period required by applicable law, typically five (5) years.
• Marketing preference records are retained until you withdraw consent.
• Technical and log data is typically retained for twelve (12) months.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised.

8. Cookies & Tracking Technologies

The xx66 Platform uses cookies and similar technologies to operate certain features, analyse usage, and personalise your experience. The following categories of cookies may be present:

• Strictly Necessary Cookies. Required for the Platform to function, including session management and authentication. Cannot be disabled.
• Analytics Cookies. Used to understand how players interact with the Platform, identify popular features, and diagnose technical issues. Data is aggregated and pseudonymous.
• Preference Cookies. Store your settings and preferences to improve your experience on return visits.

You may control non-essential cookies through your browser settings. Disabling certain cookies may affect Platform functionality. xx66 does not deploy third-party advertising cookies for the purpose of serving off-platform targeted advertising.

9. Security of Your Data

xx66 implements industry-standard technical and organisational security measures to protect your personal data, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the xx66 Platform.
• Encryption of sensitive data at rest, including passwords (stored as one-way hashes) and financial identifiers.
• Two-factor authentication (OTP via Pakistani mobile number) available to all registered players.
• Regular penetration testing and security audits by independent third parties.
• Strict access controls limiting employee access to personal data on a need-to-know basis.

While xx66 takes all reasonable precautions, no system is entirely impenetrable. In the event of a personal data breach that presents a risk to your rights, xx66 will notify affected players promptly in accordance with applicable obligations.

10. Your Rights

Subject to applicable law and certain limitations, you have the following rights in respect of your personal data held by xx66:

• Access. Request a copy of the personal data xx66 holds about you.
• Rectification. Request correction of inaccurate or incomplete personal data.
• Erasure. Request deletion of your personal data, subject to retention obligations described in Section 7.
• Restriction. Request that processing of your data be restricted in certain circumstances.
• Objection. Object to processing carried out on the basis of legitimate interests.
• Portability. Request a machine-readable copy of data you have provided to xx66.
• Withdrawal of Consent. Withdraw consent to marketing communications at any time with immediate effect.

To exercise any of these rights, contact xx66 support as described in Section 13. We will respond to all valid requests within 30 calendar days.

11. Children's Privacy

The xx66 Platform is strictly for users aged 18 and above. xx66 does not knowingly collect personal data from persons under 18. If we become aware that a registered player is under 18, the account will be immediately suspended, all activity will be reviewed, and the account will be closed. Any funds deposited by an underage player will be handled in accordance with our Terms & Conditions and applicable law. If you believe a minor has registered on xx66, please contact support immediately.

12. Changes to This Policy

xx66 may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. The "Last Updated" date at the top of this page reflects the date of the most recent revision. Where changes are material, xx66 will notify registered players via the email address or mobile number associated with their account, or through a prominent notice on the Platform. Continued use of the Platform following notification of a material change constitutes acceptance of the revised Policy.

13. Contact & Data Requests

For any questions about this Privacy Policy, to exercise your data rights, or to raise a privacy concern, please contact the xx66 support team. Our team is available 24/7 in English for all Pakistani players.

Email (plain text – not a link): [email protected]

Response time for data rights requests: within 30 calendar days of receipt of a valid, verified request.

Responsible Gaming concerns should be directed to the xx66 Responsible Gaming page, where self-exclusion, deposit limit, and session limit tools are available.