XZ999 Privacy Policy – How We Protect Your Data

1. Introduction

xz999 ("we", "us", "our") operates the online gaming platform accessible at xz999.fun and through our mobile app. We are committed to protecting the personal information of every player who registers and uses our services. This Privacy Policy sets out what data we collect, how we use it, who we may share it with, and the rights you have over your own information.

This policy applies to all users of the xz999 Platform, regardless of whether you access it through a browser on your phone or computer, or via the xz999 Android or iOS app. It covers all personal data processed in connection with your account, your betting and gaming activity, your payment transactions, and your communications with our support team.

We do not sell your personal data to third parties. We do not share it for purposes beyond those described in this policy. If that ever changes, we will notify you in advance and give you the opportunity to object.

2. Data We Collect

We collect personal information at different points in your journey on the Platform. The categories of data we may collect include:

2.1 Registration Data

When you create an xz999 account, we ask for your full name, date of birth, mobile number, email address, and a password. This is the minimum we need to set up your account and confirm that you meet our age requirement of 18 years or older.

2.2 Identity Verification (KYC) Data

To comply with our Know Your Customer obligations and to process withdrawals, we may ask for a copy of your CNIC (Computerised National Identity Card), passport, or other government-issued ID. We may also request proof of address such as a utility bill, and confirmation of ownership of the payment method you use.

2.3 Financial Data

We collect information related to your deposits and withdrawals — including the payment method used (JazzCash, Easypaisa, Raast, bank transfer, card), transaction amounts in PKR, and transaction timestamps. We do not store full card numbers or mobile wallet PINs directly; this data is handled by our payment processors in a secure environment.

2.4 Gaming & Betting Activity

We maintain records of your betting activity, casino game sessions, win/loss history, bonus usage, and any in-platform communications. This data is used for account management, dispute resolution, responsible gaming monitoring, and improving our services.

2.5 Technical & Device Data

When you use the Platform, we automatically collect certain technical information including your IP address, device type and model, operating system, browser type, session timestamps, and pages or features you interact with. This helps us maintain Platform stability and detect suspicious activity.

2.6 Communications Data

If you contact our support team via live chat or email, we retain records of those conversations. This helps us resolve disputes, improve our service quality, and ensure consistency across interactions.

3. How We Use Your Data

We use the information we collect for the following purposes:

We will not use your data for any purpose not listed here without first informing you and obtaining your consent where required. If you have opted in to marketing communications, you will receive updates about promotions, new features, PSL betting markets, and other relevant offers. You can opt out at any time through your account settings.

4. Legal Basis for Processing

We process your personal data on one or more of the following grounds:

• Contractual necessity: Processing needed to fulfil the agreement between you and xz999 — including account setup, payment processing, and gaming services.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and improving our services, where these interests are not overridden by your rights.
• Legal obligation: Where we are required to process data to comply with applicable laws, including identity verification requirements.
• Consent: Where we rely on your consent — such as for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing

xz999 does not sell, rent, or trade your personal data. We may share your information with trusted third parties in the following limited circumstances:

• Payment processors: To facilitate deposits and withdrawals through JazzCash, Easypaisa, Raast, banks, and card networks. These processors are contractually bound to handle your data sec urely and only for the purpose of processing your transactions.
• Identity verification providers: Third-party KYC services that help us verify your identity documents. These partners operate under strict data processing agreements.
• Fraud prevention services: We may share technical data such as IP addresses and device identifiers with fraud detection partners to protect players and the Platform from abuse.
• Customer support tools: Our support platform may store conversation records securely. Support agents access only what is necessary to resolve your query.
• Legal and regulatory authorities: We may disclose your information if required to do so by law, court order, or at the request of a competent authority. We will only disclose the minimum information required in such circumstances.
• Business transfers: In the event of a merger, acquisition, or restructuring, your data may be transferred to the relevant successor entity. You will be notified of any such change.

6. Payment Data

All financial transactions on xz999 are processed in PKR. We work with established Pakistani payment channels including JazzCash, Easypaisa, Raast, bank transfers, debit and credit cards, and mobile wallets. Here is how your payment data is handled:

• Full card numbers and mobile wallet PINs are never stored on xz999 servers. This data is tokenised and handled exclusively by your payment provider's secure infrastructure.
• We retain records of transaction amounts, payment method types, timestamps, and transaction references. This is necessary for account management, withdrawal processing, and dispute resolution.
• We verify that the payment method you use belongs to you, as part of our fraud prevention and KYC obligations. Third-party deposits are not permitted.
• All payment-related communications between your device and our servers are encrypted using industry-standard TLS protocols.

If you experience any issue with a deposit or withdrawal, our support team can review your transaction history to assist. We retain payment records for a minimum period in line with our financial record-keeping obligations.

7. Cookies & Tracking

xz999 uses cookies and similar tracking technologies to make the Platform work properly, remember your preferences, and understand how players use our services. Here is a breakdown of the cookies we use:

• Essential cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. You cannot opt out of these without affecting your ability to use the Platform.
• Functional cookies: Remember your preferences such as your preferred language, last visited sports market, or notification settings.
• Analytics cookies: Help us understand how players navigate the Platform — which pages are popular, where players spend time, and where they may encounter difficulty. This data is aggregated and does not identify you personally.
• Marketing cookies: Used to track visits from promotional campaigns so we can measure the effectiveness of our marketing. These are only set if you have consented.

You can manage your cookie preferences through your browser settings. Note that disabling essential cookies will affect your ability to log in and use the Platform normally. For analytics and marketing cookies, you can withdraw consent at any time through your account settings.

8. Data Security

We take the security of your personal data seriously and apply multiple layers of protection across our infrastructure:

• Encryption in transit: All data transmitted between your device and our servers is protected using TLS (Transport Layer Security) encryption.
• Encryption at rest: Sensitive data stored in our databases — including identity documents and financial records — is encrypted at rest using industry-standard algorithms.
• Access controls: Only authorised personnel with a specific need to access your data can do so. Access is logged and monitored.
• Intrusion detection: We run continuous monitoring for unusual activity, attempted breaches, and unauthorised access attempts across our systems.
• Regular security reviews: Our infrastructure is reviewed regularly and updated to address new vulnerabilities and evolving security standards.

9. Data Retention

We retain your personal data for as long as your account is active and for a reasonable period after closure to meet our legal, regulatory, and business obligations. Specific retention periods are as follows:

• Account data: Retained for the duration of your account and for up to 5 years after account closure, to comply with record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from the date of verification, in line with standard financial record-keeping practices.
• Transaction records: Retained for up to 7 years to support financial auditing, dispute resolution, and fraud investigations.
• Support communications: Retained for up to 3 years unless there is an ongoing dispute that requires longer retention.
• Technical and device data: Generally retained for up to 12 months unless a security investigation requires longer retention.

When retention periods expire, your data is securely deleted or anonymised so it can no longer be linked back to you. If you request account closure, we will begin the deletion process for data that is no longer required, while retaining what we are legally obliged to keep.

10. Your Rights

You have a number of rights in relation to your personal data. We respect these rights and will respond to any request promptly — typically within 30 days.

To exercise any of these rights, contact our support team through the live chat on the Platform or email us at the address shown in the footer. We may need to verify your identity before processing your request. There is no charge for submitting a data rights request.

11. Children's Privacy

The xz999 Platform is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If we discover or are notified that a minor has registered an account, we will immediately close the account, delete the associated data, and — where deposits have been made — return funds to the originating payment method.

If you are a parent or guardian and believe a minor in your care has registered with xz999, please contact our support team immediately. We will investigate and take appropriate action as a priority. We also encourage parents to use parental control tools available on mobile devices to prevent minors from accessing online gaming platforms.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the services we offer. When we make material changes, we will notify you via an in-app notification or a prominent notice on the xz999 website. The "Last updated" date at the top of this page will always reflect when the policy was most recently revised.

Your continued use of the Platform after a policy update indicates your acceptance of the revised terms. If you disagree with any changes, you are entitled to close your account and request deletion of your data, subject to our retention obligations described in Section 9.

13. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or how xz999 handles your personal data, please reach out to our support team. We are available 24/7 through the live chat feature on the Platform.

For data rights requests or privacy complaints, you can also email us directly at the address listed in the footer of this page. We aim to acknowledge all privacy-related enquiries within 48 hours and provide a full response within 30 days.