Privacy Policy — xg555

This Privacy Policy ("Policy") is issued by the operator of the xg555 platform ("Operator", "we", "us", "our"), accessible at https://xg555.cam ("Platform"). It governs how we collect, use, store, disclose and protect personal data relating to individuals ("you", "your", "User") who access or use the Platform.

xg555 is an English-language online sports betting and live casino entertainment platform primarily serving adult users across Pakistan and other eligible jurisdictions. The Platform is not licensed, regulated or endorsed by the Government of Pakistan, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan, any Pakistani provincial authority, or any Pakistani financial institution.

This Policy should be read alongside the xg555 Terms & Conditions and Responsible Gambling Policy. By using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you must not use the Platform.

The following definitions apply throughout this Policy:

The Data Controller for all Personal Data processed in connection with the xg555 Platform is the Operator, whose details are published in the Platform's licensing and legal information section. The Operator determines the purposes and means of processing your Personal Data in accordance with this Policy.

Where third-party service providers (such as KYC verification agencies, payment processors or fraud prevention firms) process data on the Operator's behalf, they do so as Data Processors acting under contractual instruction. The Operator remains responsible for ensuring those processors handle your data in compliance with applicable data protection law.

For all data-related queries, requests or complaints, please use the contact details set out in Section 16 of this Policy.

xg555 collects the following categories of Personal Data:

We do not intentionally collect special category data (such as health, religion, biometric or political data) except where required for responsible gambling assessment or regulatory compliance. We do not collect data from individuals known to be under 18 years of age.

The Operator processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to provide the Platform services, maintain your account, process deposits and withdrawals, and fulfil our obligations under the Terms & Conditions.
• Legal Obligation: Processing required to comply with Anti-Money Laundering (AML) legislation, KYC requirements, fraud prevention obligations, and regulatory or court-mandated disclosures.
• Legitimate Interests: Processing for fraud detection and prevention, platform security, responsible gambling monitoring, analytics and service improvement — where those interests are not overridden by your data protection rights.
• Consent: Where we rely on consent — primarily for optional marketing communications — you may withdraw consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent does not affect your ability to use the Platform.

We use your Personal Data for the following purposes:

• Account Management: Creating, maintaining and securing your xg555 account; verifying your identity; enforcing account eligibility requirements.
• Transactions: Processing deposits and withdrawal requests; reconciling payment records; detecting and preventing payment fraud.
• KYC & AML Compliance: Verifying your identity and address; screening against applicable sanctions lists; monitoring for suspicious transaction patterns as required by anti-money laundering obligations.
• Responsible Gambling: Monitoring account activity for signs of problem gambling behaviour; administering deposit limits, loss limits and self-exclusion requests; responding to responsible gambling queries.
• Platform Operations: Delivering and improving Platform functionality; diagnosing technical faults; maintaining server security; load balancing and performance optimisation.
• Customer Support: Responding to queries, complaints and account-related requests submitted via email or live chat.
• Marketing (with consent): Sending promotional communications about offers, bonuses and platform updates where you have provided valid consent and not withdrawn it. You may opt out at any time.
• Legal & Regulatory: Complying with applicable laws; responding to court orders or regulatory directions; defending or pursuing legal claims.

xg555 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Essential Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during a session. These cannot be disabled without breaking Platform functionality.
• Preference Cookies: Remember your settings such as language preference, timezone display (Pakistan Standard Time) and responsible gambling tool configurations.
• Analytics Cookies: Collect aggregated, anonymised data about how users navigate the Platform — pages visited, time on page, features used. This data is used to improve the Platform and is not used to identify individual users for marketing.
• Security Cookies: Used for fraud detection, bot prevention and anomalous login detection.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in or using core Platform features. Third-party analytics tools used by the Operator process data in anonymised or pseudonymised form.

We share your Personal Data only in the following circumstances:

• KYC / Identity Verification Providers: Specialist third-party firms process your identity documents and biometric checks on the Operator's behalf to satisfy KYC and AML obligations.
• Payment Processors: Transaction data is shared with payment processing partners to facilitate deposits and withdrawals. These partners process data only as instructed by the Operator and are bound by contractual data protection obligations. Payment provider names referenced on the Platform (including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah) are familiar local references — any data sharing with such providers occurs solely for transaction processing purposes and does not imply those providers endorse gambling or are affiliated with xg555.
• Fraud & Security Services: IP and device data may be shared with fraud detection and cybersecurity providers to protect the Platform and its users.
• Responsible Gambling Systems: Data relevant to self-exclusion requests may be shared with applicable self-exclusion scheme operators where required by the Operator's license obligations.
• Legal & Regulatory Authorities: We will disclose Personal Data to law enforcement agencies, regulatory bodies or courts where required to do so by applicable law, court order or legitimate regulatory direction.
• Business Transfers: In the event of a merger, acquisition or sale of all or part of the Operator's business, user data may be transferred to the acquiring entity subject to equivalent data protection commitments.

We do not share Personal Data with advertising networks, social media platforms, or data brokers for commercial purposes.

The xg555 Platform is operated by an entity based outside Pakistan. As a result, your Personal Data will be transferred to, and processed in, the jurisdiction where the Operator and its Data Processors are established. This may include jurisdictions that have different data protection standards than those applicable in Pakistan.

Where Personal Data is transferred internationally, the Operator implements appropriate safeguards, which may include contractual clauses requiring recipients to apply data protection standards comparable to those applicable in the Operator's primary jurisdiction.

We retain your Personal Data for as long as necessary to fulfil the purposes described in this Policy and to comply with our legal obligations. Specific retention periods are determined by the following principles:

• Active Accounts: Personal Data is retained for the duration of the account relationship.
• Closed Accounts: Identity and transaction records are retained for a minimum period after account closure as required by applicable AML and anti-fraud regulations. This retention period is typically five years from the date of account closure, but may be longer where required by law.
• Inactive Accounts: Accounts with no login activity for an extended period may be classified as dormant. The Operator's dormancy policy sets out how inactive account data is handled, including any applicable account balance treatment.
• Communications: Support communications are retained for a minimum period for dispute resolution and regulatory compliance purposes.
• Analytics Data: Anonymised and aggregated analytics data does not contain personal identifiers and may be retained indefinitely for platform improvement purposes.

When retention periods expire and no legal obligation requires continued storage, Personal Data is securely deleted or anonymised.

The Operator implements technical and organisational security measures designed to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include, but are not limited to:

• Encryption of data in transit using industry-standard TLS protocols;
• Encrypted storage of sensitive account credentials and identity documents;
• Access controls restricting internal data access to authorised personnel on a need-to-know basis;
• Two-step verification available for account login;
• Regular security reviews and vulnerability assessment procedures;
• Contractual security obligations imposed on all third-party Data Processors.

While the Operator takes all reasonable steps to secure your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account login credentials. If you suspect any unauthorised access to your account, contact support immediately at [email protected].

Subject to applicable law and the Operator's regulatory obligations (including AML and KYC data retention requirements), you may have the following rights in respect of your Personal Data:

• Right of Access: Request a copy of the Personal Data held about you and information about how it is being processed.
• Right to Rectification: Request correction of inaccurate or incomplete Personal Data held in your account.
• Right to Erasure: Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations. Note: AML/KYC regulations typically require retention of identity and transaction records for a minimum period even after account closure.
• Right to Restrict Processing: Request that processing of your data be restricted in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Request a machine-readable copy of data you have actively provided, where technically feasible and permitted by applicable law.
• Right to Object: Object to processing based on legitimate interests where you believe your rights and interests override those interests.
• Right to Withdraw Consent: Where processing is based on consent (primarily marketing), withdraw consent at any time via account settings or by contacting support. Withdrawal does not affect the lawfulness of processing before withdrawal.

The xg555 Platform is strictly for adults aged 18 years and above, or the higher minimum age required by the applicable operator license jurisdiction. We do not knowingly collect Personal Data from individuals under the age of 18. If you are under 18, you must not access, register on or use the Platform.

If the Operator becomes aware that Personal Data has been collected from an individual under the legal age, that account will be immediately closed, all associated Personal Data will be securely deleted (subject to any mandatory regulatory retention obligations), and any deposits held will be returned in accordance with applicable law and the Operator's terms.

If you are a parent or guardian and believe that a minor has accessed the Platform, please contact support immediately at [email protected] so the matter can be investigated and resolved promptly.

xg555 targets English-language adult users in Pakistan and provides PKR currency display, Pakistan Standard Time scheduling, local sports coverage and a localised user experience. The following disclosures are specifically relevant to Pakistani users:

• xg555 is operated outside Pakistan and is not subject to the regulatory jurisdiction of any Pakistani data protection authority, the PTA, the State Bank of Pakistan, or any Pakistani government body.
• Pakistani data protection legislation (where applicable) may or may not extend to operators based outside Pakistan. Users in Pakistan participate on that basis.
• Payment references such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are included for contextual familiarity. These providers do not endorse, support or are affiliated with xg555. Any data shared with such providers is limited to what is required for payment processing.
• By using the Platform, users in Pakistan acknowledge that their data will be processed and stored outside Pakistan, in the jurisdiction where the Operator and its processors are established.

This is not legal advice. Pakistani users are encouraged to understand the applicable legal framework before using the Platform. Consult a qualified legal professional if in doubt about your legal position under Pakistani law.

The Operator reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered users via the email address associated with their account and/or through a prominent notice on the Platform prior to the changes taking effect.

The "Effective date" and version number at the top of this Policy reflect the current in-force version. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with a revised Policy, you must stop using the Platform and contact support to arrange account closure.

For any questions, requests or complaints relating to this Privacy Policy, or to exercise any of your data rights under Section 12, please contact the xg555 data team using the details below. Support is available 24/7 in English, with Pakistan Standard Time (PKT UTC+5) coverage and Urdu-speaking assistance available on request.

When submitting a data rights request, please include your registered username, the nature of your request (e.g., access, rectification, erasure), and sufficient detail to allow the Operator to identify your account. Identity verification will be required before sensitive data is disclosed or deleted.