xh88 Privacy Policy

1. Data Controller

xh88.bet acts as the Data Controller for all personal data collected through the xh88 platform. As Data Controller, xh88 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted in compliance with applicable data protection principles and our international gaming license obligations.

For all data-related enquiries, including rights requests, complaints, and clarifications, you may contact our Data Protection contact point at [email protected] with the subject line "Data Privacy Request". We aim to acknowledge all privacy-related correspondence within 48 hours.

2. Data We Collect

2.1 Registration Data

When you create an xh88 account, we collect the information you provide during the registration process, including your full legal name, date of birth, residential address, email address, and mobile phone number. This information forms the foundation of your account identity and is required to fulfil our KYC obligations under our gaming license.

2.2 Identity Verification (KYC) Documents

To comply with our international gaming license requirements and anti-money-laundering regulations, xh88 may request copies of official identity documents including your CNIC (Computerised National Identity Card), passport, or driving licence, as well as proof of address (utility bill, bank statement) and proof of payment method ownership. These documents are processed by our licensed KYC verification partner and stored in an encrypted document vault.

2.3 Transaction Data

xh88 records all financial transactions conducted through your account, including deposits, withdrawals, bonus credits, wagers placed, and game results. Transaction records include timestamps, amounts in PKR or USDT, payment method identifiers (masked), and transaction status. This data is retained for regulatory compliance purposes as described in Section 6.

2.4 Technical & Usage Data

When you access the xh88 platform, our servers automatically collect certain technical information, including your IP address, browser type and version, operating system, device identifiers, session duration, pages visited, games played, and click-stream data. This information is used for platform security, fraud detection, and service improvement purposes.

2.5 Communications Data

If you contact xh88 customer support via live chat, email, or any other channel, we retain records of those communications, including chat transcripts, email threads, and any attachments you provide. These records are used to resolve disputes, improve service quality, and maintain an accurate account history.

2.6 Marketing Preferences

Where you have provided explicit consent to receive marketing communications, xh88 records that consent along with your communication preferences, including preferred language (Urdu or English), preferred channel (email or SMS), and any opt-out instructions you subsequently provide.

Data Category	Examples	Collection Method
Registration Data	Name, DOB, email, phone, address	Provided by user at signup
KYC Documents	CNIC, passport, proof of address	Uploaded by user on request
Transaction Data	Deposits, withdrawals, bets, winnings	Automatically recorded by platform
Technical Data	IP address, device ID, browser type	Automatically collected on access
Communications Data	Live chat transcripts, support emails	Recorded during support interactions
Marketing Preferences	Consent records, opt-out history	Captured at consent point

3. Purpose & Legal Basis

xh88 processes your personal data for the following purposes, each supported by a documented lawful basis:

• Account creation and management — Contractual necessity: processing is required to provide you with the xh88 service you have requested.
• Identity verification (KYC) — Legal obligation: required under our international gaming license and anti-money-laundering regulations.
• Payment processing — Contractual necessity: required to execute deposit and withdrawal transactions via JazzCash, EasyPaisa, HBL, UBL, SadaPay, and USDT.
• Fraud prevention and platform security — Legitimate interest: xh88 has a legitimate interest in protecting the platform, its users, and the integrity of all games and transactions.
• Responsible gaming monitoring — Legal obligation and legitimate interest: required by our gaming license to monitor for indicators of problem gambling and enforce self-exclusion requests.
• Customer support — Contractual necessity: required to respond to your enquiries and resolve disputes.
• Marketing communications — Consent: sent only where you have provided explicit, informed, and freely given consent. You may withdraw consent at any time by contacting support.
• Regulatory reporting — Legal obligation: certain transaction and identity data must be reported to our licensing authority and relevant financial intelligence units as required by law.
• Platform analytics and improvement — Legitimate interest: anonymised usage data is used to improve game performance, UI/UX, and overall service quality.

4. Data Sharing

4.1 Service Providers

xh88 shares personal data with carefully selected third-party service providers who assist in delivering the xh88 platform. These include KYC verification vendors, payment processing partners (JazzCash, EasyPaisa, HBL, UBL, SadaPay), cloud hosting providers, fraud detection services, and customer support platform operators. All service providers are bound by data processing agreements that restrict them from using your data for any purpose other than the specific service they provide to xh88.

4.2 Regulatory and Legal Disclosure

xh88 may disclose personal data to its gaming license authority, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where disclosure is required by applicable law, court order, or regulatory direction. xh88 will notify you of such disclosures where it is legally permitted to do so.

4.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of xh88's business, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and the identity of the new data controller with a minimum of 30 days' advance notice, and you will retain the right to request account closure and data deletion prior to the transfer taking effect.

4.4 No Commercial Data Sales

xh88 does not sell, rent, or lease your personal data to any third party for advertising, marketing, or any other commercial purpose. We do not participate in data broker arrangements or audience-targeting schemes that involve disclosing your identity or behavioural data to external parties.

5. Cookies & Tracking

The xh88 platform uses cookies and similar tracking technologies to deliver a functional and secure user experience. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the platform to function. These enable session management, authentication state, and security token validation. They cannot be disabled without impairing platform functionality.
• Functional Cookies: Store your preferences such as language selection (Urdu/English), display settings, and previously used payment methods to streamline your experience on return visits.
• Analytics Cookies: Collect anonymised data on page visits, session duration, and feature usage to help xh88 understand how the platform is used and where improvements can be made. No personally identifiable information is included in analytics data.
• Security Cookies: Used to detect and mitigate fraudulent activity, bot traffic, and suspicious login patterns. These cookies are integral to our platform security infrastructure.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies may prevent you from accessing certain platform features or your account. xh88 does not use third-party advertising or cross-site tracking cookies.

6. Data Retention

xh88 retains your personal data for no longer than is necessary for the purposes described in this Policy or as required by applicable law and our gaming license obligations. The following retention schedules apply:

• Account and registration data: Retained for the duration of the account relationship and for 5 years following account closure, as required by our gaming license.
• KYC documents: Retained for a minimum of 5 years following the end of the customer relationship, in compliance with anti-money-laundering regulations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction for financial compliance and dispute resolution purposes.
• Customer support communications: Retained for 3 years from the date of the interaction, after which they are securely deleted unless required for an ongoing dispute or legal matter.
• Technical and usage logs: Retained for 12 months in active storage for fraud detection and security analysis, then archived for a further 24 months before secure deletion.
• Marketing consent records: Retained for the duration of the marketing relationship and for 3 years following opt-out to demonstrate compliance with consent requirements.

7. Security Measures

xh88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Key measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and xh88 servers.
• AES-256 encryption for personal data and financial records stored in our databases.
• Two-factor authentication (2FA) available to all registered users and mandatory for all xh88 staff accounts with access to personal data.
• Role-based access controls ensuring that xh88 staff can only access personal data that is strictly necessary for their specific job function.
• Regular independent security audits and penetration testing conducted by accredited third-party security firms on a scheduled basis.
• Intrusion detection systems and 24/7 automated monitoring for anomalous access patterns and data breach indicators.
• Encrypted document storage for all KYC identity documents, accessible only by verified compliance personnel.

In the event of a personal data breach that poses a risk to your rights and freedoms, xh88 will notify the affected users and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with our gaming license obligations.

8. International Data Transfers

xh88 operates under an international gaming license and may process and store your personal data on servers located outside Pakistan. Where personal data is transferred to or accessed from countries that may not provide the same level of data protection as your home jurisdiction, xh88 ensures that appropriate safeguards are in place. These safeguards include standard contractual clauses, binding corporate rules, and contractual obligations on data processors requiring them to maintain security standards equivalent to those applied by xh88.

By registering on the xh88 platform, you acknowledge and consent to the international transfer of your personal data as described in this section, subject to the safeguards described herein.

9. Your Rights

As a user of the xh88 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact xh88 at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving your request, and within 5 business days for straightforward requests.

• Right of Access: You may request a copy of all personal data xh88 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held about you.
• Right to Erasure: In certain circumstances — where data is no longer necessary, consent has been withdrawn, or processing was unlawful — you may request deletion of your personal data. Note that legal and regulatory retention obligations may limit the scope of erasure requests.
• Right to Restriction: You may request that xh88 restrict processing of your personal data while a dispute about accuracy or lawfulness is being resolved.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. xh88 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

10. Minors & Age Policy

The xh88 platform is strictly intended for individuals aged 21 years and above. xh88 does not knowingly collect personal data from any person under the age of 21. During registration, you are required to confirm your date of birth, and xh88 may request documentary proof of age at any stage.

If xh88 discovers or has reasonable grounds to believe that personal data has been collected from an individual under the age of 21, the associated account will be immediately suspended, all data pertaining to that individual will be securely deleted (except where retention is required for regulatory reporting of the underage access incident), and any deposits or winnings associated with the account will be handled in accordance with our gaming license obligations.

If you are a parent or guardian and believe that a minor in your care has registered on xh88, please contact our support team immediately at [email protected]. We will treat the matter with urgency and full confidentiality.

11. Policy Changes

xh88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable legal requirements. Material changes to this Policy will be communicated to registered users via on-site notification or email to the address registered on your account, with a minimum of 14 days' advance notice before changes take effect.

The "Last Updated" date at the top of this Policy will be revised to reflect the date of any amendment. Your continued use of the xh88 platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with any material change, you are entitled to request account closure and data deletion before the change takes effect.

12. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or xh88's data practices, please reach out through the following channels:

• Email: [email protected] — use subject line "Data Privacy Request" for prioritised routing.
• Live Chat: Available 24/7 on xh88.bet — average response time under 5 minutes.
• Languages: Privacy enquiries are handled in both Urdu and English by our dedicated compliance support team.