Privacy Policy

This Privacy Policy ("Policy") sets out how xk999 ("Platform", "we", "us", "our"), operating the website accessible at https://xk999.cam, collects, stores, processes and protects the personal data of individuals ("you", "Player", "User") who access or use the xk999 online gaming and sports betting services (the "Services").

xk999 is designed for adult players, including those located in Pakistan, and operates in English. We acknowledge that Pakistani users interact with local payment infrastructure including services such as Easypaisa, JazzCash, Raast and bank accounts held with institutions such as HBL, UBL, Meezan Bank and Bank Alfalah. References to these services in this Policy are for contextual clarity only and do not imply endorsement of, affiliation with or any support for gambling by those institutions.

By registering an Account with xk999 or by continuing to use our Services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Services and contact Support to close your Account.

Throughout this Policy the following terms carry the meanings assigned to them below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, date of birth, address, email address, payment details, device identifiers and behavioural data.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure and deletion.
• "Data Controller" — xk999, which determines the purposes and means by which Personal Data is processed.
• "Data Processor" — A third party that processes Personal Data on behalf of xk999 under contractual instruction.
• "Consent" — A freely given, specific, informed and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" — Know Your Customer. The identity, age and address verification process required to confirm Account eligibility and comply with applicable anti-money laundering obligations.
• "AML" — Anti-Money Laundering. Regulatory obligations and internal controls to detect and prevent financial crime through the platform.
• "Cookie" — A small text file placed on your device by a website to store information about your session, preferences or browsing behaviour.
• "Services" — All products, features, games, betting markets and functionality made available to registered users through the xk999 platform at https://xk999.cam.

xk999 collects Personal Data through your direct interactions with the platform, automated technical systems and, where permitted, third-party verification services. The categories of data collected are as follows:

3.1 Registration Data

When you create an Account, we collect your full legal name, date of birth, email address, mobile phone number, residential address, chosen username and password (stored in hashed form — never as plain text), and your preferred currency (e.g., PKR).

3.2 Identity Verification (KYC) Data

To comply with KYC and AML obligations, we may collect copies of government-issued identity documents such as a valid Pakistani CNIC or international passport; proof of address documents such as utility bills or bank statements; liveness check data and selfie images; and proof of ownership of the payment method used. These documents are processed solely for verification purposes and are stored securely in accordance with Section 8.

3.3 Financial & Transaction Data

We collect records of deposits made, withdrawals requested, bonuses credited and wagering activity on your Account. Where payment methods are used, we collect the information necessary to process the transaction — for example, partial masked account numbers or wallet identifiers. Full payment card numbers, if applicable, are handled by compliant third-party payment processors and are not stored on xk999 servers.

3.4 Technical & Device Data

When you access the platform, our systems automatically record your IP address, browser type and version, device type and operating system, pages visited, session duration, referring URL and approximate geographic location derived from your IP address.

3.5 Communications Data

If you contact Support via Live Chat, Help Center or email, we retain records of those communications including message content, timestamps and Account identifiers, for the purposes of responding to your query and maintaining service quality records.

3.6 Marketing Preference Data

Where you have opted in to receive promotional communications, we record your consent preferences and the channels through which you have agreed to receive marketing materials. You may withdraw this consent at any time via your Account settings or by contacting Support.

xk999 uses your Personal Data only for specified, legitimate purposes. The table below summarises the primary uses:

xk999 processes Personal Data on the following legal bases depending on the specific processing activity:

• Contract Performance: Processing necessary to perform the Services you have requested, including Account management, deposit processing, withdrawal handling and customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC identity verification, AML transaction monitoring, age verification requirements and responses to lawful authority requests.
• Legitimate Interest: Processing necessary for xk999's legitimate business interests, including fraud detection, platform security, responsible gambling monitoring and service improvement — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

xk999 does not sell, rent or trade your Personal Data to any third party for their independent marketing purposes. We may share your data in the following limited circumstances:

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process Personal Data on our behalf under contractual data processing agreements. These include payment processing partners, KYC and identity verification services, fraud detection providers, cloud infrastructure and hosting providers, and customer support software operators. These processors act only on xk999's documented instructions and are not permitted to use your data for their own purposes.

6.2 Regulatory and Legal Authorities

xk999 may disclose Personal Data to competent regulatory bodies, law enforcement agencies, financial intelligence units or courts when required to do so by applicable law, a valid court order or regulatory direction. We will endeavour to notify affected users of such disclosures where legally permissible.

6.3 AML and Financial Crime Prevention

In accordance with applicable AML obligations, xk999 may report suspicious transaction activity to relevant financial intelligence authorities. Such disclosures are made confidentially and in compliance with applicable tipping-off restrictions — meaning we may be legally prohibited from notifying you that such a report has been made.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring or sale of the xk999 business or its assets, Personal Data held at the time of the transaction may be transferred to the acquiring entity, subject to equivalent data protection standards and this Policy's commitments being maintained.

6.5 With Your Consent

In circumstances not covered above, xk999 will share your Personal Data with third parties only with your explicit prior consent.

xk999 uses cookies and similar tracking technologies to enable platform functionality, improve user experience and collect analytical data. The following cookie categories are in use:

7.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They manage your login session, maintain security tokens and enable core features such as the cashier and account settings. These cannot be disabled without preventing the platform from working correctly.

7.2 Functional Cookies

Functional cookies remember your preferences such as language settings, currency display and game lobby layout choices. They improve your experience by not requiring you to re-configure settings on each visit.

7.3 Analytics Cookies

Analytics cookies collect aggregated, anonymised data about how visitors use the platform — including pages visited, time spent per page and navigation paths. This data informs platform improvement decisions. No individual player is identified through analytics data alone.

7.4 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair or prevent your use of the Services. Most modern browsers provide controls under Settings > Privacy or Settings > Cookies.

xk999 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of your Account and for a minimum period following Account closure as required by applicable AML and record-keeping regulations.
• KYC and Identity Documents: Retained for the period required by the applicable licensing jurisdiction's AML regulations, typically five to seven years from the date of Account closure or last transaction.
• Transaction Records: Financial records are retained for the period required by applicable financial and AML regulations, generally not less than five years from the date of the transaction.
• Communications Data: Support communications are retained for a minimum of two years to support complaint resolution and quality assurance.
• Marketing Data: Marketing consent records and associated data are retained for the duration of your consent and for a reasonable period thereafter as evidence of lawful processing.
• Technical and Session Logs: Server access logs are typically retained for 90 days for security and fraud investigation purposes, after which they are deleted or anonymised.

When Personal Data is no longer required and no legal obligation exists to retain it, xk999 will securely delete or irreversibly anonymise it.

xk999 operates internationally and may use service providers or infrastructure located in countries outside your country of residence, including countries outside Pakistan. Where Personal Data is transferred internationally, xk999 ensures that appropriate safeguards are in place commensurate with applicable data protection standards. These may include contractual protections with receiving parties, technical security measures or adequacy assessments of the receiving jurisdiction.

If you have questions about specific international transfers applicable to your data, you may contact our Support team for further information.

xk999 implements a range of technical and organisational measures to protect your Personal Data against unauthorised access, disclosure, alteration and destruction. These measures include:

• HTTPS/SSL encryption on all pages and data transmissions between your browser and our servers.
• Passwords stored using industry-standard one-way hashing algorithms — plain-text passwords are never stored.
• Access to Personal Data restricted to authorised personnel with a documented operational need.
• Two-factor authentication (2FA) available to all registered Account holders to protect login credentials.
• Regular security reviews and vulnerability assessments of platform infrastructure.
• Contractual security requirements imposed on third-party Data Processors.
• Active session management enabling you to review and terminate active login sessions.

Notwithstanding these measures, no internet-based transmission or storage system is unconditionally secure. xk999 cannot guarantee absolute security but commits to responding to any confirmed data breach promptly, including notifying affected users and relevant authorities where required by applicable law.

Subject to applicable law and xk999's legitimate operational requirements (including AML and legal hold obligations), you have the following rights in respect of your Personal Data held by xk999:

To exercise any of the rights above, contact the xk999 Support team in writing via email or Live Chat. We will respond within 30 days of receiving your request. We may require identity verification before processing certain requests to protect against unauthorised data access.

The xk999 Services are strictly intended for adults aged 18 years and above, or the higher minimum age required by the operator's license jurisdiction. We do not knowingly collect or process the Personal Data of any person below the minimum age requirement.

If xk999 becomes aware or has reasonable suspicion that a registered Account is held by or being operated by a minor, we will immediately suspend that Account, conduct a KYC age verification review and, where applicable, delete the Personal Data collected and refund any deposits where lawfully required to do so.

If you believe a minor has registered an Account on xk999, please notify our Support team immediately via Live Chat or email so that appropriate action can be taken without delay.

The xk999 platform may contain references to third-party services or infrastructure (for example, payment processing partners) whose own privacy practices govern how they handle your data independently of xk999. Where you interact directly with a third-party service — such as when completing a transaction through a payment wallet provider — that third party's privacy policy applies to data processed during that interaction.

xk999 is not responsible for the privacy practices or content of any third party. We encourage you to review the privacy policies of any third-party service you use in connection with your xk999 Account, including your bank, mobile wallet provider or payment gateway.

xk999 reviews this Privacy Policy periodically and may update it to reflect changes in applicable law, regulatory requirements, platform functionality or our data processing practices. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

Where a material change is made to this Policy, we will endeavour to notify registered users via a notice displayed on the platform or an email to your registered address. Continued use of the Services following the effective date of any revision constitutes acceptance of the updated Policy.

We encourage you to review this Policy periodically so that you remain informed about how your Personal Data is being handled.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a complaint about how xk999 has handled your Personal Data, please contact us through the following channels:

xk999 will acknowledge written privacy complaints within 5 business days and provide a substantive response within 30 calendar days. Where a complaint cannot be resolved to your satisfaction through xk999's internal process, you may have the right to escalate your complaint to the relevant data protection authority in the jurisdiction where xk999 holds its operating licence.