Privacy Policy — How 777xp Handles Your Personal Data

777xp ("we", "us", "our") operates the online gaming information platform accessible at https://777xp.cam (the "Platform"). We are committed to handling all personal data entrusted to us with care, honesty and in compliance with applicable data protection law.

This Privacy Policy explains the types of personal data we collect from users of the Platform — including users located in Pakistan — the purposes for which that data is processed, the legal basis on which processing occurs, and the rights available to you as a data subject. We have written this policy in plain English so that every user, whether based in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar or elsewhere, can understand it without legal training.

By accessing the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, you should discontinue use of the Platform immediately.

The following definitions apply throughout this Privacy Policy:

777xp acts as the Data Controller in respect of personal data collected through the Platform. As Data Controller, 777xp determines the purposes for which your personal data is collected and processed, and is responsible for ensuring that processing complies with applicable data protection obligations.

Where 777xp engages third-party service providers — such as KYC verification services, hosting infrastructure providers and analytics platforms — those providers act as Data Processors under written data processing agreements that bind them to handle your data only in accordance with our instructions and applicable law.

The categories of personal data that 777xp may collect, depending on how you interact with the Platform, are set out below:

We do not intentionally collect special category personal data (such as health information, political opinions or biometric data) unless it is specifically required to process a responsible gambling self-exclusion or similar welfare-based request, in which case explicit consent will be sought.

Personal data is collected through the following channels:

• Direct interactions: Data you provide when registering an Account, completing KYC verification, updating your profile, making a deposit or withdrawal, or contacting our support team;
• Automated technical collection: IP addresses, device identifiers and session data collected automatically each time you access the Platform via server logs and operational monitoring systems;
• Cookies and tracking technologies: Session cookies, analytics cookies and, where consented to, personalisation technologies as described in Section 10;
• Third-party sources: Identity verification data returned by our KYC service providers following document verification; fraud prevention signals from security service providers;
• Publicly available sources: Where relevant for fraud prevention or compliance purposes, publicly accessible records.

777xp processes personal data only where a valid legal basis exists under applicable data protection law. The legal bases relied upon are as follows:

• Contractual necessity: Processing required to fulfil the Terms & Conditions you have entered into with 777xp — including Account management, support and transaction processing;
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering obligations, KYC requirements, regulatory reporting and law enforcement requests;
• Legitimate interests: Processing for fraud prevention, platform security, service improvement and analytics — where those interests are not overridden by your fundamental rights and freedoms;
• Consent: Processing for non-essential cookies, marketing communications and certain preference-based personalisation — where you have given explicit and freely withdrawable consent.

Personal data collected by 777xp is used for the following purposes:

• Creating, managing and securing your Account on the Platform;
• Verifying your identity and age in compliance with KYC and responsible gambling requirements;
• Processing deposits and withdrawals in co-ordination with the Operator;
• Providing customer support and responding to enquiries submitted via email or live chat;
• Detecting, investigating and preventing fraudulent activity, bonus abuse, money laundering and unauthorised access;
• Enforcing the Terms & Conditions and other Platform policies;
• Analysing Platform usage to improve performance, content quality and user experience;
• Sending transactional notifications such as deposit confirmations, withdrawal updates and security alerts;
• Sending marketing communications — including news about promotions and new game categories — only where you have explicitly opted in to receive them;
• Maintaining records required by applicable AML, KYC and regulatory frameworks;
• Responding to lawful requests from regulators, courts and law enforcement agencies.

We do not use your personal data for automated decision-making that produces legally significant effects unless we have your explicit consent, or such processing is necessary for the performance of our contract with you or is required by applicable law.

777xp does not sell personal data. We share personal data with third parties only in the following circumstances and categories:

• Licensed Operator: Account data and KYC documentation may be shared with the licensed Operator whose services are accessible through the Platform, to enable account management and regulatory compliance;
• KYC and identity verification providers: Identity documents and verification data are processed by our contracted KYC service providers solely for identity and age verification purposes;
• Payment processors: Transaction reference data is shared with payment processing infrastructure providers to facilitate deposits and withdrawals. Payment provider names such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are referenced here as examples of familiar Pakistani payment rails — their inclusion does not imply endorsement of gambling;
• Fraud and security services: Technical identifiers and behavioural signals may be shared with fraud prevention and cybersecurity service providers;
• Analytics providers: Anonymised or pseudonymised usage data may be processed by analytics platform providers to help us understand Platform performance;
• Regulatory and legal authorities: We will disclose personal data to competent authorities where required to do so by applicable law, court order, or lawful regulatory request, without prior notice to you where legally permitted;
• Business transfers: In the event of a merger, acquisition or sale of all or part of our business, personal data may be transferred to the acquirer as part of the transaction, subject to equivalent data protection obligations.

All third-party data processors engaged by 777xp are bound by written data processing agreements that prohibit them from using your data for any purpose beyond those instructions.

777xp operates an international platform. Your personal data may be transferred to, stored in, and processed in countries outside of Pakistan and outside of your country of residence. Where personal data is transferred to a country that does not provide an equivalent level of data protection to that in the country from which the data originates, we take appropriate safeguards to ensure that the transfer is lawful and that your data receives adequate protection.

Safeguards for international transfers may include: standard contractual clauses approved by competent data protection authorities; binding corporate rules; adequacy decisions; or other lawful transfer mechanisms. If you would like more information about international data transfers applicable to your specific data, please contact us using the details in Section 18.

The Platform uses cookies and similar tracking technologies to operate correctly, analyse usage and, where consented to, personalise your experience. The following categories of cookies are used:

You can manage cookie preferences through your browser settings at any time. Disabling strictly necessary cookies may prevent the Platform from functioning correctly. For analytics and marketing cookies, your consent can be withdrawn through the cookie preference centre accessible on the Platform.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Account and KYC data: Retained for the duration of the Account relationship and for a minimum period of five years following account closure, as required by anti-money laundering regulations applicable to the Operator's licence jurisdiction;
• Transaction records: Retained for a minimum of five years from the date of the transaction to comply with AML and financial record-keeping obligations;
• Support and communications records: Retained for two years from the date of the communication, unless the matter relates to an ongoing dispute or legal proceeding;
• Technical and usage data: Retained in identifiable form for up to 13 months; thereafter retained only in anonymised aggregate form for platform analytics purposes;
• Marketing consent records: Retained until consent is withdrawn, plus a further period necessary to demonstrate compliance.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

777xp implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your browser and our servers;
• Encryption of sensitive personal data fields at rest within our database infrastructure;
• Role-based access controls limiting access to personal data to authorised personnel with a documented operational need;
• Two-factor authentication requirements for administrative access to systems containing personal data;
• Regular security audits, vulnerability assessments and penetration testing;
• Incident response procedures designed to detect, contain and report data breaches within required timeframes.

Subject to applicable law, you have the following rights in relation to your personal data held by 777xp:

To exercise any of these rights, please submit a request to [email protected] with the subject line "Data Rights Request" and include sufficient information for us to verify your identity. We will respond within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 60 days with written notification.

The Platform is strictly intended for adults. We do not knowingly collect personal data from any person under the age of 18 — or the higher minimum age required by the applicable Operator licence jurisdiction. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated Account.

If you believe that a minor has provided personal data to 777xp, please contact us immediately at [email protected] so that we can investigate and take appropriate action. Parents and guardians are encouraged to monitor their children's online activity and to use parental control tools available on their devices and networks.

Pakistan does not currently have a comprehensive standalone data protection statute equivalent to international frameworks such as the GDPR. However, data protection obligations arise through several applicable instruments, including the Prevention of Electronic Crimes Act 2016 (PECA), directives of the Pakistan Telecommunication Authority (PTA) and general constitutional privacy protections.

777xp is not incorporated in Pakistan and does not claim to be subject to the regulatory supervision of the PTA, the State Bank of Pakistan, or any other Pakistani regulatory authority. Our data protection practices are designed to meet internationally recognised standards. Pakistani users accessing the Platform do so subject to the governing law of the Operator's licence jurisdiction, as described in our Terms & Conditions.

References to payment providers such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah within this policy are made solely as examples of familiar Pakistani payment infrastructure. None of these entities are data processors engaged by 777xp, and none have endorsed, sponsored or approved the collection of data by 777xp.

The Platform may contain references to or links to third-party websites, including the websites of Operators whose services are described in our educational content. 777xp has no control over the data collection practices of third-party websites. This Privacy Policy applies only to the 777xp Platform at https://777xp.cam. We encourage you to review the privacy policies of any third-party websites you access before providing them with personal data.

The presence of a reference to a third-party website on this Platform does not constitute an endorsement of that website's privacy practices or data handling standards.

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law or Platform functionality. The effective date of the most recent version is displayed at the top of this page. Where changes are material, we will make reasonable efforts to notify registered users via email or in-platform notification.

Continued use of the Platform following the posting of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you should cease using the Platform and request account closure through the contact details in Section 18.

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data by 777xp, please contact our Data Privacy team. All data rights requests should include your full name, registered email address and a clear description of the right you wish to exercise. Identity verification may be required before a request can be actioned.

Please do not include full payment card numbers, bank account details or account passwords in any correspondence with our team. These are never required to process a data rights request.