xh88 Privacy Policy

This Privacy Policy applies to all personal data processed by xh88 in connection with the operation of the xh88 platform at xh88.lat, including all related subdomains, applications, and customer support channels. It applies to all registered players and prospective players who interact with the xh88 platform regardless of their location, and extends to all data collected before, during, and after Account registration.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, mobile number, or online identifier.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, and deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. xh88 is the Data Controller for all Personal Data collected through the xh88 platform.
• "Data Processor" — a third party that processes Personal Data on behalf of and under the instruction of xh88 (e.g., KYC verification service providers, payment processors).
• "Player," "you," "your" — any natural person who has registered or is in the process of registering an xh88 account, or who otherwise interacts with the xh88 platform.
• "Special Category Data" — sensitive Personal Data including, but not limited to, health information, financial vulnerability indicators, or information relating to gambling-related harm, which xh88 may collect strictly for responsible gaming purposes.

xh88 is the Data Controller responsible for the Personal Data collected and processed through the xh88 platform. xh88 operates under international online gaming licensing standards and is subject to applicable data protection obligations as a condition of its operating licence.

For all privacy-related inquiries, data subject rights requests, or complaints regarding xh88's data processing practices, Players may contact xh88's data protection point of contact via email at [email protected] (plain text — not a clickable link), clearly marking the communication as a "Privacy / Data Protection Matter" in the subject line.

xh88 will acknowledge all privacy-related correspondence within 5 business days and will endeavour to provide a substantive response within 30 calendar days of receipt. Complex requests may require additional time, in which case xh88 will inform the Player of the expected timeline before the initial 30-day period expires.

xh88 collects the following categories of Personal Data in the course of operating the platform and providing gaming services to Pakistani players:

xh88 collects Personal Data through the following means:

• Direct Collection at Registration: When you create an xh88 account, you provide identity, contact, and initial payment information directly through the registration interface.
• KYC Document Submission: When you submit identity documents as part of the account verification process, xh88 collects and processes the information contained within those documents.
• Platform Use: As you use the xh88 platform — placing bets, depositing funds, playing casino games, accessing the live casino floor, or interacting with customer support — xh88 automatically records gaming activity, session data, and transaction records.
• Payment Processing: Financial data is collected when you initiate deposits or withdrawal requests, including payment method identifiers and transaction confirmation data from payment processors such as JazzCash and EasyPaisa.
• Automated Technical Collection: xh88's servers automatically log technical data including your IP address, device type, browser characteristics, and connection timestamps each time you access the platform. This data is collected for security and fraud prevention purposes.
• Customer Support Interactions: All communications with xh88 customer support via live chat or email are recorded and retained for quality assurance, dispute resolution, and regulatory compliance purposes.
• Cookies and Tracking Technologies: xh88 uses cookies and similar technologies to maintain your login session, remember your preferences, and analyse platform usage patterns. Full details are set out in Section 9 of this Privacy Policy.

xh88 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contract Performance: Processing necessary to fulfil our contractual obligations to you as an xh88 account holder — including account administration, payment processing, game provision, and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money-laundering (AML) law, Know Your Customer (KYC) regulations, gaming licensing conditions, and tax reporting obligations. xh88 cannot waive these obligations at a Player's request.
• Legitimate Interests: Processing necessary for xh88's legitimate business interests, including fraud prevention, platform security, responsible gaming programme management, and service improvement — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where xh88 relies on your consent as the legal basis for processing — primarily in relation to direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Withdrawal of marketing consent does not affect your Account or access to xh88 Gaming Services.

xh88 uses the Personal Data it collects for the following specific purposes:

• Account Creation and Administration: To register, maintain, and administer your xh88 Account, including processing your login credentials and maintaining your account balance and history.
• Identity and Age Verification: To verify that you are who you say you are and that you are at least 21 years of age, as required by xh88's licensing obligations and responsible gaming policy.
• Payment Processing: To process deposits from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, USDT TRC20, and other supported payment methods, and to process withdrawal requests to your nominated account.
• AML Compliance: To monitor transactions and gaming activity for indicators of money laundering, terrorist financing, or other financial crime, and to report suspicious activity to the relevant authorities where legally required.
• Responsible Gaming: To monitor gaming patterns and identify players who may be experiencing gambling-related harm, and to proactively offer responsible gaming tools including deposit limits, session controls, and self-exclusion where appropriate.
• Fraud and Security: To detect, investigate, and prevent fraudulent activity, unauthorised Account access, software exploitation, and other security threats to the Platform and its players.
• Customer Support: To respond to your inquiries, resolve complaints, and provide assistance in relation to your xh88 Account and gaming activities.
• Platform Improvement: To analyse aggregated usage patterns and identify opportunities to improve the xh88 platform, game selection, payment infrastructure, and user experience for Pakistani players.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have provided your explicit consent to receive such communications, and subject to your right to opt out at any time.

xh88 does not sell Personal Data. We share Personal Data with third parties only where it is strictly necessary for one of the purposes described in Section 6, or where we are legally obliged to do so. The following categories of third parties may receive access to your Personal Data:

• KYC and Identity Verification Providers: Third-party services that verify the authenticity of identity documents and conduct age and identity checks as required by xh88's licensing obligations.
• Payment Processors: Financial services providers that facilitate the processing of deposits and withdrawals — including JazzCash, EasyPaisa, Pakistani commercial banks, and cryptocurrency exchange infrastructure providers — who receive only the transaction data necessary to execute and confirm payment instructions.
• Game Studio Partners: Certified game studios (including live casino operators) whose software is hosted on the xh88 platform may receive technical session data necessary to deliver games to your device and to log game outcomes for audit and fairness certification purposes.
• Fraud Prevention and Security Services: Third-party fraud analytics and device fingerprinting providers used to detect and prevent account fraud, bonus abuse, and money laundering on the Platform.
• Legal and Regulatory Authorities: Where xh88 is required by applicable law, court order, licensing condition, or regulatory direction to disclose Personal Data — including to law enforcement, financial intelligence units, or gaming regulators — xh88 will comply with such lawful requests.
• Professional Advisors: xh88's legal counsel, auditors, and compliance advisors may access Personal Data on a confidential basis where necessary to provide professional services to xh88.

xh88 takes the security of financial data with the utmost seriousness. Pakistani players deposit and withdraw using locally trusted methods — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 — and xh88 has designed its payment data handling accordingly.

• No Full Card Storage: Where card payments are supported, xh88 does not store full payment card numbers. Card data is tokenised through the payment processor immediately upon submission, and only a masked reference token is retained by xh88.
• Mobile Wallet Data: JazzCash and EasyPaisa mobile wallet identifiers (mobile numbers) are retained solely for the purpose of processing deposits, verifying transaction confirmation, and processing withdrawals to the same account from which a deposit originated.
• Bank Account Data: HBL, UBL, Meezan Bank, and SadaPay account numbers provided for withdrawal purposes are stored in encrypted form and accessed only by xh88's finance operations team under strict access controls.
• Transaction Records: Complete records of all deposits and withdrawals processed through your xh88 Account are retained for a minimum of 7 years following Account closure, in compliance with applicable AML record-keeping requirements.
• Cryptocurrency: USDT TRC20 wallet addresses used for deposits or withdrawals are recorded in association with the relevant transactions and retained in accordance with standard transaction record requirements.

xh88 uses cookies and similar tracking technologies to operate and improve the platform, maintain your login session, and analyse how Pakistani players interact with the xh88 interface. The following types of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the xh88 platform to function. They maintain your login session, remember your currency preference, and enable core Platform features. These cookies cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: These cookies collect anonymised information about how players use the xh88 Platform — which pages are visited most frequently, where players navigate from, and how long sessions last. This data is used to improve the Platform experience. These cookies do not identify individual players.
• Functional Cookies: These cookies remember your Platform preferences — such as your last visited section, display settings, and game category preferences — to provide a more personalised experience on subsequent visits.
• Security Cookies: These cookies support xh88's fraud prevention and account security systems, including session integrity verification and device recognition for two-factor authentication purposes.

You may configure your browser to reject or delete cookies at any time. However, disabling strictly necessary cookies will impair the functionality of the xh88 platform, including your ability to maintain a login session. xh88 does not use third-party advertising cookies or cross-site tracking technologies for the purpose of serving targeted advertising on other websites.

xh88 implements a comprehensive set of technical and organisational security measures designed to protect Player data against unauthorised access, accidental loss, destruction, or alteration:

• 256-Bit SSL/TLS Encryption in Transit: All data transmitted between your device and xh88's servers is encrypted using Transport Layer Security (TLS) with 256-bit encryption. This prevents interception by third parties during transmission.
• AES-256 Encryption at Rest: Sensitive Personal Data stored in xh88's database infrastructure is encrypted at rest using AES-256, ensuring that data remains protected even in the event of unauthorised physical or logical access to storage systems.
• Password Hashing: Player passwords are hashed using a one-way cryptographic algorithm before storage. xh88 does not store recoverable passwords and cannot retrieve a Player's original password — only a secure reset process is available.
• Access Controls: Access to Player Personal Data within xh88's operational systems is restricted to personnel with a verified operational need for that access. All internal data access is logged and auditable.
• Two-Factor Authentication: xh88 offers and encourages the use of two-factor authentication (2FA) for all player accounts, adding an additional layer of security to the login process beyond username and password.
• Intrusion Detection: xh88's technical infrastructure includes automated intrusion detection and anomaly monitoring systems that flag unusual data access patterns for immediate investigation.
• Regular Security Reviews: xh88 conducts periodic security assessments of its data processing infrastructure and engages third-party security specialists for independent penetration testing and vulnerability assessments.

xh88 retains Personal Data for the minimum period necessary to fulfil the purposes for which it was collected, subject always to overriding legal retention obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised. Anonymised data (from which individual players cannot be identified) may be retained indefinitely for statistical and platform improvement purposes.

As an xh88 player, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact xh88 at [email protected] (plain text), clearly stating which right you wish to exercise and providing sufficient information to identify your Account.

xh88 will send you promotional communications — including bonus offers, seasonal promotions, PSL cricket betting specials, and platform announcements — only where you have provided explicit consent to receive such communications during Account registration or through your Account settings.

• Opt-Out: You may withdraw your marketing consent at any time by updating your communication preferences in your xh88 Account settings, or by contacting support. Opt-out requests will be processed within 5 business days. Withdrawal of marketing consent does not affect your access to xh88 Gaming Services.
• Transactional Communications: Certain communications — including Account security alerts, withdrawal confirmations, deposit receipts, KYC status notifications, and responsible gaming messages — are sent as part of xh88's operational and contractual obligations regardless of your marketing communication preferences. These are not marketing and cannot be disabled without closing your Account.
• Communication Channels: xh88 sends marketing communications via email and (where consented) via SMS to your registered Pakistani mobile number. xh88 does not engage in unsolicited telephone marketing.

The xh88 platform is strictly restricted to persons aged 21 and above. xh88 does not knowingly collect Personal Data from individuals under the age of 21. The xh88 registration process includes mandatory age verification, and xh88 reserves the right to request documentary proof of age (such as a CNIC or passport) at any point during a Player's use of the platform.

If xh88 becomes aware that Personal Data has been collected from or submitted by an individual who is in fact under 21 years of age, xh88 will immediately close the associated Account, void all associated balances, and delete or anonymise the relevant Personal Data to the extent permitted by applicable legal record-keeping requirements. The existence of a minor's data may be retained solely to the extent required to evidence the fraudulent misrepresentation of age at registration.

In the course of operating a globally-interfaced platform with Pakistani players, xh88 may transfer Personal Data to data processors or infrastructure providers located outside Pakistan. Such transfers occur in the following contexts:

• Cloud Infrastructure: xh88's platform infrastructure may utilise cloud hosting providers whose server infrastructure is distributed across multiple international data centres. All such providers are contractually bound to implement equivalent data protection standards.
• KYC Verification Services: Third-party KYC providers used by xh88 may process identity documents on infrastructure located outside Pakistan. Such providers are selected on the basis of their security standards and data protection compliance.
• Game Studios: Live casino and slot game studios contracted by xh88 to provide gaming content may be located outside Pakistan. Session data transmitted to these studios for game delivery purposes is subject to the contractual data protection requirements imposed by xh88 on all third-party processors.

Where Personal Data is transferred internationally, xh88 implements appropriate safeguards including contractual data protection clauses with all international Data Processors, and conducts transfer impact assessments where required by applicable law.

xh88 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, platform functionality, applicable law, or regulatory guidance. The Effective Date and Last Reviewed date at the top of this document are updated each time a revised version is published.

Where changes to this Privacy Policy are material — meaning they significantly affect how xh88 processes your Personal Data or the rights you hold — xh88 will notify registered Players via their registered email address or through a prominent Platform notification at least 14 days prior to the changes taking effect, giving Players the opportunity to review the changes before they apply.

Continued use of the xh88 platform following the publication of an updated Privacy Policy constitutes the Player's acceptance of the revised policy. The current version of this Privacy Policy is always available at xh88.lat/privacy-policy. Players who do not accept a material change may close their Account prior to the effective date of the change.

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or believe that xh88 has not handled your Personal Data in accordance with this policy, please contact xh88 using the information below.

Email: [email protected] (plain text — not a clickable link). Please mark your email subject line as "Privacy Policy / Data Complaint" so it is directed to the appropriate team.

xh88 will acknowledge privacy-related complaints within 5 business days and will investigate all complaints thoroughly and impartially. Where xh88 determines that a complaint is well-founded, we will take appropriate corrective action and inform the Player of the steps taken.

If you are not satisfied with xh88's response to a privacy complaint, you may have the right to escalate your complaint to the relevant data protection supervisory authority or to xh88's applicable gaming licensing authority, which has oversight of xh88's compliance with applicable licensing conditions including data protection obligations. xh88 will cooperate fully with any regulatory inquiry.