Privacy Policy — x1777

This Privacy Policy ("Policy") is issued by x1777 ("x1777", "we", "us" or "our") and applies to all personal data processed in connection with the online casino and sports betting platform accessible at https://x1777.cam, including any related subdomains, mobile interfaces and associated services (collectively, "the Platform" or "the Service").

This Policy describes the categories of personal data we collect, the purposes for which it is processed, the legal bases we rely upon, our data sharing practices, your rights as a data subject, and how to exercise those rights or raise a concern with us.

By registering an account on the x1777 Platform, you confirm that you have read and understood this Policy and that you consent to the processing of your personal data as described herein, to the extent that consent is the applicable legal basis. Where processing is based on a legal obligation or legitimate interest, your consent is not required; however, you retain applicable rights as described in Section 9.

This Policy should be read in conjunction with the x1777 Terms & Conditions and Responsible Gambling Policy. In the event of a conflict between this Policy and the Terms & Conditions on a data-related matter, this Policy shall prevail.

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"), including name, identification number, location data, online identifiers, or factors specific to the physical, economic, cultural or social identity of that person.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, storage, use, disclosure, alteration or deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, x1777.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller, under the Controller's instructions.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates — in this context, you, the registered Player.
• "KYC" means Know Your Customer — the identity verification and due diligence process required under applicable anti-money laundering obligations.
• "Cookies" means small text files placed on your device by the Platform to enable certain functionality, session management and analytics.
• "Special Category Data" means Personal Data that is particularly sensitive by nature, including data revealing racial or ethnic origin, political opinions, religious beliefs, health data or biometric data. x1777 does not intentionally collect Special Category Data.

x1777 collects the following categories of Personal Data in the course of providing the Service:

3.1 Identity & Registration Data

• Full legal name
• Date of birth (for age verification)
• Nationality and country of residence
• Government-issued identification document details (e.g., CNIC number, passport number)
• Username and account credentials (passwords are stored in hashed form; we do not store plaintext passwords)

3.2 Contact Data

• Email address
• Mobile phone number
• Residential address (including city and province — e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar)

3.3 Financial & Payment Data

• Deposit and withdrawal transaction records
• Payment method identifiers (e.g., the registered account name on a mobile wallet such as Easypaisa or JazzCash, partial bank account references for HBL, UBL, Meezan Bank or Bank Alfalah, or partial cryptocurrency wallet addresses for BTC or USDT)
• Transaction amounts in PKR or applicable settlement currency
• Source of funds documentation where required by AML obligations

3.4 Gaming Activity Data

• Wagering history — bets placed, games played, amounts staked and outcomes
• Bonus claims and wagering requirement progress
• Sports markets accessed (e.g., cricket, PSL, ICC tournaments, football, UFC)
• Session duration and frequency of play

3.5 Technical & Device Data

• IP address
• Device type, operating system and browser version
• Geolocation data (approximate, derived from IP)
• Session timestamps and page interaction logs

3.6 Communications Data

• Records of correspondence with x1777 support, including live chat transcripts and email exchanges
• Voluntary feedback or survey responses

x1777 collects Personal Data through the following channels:

• Direct provision by you: Information you enter during registration, KYC verification, payment processing, support interactions and promotional opt-ins.
• Automated technical collection: Device and session data collected passively as you interact with the Platform, including via cookies and similar tracking technologies.
• Third-party identity verification providers: Where you submit KYC documents, an authorised verification service may process your identity data on our behalf and return a verification result.
• Payment processors: Transaction confirmation and payment status data received from payment processors upon completion of a deposit or withdrawal request.
• Fraud prevention and AML screening services: Risk screening data received from third-party services used to satisfy our anti-money laundering and fraud prevention obligations.

The table below summarises the primary purposes for which x1777 processes Personal Data and the legal basis relied upon for each purpose.

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent does not affect processing based on other legal bases such as contractual necessity or legal obligation.

x1777 does not sell, rent or trade your Personal Data. Data is shared with third parties only in the following circumstances:

6.1 Service Providers (Data Processors)

x1777 engages carefully selected third-party service providers to carry out specific operational functions. These providers process Personal Data solely under x1777's instructions and are contractually prohibited from using it for any other purpose. Categories of service providers include:

• Identity verification and KYC service providers
• Payment processing and gateway providers
• Cloud infrastructure and data hosting providers
• Fraud detection and AML screening providers
• Customer support platform providers
• Analytics and performance monitoring tools

6.2 Regulatory and Legal Authorities

x1777 may be required to disclose Personal Data to regulatory bodies, law enforcement agencies or courts where required by applicable law, a valid legal order, or where disclosure is necessary to protect the rights or safety of x1777, its players or the public. We will endeavour to notify you of any such disclosure where legally permissible to do so.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of x1777's business, Personal Data may be transferred to the acquiring entity as part of that transaction, subject to the same data protection obligations as set out in this Policy.

6.4 No Sale of Data

Under no circumstances does x1777 sell, exchange or otherwise transfer your Personal Data to third parties for advertising, marketing or commercial profiling purposes without your explicit prior consent.

x1777 uses cookies, web beacons, pixels and similar tracking technologies on the Platform. The following categories of cookies are used:

You may manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to use the Platform, including logging in and processing transactions. For detailed instructions on managing cookies in your specific browser, refer to that browser's support documentation.

x1777 retains Personal Data for as long as necessary to fulfil the purposes set out in this Policy, unless a longer retention period is required or permitted by applicable law. Key retention principles are as follows:

• Active account data: Retained for the duration of your registered account relationship with x1777.
• KYC and identity documents: Retained for a minimum period of five (5) years following account closure, or longer where required by applicable anti-money laundering legislation.
• Financial transaction records: Retained for a minimum of five (5) years after the date of the transaction, in accordance with financial record-keeping obligations.
• Gaming activity data: Retained for a minimum of three (3) years for responsible gambling monitoring, dispute resolution and regulatory purposes.
• Support communications: Retained for a minimum of two (2) years following the conclusion of the interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained until consent is withdrawn, plus a reasonable period thereafter to evidence historical consent status.

Upon expiry of the applicable retention period, data will be securely deleted or irreversibly anonymised, unless legal obligations require continued retention.

Subject to applicable law and the legal basis for processing, you have the following rights in relation to your Personal Data held by x1777. To exercise any of these rights, contact us at [email protected] with the subject line "Data Subject Request" and a description of the right you wish to exercise.

x1777 implements appropriate technical and organisational measures to protect Personal Data against unauthorised access, accidental loss, destruction or disclosure. Security measures include, but are not limited to:

• Encryption of data in transit using TLS (Transport Layer Security)
• Hashed and salted storage of account passwords — plaintext passwords are never stored
• Role-based access controls limiting staff access to Personal Data to those with a legitimate operational need
• Regular internal security reviews and vulnerability assessments
• Incident response procedures to detect, investigate and respond to data security incidents

Notwithstanding the above, no method of electronic transmission or storage is completely secure. x1777 cannot guarantee absolute security of your data. In the event of a material data breach affecting your rights and freedoms, x1777 will notify affected individuals in accordance with applicable legal requirements.

You are responsible for maintaining the confidentiality of your account credentials. Do not share your password with anyone, and notify x1777 support immediately if you suspect unauthorised access to your account.

As an online platform with a global operational infrastructure, x1777 may transfer Personal Data to countries outside the jurisdiction in which you reside, including to countries that may not provide the same level of data protection as your home jurisdiction. Such transfers are conducted in accordance with applicable data transfer mechanisms, including standard contractual clauses or equivalent safeguards where required.

Where data is transferred to third-party service providers located outside applicable data protection regulatory frameworks, x1777 ensures that contractual obligations are in place to maintain an equivalent standard of data protection.

The x1777 Platform is strictly for adults aged 18 years or above, or the higher minimum age required by the operator's license jurisdiction. x1777 does not knowingly collect Personal Data from individuals below the applicable minimum age. If you believe that a minor has registered on the Platform, please notify us immediately at [email protected].

Upon confirmation that an account was registered by a person below the applicable minimum age, x1777 will immediately suspend and close that account, delete the associated Personal Data to the extent legally permissible, and take appropriate remedial action, including the return of any deposited funds after applicable processing deductions.

The x1777 Platform may contain references to third-party payment services (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah) and other external services. These references are for informational context only. x1777 is not responsible for the privacy practices of any third-party services, and this Policy does not apply to data processed by those third parties. You should review the privacy policies of any external service you use in connection with your use of x1777, particularly your chosen payment provider.

x1777 reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to registered users via email to the registered address or through a prominent notice on the Platform, with reasonable advance notice where practicable.

The effective date displayed at the top of this Policy will be updated to reflect the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not accept the amended Policy, you must cease using the Platform and request account closure.

For any questions, concerns or requests relating to this Privacy Policy or the processing of your Personal Data, please contact x1777 through the following channels:

• Email: [email protected] — please use the subject line "Privacy Request" or "Data Subject Request" for privacy-related correspondence.
• Live Chat: Available 24/7 on the x1777 Platform. Live chat is recommended for urgent queries; a written email record is recommended for formal data subject requests.

x1777 will acknowledge receipt of a data subject request within a reasonable period and will respond within 30 calendar days of receiving a complete, verifiable request. Where the request is complex or multiple requests are received concurrently, this period may be extended by up to a further 60 days, with notification to you.

If you are dissatisfied with x1777's response to a privacy complaint, you have the right to escalate the matter to the relevant supervisory authority in the operator's license jurisdiction. Details of the applicable supervisory authority are available on request.