xhopex Privacy Policy — How We Protect Your Personal Data

xhopex (accessible at xhopex.app) is an online casino and sports gaming platform operated for and serving players in Pakistan. xhopex is the data controller for all personal information collected through the platform. As data controller, xhopex is responsible for deciding how and why your personal data is collected and used.

This Privacy Policy applies to all personal data collected through the xhopex website, mobile interface, customer support channels, and any other interaction you have with the xhopex platform. It covers data collected from registered players as well as data collected from visitors who browse the xhopex website without registering an account.

If you have questions about this Privacy Policy or about how xhopex handles your personal information, you can contact our data team directly at support@xhopex.app. We respond to all privacy-related queries within 5 business days.

xhopex collects personal data through several channels. Below is a complete breakdown of the categories of data we collect, the source of each, and why it is needed:

xhopex uses your personal data solely for the purposes set out below. We do not repurpose data for uses that are incompatible with the original collection purpose without obtaining fresh consent from you.

• Account Management: Creating, maintaining, and securing your xhopex account. This includes verifying your identity at registration, managing login credentials, and processing account closure requests.
• Transaction Processing: Handling PKR deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and Visa/Mastercard. This requires sharing relevant transaction data with our payment processing partners to complete the transfer.
• Platform Operation: Running the games, maintaining session history, calculating VIP tier status, and operating the Refer a Friend programme. Without this data, the core functions of xhopex cannot work.
• Security and Fraud Prevention: Monitoring account activity for unusual patterns that may indicate fraud, account takeover, or bonus abuse. xhopex uses technical data including IP addresses and device fingerprints as part of this monitoring.
• Responsible Gaming: Using account activity data to identify behaviour patterns that may indicate problem gambling, and triggering responsible gaming interventions where necessary — including deposit limit reminders and support referrals.
• Legal and Regulatory Compliance: Meeting our obligations under applicable anti-money laundering and know-your-customer regulations. This includes retaining transaction records and identity verification documents for the periods required by law.
• Customer Support: Resolving queries, investigating complaints, and managing disputes using communications and account activity records.
• Platform Improvement: Analysing anonymised and aggregated usage data to identify how the platform can be improved. This analysis does not involve making decisions about individual players based on their personal profiles.
• Marketing Communications: Sending promotional emails and notifications about xhopex offers and VIP Club updates — but only to players who have opted in to marketing communications and only via channels they have consented to.

Every data processing activity at xhopex is conducted on one of the following legal bases:

• Contract Performance: Processing your personal data is necessary to perform the contract between you and xhopex — that is, to operate your account, process your transactions, and provide the games and services you have registered to use. Without this processing, xhopex cannot deliver what you signed up for.
• Legal Obligation: Certain processing — particularly identity verification, transaction record-keeping, and AML reporting — is required by applicable regulations. xhopex is legally obligated to carry out this processing regardless of your preferences.
• Legitimate Interests: Some processing is carried out on the basis of xhopex's legitimate interests in operating a secure, fraud-free platform and protecting the integrity of our services. This includes security monitoring and fraud detection. We only rely on this basis where our interest is not overridden by your privacy rights.
• Consent: Processing for marketing communications and optional platform features is conducted only where you have provided clear, informed consent. You can withdraw consent for marketing communications at any time by updating your preferences in account settings or by contacting support.

xhopex uses cookies and similar tracking technologies on the platform. Cookies are small text files placed on your device when you visit the website. They help us operate the platform correctly, maintain your session, and understand how players use xhopex so we can improve it.

The following categories of cookies are used on xhopex:

• Essential Cookies: These are strictly necessary to operate the xhopex platform. They maintain your login session, handle secure payment flows, and ensure the platform functions correctly. Essential cookies cannot be disabled without breaking core platform functionality.
• Analytics Cookies: These collect anonymised data about how players navigate xhopex — which pages are visited most often, where players encounter issues, and how sessions flow through the platform. This data is aggregated and does not identify individual players. Analytics cookies can be declined.
• Preference Cookies: These remember your platform settings — language preferences, game configuration, and display preferences — so you do not have to reconfigure them each visit. Preference cookies can be declined, but doing so means your settings will not persist between sessions.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent xhopex from functioning correctly and you will not be able to log in or place bets.

xhopex does not sell your personal data. We share data with third parties only where it is necessary to operate the platform or meet our legal obligations. The following categories of third parties may receive your data:

• Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and card processing partners receive the transaction data necessary to process your deposits and withdrawals. These partners process data under their own privacy policies and are responsible for securing the data they receive.
• Identity Verification Providers: Where third-party KYC verification services are used to validate CNIC documents or confirm identity, your verification data is shared with those providers only for the purpose of completing the verification check. They do not retain your data beyond what is required for that verification.
• Game Providers: Licensed game software providers whose titles are hosted on xhopex may receive anonymised session data for the purpose of game performance monitoring and RNG certification. They do not receive your identifiable personal information.
• Regulatory and Law Enforcement Authorities: xhopex may be required by applicable law or regulation to disclose personal data to governmental or regulatory authorities, including as part of AML reporting obligations. Such disclosures are made only when legally required.
• Technology and Infrastructure Providers: Cloud hosting, data storage, and platform infrastructure providers may process your data as data processors acting under xhopex's instructions. These providers are contractually bound to process data only as directed by xhopex and to maintain appropriate security standards.

All third parties who process xhopex player data on our behalf are required to enter into data processing agreements that obligate them to handle the data securely, use it only for the specified purpose, and not share it further without xhopex's authorisation.

xhopex employs a range of technical and organisational security measures to protect your personal data from unauthorised access, loss, disclosure, or misuse. Security is not treated as an afterthought at xhopex — it is embedded in how the platform is built and operated.

Specific security measures in place at xhopex include:

• TLS Encryption: All data transmitted between your device and the xhopex platform is encrypted in transit using Transport Layer Security (TLS). This prevents interception of your data on public or shared networks.
• At-Rest Encryption: Personal data stored in xhopex databases is encrypted at rest. This means that even in the unlikely event of a database compromise, stored data is not readable without the encryption keys, which are stored separately and under strict access control.
• Access Controls: Access to personal data within xhopex is restricted on a need-to-know basis. Staff who do not require access to personal data as part of their role do not have it. Access rights are reviewed regularly.
• Two-Factor Authentication: 2FA is available and recommended for all player accounts. For internal system access, 2FA is mandatory for all xhopex staff with access to player data systems.
• Security Monitoring: xhopex monitors platform activity for security anomalies and potential data access events. Automated alerts are triggered by access patterns that deviate from normal operational behaviour.
• Payment Data Isolation: xhopex does not store full payment card numbers or full mobile wallet credentials. Payment processing is handled through PCI-compliant channels, and only the minimum reference data required for transaction matching is retained by xhopex.

In the event of a personal data breach that poses a risk to players, xhopex will notify affected individuals promptly and take immediate steps to contain and remediate the breach. Security incidents can also be reported by players to support@xhopex.app.

xhopex retains personal data only for as long as it is needed for the purpose for which it was collected, or for as long as is required by applicable regulations. The following retention periods apply:

After the applicable retention period has passed, xhopex securely deletes or anonymises the relevant data. Anonymised data may be retained beyond these periods for aggregated analytics, but it cannot be linked back to any individual player.

As an xhopex player, you have the following rights regarding your personal data. To exercise any of these rights, contact support@xhopex.app with the subject line "Data Rights Request" and we will respond within 30 days:

xhopex is strictly an adult platform intended for users aged 18 and above. We do not knowingly collect personal data from any person under the age of 18. All registration submissions are subject to age verification checks, and accounts confirmed to be held by minors are closed immediately with all associated data deleted, except where retention is required to document the breach and prevent re-registration.

If you are a parent or guardian and believe that a person under 18 in your household has registered an account on xhopex, please contact support@xhopex.app immediately. We will investigate and, where confirmed, close the account and remove all associated personal data as quickly as practicable.

xhopex sends promotional communications — including bonus offers, VIP Club updates, new game announcements, and Refer a Friend programme news — to players who have opted in to receive them. Marketing communications are sent only by email and in-platform notification.

You can update your marketing preferences at any time from the notifications section of your xhopex account settings. You can also unsubscribe from email marketing by clicking the unsubscribe link in any promotional email. Opt-out requests are processed within 48 hours.

Please note that opting out of marketing communications does not affect transactional communications — xhopex will still send you account security alerts, payment confirmation messages, withdrawal notifications, and support responses regardless of your marketing preference settings, as these are essential communications related to the operation of your account.

xhopex may update this Privacy Policy from time to time as the platform evolves, as new payment methods are added, or as applicable regulations change. When material changes are made — meaning changes that significantly affect how we use your data or what rights you have — we will notify registered players via email at least 14 days before the updated policy takes effect.

Minor clarifications or corrections that do not alter the substance of the policy may be published without advance notice. The effective date shown at the top of this page always reflects when the current version was last updated. We encourage you to review this page periodically, particularly if you receive a notification of an update.

Continued use of the xhopex platform following the effective date of an updated Privacy Policy constitutes your acceptance of the updated terms. If you do not accept a material change, you may close your account without penalty by contacting support before the effective date of the change.

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how xhopex is handling your personal information, please get in touch:

This Privacy Policy is written in English (en-PK) for Pakistani players. It was last updated on 1 June 2025. In the event of any ambiguity in interpretation, the English text shall prevail.