123xxx Privacy Policy — How We Handle Your Personal Data

This Privacy Policy is issued by 123xxx, the operator of the online gaming and sports betting platform available at 123xxx.app. Throughout this policy, "123xxx", "we", "us", or "our" refers to the platform operator. "You" or "your" refers to any person who visits, registers on, or uses the 123xxx platform in any capacity.

123xxx acts as the data controller in respect of personal data collected through the 123xxx platform. This means that 123xxx determines the purposes for which and the manner in which your personal data is collected and processed. Where 123xxx engages third-party service providers to assist in delivering the platform's services, those third parties act as data processors under instruction from 123xxx, except where they independently determine their own purposes for processing, in which case they are independent data controllers for those purposes.

This policy covers personal data collected from members and visitors to 123xxx across all device types including desktop browsers, mobile browsers, and any native application that 123xxx may make available. If you have any questions about how 123xxx handles your personal data, the contact details are in Section 14 of this policy.

The personal data collected by 123xxx falls into four main categories depending on the context in which it is provided or generated:

Registration Data: When you create a 123xxx account you provide your full name, date of birth, Pakistani mobile number, and a password. This data is essential to create and manage your account.

Identity Verification Data: When 123xxx requires identity verification — for example before processing a large withdrawal or in response to a suspicious activity flag — we may request a copy of your Computerised National Identity Card (CNIC), a recent utility bill or bank statement, and a selfie or photograph for comparison. This data is used solely for verification and anti-fraud purposes.

Transaction Data: Every deposit, withdrawal, bet, game wager, and promotional claim made through 123xxx generates a transaction record associated with your account. This includes the amount, the payment method used, the date and time, and the outcome. Transaction records are retained for legal and regulatory compliance purposes.

Technical and Usage Data: 123xxx automatically collects certain technical data when you access the platform. This includes your IP address, device type and operating system, browser type and version, session duration, pages visited, and game or betting activity patterns. This data is used for security monitoring, fraud detection, platform performance optimisation, and responsible gaming monitoring.

123xxx uses your personal data for specific, defined purposes. The table below summarises the main processing activities, the data involved, and the justification for each.

Every instance of personal data processing at 123xxx is conducted under one of the following legal bases:

• Contract: Processing is necessary to fulfil our obligations under the contract formed when you accept the 123xxx Terms and Conditions — for example, managing your account and processing your financial transactions.
• Legal Obligation: 123xxx is required to process certain data to comply with applicable laws, including anti-money-laundering regulations that require identity verification, transaction record retention, and suspicious activity reporting.
• Legitimate Interest: 123xxx processes some data on the basis of legitimate business interests, including fraud prevention, platform security, and performance monitoring. Where this basis is used, 123xxx has assessed that the legitimate interest does not override your fundamental privacy rights.
• Consent: Where processing is based on consent — for example, sending you promotional messages about 123xxx offers — you have given a clear, specific, and freely given agreement to that processing. You may withdraw consent at any time without affecting the lawfulness of any processing that occurred before withdrawal.

123xxx does not sell your personal data. We share your data only with parties that require it to help us deliver the 123xxx platform and comply with legal obligations. The categories of recipients are:

• Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT partners, and card processing networks receive the minimum payment data necessary to process your deposits and withdrawals. These providers operate their own privacy policies in respect of the data they independently control.
• Identity Verification Providers: Where 123xxx uses a third-party service to assist with CNIC verification or document authentication, that provider receives the relevant documents under a data processing agreement with 123xxx and may only use the data for verification purposes.
• Game Software Providers: The studios whose games are hosted on 123xxx receive session and betting data necessary to operate the game and to audit RNG fairness. They do not receive your personal identity data.
• Fraud Detection and Security Services: Third-party services that assist 123xxx in detecting fraudulent activity, unusual betting patterns, and platform abuse receive technical and usage data, including IP addresses and device fingerprints.
• Legal and Regulatory Authorities: 123xxx will disclose personal data to law enforcement, regulatory bodies, or courts where required by applicable law or valid legal process.
• Professional Advisors: Lawyers, accountants, and auditors engaged by 123xxx may receive personal data in the course of providing professional services, subject to professional confidentiality obligations.

Payment data is among the most sensitive personal information that 123xxx handles. The following principles govern how we treat your financial data:

• Full bank account numbers and full card numbers are never stored on 123xxx servers. Card payments are processed via PCI-DSS-compliant payment gateways that tokenise card data before it reaches 123xxx systems.
• Mobile wallet identifiers (Easypaisa and JazzCash account numbers) are stored in encrypted form and used solely to facilitate deposits and withdrawals associated with your 123xxx account.
• Transaction amounts, dates, and types are stored as part of your 123xxx account record for the purposes of financial reconciliation, withdrawal processing, bonus tracking, and regulatory compliance.
• 123xxx will never ask you to share full payment credentials through any communication channel including live chat, email, or phone. Any request for full account numbers or card details purportedly from 123xxx should be treated as a phishing attempt and reported to us immediately.

123xxx uses cookies and similar tracking technologies on the platform. A cookie is a small text file placed on your device by your browser when you visit a website. Cookies allow 123xxx to recognise your device between sessions, maintain your login state, and understand how you use the platform.

You can manage or delete cookies through your browser settings at any time. Disabling essential cookies will affect your ability to log in and use the 123xxx platform. Disabling analytics and preference cookies will not prevent you from using the platform but may affect the personalisation of your experience.

123xxx retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by law. The following retention periods apply to the main categories of data held at 123xxx:

• Account Data: Retained for the duration of your active membership plus five years following account closure. This retention is required under anti-money-laundering regulations applicable to financial services platforms.
• Transaction Records: Retained for five years from the date of the transaction. This applies to all deposits, withdrawals, bets, game wagers, and bonus claims at 123xxx.
• Identity Verification Documents: Retained for five years from the date of verification or from the date of account closure, whichever is later. After this period, documents are securely deleted.
• Customer Support Communications: Retained for two years from the date of the last communication in each support thread, unless the communication relates to an ongoing dispute or legal matter, in which case it is retained until the matter is fully resolved plus one year.
• Technical and Usage Data: Most technical log data is retained for twelve months. Aggregated and anonymised analytics data may be retained indefinitely as it contains no personal identifiers.
• Marketing Preferences: Records of your consent to or refusal of marketing communications are retained for five years from the date of the last preference update, to enable 123xxx to demonstrate compliance with consent requirements.

When data reaches the end of its retention period, 123xxx deletes it securely using industry-standard methods that prevent recovery. Where physical documents exist, they are destroyed by cross-cut shredding or equivalent secure disposal.

You have a number of rights in relation to the personal data that 123xxx holds about you. These rights are available to all 123xxx members and can be exercised at any time by contacting our support team:

The 123xxx platform is strictly for adults aged 18 and over. 123xxx does not knowingly collect personal data from any person under the age of 18. If we discover that a user under 18 has registered an account or provided personal data, we will immediately close that account, delete all associated personal data, and forfeit any balance held in the account.

If you are a parent or guardian and you believe that a person under 18 has created an account at 123xxx using your details or independently, please contact us immediately at support@123xxx.app with the subject line "Underage Account Report". We will investigate and respond within 24 hours.

123xxx implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data in transit between your device and 123xxx servers.
• Password Security: All 123xxx account passwords are stored as bcrypt hashes with unique per-user salts. They cannot be recovered — only reset.
• Two-Factor Authentication: 123xxx supports two-factor authentication for account logins. We strongly recommend all members enable this feature to protect their accounts.
• Access Controls: Personal data is accessible only to 123xxx staff who require it for their specific role. Role-based access controls are enforced, and all access is logged and audited.
• Infrastructure Security: 123xxx servers are hosted in secure data centres with physical access controls, 24-hour monitoring, redundant power, and regular third-party penetration testing.
• Incident Response: 123xxx maintains a formal security incident response plan. In the event of a data breach, the response procedure includes immediate containment, investigation, notification to affected members, and review to prevent recurrence.

Despite these measures, no internet-based platform can guarantee absolute security. 123xxx recommends that all members use a strong, unique password for their account, enable two-factor authentication, and exercise caution when accessing their account from shared or public devices.

123xxx will only send you promotional and marketing communications — such as information about new games, upcoming PSL betting offers, bonus promotions, or other 123xxx updates — if you have given your explicit consent to receive such communications at the time of registration or at any subsequent point through your account settings.

You can withdraw consent to marketing communications at any time by:

• Updating your communication preferences in the account settings section of your 123xxx profile.
• Clicking the "unsubscribe" link in any marketing email or SMS from 123xxx.
• Contacting 123xxx support directly and requesting that your contact details be removed from all marketing lists.

Withdrawing consent for marketing will not affect service communications — 123xxx will still send you important account notifications, transaction confirmations, security alerts, and other communications that are necessary for the operation of your account and are not subject to marketing consent requirements.

123xxx reviews and updates this Privacy Policy periodically to reflect changes in our data practices, changes in applicable law, or operational developments on the platform. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Where a change to this Privacy Policy is material — meaning it significantly affects how we handle your personal data or the rights available to you — 123xxx will notify registered members via their registered mobile number or email address before the change takes effect. Less material updates, such as clarifications of existing practices or corrections of typographical errors, will be made without direct notification but will be reflected in the updated "Last Updated" date.

Your continued use of the 123xxx platform after a notified policy change constitutes your acknowledgement of the updated policy. If you do not agree with a change to this Privacy Policy, you should stop using the platform and contact 123xxx support to exercise any applicable data rights and to request account closure if desired.

If you have any questions, concerns, or requests related to this Privacy Policy or to the personal data that 123xxx holds about you, please use one of the contact methods below. Our support team is available 24 hours a day, seven days a week, and all privacy-related requests are treated as high priority.