x388 Privacy Policy

x388, operating through the domain x388.club, is the data controller responsible for the personal data of all registered players and website visitors. As data controller, x388 determines the purposes and means by which personal data is processed in connection with the delivery of its online casino and sports betting services.

For all privacy-related enquiries, data subject requests, or complaints relating to this Privacy Policy, players may contact the x388 Data Protection team directly at [email protected]. x388 will acknowledge all data-related requests within 5 business days and will endeavour to resolve them within 30 calendar days of receipt.

x388 collects the following categories of personal data in the course of operating its licensed gaming platform for Pakistani players:

x388 does not knowingly collect sensitive personal data beyond what is required for KYC identity verification and responsible gaming purposes. x388 does not collect biometric data, health records, or political opinions.

x388 collects personal data through the following mechanisms:

• Direct collection: Data you provide when registering an x388 account, completing KYC verification, making a deposit or withdrawal, contacting x388 support, or participating in a promotion.
• Automated collection: Technical data collected automatically when you visit x388.club, including IP addresses, device fingerprints, session metadata, and cookies placed on your browser or device. See Section 7 for full details on cookies.
• Third-party sources: Identity verification data confirmed by our licensed KYC providers; transaction confirmation data received from JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK; fraud risk scores from licensed fraud prevention service providers.
• Inferred data: Responsible gaming risk assessments and behavioural profiles generated from your gaming activity data, used exclusively for player protection purposes in accordance with x388's responsible gaming obligations.

x388 processes your personal data on the following legal bases, each of which applies to specific processing activities:

• Contractual necessity: Processing required to register your account, verify your identity, process PKR deposits and withdrawals, settle bets, and deliver the gaming services you have contracted with x388 to receive.
• Legal obligation: Processing required to comply with anti-money laundering (AML) obligations, counter-terrorism financing (CTF) regulations, and the record-keeping requirements of x388's international gaming licence.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, customer service improvement, and internal analytics — where x388's legitimate business interests do not override your rights and interests.
• Consent: Marketing communications and optional cookie categories — where x388 relies on your explicit consent, you may withdraw that consent at any time by contacting [email protected] or adjusting your account preferences.

x388 uses your personal data exclusively for the following purposes:

• To create, maintain, and administer your x388 account, including verifying your identity and age (21+) prior to activation.
• To process PKR deposits via JazzCash, EasyPaisa, Raast, and all supported Pakistani bank transfer channels, and to process withdrawal requests to your verified payment method.
• To detect, investigate, and prevent fraudulent activity, money laundering, multiple-account registrations, bonus abuse, and other violations of x388's Terms and Conditions.
• To monitor your gaming activity patterns for responsible gaming purposes, including identifying indicators of problem gambling and triggering intervention workflows where x388's responsible gaming obligations require it.
• To settle your bets, calculate bonus wagering progress, apply promotional credits, and generate your account statements.
• To respond to your customer support requests via live chat and email, and to maintain records of those interactions.
• To send you transactional communications — deposit confirmations, withdrawal updates, account security alerts — that are necessary for the performance of your x388 contract.
• To send marketing communications about x388 promotions, new game launches, PSL cricket betting markets, and special PKR bonus offers — only where you have provided consent or where applicable law permits.
• To comply with x388's obligations under its international gaming licence, including reporting obligations to the relevant licensing authority.

x388 does not sell, rent, or trade your personal data to any third party for commercial purposes. x388 shares personal data only in the following strictly defined circumstances:

• Payment processors: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK receive the transaction data strictly necessary to process your PKR deposits and withdrawals. Each payment processor operates under its own privacy obligations.
• KYC & identity verification providers: Licensed third-party KYC providers receive your identity documents and personal details solely to perform identity and age verification on x388's behalf. These providers are contractually bound to process your data only for KYC purposes.
• Game software providers: x388's licensed slot, live dealer, poker, and cricket betting software suppliers may receive anonymised or pseudonymised game session data required to deliver their games to your account. No directly identifiable personal data is shared beyond what is technically necessary.
• Fraud prevention services: Licensed fraud detection providers may receive technical data (IP address, device identifiers) to generate risk scores that protect both x388 and its players from fraudulent activity.
• Regulatory and law enforcement authorities: x388 will disclose personal data to regulatory bodies, law enforcement agencies, or courts where required by applicable law, court order, or regulatory direction — including Pakistani authorities where applicable.
• Professional advisers: x388's lawyers, auditors, and insurers may access personal data on a strictly confidential, need-to-know basis in connection with legal, audit, or insurance matters.

All third parties with whom x388 shares personal data are required to process that data in accordance with applicable data protection law and are subject to appropriate contractual data processing agreements.

x388 uses cookies and similar tracking technologies on x388.club to operate the platform, improve user experience, and — where consent is given — to deliver relevant promotional content. The categories of cookies used by x388 are as follows:

• Strictly necessary cookies: Required for the x388 platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled as they are essential to the delivery of the service you have requested.
• Functional cookies: Remember your x388 account preferences — such as language settings, preferred game categories, and responsible gaming tool settings — so that you do not need to re-enter them on each visit.
• Analytics cookies: Collect anonymised data about how players interact with x388.club — pages visited, session duration, navigation paths — to help x388 improve the platform experience. No personally identifiable data is transmitted via analytics cookies.
• Marketing cookies: Used only with your explicit consent to identify your session for the purpose of attributing your registration to an x388 marketing campaign. x388 does not use third-party advertising networks or serve behavioural advertising.

You can manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair the functionality of the x388 platform. For further information on managing cookies in Pakistani-market browsers, please refer to your browser's help documentation.

x388 implements a layered security framework to protect all personal data held on Pakistani players from unauthorised access, alteration, disclosure, or destruction. Key security measures include:

• Encryption in transit: All data exchanged between your browser or app and x388 servers is encrypted using TLS 1.2 or higher. x388.club is served exclusively over HTTPS.
• Encryption at rest: Sensitive personal data — including CNIC scans, bank account identifiers, and financial transaction records — is encrypted at rest using industry-standard encryption protocols.
• Access controls: Access to personal data is restricted to x388 staff and authorised service providers who have a specific, documented need to access it. All access is logged and subject to periodic review.
• Two-factor authentication: x388 supports two-factor authentication (2FA) for player accounts to reduce the risk of unauthorised account access resulting from compromised passwords.
• Security monitoring: x388 operates continuous automated monitoring for anomalous access patterns, suspicious transaction behaviour, and potential data breach indicators.

In the event of a data breach that poses a risk to your rights and freedoms as a data subject, x388 will notify you and the relevant regulatory authority in accordance with applicable data breach notification obligations.

x388 retains personal data for the periods set out below. These periods reflect the balance between our contractual obligations, legal requirements, and the principles of data minimisation:

• Active account data: Retained for the full duration of your x388 account relationship. While your account is active, all account, transaction, and gaming data is retained to support the ongoing delivery of services.
• Post-closure retention: Following account closure, x388 retains personal data for a minimum of 5 years in compliance with anti-money laundering and counter-terrorism financing record-keeping obligations applicable to licensed gaming operators.
• KYC documents: Identity verification documents (CNIC copies, passport scans, address proofs) are retained for the same 5-year post-closure period and then securely deleted.
• Support communications: Live chat transcripts and email correspondence are retained for 3 years from the date of the interaction, or for the duration of any ongoing dispute, whichever is longer.
• Marketing data: Where you have consented to marketing communications, marketing preference data is retained until you withdraw consent, at which point it is deleted within 30 days.
• Technical & analytics data: Anonymised analytics data is retained indefinitely in aggregated form. Identifiable technical data (IP logs, session logs) is retained for 12 months and then deleted.

Upon expiry of the applicable retention period, x388 will securely delete or anonymise your personal data in a manner that renders it irrecoverable.

x388 is operated under an international gaming licence and may process or store personal data on servers located outside of Pakistan. Where personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to applicable standards, x388 ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses with all data processors located outside Pakistan.
• Selection of KYC, payment, and technology service providers that operate under recognised international data protection frameworks.
• Technical and organisational security measures proportionate to the risk associated with the specific data transfer.

By using the x388 platform, you acknowledge and consent to the transfer of your personal data to x388's international service infrastructure as described in this clause, subject to the safeguards described above.

Subject to applicable law and x388's legal retention obligations, you have the following rights in respect of your personal data held by x388:

To exercise any of the above rights, contact x388 at [email protected] with the subject line "Data Subject Request" and a description of your request. x388 may require identity verification before processing a data subject request. Where x388 is unable to fulfil a request due to legal retention obligations, it will explain the specific legal basis for its position.

x388 operates a strict minimum age policy of 21 years for all registered players. x388 does not knowingly collect, store, or process personal data belonging to any person under the age of 21.

As part of the x388 KYC verification process, all players must submit a valid government-issued identity document confirming they meet the minimum age requirement before any withdrawal is processed. Where x388 becomes aware — through the KYC process or any other means — that a registered player is under 21 years of age, x388 will immediately:

• Suspend the account pending investigation.
• Freeze all associated balances.
• Notify the appropriate regulatory authority where required.
• Delete all personal data associated with the underage registration in accordance with applicable law.

If you believe a person under 21 has registered an x388 account using false identity information, please report this immediately to [email protected].

x388's responsible gaming obligations require the platform to monitor player activity for indicators of problem gambling. This monitoring involves automated processing of your gaming activity data — including session frequency, bet amounts, win/loss patterns, and deposit velocity — to generate responsible gaming risk assessments.

Where an automated assessment indicates that a player may be experiencing gambling-related harm, x388 may:

• Send a responsible gaming communication to the player's registered email address.
• Prompt the player to review and consider using deposit limit or cooling-off tools.
• In cases of severe concern, temporarily restrict account access pending a responsible gaming review.

Responsible gaming data — including self-exclusion elections, deposit limits, and cooling-off records — is treated as sensitive operational data and is shared only where required to enforce those elections across x388's platform infrastructure. For more information on x388's responsible gaming tools, please visit the Responsible Gaming page.

x388 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or x388's data processing practices. Where a material change is made, x388 will notify registered players via email to their registered address and via a prominent notice on x388.club at least 14 days before the change takes effect.

Your continued use of the x388 platform following the effective date of an updated Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. x388 recommends that all Pakistani players review this Privacy Policy periodically to stay informed of how their data is being managed.

For all privacy-related enquiries, data subject access requests, or complaints relating to x388's handling of your personal data, please contact the x388 Data Protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Policy Enquiry" or "Data Subject Request" so your message is routed correctly.
• Live Chat: Available 24/7 through the x388 account dashboard after login.
• Response Time: x388 will acknowledge all privacy-related requests within 5 business days and will respond in full within 30 calendar days.

If you are dissatisfied with x388's handling of your data subject request or privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction in which x388 holds its international gaming licence.