xsix6
Privacy Policy

This Privacy Policy ("Policy") is issued by xsix6 ("xsix6," "we," "us," "our") and governs the collection, processing, storage, and use of personal data belonging to individuals ("you," "your," "the Player") who access or use the xsix6 platform available at https://xsix6.net and any associated mobile-optimised interfaces.

xsix6 operates as an internationally licensed online gaming and sports betting platform serving Pakistani players. In the course of providing our services — including casino games, sports betting, live dealer tables, slot games, racing, and bingo fishing — xsix6 necessarily processes certain personal data relating to registered players. This Policy explains precisely what data is collected, why it is collected, how it is used, how long it is retained, and what rights you hold over your personal data.

This Policy should be read alongside the xsix6 Terms & Conditions and Responsible Gaming Policy, each of which forms part of the overall agreement between you and xsix6.

xsix6 is the data controller responsible for the personal data processed in connection with the xsix6 platform. As data controller, xsix6 determines the purposes and means by which your personal data is processed, and is accountable for compliance with applicable data protection standards under the international licensing framework within which xsix6 operates.

xsix6 has appointed a designated data protection point of contact who is responsible for overseeing data protection compliance, responding to data rights requests, and liaising with regulatory authorities on data protection matters. Contact details for data protection queries are provided in Section 14 of this Policy.

xsix6 collects personal data across several categories depending on the nature of your interaction with the platform. The table below sets out the categories of personal data collected, the specific data points within each category, and the context in which collection occurs.

xsix6 does not collect sensitive personal data such as biometric identifiers, racial or ethnic origin, political opinions, or health data, except where strictly required for responsible gaming assessments in specific circumstances outlined in Section 4.

xsix6 uses your personal data for the following specific purposes, each of which is tied to a legal basis described in Section 5:

• Account Creation and Management: Processing your registration, verifying your identity, maintaining your xsix6 account, and enabling you to log in and access platform features.
• Payment Processing: Facilitating PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank. Financial data is processed to execute transactions and maintain accurate account ledgers.
• KYC and AML Compliance: Verifying your identity and the legitimacy of financial transactions as required under xsix6's international licensing obligations and applicable anti-money laundering standards.
• Responsible Gaming: Monitoring gameplay patterns for indicators of problem gambling, enforcing deposit limits and self-exclusion orders, and ensuring compliance with the 21+ age restriction across all xsix6 services.
• Customer Support: Responding to your queries, resolving account issues, processing complaints, and delivering the 24/7 support service available to all xsix6 players.
• Security and Fraud Prevention: Detecting and preventing fraudulent activity, collusion, bonus abuse, account takeover attempts, and other prohibited activities that may harm the integrity of the xsix6 platform.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve platform performance, game library selection, payment processing speed, and the mobile experience for Pakistani players.
• Marketing Communications: Where you have provided explicit consent, sending you promotional offers, bonus notifications, and game recommendations by email or SMS. You may withdraw consent to marketing communications at any time via your account settings.

Each processing activity carried out by xsix6 rests on one of the following recognised legal bases:

• Contract Performance: Processing necessary to deliver the xsix6 gaming and betting services you have contracted for by creating an account and accepting the Terms & Conditions. This covers account management, payment processing, and core platform functionality.
• Legal Obligation: Processing required to comply with legal obligations applicable to xsix6 as an internationally licensed gaming operator, including KYC verification, AML transaction monitoring, age verification, and regulatory reporting.
• Legitimate Interests: Processing carried out in the pursuit of xsix6's legitimate business interests, where those interests are not overridden by your data protection rights. This covers fraud prevention, platform security, responsible gaming monitoring, and aggregate analytics for service improvement.
• Consent: Processing based on your freely given, specific, and informed consent. This covers marketing communications and any processing of optional data not required for core service delivery. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

xsix6 does not sell your personal data. xsix6 may share your personal data with carefully selected third parties only where necessary to deliver platform services, meet legal obligations, or protect the security of the platform. All third-party data sharing is governed by written data processing agreements that require third parties to process your data solely in accordance with xsix6's instructions and to maintain appropriate security standards.

Categories of third parties with whom xsix6 may share your data include:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment infrastructure providers require certain financial and identity data to process PKR deposits and withdrawals on your behalf.
• KYC and Identity Verification Providers: Third-party identity verification services used to confirm the validity of CNIC documents and conduct the age verification required for 21+ compliance.
• Game Software Providers: Casino game providers whose titles are available on xsix6 receive game session data necessary to operate their games and maintain RNG certification. These providers do not receive full player identity data.
• IT and Platform Infrastructure Providers: Cloud hosting, database management, and cybersecurity service providers who support the operation of the xsix6 technical infrastructure. All are bound by strict confidentiality and data protection obligations.
• Regulatory and Law Enforcement Authorities: xsix6 will disclose personal data to competent authorities where required by applicable law, court order, or regulatory direction, including in connection with anti-money laundering investigations.

xsix6 uses cookies and similar tracking technologies to operate the platform, maintain login sessions, personalise your experience, and analyse aggregate usage patterns. Cookies are small data files stored on your device when you visit the xsix6 website.

xsix6 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the xsix6 platform. These include session cookies that maintain your logged-in state, security tokens, and load-balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, preferred game categories, and notification preferences. These are not strictly necessary but improve your platform experience.
• Analytics Cookies: Used to collect anonymised data about how Pakistani players navigate and use the xsix6 platform. This data is used in aggregate to improve site performance and user experience. Individual players are not identified from analytics data.
• Security Cookies: Used to support xsix6's fraud detection and account security systems, including identification of suspicious login patterns and detection of automated access attempts.

You can manage cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect your ability to access or use specific features of the xsix6 platform.

xsix6 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures are reviewed and updated on a regular basis in line with industry standards and the evolving threat landscape.

• Encryption: All data transmitted between your device and the xsix6 platform is encrypted using TLS (Transport Layer Security). Personal and financial data stored in xsix6 systems is encrypted at rest using AES-256 encryption.
• Access Controls: Access to production systems containing player data is restricted to authorised personnel only, governed by role-based access control policies and multi-factor authentication requirements.
• Penetration Testing: xsix6 conducts regular security assessments and penetration tests to identify and remediate vulnerabilities in the platform infrastructure before they can be exploited.
• Incident Response: xsix6 maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a risk to your rights and freedoms, xsix6 will notify the relevant supervisory authority and affected players within the timeframes required by applicable data protection standards.

xsix6 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as is required by applicable legal or regulatory obligations. The following retention periods apply to the main categories of data held by xsix6:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with xsix6's data deletion procedures. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.

As a player whose personal data is processed by xsix6, you hold the following data rights. These rights may be subject to certain limitations and exceptions under applicable law, particularly where processing is required for legal compliance or fraud prevention purposes.

• Right of Access: You have the right to request a copy of the personal data xsix6 holds about you, together with information about how that data is processed. xsix6 will respond to access requests within 30 days.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held about you. Basic account information can be updated directly from your xsix6 account settings. Changes to identity or KYC data may require supporting documentation.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is subject to limitations where xsix6 is required to retain data under AML, regulatory, or contractual obligations.
• Right to Restriction: You have the right to request that xsix6 restrict the processing of your personal data in certain circumstances, such as where the accuracy of data is contested or where you have objected to processing pending a determination of whether legitimate grounds override your objection.
• Right to Data Portability: Where processing is based on your consent or on contract performance, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request its transfer to another controller.
• Right to Object: You have the right to object to processing of your personal data where xsix6 relies on legitimate interests as the legal basis. xsix6 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

The xsix6 platform is strictly intended for individuals aged 21 and above. xsix6 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the registration process and is enforced again prior to withdrawal processing.

If xsix6 becomes aware that personal data has been collected from an individual under 21 — whether through a misrepresentation at registration or any other means — the following steps will be taken without delay:

• The account will be suspended immediately pending investigation.
• All personal data collected from the underage individual will be deleted in accordance with applicable data protection standards.
• Any deposits made by the underage individual will be reviewed in accordance with xsix6's underage player policy and applicable regulatory guidance.
• The incident will be documented and reported to the relevant regulatory authority where required.

If you believe a minor may have accessed the xsix6 platform using falsified information, please contact the xsix6 support team immediately using the contact details in Section 14. xsix6 treats all reports of underage access as a priority matter.

xsix6 operates as an internationally licensed gaming platform and processes personal data in secure data centres that may be located outside Pakistan. Where personal data is transferred internationally, xsix6 ensures that such transfers are conducted in accordance with applicable data protection standards and that appropriate safeguards are in place to protect your data.

International data transfers made by xsix6 are subject to one or more of the following safeguards:

• Standard contractual clauses approved by competent data protection authorities.
• Data processing agreements with third-party service providers that incorporate appropriate technical and organisational security measures.
• Use of data centres and cloud infrastructure providers that maintain internationally recognised security certifications (ISO 27001, SOC 2, etc.).

All third-party service providers to whom data is transferred internationally are contractually obligated to process data solely in accordance with xsix6's instructions and to maintain the same level of data protection required under this Policy.

xsix6 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in data processing practices, legal obligations, or platform functionality. The "Last Updated" date at the top of this Policy indicates when the most recent amendments were published.

Where material changes are made to this Privacy Policy that substantially affect how your personal data is processed, xsix6 will endeavour to notify registered players via email or in-account notification at least 14 days prior to the changes taking effect.

It is your responsibility to review this Privacy Policy periodically. Continued use of the xsix6 platform following the publication of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the amended Policy, you must cease using the xsix6 platform and may request account closure in accordance with the procedure set out in the Terms & Conditions.

For all queries, concerns, or formal requests relating to the processing of your personal data, data rights, or data protection matters, please contact the xsix6 data protection team using the following channels:

• Data Protection Email: [email protected] (mark subject line: "Data Protection Request")
• Live Chat: Available 24/7 from the xsix6 platform after logging in. For data rights requests, inform the agent that you wish to speak to the data protection team.

xsix6 will acknowledge all data protection requests within 2 business days and provide a full response within 30 calendar days of receipt. Where a request is complex or xsix6 has received multiple requests from you, the response period may be extended by a further 60 days. You will be informed of any such extension within the initial 30-day period, together with the reasons for the delay.

xsix6 is committed to resolving all data protection queries and complaints in a transparent, timely, and respectful manner. Your privacy matters to us, and we take every data protection concern seriously.