Privacy Policy

This Privacy Policy ("Policy") is issued by Xaxino ("xaxino", "we", "us", or "our") and applies to all personal data collected from individuals ("you", "your", or "User") who access or use the xaxino platform, website, mobile interface, and associated services (collectively the "Platform") available at xaxino.cam.

We are committed to processing your personal data lawfully, fairly, and transparently. This Policy describes the categories of personal data we collect, the purposes for which we use it, how we protect it, who we may share it with, how long we retain it, and what rights you hold in relation to it.

By creating an Account or using the Platform, you acknowledge that you have read and understood this Policy. Where your consent is the legal basis for processing, a specific consent interaction will be presented — separate from this general acceptance. Where you do not agree with this Policy, you should not use the Platform.

The following defined terms are used consistently throughout this Policy:

Xaxino collects personal data across several categories, depending on how you interact with the Platform:

3.1 Registration Data. When you create an Account, we collect your full legal name, date of birth, email address or mobile number, chosen username, and country of residence. This data is necessary to establish your Account and verify eligibility.

3.2 Identity Verification (KYC) Data. To comply with anti-money-laundering (AML) obligations and to verify age and identity, we collect government-issued identification documents. For Pakistani users, this typically includes a Computerised National Identity Card (CNIC) or passport, and may include proof of address and a selfie or liveness image. KYC data is processed strictly for compliance and fraud-prevention purposes.

3.3 Financial Data. We collect transaction-related information including deposit amounts, withdrawal requests, payment method identifiers (where applicable), and transaction reference numbers. We do not store full card numbers or sensitive payment credentials — payment processing is handled by third-party processors under their own security standards.

3.4 Usage and Activity Data. We collect records of games played, bets placed, session durations, navigation patterns, and interactions with Platform features. This data supports personalisation, fraud detection, and responsible gambling monitoring.

3.5 Device and Technical Data. We automatically collect IP addresses, browser type and version, operating system, device identifiers, screen resolution, and referring URLs. This data is used for security, analytics, and Platform optimisation.

3.6 Communications Data. When you contact our support team via live chat or email at [email protected], we retain records of those communications for quality assurance, dispute resolution, and regulatory compliance purposes.

Xaxino collects personal data through the following channels and mechanisms:

• Directly from you when you register, complete KYC, submit a deposit or withdrawal request, contact support, or participate in promotions;
• Automatically through server logs, cookies, pixel tags, and similar tracking technologies when you interact with the Platform;
• From third-party identity verification providers engaged to perform KYC and liveness checks on our behalf;
• From payment processors who provide transaction confirmation and fraud-screening signals;
• From device and browser environments that report technical information as part of the standard HTTPS connection process.

You are under no obligation to provide data beyond what is strictly required for the specific Service you wish to use. However, declining to provide mandatory data (for example, refusing KYC documents) may prevent access to certain features such as withdrawals.

Every data processing activity at Xaxino is conducted on a lawful basis. The applicable legal bases are set out below by processing purpose:

Where processing is based on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms, given the nature of the data and the context of processing.

Xaxino does not sell, rent, or trade your personal data to third parties. We may share personal data with third parties only in the limited circumstances described below:

• Service Providers and Data Processors: We engage third-party companies to perform functions on our behalf — including payment processing, identity verification, cloud hosting, analytics, and customer support tools. All such providers are bound by data processing agreements that restrict their use of your data to the specified purpose.
• Regulatory and Law Enforcement Authorities: We may disclose personal data where required to do so by law, court order, regulatory direction, or where we believe disclosure is necessary to prevent fraud, money laundering, or other illegal activity.
• Licensing Authorities: The operator's licensing jurisdiction may require audit access to certain account and transaction records. Such access is governed by the applicable licensing framework.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of Xaxino's assets, personal data may be transferred to the acquiring entity, subject to an equivalent level of protection being maintained. Users will be notified of any such transfer.

The Platform uses cookies and similar technologies to provide core functionality, maintain session continuity, and support analytics. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management cookies that keep you logged in and security tokens. They cannot be disabled.
• Functional Cookies: Store your preferences such as language settings, chosen interface layout, and responsible gambling limit acknowledgements.
• Analytics Cookies: Collect aggregated, pseudonymised data about how users navigate the Platform — page views, session duration, and feature interaction. This data supports Platform improvement.
• Marketing Cookies: Used only with your explicit consent to measure the effectiveness of any promotional campaigns. You may withdraw consent at any time through your cookie preferences settings.

You may manage cookie preferences through your browser settings at any time. Blocking strictly necessary cookies will affect Platform functionality. For all other cookie categories, you may opt out without affecting core Platform access.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to applicable legal and regulatory obligations. The general retention approach is as follows:

• Account Data: Retained for the duration of your Account and for a period of up to 5 years following account closure, as required by AML and licensing obligations.
• KYC Documents: Retained for the minimum period required by the operator's licensing jurisdiction (typically 5 years from the end of the business relationship).
• Transaction Records: Retained for at least 5 years in line with standard financial record-keeping requirements.
• Support Communications: Retained for 3 years from the date of the last interaction, or longer where the communication is relevant to an open dispute.
• Analytics Data: Retained in aggregated, non-identifiable form for up to 3 years for platform improvement analysis.
• Marketing Data: Retained until you withdraw consent or request deletion, whichever is earlier.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identified individual.

Subject to applicable data protection law and certain operational limitations, you hold the following rights in relation to your personal data held by Xaxino:

To exercise any of the above rights, please contact our support team via live chat or by email at [email protected]. We will acknowledge your request within 5 business days and aim to resolve it within 30 days. In complex cases, the resolution period may be extended by a further 60 days with prior notification.

Where your request is declined (for example, because it conflicts with a legal retention obligation), we will explain the reason clearly and advise on any further steps available to you.

Xaxino implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key measures include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and the Platform;
• Encrypted storage of sensitive data at rest, including KYC documents and financial records;
• Role-based access controls ensuring that staff can only access personal data necessary for their specific function;
• Regular security audits, penetration testing, and vulnerability assessments;
• Incident response procedures to identify, contain, and notify affected parties of data breaches within the timeframe required by applicable law;
• Multi-factor authentication for internal system access by Xaxino personnel.

While we take all reasonable measures to protect your data, no internet-based system is entirely free from risk. You are responsible for maintaining the security of your Account credentials and for notifying us immediately if you suspect unauthorised access to your Account.

The Platform is strictly for adults. Xaxino does not knowingly collect or process personal data from individuals under the age of 18 (or the higher minimum age required by the operator's licence jurisdiction). Age verification is a mandatory step in the account registration and KYC process.

If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated Account. If you believe a minor has registered on the Platform, please contact us immediately at [email protected].

Parents and guardians are encouraged to make use of parental control software and to monitor minors' internet activity. Allowing a minor to use an adult's Xaxino Account constitutes a serious breach of these Terms.

Xaxino operates internationally and may transfer your personal data to countries outside of Pakistan and outside of the European Economic Area. Such transfers occur when we use cloud service providers, third-party processors, or licensing authority reporting systems that are based in other jurisdictions.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities;
• Adequacy decisions where the receiving country provides an equivalent level of data protection;
• Binding corporate rules where applicable within corporate group structures;
• Explicit consent where required and none of the above mechanisms are applicable.

By using the Platform, you acknowledge that your personal data may be processed in jurisdictions outside Pakistan. For further information about the safeguards applicable to a specific transfer, contact us at [email protected].

Xaxino reserves the right to update or revise this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data collection or a new purpose for processing — we will notify registered Users via email or in-account notification at least 14 days before the change takes effect.

Minor clarifications or corrections that do not affect the substance of data processing activities may take effect immediately upon publication. The "Last Updated" date at the top of this page reflects the effective date of the current version.

Your continued use of the Platform after a material change has taken effect constitutes your acceptance of the revised Policy. If you do not agree with the revised terms, you may request account closure and the return of any eligible funds in accordance with the prevailing withdrawal terms.

If you have any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact the Xaxino privacy team through the following channels:

• Live Chat: Available 24/7 via the Platform. The fastest channel for general queries and data rights requests.
• Email (plain text — not a clickable link): [email protected] — typically responded to within 4–12 hours.

When submitting a data rights request, please include your registered email address, a description of the right you wish to exercise, and any relevant reference information. We may request proof of identity before processing requests that involve access to or deletion of personal data.