This Privacy Policy explains how XH88 collects, uses, stores, shares and protects your personal data when you access or use our platform. It also sets out your rights as a data subject and how you can exercise them. We are committed to handling your information with transparency, integrity and security.
Last Reviewed: 2026 — Subject to Periodic UpdatesWe collect registration details, KYC documents, transaction records, device and session data, and support communications — only what is needed to operate the platform safely and compliantly.
All data in transit is encrypted over HTTPS. KYC documents are handled through a secure verification portal. We do not store unencrypted sensitive documents in publicly accessible environments.
Subject to applicable law, you have the right to access, correct, delete, or object to the processing of your personal data. Contact our support team to submit a data subject request.
XH88 does not sell your personal data to third parties for marketing or commercial purposes. Sharing is limited to KYC providers, payment processors, and regulatory bodies where legally required.
We use essential cookies for session management and security, and analytics cookies to understand platform usage. You can manage cookie preferences through your browser settings.
For any privacy-related enquiry or to exercise your data subject rights, contact our support team at [email protected]. We aim to respond to all data requests within 30 days.
XH88 ("we", "us", "our", "the Platform") operates the online sports betting and casino services accessible at xh88.cam. In the course of providing these services, we collect and process personal data relating to our users ("you", "your", "User").
This Privacy Policy ("Policy") describes what personal data we collect, the lawful bases on which we process it, the purposes for which it is used, how long we retain it, who we share it with, and what rights you have in relation to it. This Policy forms part of the Terms & Conditions governing your use of the Platform.
By registering an account, depositing funds, or otherwise using the Platform, you confirm that you have read this Policy and consent to the processing of your personal data as described herein where consent is the applicable legal basis. Where other lawful bases apply, your use of the Platform does not override those independent legal obligations.
The following defined terms are used throughout this Policy:
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, including names, email addresses, device identifiers, IP addresses, transaction records and identity documents. |
| Processing | Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure or deletion. |
| Data Controller | The entity that determines the purposes and means of processing personal data. XH88 is the Data Controller for data processed through the Platform. |
| Data Processor | A third party that processes personal data on behalf of the Data Controller under a contractual obligation (e.g., KYC verification providers, payment processors). |
| KYC | Know Your Customer — the identity, age verification and fraud-prevention process requiring submission of identity documents such as a CNIC or passport. |
| Cookies | Small data files placed on your device by the Platform to support session management, security, user preferences and analytics functions. |
| Applicable Law | All laws, regulations and binding regulatory requirements applicable to the processing of personal data in the relevant jurisdiction, including the operator's license jurisdiction and, where applicable, laws governing data protection in Pakistan. |
XH88 collects personal data through different channels and at different points in your relationship with the Platform. The categories of data collected are set out below:
XH88 processes personal data under one or more of the following lawful bases, depending on the specific processing activity:
| Legal Basis | Application at XH88 |
|---|---|
| Contractual Necessity | Processing your registration data, transaction data and account management data is necessary to perform our contract with you — without it, we cannot provide the Platform's services. |
| Legal Obligation | KYC verification, anti-money laundering (AML) checks, age verification and fraud prevention processing are required by the operator's licensing obligations and applicable regulatory requirements. |
| Legitimate Interests | Security monitoring, fraud detection, platform improvement analytics, and responsible gambling monitoring are conducted on the basis of XH88's legitimate interest in operating a safe, fair and compliant platform. |
| Consent | Where we send you promotional communications or use non-essential cookies, we rely on your consent. You may withdraw consent at any time by adjusting your communication preferences in your account settings or your browser cookie settings. |
The personal data XH88 collects is used for the following specific purposes:
XH88 does not sell your personal data to any third party. Data sharing is limited to the following categories of recipients, each of whom is bound by appropriate contractual data protection obligations:
We share identity documents and selfie images with third-party KYC verification service providers for the purpose of identity confirmation, age verification and liveness checking. These providers are contractually required to process data only for the purposes specified and to maintain appropriate security standards.
Transaction data is shared with payment processors to facilitate deposits and withdrawals. Payment method details (including mobile wallet identifiers associated with services such as Easypaisa and JazzCash, or bank account references for transfers via HBL, UBL, Meezan Bank and Bank Alfalah) are referenced for transaction routing purposes only. These providers are referenced as familiar Pakistani payment contexts; XH88 does not claim their endorsement. Their handling of your financial data is governed by their own privacy policies and applicable financial regulations.
XH88 may disclose personal data to licensing authorities, financial intelligence units, or law enforcement agencies where legally required to do so — for example, in connection with AML reporting obligations, court orders, or regulatory investigations. Such disclosures are made only to the extent required and are documented in accordance with applicable compliance obligations.
We use third-party providers for hosting, cloud storage, security services and platform analytics. These providers access data only as data processors under contract and are prohibited from using it for their own purposes.
XH88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention guidelines apply:
| Data Category | Retention Guideline |
|---|---|
| Account & Registration Data | Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, as required by AML and licensing regulations. |
| KYC Documents | Retained for a minimum of five (5) years from verification date, or longer where required by the operator's licensing authority or applicable law. |
| Transaction Records | Retained for a minimum of five (5) years from the date of the relevant transaction, in line with financial record-keeping obligations. |
| Support Communications | Retained for a minimum of three (3) years from the date of the last communication in a support interaction, unless the matter involves a dispute or regulatory inquiry requiring longer retention. |
| Technical & Usage Data | Retained for up to twenty-four (24) months from collection, after which it is anonymised or deleted. |
| Self-Exclusion Records | Retained indefinitely where permanent self-exclusion is requested; for the duration of the exclusion plus five (5) years for time-limited exclusions, to prevent re-registration during the exclusion period. |
Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.
XH88 implements technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:
XH88 uses cookies and similar tracking technologies to support the operation, security and improvement of the Platform. The types of cookies used are described below:
These cookies are strictly necessary for the Platform to function. They manage your login session, maintain security tokens, enable the shopping cart functionality within the cashier, and support core page operations. These cookies cannot be disabled without breaking fundamental platform functions.
Analytics cookies help us understand how users interact with the Platform — which pages are most visited, where users encounter difficulties, and how performance can be improved. Data collected through analytics cookies is aggregated and, where possible, anonymised before analysis. These cookies are only placed where you have consented.
Preference cookies remember your settings and choices — such as your preferred odds format, language setting and responsible gambling reminder intervals — so that you do not need to re-configure them on each visit.
You can manage and delete cookies through your browser settings. Most modern browsers allow you to block third-party cookies, delete all cookies or receive alerts before a cookie is placed. Note that disabling essential cookies will affect the Platform's ability to function correctly. Detailed guidance on managing cookies is available in your browser's help documentation.
XH88 and its service providers may process personal data in jurisdictions outside your country of residence. Where data is transferred internationally, XH88 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required in the operator's license jurisdiction.
These safeguards may include contractual clauses in agreements with third-party processors that require data protection standards consistent with applicable data protection frameworks. Where personal data relating to Pakistani users is transferred internationally, it is done only to the extent necessary to provide the Platform's services and is subject to the safeguards described in this Policy.
Pakistani users should be aware that Pakistan does not currently have a comprehensive data protection law equivalent to European frameworks. XH88 applies the protections described in this Policy independently of Pakistani domestic law requirements, as part of its commitment to responsible data handling.
Subject to applicable law and the conditions of the operator's license jurisdiction, you have the following rights in respect of your personal data. To exercise any of these rights, please contact us at [email protected] with a description of your request and sufficient information to identify your account. We aim to respond within 30 days of receipt.
You have the right to request a copy of the personal data XH88 holds about you, along with information about how it is processed.
You have the right to request correction of inaccurate or incomplete personal data held about you.
You may request deletion of your personal data where it is no longer necessary for the purpose collected, or where you withdraw consent. This right is subject to overriding legal retention obligations.
You have the right to object to processing based on legitimate interests where your interests or fundamental rights override those interests.
You may request that processing of your data be restricted in certain circumstances — for example, while the accuracy of data is being contested.
Where processing is based on consent or contract and is carried out by automated means, you may request your data in a structured, machine-readable format.
XH88 is strictly an adults-only platform. The Platform is not directed at, and XH88 does not knowingly collect personal data from, individuals under the age of 18 — or the higher minimum age required by the operator's license jurisdiction or applicable local law.
Age verification is a mandatory part of the KYC process, and accounts will be suspended where verification reveals that a User does not meet the minimum age requirement. Any personal data collected from a minor before their age is identified will be deleted promptly upon discovery, except where retention is required by law in connection with the investigation of the matter.
If you believe that a minor has created an account on XH88 using falsified information, please contact [email protected] immediately. We take underage access seriously and will take appropriate action, including reporting to relevant authorities where required.
Pakistani users accessing the Platform should be aware of the following specific considerations relating to personal data and the legal context of online gambling in Pakistan:
XH88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or changes in the Platform's functionality. The "Last Reviewed" date at the top of this document reflects the most recent update.
Where changes to this Policy are material — meaning they significantly affect your rights or how your data is processed — XH88 will notify you by email to the address associated with your account, or through a prominent notice within the Platform, no less than fourteen (14) days before the revised Policy takes effect.
Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not accept the revised Policy, you must stop using the Platform and request account closure before the revised Policy takes effect. Data already collected and being processed under the previous Policy will continue to be handled in accordance with the version of the Policy under which it was collected, to the extent the new version is less favourable.
If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a complaint about the way your personal data has been handled, please contact the XH88 data privacy team through the following channel:
Email: [email protected]
Subject line: "Privacy Enquiry — [your registered email address]"
Response target: Within 30 days of receipt of a valid, complete data subject request.
Support languages: English and Urdu.
When submitting a data subject request, please include: your full registered name, your registered email address, a clear description of the right you wish to exercise, and any relevant account or transaction reference numbers. We may need to verify your identity before processing the request.
Understanding how your data is used gives you the confidence to use XH88 on your own terms. Explore the platform, read our full terms, and reach out to support with any questions.