Privacy Policy

1. Data Controller

xm777 (referred to as "xm777," "we," "us," or "our") is the Data Controller in respect of the personal data processed through the xm777 platform at xm777.co. xm777 is a PAGCOR-licensed online gaming operator and is subject to the requirements of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC).

This Privacy Policy applies to all personal data collected in connection with your use of xm777, including account registration, deposits, gameplay, withdrawals, bonus participation, customer support interactions, and any communications between you and xm777.

2. Personal Data We Collect

xm777 collects the following categories of personal data:

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued ID information provided during registration and KYC verification (e.g., PhilSys number, passport number, driver's license number).
• Contact Data: Philippine mobile number, email address, and mailing address.
• Financial Data: GCash account reference, bank account details (BPI, BDO, Metrobank), Maya account reference, transaction amounts, deposit and withdrawal history, and source of funds documentation where required by PAGCOR's AMLA compliance obligations.
• Account Data: Username, encrypted password hash, account balance, bonus balance, wagering history, game activity logs, and session records.
• Technical Data: IP address, device type, operating system, browser type, device fingerprint, and geographic location data derived from your connection at time of login or transaction.
• Usage Data: Pages visited on the xm777 platform, game sessions initiated, duration of sessions, click paths, and feature usage patterns.
• Communications Data: Records of customer support interactions via live chat, email correspondence, and any feedback or complaints submitted to xm777.

3. How We Collect Your Data

xm777 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically through cookies, session tokens, server logs, and device fingerprinting technologies when you access the xm777 platform.
• Third-party sources: Identity verification data from government ID verification services engaged by xm777; fraud prevention data from third-party risk management providers; payment transaction data from GCash, Maya, BPI, BDO, Metrobank, and other payment processing partners.

4. Purpose and Legal Basis for Processing

xm777 processes your personal data for the following purposes and on the following legal bases:

• Contract performance: Processing necessary to deliver xm777's gaming services, manage your account, process deposits and withdrawals, and award promotional bonuses.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Philippine AMLA reporting obligations (Republic Act No. 9160 as amended), KYC requirements, NPC data governance obligations, and Bureau of Internal Revenue reporting where applicable.
• Legitimate interests: Fraud detection and prevention, account security monitoring, responsible gaming enforcement, platform performance analysis, and customer support quality management — in each case balanced against your privacy interests.
• Consent: Direct marketing communications (promotional emails, SMS notifications) where you have provided opt-in consent. You may withdraw consent to marketing communications at any time via your account notification settings.

5. Data Sharing and Disclosure

xm777 does not sell or rent personal data to third parties. Personal data is shared only in the following circumstances:

• Service providers: Third-party processors engaged by xm777 to provide payment processing, identity verification, fraud prevention, cloud hosting, customer support technology, and data analytics services. All such providers operate under data processing agreements that bind them to confidentiality and security obligations consistent with RA 10173.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies where disclosure is required by law, court order, or regulatory direction.
• Law enforcement: Philippine law enforcement agencies where xm777 is required to disclose data in connection with an investigation of illegal activity, fraud, or violations of these Terms.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of xm777's assets, your personal data may be transferred as part of that transaction, subject to continued protection under this Privacy Policy.

6. Cookies and Tracking Technologies

xm777 uses cookies and similar tracking technologies on the xm777 platform for the following purposes:

• Essential cookies: Required for platform functionality including login session management, security token validation, and account preferences. These cannot be disabled without impairing Platform use.
• Analytics cookies: Used to understand how users navigate the xm777 platform, which game categories are most accessed, and where technical performance issues occur. xm777 uses anonymized aggregated analytics data only.
• Security cookies: Device fingerprinting and session integrity cookies used by xm777's fraud prevention and responsible gaming systems to detect unusual login patterns and multi-account activity.

You may manage non-essential cookies through your browser settings. Disabling essential cookies will impair your ability to log in to xm777 and use platform features.

7. Data Security

xm777 implements technical and organizational security measures appropriate to the sensitivity of the personal data processed, including:

• 256-bit SSL/TLS encryption for all data in transit between your device and xm777 servers.
• AES-256 encryption for sensitive data at rest, including financial data and KYC document files.
• bcrypt hashing of all user passwords — xm777 cannot retrieve your password in plain text.
• Role-based access controls limiting personal data access to authorized xm777 personnel with a legitimate operational need.
• Regular security audits and penetration testing of xm777's infrastructure by qualified cybersecurity professionals.
• Incident response procedures aligned with NPC notification requirements under RA 10173.

While xm777 takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system is 100% secure. You are responsible for maintaining the security of your xm777 login credentials.

8. Data Retention

xm777 retains personal data for the following periods:

• Active account data: Retained for the duration of your active xm777 account plus five (5) years following account closure, consistent with PAGCOR's record-keeping requirements and Philippine AMLA obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of the last transaction, as required by AMLA regulations.
• Transaction records: Retained for five (5) years from the date of each transaction for AMLC and BIR compliance purposes.
• Marketing communications consent records: Retained for the duration of consent plus three (3) years to demonstrate compliance with RA 10173 consent requirements.

Data is securely deleted or anonymized at the end of the applicable retention period using procedures that render the data irrecoverable.

9. Your Rights Under the Data Privacy Act

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by xm777:

• Right to be informed: The right to be notified of how your personal data is processed, as described in this Privacy Policy.
• Right of access: The right to obtain a copy of the personal data xm777 holds about you.
• Right to rectification: The right to have inaccurate personal data corrected.
• Right to erasure: The right to request deletion of personal data that is no longer necessary for the purposes for which it was collected, subject to xm777's legal retention obligations.
• Right to object: The right to object to processing of your personal data for direct marketing purposes or processing based on xm777's legitimate interests.
• Right to data portability: The right to receive a structured, machine-readable copy of the personal data you provided to xm777, where technically feasible.
• Right to damages: The right to claim compensation for damages suffered as a result of unlawful processing of your personal data.

To exercise any of these rights, contact xm777's Data Protection Officer at [email protected]. xm777 will respond to rights requests within thirty (30) days of receipt, consistent with the timeframes prescribed under RA 10173.

10. Children and Minors

The xm777 platform is strictly for individuals aged 21 years and above. xm777 does not knowingly collect personal data from individuals under the age of 21. If xm777 becomes aware that personal data has been collected from a minor, that data will be deleted immediately and the associated account suspended. If you believe a minor has registered on xm777, please contact us at [email protected] immediately.

11. Cross-Border Data Transfers

xm777's primary data processing infrastructure is located within the Philippines. In limited circumstances, personal data may be transferred to xm777's third-party service providers operating in other jurisdictions — for example, cloud infrastructure providers or international payment processors. Any such cross-border transfers are made only where:

• The receiving jurisdiction provides an adequate level of data protection recognized by the NPC; or
• Appropriate safeguards are in place, such as data processing agreements incorporating NPC-approved standard contractual clauses; or
• The transfer is necessary for the performance of a contract between you and xm777 (e.g., processing an international card payment).

12. Third-Party Links

The xm777 platform may contain links to third-party websites or services (for example, game provider demonstration pages). xm777 is not responsible for the privacy practices of third-party sites. This Privacy Policy applies solely to data processed by xm777 in connection with your use of the xm777 platform. We encourage you to review the privacy policies of any third-party sites you visit.

13. Amendments to This Privacy Policy

xm777 may update this Privacy Policy from time to time to reflect changes in our data processing activities, regulatory requirements, or operational practices. Material changes will be communicated to registered users via email or in-platform notification at least seven (7) days prior to taking effect. The updated Privacy Policy will be published on this page with a revised "Last Updated" date. Your continued use of xm777 following the effective date of any amended Privacy Policy constitutes your acknowledgment of the updated terms.

14. Contact Information and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or xm777's data processing practices, please contact our Data Protection Officer:

• Email: [email protected]
• Live Chat: Available 24/7 within your logged-in xm777 account dashboard

If you are not satisfied with xm777's response to your data privacy concern, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC) at privacy.gov.ph.