xb99 Privacy Policy

When you register for an xb99 account, we collect the following personal information directly from you:

• Full name as it appears on your government-issued identification document.
• Mobile phone number registered to your mobile banking account (bKash, Nagad, Rocket, or Upay).
• Date of birth, used solely for the purpose of verifying that you meet the 21+ age requirement.
• Copies of identity verification documents (such as a National ID Card or passport) when required for KYC compliance.

To facilitate deposits and withdrawals, and to comply with anti-money-laundering obligations, xb99 records the following financial data:

• Mobile wallet identifiers (the mobile number associated with your bKash, Nagad, Rocket, or Upay account) used for each transaction. We do not store full wallet PINs or passwords.
• Deposit amounts, withdrawal amounts, transaction timestamps, and transaction reference numbers.
• Account balance history, bonus credits applied, and wagering activity logs, retained for fraud prevention, dispute resolution, and regulatory compliance purposes.

When you access and use the xb99 Platform, we automatically collect certain technical information about your device and browsing behaviour:

• IP address and approximate geographic location derived from it. We use this to detect multiple accounts and to flag unusual login patterns.
• Device type, operating system version, and browser type. Used to optimise the Platform for your specific device configuration.
• Session duration, pages visited, games played, and interaction logs. Used for Platform performance analysis and responsible gaming monitoring.
• Cookie data and similar tracking technologies (see the Cookies section below for full details).

xb99 uses the personal data we collect for the following specific purposes:

• Account creation and management: to set up your player account, verify your identity, and manage your account settings throughout the account lifecycle.
• Payment processing: to process your deposit and withdrawal requests through your chosen Bangladesh mobile banking provider, and to maintain an accurate transaction record.
• Customer support: to respond to your queries, handle complaints, and resolve disputes in a timely and effective manner.
• Fraud prevention and security: to detect and prevent fraudulent activity, multi-account creation, money laundering, and other prohibited conduct as defined in our Terms and Conditions.
• Responsible gaming: to monitor gameplay patterns, identify players who may be exhibiting signs of problem gambling, and to operate deposit limit, cooling-off, and self-exclusion features effectively.
• Marketing communications: to send you promotional offers, bonus updates, and platform news by SMS or message notification to your registered mobile number — but only where you have consented to receive such communications. You may opt out at any time.

xb99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: processing required to fulfil our obligations under the Terms and Conditions you accepted at registration — including account management, payment processing, and customer support.
• Legitimate interests: processing necessary to protect the security and integrity of the Platform, detect and prevent fraud, and ensure responsible gaming compliance — where these interests are not overridden by your data protection rights.
• Consent: processing for marketing communications, where you have explicitly opted in to receive such communications. You may withdraw consent at any time by contacting [email protected].
• Legal obligation: processing required to comply with anti-money-laundering regulations, age verification obligations, and any lawful request from a competent regulatory or law enforcement authority.

xb99 does not sell, rent, or trade your personal data to any third party for commercial gain. We share personal data only in the following limited and specific circumstances:

• Payment processing partners: your mobile wallet identifier is shared with your chosen Bangladesh mobile banking provider (bKash, Nagad, Rocket, or Upay) solely to the extent necessary to process the specific transaction you have initiated.
• Game content providers: aggregated and anonymised gameplay data (not personally identifiable) may be shared with licensed game studios such as Pragmatic Play, Evolution Gaming, or Spribe to support game integrity monitoring and RNG certification audits.
• Legal and regulatory authorities: where we receive a lawful request from a competent authority — such as a court order, law enforcement agency, or financial regulator — we may disclose specific personal data to the extent required to comply with that request.
• Fraud prevention and security service providers: we may share data with third-party fraud detection or identity verification service providers where necessary to protect the Platform and its users. Any such provider is bound by a data processing agreement requiring them to maintain confidentiality and process data only on our instructions.

In all cases where we share personal data with third parties, we require those parties to protect your data to a standard at least equivalent to the protections described in this Policy, and to use your data only for the specific purposes for which it was shared.

xb99 uses cookies and similar local storage technologies to make the Platform function correctly and to improve your experience. We use three categories of cookies:

• Essential cookies: strictly necessary for the Platform to function. These include session authentication cookies that keep you logged in during a gaming session, and security tokens that protect your account from cross-site request forgery. These cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies: used to remember your preferences such as language setting and display options, so you do not need to reconfigure them on each visit. These cookies improve convenience but are not essential to basic Platform operation.
• Analytics cookies: used to collect aggregated, anonymised data about how players use the Platform — such as which pages are visited most frequently and where players encounter errors. This data is used solely to improve Platform performance and is never used to personally identify you.

You can manage cookie preferences through your mobile browser settings. Disabling essential cookies will prevent you from using core Platform features including account login and gameplay. xb99 does not use third-party advertising cookies or cross-site tracking technologies.

xb99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. As a general guide: account data and transaction records are retained for a minimum of 5 years following account closure to meet anti-money-laundering record-keeping requirements. KYC documents are retained for the same 5-year period. Marketing communication preferences and opt-out records are retained indefinitely to ensure we do not contact players who have withdrawn consent.

When personal data is no longer required and the applicable retention period has expired, xb99 will securely delete or anonymise that data so that it can no longer be associated with any individual player. Where anonymisation is not technically feasible, we will apply access restrictions so that the data is not accessible for any operational purpose.

xb99 takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure:

• SSL/TLS encryption: all data transmitted between your device and the xb99 Platform is encrypted in transit using industry-standard SSL/TLS protocols, preventing interception by third parties.
• Access controls: personal data is accessible only to xb99 staff members who have a legitimate operational need to access it. All staff with data access are subject to confidentiality obligations and receive data protection training.
• Password security: account passwords are stored using one-way cryptographic hashing. xb99 staff cannot view your password in plain text and will never ask you to share it.
• Incident response: xb99 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to your rights and freedoms, we will notify affected players without undue delay.

While xb99 implements robust security measures, no online platform can guarantee absolute security against all possible threats. You are responsible for keeping your own account credentials secure and for logging out of your account when using a shared or public device.

• 👁️ Right of Access — Request a copy of all personal data xb99 holds about you.
• ✏️ Right to Rectification — Request correction of any inaccurate or incomplete personal data we hold about you.
• 🗑️ Right to Erasure — Request deletion of your personal data, subject to legal retention obligations. Note that we cannot erase data we are legally required to retain (e.g. transaction records for AML compliance).
• ⏸️ Right to Restrict Processing — Request that we pause processing of your data in certain circumstances, such as where you contest its accuracy or object to its use.
• 📦 Right to Data Portability — Request a structured, machine-readable copy of the personal data you have provided to us, where processing is based on consent or contract.
• 🚫 Right to Object — Object to processing of your data for direct marketing at any time, with immediate effect. You may also object to processing based on legitimate interests, subject to our assessment.

The xb99 Platform is strictly intended for adults aged 21 and above. xb99 does not knowingly collect personal data from individuals under the age of 21. All registration submissions include a date-of-birth field which is verified against the 21+ age requirement, and where there is reasonable doubt about a player's age, xb99 will request official identification before permitting access to the Platform.

If xb99 discovers that personal data has been collected from a player who was under the age of 21 at the time of collection, we will immediately close the account, delete or anonymise all associated personal data to the extent permitted by law, and return any deposits made (net of withdrawals already processed) to the payment source.

xb99 may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law, or improvements to the Platform. When we make material changes to this Policy, we will update the "Last updated" date at the top of this page and, where the changes are significant, endeavour to notify registered players via their registered mobile number.

Your continued use of the xb99 Platform following the posting of an updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically to remain informed about how we protect your personal data. The most current version is always the one available at xb99.org/privacy-policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how xb99 has handled your personal data, please contact our support team. All privacy enquiries are handled confidentially and with priority.

Email: [email protected]

Our support team operates 24 hours a day, 7 days a week, including Bangladeshi public holidays. We aim to acknowledge all privacy enquiries within 2 hours and to provide a full response within 30 days (Bangladesh Standard Time, UTC+6).