Your Privacy Matters at xb99

1 Introduction

xb99 operates Bangladesh's trusted online betting and casino platform, providing cricket betting, live dealer casino games, online slots, and related entertainment services to eligible players in Bangladesh. In the course of providing these services, xb99 necessarily collects and processes certain personal data about the individuals who use the platform.

xb99 takes its data protection obligations seriously. We are committed to handling personal data with care, transparency, and respect for the individuals to whom it relates. This Policy sets out, in plain and accessible English, exactly what data we collect from players, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have in relation to your personal data.

This Policy applies to all personal data collected through the xb99 website at https://xb99.io, through any mobile browser interface, and through any communication channels operated by xb99, including live chat and email. It does not apply to third-party websites or services that may be linked from xb99 content — those third parties operate under their own privacy policies, and xb99 accepts no responsibility for their data practices.

2 Data Controller

For the purposes of this Privacy Policy, xb99 is the data controller in respect of the personal data of players who use the xb99 platform. As data controller, xb99 determines the purposes for which and the means by which personal data is processed.

All data protection and privacy-related enquiries, requests, and complaints should be directed to the xb99 data protection team. Contact details are set out in Section 14 of this Policy. xb99 aims to acknowledge all data-related correspondence within 3 business days and to resolve requests within 30 calendar days of receipt, in line with standard data protection practice.

3 Data We Collect

The categories of personal data that xb99 collects and processes about its players are set out in the table below. We collect only the data that is necessary and proportionate for the stated purpose.

4 How We Collect Your Data

xb99 collects personal data through the following means:

4.1 Directly from You

The majority of the personal data xb99 holds is provided directly by you at the time of account registration, during the KYC verification process, when making deposits or withdrawal requests, when setting responsible gaming preferences, and when contacting our support team via live chat or email.

4.2 Automatically During Platform Use

When you access and use the xb99 platform, certain technical and usage data is collected automatically. This includes your IP address, browser and device characteristics, session timestamps, and interaction data. This data is collected via server logs, cookies, and analytics tools operated by or on behalf of xb99. See Section 11 for details on cookies.

4.3 From Third-Party Service Providers

xb99 receives certain data from trusted third-party service providers who support the delivery of our platform services. These include:

• Payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard): transaction status confirmation, payment method validation data.
• Identity and KYC verification partners: confirmation of identity verification results, watchlist screening outcomes, and age verification status.
• Game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others): game session data, round results, and wager records necessary for account settlement.
• Fraud and security monitoring services: risk scores, device fingerprinting signals, and behavioural anomaly flags that assist in protecting player accounts and the integrity of the platform.

5 How We Use Your Data

xb99 uses personal data for the following purposes. For each purpose, the specific categories of data used are identified, along with the legal basis for processing (detailed in Section 6).

5.1 Account Registration and Management

We use your identity data and contact data to create and manage your xb99 account, verify your identity, enforce the one-account policy, and maintain your account settings and preferences.

5.2 Payment Processing

We use your financial data and identity data to process deposits and withdrawals in Bangladeshi Taka (BDT), to verify that withdrawals are directed to your registered mobile wallet, and to maintain accurate transaction records for audit and dispute resolution purposes.

5.3 Fraud Prevention and Platform Security

We use technical data, financial data, usage data, and identity data to detect and prevent fraud, money laundering, multi-accounting, bonus abuse, match-fixing-related betting patterns, and other prohibited conduct as defined in the Terms and Conditions. Real-time monitoring systems analyse patterns across these data categories to flag suspicious activity for human review.

5.4 Responsible Gaming

We use account data, financial data, usage data, and responsible gaming data to identify players who may be exhibiting signs of problem gambling behaviour, to enforce the responsible gaming tools selected by the player (deposit limits, loss limits, session alerts, self-exclusion), and to fulfil our player protection obligations.

5.5 Customer Support

We use contact data, account data, communications data, and financial data to respond to player enquiries, process complaints, resolve disputes, and provide technical assistance. All support communications are logged and retained as described in Section 8.

5.6 Platform Improvement and Personalisation

We use usage data and technical data in aggregated and anonymised form to analyse platform performance, identify areas for improvement, and enhance the user experience. Where personalisation features are available, account data and usage data may be used to surface game recommendations or relevant promotional content relevant to your demonstrated preferences.

5.7 Regulatory and Legal Compliance

We use identity data, financial data, and account data as necessary to comply with applicable anti-money laundering obligations, to respond to lawful requests from law enforcement or regulatory authorities, and to establish, exercise, or defend legal claims involving xb99.

5.8 Marketing Communications

Where you have provided explicit consent, we may use your contact data (email address and/or mobile number) to send promotional communications about xb99 bonuses, seasonal offers (such as BPL cricket promotions or Eid special offers), and new product features. You may withdraw your consent to receive marketing communications at any time by contacting support or adjusting your account notification preferences. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.

6 Legal Basis for Processing

xb99 processes personal data on the following legal bases:

• Contractual necessity: Processing that is necessary to perform the contract between xb99 and the player — including account creation, payment processing, game delivery, and customer support. Without this processing, xb99 cannot deliver the services described in the Terms and Conditions.
• Legal obligation: Processing that is required for xb99 to comply with applicable legal and regulatory requirements, including anti-money laundering obligations, identity verification requirements, and responding to lawful authority requests.
• Legitimate interests: Processing for fraud detection, platform security, responsible gaming monitoring, and platform improvement, where xb99's legitimate interest in operating a safe and fair platform is balanced against the player's privacy interests and does not override those interests.
• Consent: Processing for optional marketing communications, where xb99 has obtained your explicit prior consent. You have the right to withdraw consent at any time.

7 Sharing Your Personal Data

xb99 does not sell your personal data. We share personal data with third parties only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

7.1 Payment Service Providers

To process deposits and withdrawals, xb99 shares necessary financial and identity data with mobile wallet providers (bKash, Nagad, Rocket, Upay) and card scheme processors (Visa, Mastercard). These providers receive only the data required to execute the transaction and are bound by their own data protection obligations.

7.2 Identity Verification and KYC Partners

To comply with age verification and anti-money laundering obligations, xb99 shares identity documents and personal identification data with third-party KYC service providers. These providers process data solely for verification purposes and under strict confidentiality agreements.

7.3 Game Providers and Content Suppliers

To deliver real-money casino and sports betting products, xb99 shares a player session token and anonymised account identifier with game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. Game providers do not receive your full identity data, contact details, or payment information in connection with individual game sessions.

7.4 Technology and Infrastructure Partners

xb99 uses third-party providers for hosting, data storage, platform analytics, fraud detection, and security monitoring. These providers act as data processors on xb99's behalf and are contractually bound to process data only in accordance with xb99's documented instructions and applicable data protection standards.

7.5 Legal and Regulatory Authorities

xb99 may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other governmental authorities where required by law, or where xb99 reasonably believes that disclosure is necessary to protect the safety of any person, to prevent or detect crime, or to establish, exercise, or defend a legal claim.

7.6 Business Transfers

In the event that xb99 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, player personal data may form part of the transferred assets. In such circumstances, xb99 will notify affected players before their personal data becomes subject to a materially different privacy policy.

8 Data Retention

xb99 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, and no longer than is required or permitted under applicable law. The following retention guidelines apply:

Upon expiry of the applicable retention period, personal data is securely deleted from xb99's active systems and any backup storage. Where complete deletion is not immediately technically feasible (for example, in encrypted backup archives), data is isolated from active processing until it can be securely destroyed in the next scheduled backup rotation cycle.

9 Data Security

xb99 implements a multi-layered security programme designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, and unlawful disclosure. Key security measures in place include:

• SSL/TLS encryption: All data in transit between player devices and xb99 servers is encrypted using current SSL/TLS protocols. Connections using outdated protocol versions are rejected.
• Password hashing: Player account passwords are never stored in plain text. Passwords are hashed using a strong, salted hashing algorithm. xb99 staff cannot retrieve or view your password — only a reset is possible if credentials are forgotten.
• Access controls: Access to systems holding personal data is restricted on a least-privilege basis. Staff are granted access only to the data and systems necessary for their specific role. All access is authenticated, logged, and subject to regular review.
• Intrusion detection and monitoring: xb99's infrastructure is monitored 24/7 for anomalous access patterns, intrusion attempts, and unusual data transfer activity.
• Penetration testing: xb99 conducts regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities in the platform and supporting infrastructure.
• Data minimisation: Systems are designed to collect and retain the minimum personal data necessary. Data that is no longer required is deleted or anonymised promptly.
• Incident response: xb99 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to player rights and freedoms, xb99 will notify affected players without undue delay.

10 Your Rights in Relation to Your Personal Data

xb99 recognises that you have meaningful rights in relation to your personal data. You may exercise any of the following rights by submitting a request to [email protected] with the subject line "Privacy Request". xb99 will respond within 30 calendar days.

To verify your identity before processing a data rights request, xb99 may ask you to confirm certain account details. This is solely to protect your data from unauthorised access by third parties claiming to act on your behalf. xb99 will not charge a fee for handling data rights requests unless a request is manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply.

11 Cookies and Tracking Technologies

xb99 uses cookies and similar tracking technologies on the platform to ensure the site functions correctly, to maintain your session when you are logged in, to detect fraud, and to analyse platform usage. The main categories of cookies used are described below.

11.1 Strictly Necessary Cookies

These cookies are essential for the platform to operate. They enable core functions such as session management, login authentication, load balancing, and security token delivery. These cookies cannot be disabled without breaking core platform functionality. No personal data collected by strictly necessary cookies is used for any purpose beyond platform operation.

11.2 Analytics and Performance Cookies

xb99 uses analytics cookies to collect aggregated, anonymised data about how players interact with the platform — including which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used to improve platform performance and user experience. Where third-party analytics tools are used, they are configured to anonymise IP addresses and are prohibited from using xb99 data for their own purposes.

11.3 Functional Cookies

Functional cookies remember your preferences — such as your preferred language, display settings, and last visited game category — so that the platform delivers a consistent experience across sessions. These cookies do not track you across other websites.

11.4 Managing Cookies

You may control and manage cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies at any time. Please note that blocking strictly necessary cookies will impair your ability to use the xb99 platform. Blocking analytics or functional cookies will not prevent you from accessing the platform but may affect certain personalisation features. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

12 Minors and Age Restriction

xb99 is strictly intended for adults aged 21 and above. The xb99 platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. All account registration processes include an age verification step, and xb99 reserves the right to request documentary proof of age (such as a National ID card or passport) from any player at any time.

If xb99 discovers or is notified that personal data has been collected from a person under 21 years of age, the relevant account will be immediately suspended pending investigation, all funds will be handled in accordance with the Terms and Conditions, and all personal data associated with that account will be deleted or anonymised once any outstanding regulatory obligations have been fulfilled.

13 Changes to This Privacy Policy

xb99 reserves the right to update and amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, business practices, or the services provided on the platform. The date at the top of this Policy indicates when it was last revised.

Where changes are material — meaning they significantly affect how xb99 processes your personal data or alter your rights in a meaningful way — xb99 will provide advance notice by displaying a prominent notice on the platform and, where appropriate, by sending a notification to your registered email address or mobile number. Your continued use of the xb99 platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically to stay informed about how xb99 protects your personal data. If you have any questions about changes to this Policy, please contact our data protection team before continuing to use the platform.

14 Contact and Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xb99 processes your personal data, please contact us using the details below. All correspondence is treated with strict confidentiality and will be handled by our dedicated data protection team.

If you are not satisfied with xb99's response to your privacy concern, or if you believe that xb99 is processing your personal data in a manner that is inconsistent with applicable data protection principles, you have the right to escalate your complaint through appropriate legal channels. xb99 encourages players to contact us directly first so that we have the opportunity to resolve the matter before escalation.

xb99 treats all privacy complaints seriously and commits to investigating every concern thoroughly, fairly, and promptly. We view player trust as fundamental to our mission of providing a safe, reliable, and responsible online betting and casino platform for players across Bangladesh.