xo99 Privacy Policy — Your Data, Your Rights, Our Commitment

xo99 is an online betting and casino platform operating at xo99.io and all associated subdomains and services. For the purposes of this Privacy Policy, xo99 ("the Platform", "we", "us", "our") acts as the data controller in respect of the personal information collected from players who register for and use the xo99 platform.

xo99 is designed and operated with the Bangladesh player market as its primary audience, offering cricket betting, live casino games, slots, and a full suite of online gaming services accessible via bKash, Nagad, Rocket, and other supported Bangladeshi payment methods. This Privacy Policy applies to all players who access xo99 from Bangladesh or any other supported region.

If you have questions about how xo99 handles your personal data, or if you wish to exercise any of your privacy rights, please contact the xo99 Data Protection contact at: [email protected]

xo99 collects personal data from players through several distinct channels. The categories of data collected are described below.

2.1 Registration Data. When you create an xo99 Account, we collect the following information:

• Full legal name
• Date of birth (to verify you are 21 years of age or older)
• Email address
• Mobile phone number
• Residential address (including district, city, and postcode within Bangladesh)
• Username and password (password stored as a one-way cryptographic hash — never in plain text)

2.2 Identity Verification (KYC) Data. As part of xo99's Know Your Customer process, we may request and collect:

• Copy of a government-issued national identity card (NID), passport, or driving licence
• Proof of address document (utility bill, bank statement, or equivalent)
• Selfie photograph for liveness verification where required
• Source-of-funds documentation in cases where xo99's anti-money laundering procedures require it

2.3 Financial Transaction Data. When you make deposits or withdrawal requests on xo99, we collect:

• Payment method type (e.g., bKash, Nagad, Rocket, Upay, Visa, Mastercard)
• Mobile financial service account number or card last-four digits (never full card numbers)
• Transaction amounts in Bangladeshi Taka (BDT / ৳)
• Transaction timestamps and reference numbers
• Transaction status and outcome records

2.4 Usage and Behavioural Data. During your use of the xo99 platform, we automatically collect:

• IP address and approximate geolocation data
• Device type, operating system, and browser/app version
• Session start and end times
• Pages visited and features accessed within the platform
• Betting history, game play records, and wagering activity
• Bonus claims, promotional interactions, and offer redemptions

2.5 Communications Data. When you contact xo99 support or communicate with us through any channel, we retain:

• The content of your support messages and our responses
• Date, time, and channel of communication
• Any documents or attachments you submit in connection with a query or dispute

xo99 uses the personal data it collects for the following specific, legitimate purposes:

3.1 Marketing Communications. xo99 may send you promotional emails or messages about new bonuses, upcoming BPL and IPL cricket markets, seasonal promotions (such as Eid ul-Fitr or Pohela Boishakh offers), and new game releases. You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing message or by contacting support at [email protected]. Opting out of marketing does not affect transactional communications necessary to manage your account.

3.2 Automated Decision-Making. xo99 uses automated systems to detect fraudulent activity, identify potential problem gambling patterns, and enforce responsible gaming tool triggers (such as session time reminders and deposit limit enforcement). These automated systems assist human review processes and do not make irreversible decisions about player accounts without human oversight.

xo99 processes your personal data on the following legal grounds, depending on the specific purpose for which data is used:

• Contractual necessity: Processing required to perform the xo99 Player Agreement (our Terms & Conditions), including account management, payment processing, and delivering the services you have signed up for.
• Legal obligation: Processing required to comply with applicable laws and regulations, including age verification (21+), anti-money laundering procedures, KYC identity checks, and fraud prevention obligations.
• Legitimate interests: Processing conducted for xo99's legitimate business interests where these interests are not overridden by your privacy rights — including fraud detection, platform security monitoring, responsible gaming analysis, and aggregate analytics for service improvement.
• Consent: Processing for which xo99 specifically requests and obtains your explicit agreement — primarily marketing and promotional communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5.1 We Do Not Sell Your Data. xo99 does not sell, rent, or trade your personal information to any third party for commercial marketing purposes. This is an unconditional commitment.

5.2 Third-Party Service Providers. xo99 shares personal data with carefully selected third-party service providers who assist in operating the platform. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard networks — to process deposits and withdrawals on your behalf.
• KYC and identity verification providers: Third-party identity verification services used to validate government-issued ID documents and confirm player eligibility.
• Game studio partners: Evolution, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe, and other certified game providers — who receive session data necessary to deliver their game content within the xo99 platform.
• IT infrastructure and hosting providers: Cloud infrastructure and server hosting partners who store xo99 platform data in secure, access-controlled environments.
• Customer support platform providers: Third-party support ticketing and live chat software providers used to deliver xo99's player support service.

All third-party service providers are required by contract to process personal data only for the purposes specified by xo99, to maintain appropriate technical and organisational security measures, and to comply with applicable data protection standards.

5.3 Legal Disclosures. xo99 may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or where disclosure is necessary to prevent or investigate fraud, money laundering, or other serious criminal activity. xo99 will notify affected players of such disclosures where it is legally permissible to do so.

5.4 Business Transfers. In the event of a merger, acquisition, or sale of all or part of xo99's business assets, personal data held by xo99 may be transferred to the acquiring entity as part of that transaction. Players will be notified in advance of any such transfer and of any changes to the Privacy Policy that would result from it.

6.1 Payment Processing Architecture. All financial transactions on xo99 — whether via bKash, Nagad, Rocket, Upay, bank transfer, Visa, or Mastercard — are processed by certified payment gateway partners. xo99's application servers do not receive or store full payment credentials at any point in the transaction flow. The payment gateway receives your payment details directly over an encrypted connection and returns only a transaction reference to xo99 upon completion.

6.2 What xo99 Retains. For each completed transaction, xo99 retains only: the payment method type, a masked account identifier (e.g., last four digits of a card, or a partially masked mobile number), the transaction amount in BDT, the transaction timestamp, the payment gateway reference number, and the transaction outcome status. This data is retained for a period of seven years from the transaction date in compliance with standard financial record-keeping obligations.

6.3 Encryption Standards. All data in transit between xo99 and player devices is protected using TLS 1.2 or higher. Sensitive data at rest — including KYC documents and account credentials — is stored using AES-256 encryption with access keys managed under strict key management procedures.

6.4 Security Incident Response. xo99 maintains a documented security incident response plan. In the event of a data breach that poses a risk to players' rights and freedoms, xo99 will notify affected players within 72 hours of becoming aware of the breach, providing details of the nature of the incident, the data categories affected, and the steps xo99 is taking to remediate the situation.

xo99 uses cookies and similar tracking technologies to operate the platform effectively, maintain session security, and understand how players interact with the site. The following categories of cookies are in use:

7.1 Managing Cookies. You may control cookie settings through your browser preferences. Please note that disabling essential cookies will prevent you from logging into your xo99 Account and using core platform features. Disabling analytics or preference cookies will not affect your ability to use the platform but may result in a less personalised experience.

7.2 No Third-Party Advertising Cookies. xo99 does not use third-party advertising networks or retargeting cookies that track your behaviour across other websites for advertising purposes. All tracking technologies used on xo99 are strictly first-party and serve the operational and security purposes described in this section.

xo99 retains personal data for defined periods aligned with the purpose of collection and applicable legal requirements. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an individual player. Anonymised aggregated data (such as aggregate betting statistics used for platform analytics) may be retained indefinitely as it no longer constitutes personal data.

xo99 recognises and respects the following privacy rights of all registered players. These rights may be exercised at any time by contacting xo99 at [email protected] with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of the personal data xo99 holds about you. xo99 will provide a structured, machine-readable summary of your account data within 30 calendar days of receiving a verified request.
• Right to Rectification: If any personal data xo99 holds about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay. You may update basic account information directly through your account settings after xo99 Login, or contact support for data that cannot be self-corrected.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. This right is subject to limitations where xo99 is required to retain data for legal, regulatory, or fraud prevention purposes. xo99 will inform you of any applicable limitations when responding to an erasure request.
• Right to Restrict Processing: You may request that xo99 restrict the processing of your personal data in specific circumstances — for example, while the accuracy of the data is being contested, or where you have objected to processing pending verification of legitimate grounds.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on xo99's legitimate interests. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another data controller where technically feasible.
• Right to Withdraw Consent: Where xo99 processes your data on the basis of your consent (primarily for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

9.1 Identity Verification for Requests. To protect player privacy, xo99 requires that all data rights requests be submitted by the verified account holder. xo99 may request that you verify your identity before processing a data rights request. This is to ensure that personal data is not disclosed to, or acted upon at the request of, an unauthorised third party.

9.2 Response Timeframe. xo99 will acknowledge all data rights requests within 5 working days and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 60 days, in which case xo99 will notify you of the extension and the reason for it within the initial 30-day period.

10.1 Age Restriction. The xo99 platform is strictly intended for individuals aged 21 years or older. xo99 does not knowingly collect personal data from persons under the age of 21. The age verification procedures described in Section 2.2 of this Privacy Policy are in place specifically to prevent underage individuals from registering accounts or accessing xo99 services.

10.2 Discovery of Underage Data. If xo99 discovers or is notified that personal data has been collected from a person under the age of 21 — whether through fraudulent registration or any other means — xo99 will immediately suspend the associated account, delete the personal data collected in connection with that account to the extent not required for legal and fraud prevention records, and take appropriate steps to prevent future access by the underage individual.

10.3 Parental Guidance. Parents and guardians who are concerned that a minor may have accessed or registered on the xo99 platform are encouraged to contact xo99 immediately at [email protected]. xo99 will treat such reports as urgent and will investigate and respond within 24 hours.

11.1 Cross-Border Processing. As an online platform serving players from Bangladesh and operating with technology partners and game providers located in multiple jurisdictions, xo99 may transfer personal data to countries outside Bangladesh. These transfers occur when, for example, a game studio partner based in another country processes session data to deliver a game, or when cloud infrastructure services store encrypted data on servers in a different region.

11.2 Transfer Safeguards. Where personal data is transferred outside Bangladesh, xo99 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections described in this Privacy Policy. These safeguards may include:

• Contractual data processing agreements incorporating standard data protection clauses binding the recipient to equivalent security and privacy obligations
• Transfer to jurisdictions that maintain adequate data protection frameworks recognised as providing a comparable level of protection to that applied within Bangladesh
• Technical safeguards including end-to-end encryption ensuring that data is not accessible to the recipient in unencrypted form

11.3 Player Queries on Transfers. If you wish to obtain further information about the specific safeguards applied to international transfers of your personal data, or to receive a copy of any contractual data transfer documentation, please contact xo99 at [email protected] with the subject line "International Transfer Query".

12.1 Right to Update. xo99 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform and services. The most current version of this Privacy Policy will always be available at xo99.io/privacy-policy.

12.2 Notification of Material Changes. Where xo99 makes a material change to this Privacy Policy — meaning a change that significantly affects the way your personal data is collected, used, or shared — xo99 will notify registered players via email to their registered address at least 14 calendar days before the change takes effect. The notification will describe the nature of the change, the reason for it, and any action you may wish to take in response.

12.3 Continued Use as Acceptance. Your continued use of the xo99 platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any changes to this Privacy Policy, you should cease using the platform and may request account closure in accordance with the xo99 Terms & Conditions. Outstanding balances will be returned to your verified payment method upon closure.

12.4 Version Archive. xo99 maintains an internal archive of all previous versions of this Privacy Policy. If you require a copy of a previous version, please submit your request to [email protected] specifying the approximate date of the version you require.

For all privacy-related queries, data rights requests, or concerns about how xo99 handles your personal data, please use the contact details below. xo99's player support team is available 24 hours a day, 7 days a week, including Bangladesh public holidays, and handles all data protection queries in English.

• Data Protection Contact: [email protected] — Subject line: "Privacy / Data Request"
• General Support: [email protected]
• Standard Response Time: Acknowledgement within 5 working days; full response within 30 calendar days.
• Urgent Requests (data breach concern, underage registration report): xo99 will prioritise and respond within 24 hours.
• Operating Hours: 24/7, Bangladesh Standard Time (BST, UTC+6).