Privacy Policy — xc99

xc99 collects personal data through several channels: directly from you when you register an account or contact support, automatically when you use the platform, and in some cases from trusted third-party sources such as payment providers and identity verification services. The categories of personal data we collect are set out below.

1.1 Registration and Account Data

When you create a xc99 account, we collect the information you provide during the registration process, including:

• Full legal name
• Date of birth (for age verification — all players must be 18 or older)
• Email address
• Mobile phone number
• Residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Rajshahi, Khulna) and postcode
• Username and encrypted password
• Preferred currency (Bangladeshi Taka / BDT)

1.2 Identity Verification Data

To comply with Know Your Customer (KYC) requirements and to prevent underage gambling and fraud, xc99 may request copies of:

• Government-issued photo identification (National ID card, passport, or driving licence)
• Proof of residential address (utility bill or bank statement dated within the last three months)
• Proof of payment method ownership (e.g., a screenshot of your bKash or Nagad account showing your name and registered number)

These documents are handled with strict confidentiality and used exclusively for verification purposes. They are stored securely and are not shared with any third party except where legally required or necessary for verification processes.

1.3 Financial Transaction Data

When you make deposits or withdrawals on xc99, we collect transaction data including:

• Payment method type (bKash, Nagad, Rocket, Upay, Visa, Mastercard)
• Transaction amount in BDT (৳)
• Transaction date, time, and reference number
• Partial payment account identifiers (e.g., the last four digits of a card, or the registered mobile number associated with a bKash or Nagad account)

We do not store full card numbers or full mobile banking PINs on our servers. Payment processing is handled by certified payment gateways that maintain their own security standards.

1.4 Gaming Activity Data

As you use the xc99 platform — playing casino games, placing sports bets, or using features such as live dealer tables — we automatically record:

• Games played, bet amounts, game outcomes, and session duration
• Bonus activations, wagering progress, and promotion participation
• Sports markets accessed and betting selections made (e.g., cricket BPL matches, IPL, T20 World Cup fixtures)
• Win/loss history and account balance movements

This data is used primarily for account management, responsible gaming monitoring, dispute resolution, and the continuous improvement of our platform.

1.5 Technical and Device Data

When you access xc99 via a browser or mobile interface, we automatically collect certain technical data, including:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Referring URL and pages visited within xc99
• Session timestamps and duration

1.6 Communications Data

If you contact our support team via live chat or email, we retain records of those communications — including the content of messages and any attachments — for quality assurance, dispute resolution, and training purposes. We also retain records of any marketing communication preferences you express.

xc99 uses the personal data we collect for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the reasons it was originally collected. The primary purposes for which we use your personal data are set out in the table below.

Where we rely on your consent as the legal basis for processing (such as sending you personalised promotional emails about new games, bonus offers, or seasonal events like Eid promotions or BPL cricket specials), you may withdraw that consent at any time by updating your communication preferences in your account settings or by contacting [email protected]. Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal.

xc99 does not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you, except where such processing is strictly necessary for fraud prevention or regulatory compliance — in which case you have the right to request human review of any such decision.

xc99 uses cookies and similar tracking technologies to make the platform function correctly, to remember your preferences, and to gather anonymised analytics data that helps us understand how our players use the site. A cookie is a small text file placed on your device by a website you visit. Cookies cannot be used to run programmes or deliver viruses to your device; they are associated only with your browser, not your person directly.

The cookies used on xc99 fall into the following categories:

• Strictly necessary cookies: These are essential for the platform to function. They enable core features such as logging in, maintaining your session, processing deposits and withdrawals, and keeping your gaming preferences intact during a session. You cannot opt out of strictly necessary cookies without ceasing to use the platform.
• Functional cookies: These remember choices you make (such as your preferred language, display settings, or whether you have accepted this Privacy Policy) to provide a more personalised experience. They are not used for advertising purposes.
• Analytics cookies: xc99 uses anonymised analytics data to understand page performance, navigation patterns, and feature usage. This data is aggregated and does not identify you personally. It helps our team prioritise improvements to the platform.
• Security cookies: These cookies help detect and prevent fraudulent activity, identify unusual login patterns, and protect player accounts. They are a component of our overall fraud-prevention infrastructure.

xc99 does not use third-party advertising cookies or cross-site tracking technologies for the purpose of serving targeted advertisements on external websites. Any analytics tools used by xc99 are configured to anonymise IP addresses and are governed by data processing agreements that require those providers to handle data only on xc99's instructions.

xc99 does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only with parties who are bound by appropriate confidentiality and data protection obligations.

4.1 Payment Service Providers

To process your deposits and withdrawals, xc99 shares necessary financial and identity data with our payment partners — including bKash, Nagad, Rocket, Upay, and card processing networks (Visa, Mastercard). These providers receive only the data necessary to complete your transaction and are contractually required to handle it securely. They may carry out their own identity and fraud checks as part of their service obligations.

4.2 Game Content Providers

Casino games on xc99 are supplied by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play these games, basic session data (such as player ID, bet amount, and game outcome) is transmitted to and from the relevant game provider's servers. This data is used solely to power the game and to verify outcomes. Game providers do not receive your full name, payment details, or contact information.

4.3 Identity Verification Services

xc99 may use third-party identity verification providers to assist with KYC processes. Where this is the case, relevant portions of your identity documents and personal details are shared with the verification provider solely for the purpose of confirming your identity. These providers are contractually bound to use your data only for this purpose and to destroy it after verification is complete.

4.4 Legal and Regulatory Disclosure

xc99 may disclose your personal data to law enforcement agencies, regulatory bodies, or other authorities where we are legally required to do so — for example, in response to a valid court order, regulatory investigation, or in connection with the prevention or detection of crime (including money laundering and fraud). In such cases, we will disclose only the minimum data required by the legal obligation and will notify you where we are legally permitted to do so.

4.5 Corporate Transactions

In the event that xc99 undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to how your data is handled as a result.

xc99 takes data security seriously and has implemented a layered set of technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security framework includes the following measures:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Encrypted storage of sensitive data fields — including passwords (which are hashed and salted using industry-standard algorithms) and identity document files — on secured servers with restricted access controls.
• Two-factor authentication options for your xc99 account, providing an additional layer of login security beyond your password alone.
• Regular security audits and penetration testing carried out by independent security professionals to identify and address potential vulnerabilities in the platform.
• Access controls that restrict internal access to personal data on a strict need-to-know basis. Staff members who handle personal data are subject to confidentiality obligations and receive regular data protection training.
• Intrusion detection systems and real-time monitoring of our infrastructure to identify and respond to suspicious activity promptly.

While xc99 takes every reasonable precaution to protect your personal data, no system connected to the internet can guarantee absolute security. In the unlikely event of a data breach that poses a risk to your rights and freedoms, xc99 will notify affected users without undue delay and will take all necessary steps to contain the breach and mitigate its impact.

xc99 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

When personal data is no longer required for any of the purposes listed above, xc99 will securely delete or anonymise it. Where anonymisation is used, the resulting data no longer constitutes personal data and may be retained indefinitely for statistical and analytical purposes.

If you request deletion of your account and personal data (see Section 7 below), xc99 will action that request within a reasonable timeframe, subject to our obligation to retain certain data for the minimum legal periods set out in the table above. Data that must be retained for legal reasons will be kept in a restricted-access archive and will not be used for any other purpose during the retention period.

xc99 respects your rights over your personal data. Regardless of where you are located in Bangladesh — whether in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar — you have the following rights in relation to the personal data xc99 holds about you:

• Right of access: You have the right to request a copy of the personal data xc99 holds about you, along with information about how it is used. We will respond to access requests within 30 days.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For basic account details such as your email address or contact number, you can update these directly in your account settings.
• Right to erasure: You may request that xc99 delete your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn your consent, or where we have no other lawful basis to retain it. This right is subject to our legal obligation to retain certain data for the periods described in Section 6.
• Right to restrict processing: You have the right to request that xc99 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: Where processing is carried out on the basis of your consent or as a necessity of your contract with us, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing of your personal data carried out on the basis of legitimate interest, including profiling. You may also object at any time to receiving direct marketing communications from xc99.
• Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you, and to request human review of any such decision.

To exercise any of these rights, please contact our data protection team at [email protected] with the subject line "Privacy Rights Request" and a description of your request. We will acknowledge your request within 5 business days and provide a full response within 30 calendar days. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

xc99 will not discriminate against you for exercising any of your privacy rights. Exercising your rights will not affect your ability to use the platform, subject only to any limitations that arise from our legal retention obligations.

xc99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the features and services we offer. When we make material changes to this Policy, we will notify registered account holders via email to the address on file and/or by displaying a prominent notice on the xc99 platform for a reasonable period following the update.

The "Last Updated" date at the top of this Policy will always reflect the most recent revision. We encourage you to review this Privacy Policy periodically to remain informed about how xc99 protects your information. Your continued use of the xc99 platform after any update to this Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or complaints about this Privacy Policy or about how xc99 handles your personal data, please contact our support team using the details below. We take all privacy enquiries seriously and aim to resolve concerns quickly and fairly.

This Privacy Policy was drafted in English and is the authoritative version. Any translations provided are for convenience only; in the event of any discrepancy, the English version prevails. This Policy is governed by the laws of Bangladesh and is intended to reflect best-practice standards for online data protection in the context of the Bangladesh market.

xc99 is committed to maintaining the trust of every player across Bangladesh — from Dhaka and Chittagong to Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh, and Cox's Bazar. Your data is safe with us. If you are ever uncertain about how your information is being used, please reach out. We are here to help.