xc999 Privacy Policy — How We Collect, Use, and Safeguard Your Personal Data

1 About This Policy

xc999 is committed to protecting the privacy and personal data of every player who uses the xc999 platform. This Privacy Policy has been prepared in accordance with broadly recognised data protection principles and is designed to give players in Bangladesh a clear, transparent understanding of how their personal information is handled from the moment they register an account through to the closure of that account.

This Policy applies to all personal data collected through the xc999 website at xc999.io, including any mobile-optimised version of the site. It applies to all registered players, to visitors who browse the site without registering, and to individuals who contact xc999 customer support.

This Policy does not apply to the data practices of third-party game providers (Evolution Gaming, Pragmatic Play, Spribe, NetEnt, Microgaming, Ezugi) whose game software is accessible through the xc999 platform. Those providers operate under their own respective privacy policies, and xc999 is not responsible for their data handling practices.

2 Data We Collect

xc999 collects personal data in three broad categories: data you provide directly, data generated automatically through your use of the platform, and data obtained from third-party verification services. The specific data points collected within each category are described below.

• Registration data: full legal name, date of birth, residential address (including division, district, and postal code in Bangladesh), email address, and mobile phone number.
• Identity verification documents: scanned or photographed copies of government-issued photo ID (National Identity Card, passport, or driving licence), proof of address documents, and payment method ownership proofs submitted during KYC (Know Your Customer) review.
• Financial data: payment method identifiers (e.g., registered bKash number, Nagad account number, Rocket number, Upay account, Visa/Mastercard last four digits) and transaction records including deposit amounts, withdrawal amounts, and dates.
• Support communications: the content of messages, emails, and live chat conversations you initiate with the xc999 support team, including any attachments or screenshots provided.
• Self-exclusion and responsible gaming preferences: deposit limits, loss limits, session time reminders, cooling-off periods, and self-exclusion instructions you submit through the responsible gaming tools.

• Device and browser data: IP address, device type, operating system version, browser type and version, and screen resolution.
• Session data: login timestamps, session duration, pages visited, game titles accessed, bet amounts, game outcomes, and navigation paths within the platform.
• Cookie and tracking data: first-party cookie identifiers used to maintain your logged-in session and remember your preferences. See Section 6 for full cookie details.
• Performance and error logs: technical error reports, connection quality indicators, and platform performance metrics used to diagnose and resolve technical issues.

• Identity verification services: xc999 may receive confirmation data from third-party KYC verification providers that assists in confirming the authenticity of identity documents submitted by players.
• Payment processors: transaction status confirmations (success, failure, pending) and fraud screening signals received from payment gateways. xc999 does not receive full card numbers or full mobile banking PINs from payment processors.
• Anti-fraud and AML screening: data from risk-scoring services used to detect patterns associated with money laundering, fraud, or multi-accounting behaviour.

3 How We Use Your Data

xc999 uses the personal data it collects strictly for the purposes set out below. We do not use your personal data for purposes that are incompatible with those disclosed in this Policy without first seeking your consent.

xc999 does not use automated decision-making or profiling that produces legally significant effects on players without human review. Where automated systems flag an account for review (e.g., an AML alert or a responsible gaming concern), a qualified member of the xc999 team reviews the case manually before any account action is taken.

4 Legal Basis for Processing

xc999 processes player personal data on the following legal bases:

• Contractual necessity: Processing that is necessary to perform the contract between xc999 and the player — i.e., to operate the account, process bets, handle deposits and withdrawals, and provide customer support. Without this processing, xc999 cannot provide its services.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering obligations, age verification mandates, and the retention of financial transaction records.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, and aggregated analytics where those interests are not overridden by the player's privacy rights. xc999 conducts a balancing assessment before relying on this basis.
• Consent: Processing for optional communications such as promotional emails, bonus alerts, and seasonal offers. Consent is obtained explicitly at the point of registration or through the account communication preferences section. Players may withdraw consent at any time by updating their account preferences or contacting support.

5 Data Sharing & Disclosure

xc999 does not sell, rent, or commercially share player personal data with third parties for their own marketing or commercial purposes under any circumstances. Personal data is shared with third parties only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment processors and financial institutions: Transaction data is shared with bKash, Nagad, Rocket, Upay, Visa, and Mastercard processing networks strictly to execute deposit and withdrawal instructions submitted by the player.
• Identity verification providers: KYC document data is shared with certified third-party identity verification services that assist xc999 in confirming the authenticity of documents submitted during account verification. These providers are contractually bound to process data solely for the verification purpose and to maintain strict data security standards.
• Game providers: Your player ID and session token are shared with game providers (Evolution Gaming, Pragmatic Play, Spribe, NetEnt, Microgaming, Ezugi) when you launch a game. This is necessary to authenticate your session and record game outcomes. These providers do not receive your name, address, or payment details.
• Anti-fraud and AML services: Anonymised or pseudonymised transaction and device data may be shared with fraud screening and AML compliance services that help xc999 detect and prevent illegal financial activity on the platform.
• Legal and regulatory authorities: xc999 will disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by a lawful legal request, court order, or regulatory obligation. xc999 will, where permitted by law, notify the affected player of such a disclosure.
• Business succession: In the event of a merger, acquisition, or sale of all or part of the xc999 business, player data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and the privacy policy governing their data following completion of the transaction.

All third-party service providers who process personal data on xc999's behalf are required to enter into data processing agreements that obligate them to maintain the confidentiality and security of that data and to process it only in accordance with xc999's documented instructions.

6 Cookies & Tracking Technologies

xc999 uses cookies and similar tracking technologies on the xc999.io website. Cookies are small text files stored on your device by your browser when you visit a website. xc999 uses cookies exclusively for the operational and analytical purposes described below — not for cross-site advertising tracking.

• Session cookies (essential): These cookies maintain your authenticated session while you are logged in to xc999. Without them, you would be logged out every time you navigate between pages. Session cookies are deleted automatically when you close your browser.
• Preference cookies (functional): These cookies remember your language preference, game display settings, and other platform preferences so you do not have to re-configure them on every visit.
• Analytics cookies (performance): xc999 uses first-party analytics to understand how players navigate the platform, which sections are most visited, and where technical issues occur. This data is aggregated and anonymised — it cannot be used to identify individual players.
• Security cookies (essential): These cookies are used to detect and prevent fraudulent activity, including CSRF (cross-site request forgery) protection tokens that secure form submissions on the platform.

xc999 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on xc999.io. You may control cookie behaviour through your browser settings. Blocking essential cookies may impair the functionality of the xc999 platform, including the ability to log in and maintain an authenticated session.

7 Data Security

xc999 implements a multi-layered approach to data security designed to protect player personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption: All data transmitted between players and the xc999 platform is encrypted using industry-standard SSL/TLS protocols. Our SSL certificate is maintained and renewed continuously.
• Encrypted data storage: Sensitive personal data — including identity document copies and payment method details — is stored in encrypted format in secure database environments with strict access controls.
• Access control and authentication: Access to player data within xc999's systems is restricted on a strict need-to-know basis. All internal access is authenticated, logged, and subject to audit review. No xc999 employee accesses player data without a documented operational reason.
• Two-factor authentication: xc999 supports two-factor authentication (2FA) via SMS OTP for player accounts. We strongly recommend all players activate 2FA to protect against unauthorised account access.
• Regular security audits: xc999's platform and infrastructure undergo periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response procedures: xc999 maintains documented incident response procedures that are activated in the event of any suspected or confirmed data security breach. Affected players are notified promptly in line with this Policy.

While xc999 takes all reasonable and industry-standard precautions to secure player data, no online platform can guarantee absolute security. Players are responsible for maintaining the security of their own account credentials and should never share their xc999 password with any third party.

8 Data Retention

xc999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The general retention periods applied by xc999 are as follows:

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player. Data that is retained beyond account closure is held in a restricted archive accessible only to xc999's compliance team for the specific purposes described above.

9 Your Data Rights

As a player whose personal data is processed by xc999, you hold the following rights in relation to that data. xc999 will respond to all valid data rights requests within 30 calendar days of receipt.

• Right of Access: You may request a copy of all personal data that xc999 holds about you. xc999 will provide this information in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Rectification: If any personal data xc999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For account details, you may update many fields directly within your xc999 account settings; for identity document corrections, contact support.
• Right to Erasure ("Right to be Forgotten"): You may request that xc999 delete your personal data. This right is subject to limitations where xc999 is required to retain data for legal, regulatory, or fraud prevention purposes as described in Section 8. Where erasure is not possible in full, xc999 will explain which data must be retained and why.
• Right to Restriction of Processing: You may request that xc999 restrict the processing of your personal data in specific circumstances — for example, while a dispute over data accuracy is being resolved.
• Right to Data Portability: You may request a machine-readable export of the personal data you provided to xc999 directly, in a format such as JSON or CSV, to facilitate transfer to another service.
• Right to Object: You may object to the processing of your personal data where xc999 relies on legitimate interests as the legal basis. You may also object at any time to processing for direct marketing purposes, including profiling related to marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, contact xc999 by email at [email protected] with the subject line "Data Rights Request". Include your registered account email address and a description of your request. xc999 may ask for additional verification to confirm your identity before processing the request.

10 Children's Privacy

The xc999 platform is strictly for adults aged 21 years and above. xc999 does not knowingly collect, store, or process personal data from any individual under the age of 21. The registration process includes age verification steps specifically designed to identify and reject underage applicants.

If xc999 becomes aware that personal data has been collected from an individual under 21 — whether through a misrepresentation during registration or any other means — xc999 will immediately close the relevant account, void any bets placed, return deposited funds via the original payment method where possible, and permanently delete all personal data associated with that individual from xc999's systems.

Parents or guardians who believe a minor may have accessed xc999 using false information should contact xc999 immediately at [email protected]. xc999 will investigate all such reports as a priority matter and take appropriate action without delay.

11 Third-Party Links

The xc999 platform may from time to time contain informational references to third-party services such as payment providers (bKash, Nagad, Rocket, Upay) or game studios. xc999 does not link externally to third-party websites from within the xc999.io domain. However, where such references exist in a documentation context, players should be aware that xc999 has no control over the privacy practices, content, or security standards of any external website or service.

This Privacy Policy applies solely to data collected through xc999.io. If you visit any external service referenced in connection with xc999 — such as bKash or Nagad to manage your mobile banking account — the privacy practices of those external services are governed entirely by their own policies, which you should review independently.

12 Updates to This Privacy Policy

xc999 reserves the right to update or amend this Privacy Policy at any time. Changes may be made in response to evolving regulatory requirements, updates to xc999's data processing practices, changes in the services offered, or other operational developments.

When material changes are made to this Policy, xc999 will update the "Last Updated" date displayed at the top of this page and, where practicable, notify registered players via email or in-platform notification prior to or at the time the changes take effect. Non-material clarifications or editorial corrections may be made without prior notice.

Your continued use of the xc999 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. xc999 recommends that all players review this page periodically, particularly when xc999 announces changes to its services or platform features.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xc999 handles your personal data, please contact the xc999 privacy team through one of the following channels:

• Email: [email protected] — include "Privacy Policy" or "Data Rights Request" in the subject line for faster routing to the relevant team.
• Live Chat: Available 24/7 via the xc999 platform after login. Live chat is the fastest way to reach the xc999 support team for general privacy queries.

xc999 support operates in English and is available around the clock, 365 days per year, with agents based in Bangladesh Standard Time (BST, UTC+6) maintaining 24/7 coverage for players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh.

xc999 takes all privacy-related enquiries seriously and will acknowledge receipt of your message within one business day. Formal data rights requests will be handled in accordance with the timelines set out in Section 9 of this Policy.