xv99 Privacy Policy — How We Protect Your Personal Data

This Privacy Policy ("Policy") is issued by xv99 ("xv99", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the xv99 website, mobile interface, casino games, sports betting products, customer support channels, payment services, and all related features of the platform (collectively, "the Services").

We are committed to handling your personal data responsibly and transparently. This Policy describes our data practices in plain English so that every player — whether based in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or anywhere else in Bangladesh — can make informed decisions about their personal information and understand their rights fully.

By registering an xv99 account, by using any part of the Services, or by submitting any personal information to xv99 through any channel, you acknowledge that you have read and understood this Policy and consent to the collection and use of your data as described herein. If you do not agree with this Policy, you should cease using the Services and may close your account in accordance with the xv99 Terms and Conditions.

This Policy should be read alongside the xv99 Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with xv99.

For the purposes of applicable data protection law, xv99 acts as the data controller in respect of the personal data of registered players and website visitors. As data controller, xv99 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully and fairly.

All enquiries relating to this Privacy Policy, data subject rights requests, or data protection concerns should be directed to the xv99 Data Protection contact using the details set out in Section 13 of this Policy. xv99 will acknowledge data-related enquiries within 48 hours and aim to provide a substantive response within 14 calendar days.

xv99 collects personal data from you through several channels: directly when you register an account or interact with the platform, automatically when you browse or use the Services, and from third-party partners where necessary to verify your identity or process payments. The categories of personal data we collect are described below.

xv99 does not intentionally collect sensitive personal data beyond what is necessary for identity verification and age compliance. We do not collect racial or ethnic origin data, political opinions, religious beliefs, biometric data (other than identity photographs required for KYC), or health data, unless specifically required by a regulatory obligation.

xv99 uses personal data only for defined, legitimate purposes directly related to operating the platform and providing the Services to you. We do not use your data for any purpose that would be incompatible with the reasons for which it was originally collected. The specific purposes for which each category of data is used are as follows:

• Account Creation and Management: Registration data is used to create and maintain your xv99 account, authenticate your identity at login, and personalise your platform experience;
• Age and Identity Verification: KYC documents are used to verify that you meet the 21+ age requirement, confirm your identity, and satisfy our obligations to prevent underage gambling and fraudulent account creation;
• Payment Processing: Financial data is used to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank — and to reconcile your account balance accurately;
• Fraud Prevention and Security: Device data, IP address, and usage patterns are analysed to detect and prevent fraudulent activity, unauthorised account access, money laundering, and abuse of the bonus system;
• Platform Improvement: Anonymised usage and technical data is used to understand how players interact with the xv99 platform, identify performance issues, and improve the overall user experience;
• Customer Support: Communications data is used to respond to your enquiries, resolve disputes, and maintain a record of all support interactions for quality assurance purposes;
• Responsible Gaming Compliance: Responsible gaming data is used to enforce deposit limits, apply self-exclusion restrictions, and monitor for patterns of play that may indicate problem gambling requiring intervention;
• Marketing Communications: Where you have opted in, your contact details and marketing preferences are used to send you promotional offers, bonus notifications, and relevant platform updates. You may opt out at any time via account settings or by contacting support;
• Legal and Regulatory Compliance: We may use and retain your personal data where necessary to comply with applicable legal obligations, respond to lawful requests from competent authorities, or pursue or defend legal claims.

xv99 processes your personal data only where a valid legal basis exists for doing so. The primary legal bases on which xv99 relies are as follows:

• Performance of a Contract: The majority of processing activities — including account management, payment processing, game delivery, and KYC verification — are necessary to perform the contract between xv99 and you as described in the xv99 Terms and Conditions;
• Legitimate Interests: xv99 processes certain data on the basis of legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement. In each case, xv99 has assessed that these interests are not overridden by your privacy rights;
• Compliance with a Legal Obligation: xv99 is required to collect and retain certain data to comply with applicable laws, including anti-money laundering obligations and age verification requirements;
• Consent: Where xv99 relies on consent as its legal basis — for example, for sending you direct marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

xv99 uses cookies and similar tracking technologies on its platform to ensure the Services function correctly, to remember your preferences, and to collect analytics data that helps us improve the platform. A cookie is a small text file placed on your device when you visit a website. xv99 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the platform to operate. They enable core functions such as user authentication, session management, and security features. These cookies cannot be disabled without breaking the platform;
• Functional Cookies: These cookies remember your preferences such as language settings and display options to personalise your xv99 experience across sessions;
• Analytics Cookies: These cookies collect anonymised information about how players use the xv99 platform — which pages are visited most frequently, how long sessions last, and which features are used. This data is used in aggregate form to improve the platform;
• Security Cookies: These cookies support xv99's fraud detection and anti-bot systems by recording device fingerprinting data and behavioural signals that help distinguish genuine players from automated activity.

xv99 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on its platform. Your browsing activity on xv99 is not shared with advertising networks for the purposes of serving personalised advertisements on other websites.

xv99 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the circumstances described below, and only to the minimum extent necessary for the relevant purpose.

• Payment Processors: Your financial data is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank as required to process your deposits and withdrawals. Each payment partner processes your data under their own privacy terms and security standards;
• KYC and Identity Verification Partners: Your identity documents are shared with certified KYC service providers solely for the purpose of verifying your identity and age in accordance with our compliance obligations. These partners are contractually prohibited from using your data for any other purpose;
• Game Providers: When you play games on xv99, basic session data (such as your player identifier and bet amounts) is shared with the relevant game studio — including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe — to deliver the game, calculate outcomes, and maintain game integrity;
• Analytics Providers: Anonymised and aggregated usage data is shared with analytics service providers to help xv99 understand platform performance. No personally identifiable information is shared in this context;
• Legal and Regulatory Authorities: xv99 may disclose your personal data to competent authorities, law enforcement agencies, or regulatory bodies where required to do so by law, court order, or where disclosure is necessary to protect the rights, safety, or property of xv99, its players, or the public;
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of xv99's assets, your personal data may be transferred to the acquiring entity as part of the transaction. xv99 will provide notice of any such transfer and the new entity will be required to honour the terms of this Policy.

All third parties with whom xv99 shares personal data are required to maintain appropriate technical and organisational security measures to protect that data and are contractually prohibited from using it for purposes beyond those specified by xv99.

xv99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Where xv99 is required to retain data beyond the periods stated above due to an ongoing legal dispute, regulatory investigation, or other exceptional circumstance, we will retain only the data that is directly relevant to the matter and will delete it as soon as the matter is resolved.

When data is no longer required and no legal basis exists for its retention, xv99 securely deletes or anonymises it in accordance with industry-standard data destruction procedures.

xv99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes, but is not limited to, the following measures:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the xv99 platform is protected by 256-bit SSL/TLS encryption. This applies to every page of the platform — from the login screen to the cashier to live dealer game sessions;
• Password Hashing: Account passwords are never stored in plain text. xv99 uses industry-standard one-way cryptographic hashing algorithms with salting to store password data. Even xv99 employees cannot read your password;
• Two-Factor Authentication (2FA): xv99 offers two-factor authentication as an additional layer of account security. We strongly recommend all players enable 2FA from their account settings;
• Access Controls: Access to personal data within xv99's systems is restricted on a strict need-to-know basis. Only staff members whose role requires access to specific data categories are granted access, and all access is logged and audited;
• Intrusion Detection Systems: xv99's platform infrastructure is monitored continuously by automated intrusion detection and prevention systems that identify and respond to suspicious activity in real time;
• Regular Security Audits: xv99 commissions periodic security assessments and penetration tests by independent third-party security specialists to identify and remediate vulnerabilities before they can be exploited.

Despite our extensive security measures, no system connected to the internet can be guaranteed to be completely secure at all times. xv99 maintains an incident response plan and will notify affected players promptly in the event of a confirmed personal data breach that poses a risk to their rights and freedoms.

xv99 respects your rights over your personal data. Subject to applicable law, you hold the following rights in connection with the personal data xv99 holds about you:

• Right of Access: You have the right to request a copy of all personal data xv99 holds about you. xv99 will provide this information in a structured, commonly used format within 30 calendar days of a verified request;
• Right to Rectification: If any personal data xv99 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may update basic account information directly from your account settings panel at any time;
• Right to Erasure: You have the right to request that xv99 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing was unlawful. Please note that erasure requests may not apply to data xv99 is required to retain by law (such as KYC records and transaction data);
• Right to Restrict Processing: You have the right to request that xv99 restrict the processing of your data in certain circumstances — for example, while the accuracy of the data is being contested or where an erasure request is pending determination;
• Right to Data Portability: Where processing is based on consent or contract performance, you have the right to receive your personal data in a structured, machine-readable format and to have it transmitted to another data controller where technically feasible;
• Right to Object: You have the right to object to xv99's processing of your personal data where that processing is based on legitimate interests, including profiling for fraud detection purposes. xv99 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent: Where processing is based on your consent (for example, direct marketing), you may withdraw that consent at any time by updating your account preferences or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the rights listed above, please contact xv99 at [email protected] with the subject line "Data Rights Request". xv99 will verify your identity before processing any data rights request to protect against fraudulent requests. All requests will be acknowledged within 48 hours and responded to substantively within 30 calendar days.

The xv99 platform is strictly for adults aged 21 and above. xv99 does not knowingly collect, process, or retain personal data belonging to any individual under the age of 21. Age verification is a mandatory step in the xv99 registration and KYC process specifically to prevent minors from accessing the platform.

If xv99 becomes aware that personal data has been collected from an individual who is under 21 years of age, the relevant account will be immediately suspended, all balances will be frozen pending investigation, and the minor's personal data will be deleted in accordance with applicable law. Any deposits made by an underage player will be returned to the originating payment method following verification that the funds did not arise from prohibited gambling activity.

xv99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or changes in the Services we offer. Where changes are material — meaning they could significantly affect how we handle your personal data or reduce your privacy rights — xv99 will notify registered players via the email address on file at least seven (7) days before the updated Policy takes effect.

For minor or administrative changes (such as updated contact details, clarifications of existing practices, or corrections to typographical errors), the updated Policy will be published on this page and the "Last Updated" date at the top of the page will be revised accordingly. Continued use of the xv99 platform after any version of this Policy has taken effect constitutes acceptance of the revised terms.

Players are encouraged to review this Policy periodically. Archived versions of previous Privacy Policy editions are available upon request by contacting [email protected].

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have a complaint about the way xv99 handles your personal data, please contact the xv99 Data Protection team using the details below. All contact information is provided as plain text only and is not a clickable link.

• Data Protection Email: [email protected] (Subject line: "Data Privacy Request")
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Acknowledgement Target: Within 48 hours of receiving your request
• Response Target: Substantive response within 30 calendar days for data rights requests; within 14 business days for general privacy enquiries

If you are not satisfied with xv99's response to your privacy complaint, you have the right to escalate the matter through xv99's formal complaints procedure as described in the xv99 Terms & Conditions. xv99 is committed to resolving all privacy complaints fairly and promptly.