xz999 Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how xz999 ("xz999", "we", "us", or "our"), the operator of the online gaming platform accessible at xz999.io, collects, processes, uses, stores, and discloses personal information about individuals ("you", "your", or "the User") who access or use our platform, including our website, mobile-optimised site, and any related services.

xz999 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. By registering an account with xz999 or by continuing to use our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference. If you do not agree with any part of this Policy, you must cease using the xz999 platform and request account closure.

Data We Collect

xz999 collects personal data from you in several ways: directly when you register and use our platform, automatically when you interact with our services, and occasionally from third-party verification and payment partners. The categories of personal data we collect are set out below.

2.1 Registration Data

When you create a xz999 account, we collect the following information:

• Full legal name
• Date of birth (for mandatory 21+ age verification)
• Residential address, including city and country
• Email address
• Mobile phone number
• Username and encrypted password
• Preferred currency (Bangladeshi Taka, BDT)

2.2 Identity Verification (KYC) Data

To comply with our know-your-customer (KYC) and anti-money-laundering (AML) obligations, we may additionally collect:

• A copy of a government-issued photo identity document (National ID card, passport, or driving licence)
• Proof of residential address (utility bill or bank statement dated within 90 days)
• Proof of payment method ownership (e.g., a screenshot showing your bKash or Nagad account name and number)
• A self-portrait (selfie) holding your identity document, if requested during enhanced due diligence

2.3 Financial Transaction Data

When you deposit or withdraw funds, we record:

• Transaction amounts and timestamps
• Payment method used (bKash, Nagad, Rocket, Upay, bank name)
• Mobile wallet account numbers or bank account details associated with the transaction
• Transaction reference numbers and status

2.4 Gaming Activity Data

We log your gaming and betting behaviour on the platform, including:

• Games played, bets placed, and outcomes
• Session start and end times
• Bonus claims and wagering progress
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion status)

2.5 Technical and Device Data

Our systems automatically collect certain technical information when you access xz999.io:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Screen resolution and language settings
• Pages visited, time on page, and navigation path through the platform
• Referral source (how you arrived at xz999.io)

2.6 Communications Data

When you contact our support team, we retain records of your communications including email correspondence, live chat transcripts, and WhatsApp message histories. These records are used for quality assurance, dispute resolution, and regulatory compliance purposes.

How We Use Your Data

xz999 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose that is not listed here without first obtaining your explicit consent.

• Account creation and management: To register your account, authenticate your identity on each login, manage your account settings, and maintain the accuracy of your account profile.
• Age and identity verification: To confirm that you are aged 21 or above and to verify that you are who you claim to be, in compliance with our mandatory Know Your Customer (KYC) obligations.
• Payment processing: To process deposits into and withdrawals from your xz999 account via your chosen payment method (bKash, Nagad, Rocket, Upay, or bank transfer), and to maintain a complete audit trail of all financial transactions.
• Service delivery: To provide you with access to casino games, live dealer tables, sports betting markets, Plinko, Win Drop, and all other platform features.
• Anti-fraud and AML compliance: To detect, investigate, and prevent fraudulent activity, money laundering, identity theft, and other financial crimes. Unusual transaction patterns or gameplay behaviours may trigger enhanced monitoring.
• Responsible gaming: To monitor your gambling behaviour for indicators of problem gambling, to enforce the responsible gaming tools you have activated (deposit limits, self-exclusion), and to fulfil our duty of care obligations.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the performance, design, and content of the xz999 platform. Individual player data is not used for this purpose without anonymisation.
• Marketing communications: Where you have opted in to receive promotional communications, to send you information about bonuses, tournaments, seasonal promotions (such as those tied to Eid, Pohela Boishakh, or major cricket tournaments like BPL and IPL), and other offers relevant to you. You may opt out at any time.
• Legal and regulatory compliance: To comply with applicable laws, regulations, court orders, and lawful requests from competent authorities.

Legal Basis for Processing

xz999 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and xz999 — specifically, to operate your account, process transactions, and deliver the platform services you have signed up for.
• Legal obligation: Processing that is required to comply with applicable legal requirements, including KYC/AML legislation, age verification mandates, and financial record-keeping obligations.
• Legitimate interests: Processing that is necessary for xz999's legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and internal analytics — provided these interests are not overridden by your fundamental data protection rights.
• Consent: Processing that is based on your specific, freely given, informed consent — in particular, the sending of direct marketing communications. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Data Sharing & Disclosure

xz999 does not sell, rent, or otherwise trade your personal data to third parties for their own commercial purposes. Your data is shared only in the limited circumstances described below, and always under appropriate data protection safeguards.

5.1 Essential Service Providers

We share necessary data with carefully selected third-party service providers who assist us in operating the xz999 platform. These providers include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank — who receive transaction data necessary to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party services that assist us in verifying identity documents and checking against sanctions and politically-exposed-persons (PEP) lists.
• Game studios and platform providers: Certified game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others, who may receive the minimum data necessary to deliver their games within the xz999 platform environment.
• Cloud infrastructure and hosting providers: Server and cloud storage providers who host xz999 platform data under strict data processing agreements.
• Customer support platforms: Software providers that power our live chat and customer communications systems.

All third-party service providers are contractually required to process your data only for the specific purpose for which it was shared, to maintain appropriate security measures, and to comply with all applicable data protection obligations.

5.2 Legal and Regulatory Disclosure

xz999 may disclose your personal data to governmental authorities, law enforcement agencies, regulators, or courts where we are legally required or permitted to do so, including in response to valid legal process, to prevent or investigate suspected fraud or money laundering, or to protect the rights, property, or safety of xz999, our players, or the public.

5.3 Business Transfers

In the event that xz999 undergoes a merger, acquisition, restructuring, or sale of all or a portion of its business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any resulting change to this Privacy Policy in advance of the transfer taking effect.

Cookies & Tracking Technologies

6.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits and to remember certain preferences or session information. xz999 uses cookies and similar technologies (such as local storage and session tokens) to operate and improve the platform.

6.2 Types of Cookies We Use

6.3 Cookies We Do Not Use

xz999 does not use third-party advertising cookies, cross-site tracking cookies, or behavioural profiling cookies that follow your activity across other websites. We do not participate in programmatic advertising networks that rely on cookie-based audience targeting.

6.4 Managing Cookies

You can control cookie settings through your browser's privacy or settings menu. Disabling strictly necessary cookies will prevent xz999 from functioning correctly and may prevent you from logging in to your account. Disabling functional or analytical cookies will not affect your ability to access and play games, but may reduce the quality of your experience on the platform.

Data Retention

xz999 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and registration data: Retained for the duration of your active account relationship with xz999, plus a minimum of 5 years following account closure. This extended retention period is required by applicable anti-money-laundering regulations.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of account closure or from the date the document was submitted, whichever is later.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, as required for AML compliance and financial audit purposes.
• Gaming activity logs: Retained for a minimum of 2 years from the date of each logged session or bet.
• Customer support communications: Retained for a minimum of 2 years from the date of the last communication in a given support thread, or until any related dispute is fully resolved.
• Marketing consent records: Retained for as long as your marketing consent remains active, plus 2 years following withdrawal of consent as evidence of the consent history.

Where data is no longer required for any lawful purpose, xz999 will securely delete or anonymise it. Anonymised, aggregated data that cannot be linked to any individual may be retained indefinitely for statistical and business improvement purposes.

International Data Transfers

xz999 operates as an international platform. Your personal data may be processed by us or by our service providers in countries outside of Bangladesh. Where personal data is transferred internationally, xz999 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that which would apply if the data remained within Bangladesh.

Safeguards used for international transfers include:

• Contractual data protection clauses in agreements with all international service providers
• Transferring data only to service providers who operate under recognised data protection standards and who can demonstrate compliance with those standards
• Minimising the volume of personal data transferred internationally to what is strictly necessary for the relevant service

Your Data Rights

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data xz999 holds about you. To exercise any of these rights, please submit a written request to [email protected] from the email address registered to your xz999 account.

• Right of access: You have the right to request a copy of all personal data xz999 holds about you, together with information about how it is being processed. We will provide this within 30 days of a valid request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You may also update certain details directly through your Account Settings.
• Right to erasure ("right to be forgotten"): In certain circumstances, you have the right to request the deletion of your personal data. Note that we may be required by law to retain certain data (particularly KYC and financial records) even after a deletion request, as described in Section 7.
• Right to restrict processing: You have the right to request that we restrict processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to data portability: Where processing is based on your consent or on a contract, you have the right to receive a structured, machine-readable copy of the personal data you have provided to us, suitable for transfer to another service provider.
• Right to object: You have the right to object to processing of your personal data carried out on the basis of our legitimate interests. We will cease the processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

xz999 will respond to all data subject requests within 30 days. In complex cases, this period may be extended by a further 60 days, in which case you will be notified of the extension and the reason for it within the initial 30-day period.

Children's Privacy

The xz999 platform is strictly intended for adults aged 21 and above. xz999 does not knowingly collect personal data from individuals under the age of 21. Our registration process requires all applicants to confirm their date of birth, and accounts are subject to mandatory age verification.

If xz999 becomes aware that personal data has been collected from a person under 21 years of age without verified parental consent, we will take immediate steps to delete that data and close the associated account. Any winnings generated by an underage player will be voided in full.

Security Measures

xz999 employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, and destruction. Our security infrastructure includes:

• SSL/TLS encryption: All data transmitted between your device and the xz999 platform is protected by industry-standard Transport Layer Security (TLS) encryption. Look for the padlock icon in your browser's address bar when accessing xz999.io.
• AES-256 data encryption: Sensitive data stored in our databases — including KYC documents and financial records — is encrypted at rest using AES-256 encryption, the same standard used by financial institutions worldwide.
• Access control: Access to personal data is restricted on a strict need-to-know basis. All staff with access to player data undergo background screening and are bound by confidentiality obligations.
• Two-factor authentication (2FA): xz999 offers 2FA for player accounts and mandates 2FA for all internal administrative access to systems containing personal data.
• Intrusion detection and monitoring: Our systems are continuously monitored for suspicious activity, intrusion attempts, and anomalous data access patterns.
• Regular security audits: xz999 engages independent security professionals to conduct periodic penetration testing and vulnerability assessments of the platform.
• Incident response plan: A formal data breach incident response plan is in place, with defined roles, escalation procedures, and a 72-hour notification commitment to affected players in the event of a material breach.

While xz999 takes every reasonable precaution to protect your data, no internet-based platform can guarantee absolute security. You are responsible for keeping your own login credentials confidential and for notifying us immediately at [email protected] if you suspect unauthorised access to your account.

Third-Party Links

The xz999 platform does not contain links to external third-party websites. In the event that any third-party content is integrated into the platform in the future (for example, through embedded game providers), xz999 is not responsible for the privacy practices of those third parties. Each game studio and third-party provider operates under its own privacy policy.

xz999 recommends reviewing the privacy policies of any third-party services you interact with through our platform. If you have concerns about the privacy practices of a specific game provider available on xz999, please contact us and we will provide the relevant contact details for that provider.

Amendments to This Policy

xz999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, we will provide reasonable advance notice by:

• Sending an email notification to your registered email address prior to the changes taking effect
• Displaying a prominent notice on the xz999 platform for a minimum of 14 days before the changes take effect
• Updating the "Last Updated" date at the top of this page

Your continued use of the xz999 platform after the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must cease using the platform and may request account closure and deletion of your data (subject to our legal retention obligations) before the amendments take effect.

Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or about the way xz999 handles your personal data, please contact our Data Protection team using the details below. All privacy-related enquiries are handled by a dedicated team member.

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Subject Request" as appropriate
• WhatsApp: +880 1700 000 000 (available 08:00–24:00 BST)
• Live Chat: Available 24/7 via the xz999 platform

We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a full substantive response within 30 days. For complex data subject requests involving large volumes of data, we may extend this period by a further 60 days, with prior written notice to you.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. xz999 will cooperate fully with any such regulatory inquiry.