xa999 Privacy Policy

This Privacy Policy ("Policy") describes how xa999 ("xa999", "we", "us", "our") collects, processes, stores, shares, and protects personal information relating to you ("Player", "you", "your") when you access or use the xa999 platform at https://xa999.bio, including all associated games, promotions, and payment services. By registering an account or otherwise using the xa999 platform, you confirm that you have read and accepted this Policy.

xa999 is committed to handling your personal data responsibly and transparently. We collect only the data we genuinely need to deliver a safe, fair, and enjoyable gaming experience for players across Bangladesh, including those in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and Rangpur. This Policy is written in plain English so you understand your rights without needing a legal background.

The personal data xa999 may collect includes, but is not limited to, the following:

• Identity data: full name, date of birth, gender, and a copy of your government-issued identification document (e.g. Bangladesh National Identity Card or valid passport) collected as part of mandatory KYC verification.
• Contact data: email address, mobile phone number (particularly the number registered to your bKash or Nagad account), and residential address.
• Financial data: deposit and withdrawal transaction records, payment method identifiers (e.g. the bKash or Nagad mobile number used), and where applicable, card last-four-digit references for Visa or Mastercard transactions.
• Gaming activity data: betting history, game session logs, wager amounts, bonus usage, and responsible gaming tool activations such as deposit limits or self-exclusion requests.
• Technical data: IP address, device type, operating system, browser type and version, referring URL, pages viewed, session duration, and approximate geolocation derived from your IP address.

xa999 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information beyond what is strictly necessary for age verification and responsible gaming obligations. All data collection is grounded in a legitimate purpose and proportionate to that purpose.

xa999 uses your personal data for the following specific purposes:

• Account management: creating and maintaining your xa999 player account, verifying your identity and age, processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and responding to your support requests.
• Platform integrity: detecting, investigating, and preventing fraud, money laundering, collusion, multi-accounting, and any other prohibited conduct described in our Terms and Conditions.
• Legal compliance: meeting our obligations under applicable anti-money laundering laws, complying with lawful requests from regulatory authorities or law enforcement agencies, and maintaining records required by law.
• Responsible gaming: monitoring gaming activity to identify potential problem gambling patterns and, where appropriate, making contact with players who may benefit from responsible gaming tools or information.
• Service improvement: analysing aggregated, anonymised usage data to improve the xa999 platform, personalise your experience, and develop new features. This analysis does not involve identifying individual players by name.

xa999 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Where automated screening flags an account for investigation, a human member of the xa999 team reviews the case before any account action is taken.

Your personal data may be shared with the following categories of third parties:

• Payment processors: bKash, Nagad, Rocket, Upay, and card payment networks (Visa, Mastercard) receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and data security standards.
• Game software providers: third-party game studios such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi receive session data necessary to run games and validate outcomes. These providers do not receive your full identity data.
• Regulatory and law enforcement authorities: xa999 will disclose personal data to competent authorities where required to do so by applicable law, court order, or lawful request, including for anti-money laundering and counter-terrorism financing purposes.
• Technology and infrastructure service providers: cloud hosting, cybersecurity, and analytics service providers who process data strictly on xa999's instructions and under binding data processing agreements that prohibit them from using your data for their own purposes.

xa999 requires all third-party data processors to maintain appropriate technical and organisational security measures and to use your data only for the specific purpose for which it was shared. xa999 does not transfer personal data to countries or organisations that do not provide an adequate level of data protection without implementing appropriate safeguards.

The cookies xa999 uses fall into the following categories:

• Strictly necessary cookies: essential for the platform to function. These include session authentication tokens, security cookies, and load balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: remember your preferences such as language setting and the responsible gaming limit values you have configured, so you do not need to re-enter them on each visit.
• Analytics cookies: collect anonymised data about how players navigate xa999 — pages visited, session duration, and device type — to help us identify usability issues and improve the platform experience. No individual player is identified by this data.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling functional cookies may affect how certain platform features behave. For information on managing cookies in your browser, refer to your browser's help documentation.

xa999 retains your personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable law. For active player accounts, xa999 retains identity, financial, and gaming activity data for the lifetime of the account plus a minimum of five years following account closure, in order to satisfy anti-money laundering record-keeping requirements.

Technical data such as IP logs and session data is retained for a shorter period of up to 12 months, unless a specific security or fraud investigation requires longer retention. When data is no longer required, xa999 deletes or anonymises it securely so that it can no longer be associated with you. You may request early deletion of data that xa999 is not legally required to retain by contacting [email protected].

Your rights with respect to your personal data held by xa999 include:

• Right of access: you may request a copy of the personal data xa999 holds about you, along with information about how it is being used and with whom it has been shared.
• Right to rectification: if any personal data xa999 holds about you is inaccurate or incomplete, you may request that it be corrected or completed without undue delay.
• Right to erasure: you may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (where consent is the basis for processing), or where it has been unlawfully processed. This right is subject to xa999's legal retention obligations.
• Right to restriction: in certain circumstances you may request that xa999 restricts processing of your data — for example while the accuracy of the data is being contested, or while you are waiting for xa999 to respond to an erasure request.
• Right to object: you may object to xa999 processing your personal data where processing is based on legitimate interests. xa999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.

xa999 aims to resolve all privacy rights requests fairly and promptly. Where a request is complex or xa999 receives a high volume of requests, xa999 may extend its response time by up to one additional month and will notify you of the extension. xa999 will never charge a fee for a first request unless it is manifestly unfounded or excessive.

xa999 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include SSL/TLS encryption for all data in transit between your device and xa999 servers, access controls that limit who within xa999 can access personal data on a need-to-know basis, secure encrypted storage of sensitive data at rest including KYC documents and payment identifiers, and regular security monitoring and penetration testing of platform infrastructure.

While xa999 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is completely secure. If xa999 becomes aware of a data breach that is likely to affect your rights and freedoms, xa999 will notify you as soon as reasonably practicable. You can help protect your account by using a strong, unique password and by never sharing your login credentials with anyone.

xa999 does not knowingly collect personal data from any person under the age of 21. The xa999 platform is strictly for adults aged 21 and over. If xa999 becomes aware that personal data has been collected from a person under 21 years of age, xa999 will immediately delete that data and close the associated account. If you are a parent or guardian and believe your child has registered on xa999, please contact [email protected] immediately so we can take appropriate action.

xa999 reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this Policy, we will update the Last Updated date at the top of this page and, where the changes are significant, notify registered players via the email address associated with their account at least seven days before the revised Policy takes effect.

Your continued use of the xa999 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically. The version displayed on this page is always the current, operative version. Previous versions of this Policy are available upon request by contacting [email protected].

If you have any questions, concerns, or requests regarding this Privacy Policy or the way xa999 handles your personal data, please contact our data team by email at [email protected].