xc99 Privacy
Policy & Data Protection

1 Introduction

This Privacy Policy ("Policy") describes how xc99 ("xc99", "we", "us", "our"), the operator of the online gaming platform accessible at xc99.io, collects, uses, stores, and protects personal information provided by or collected about registered players, visitors, and other users ("you", "your") of the xc99 platform.

xc99 is committed to safeguarding the privacy of all individuals who interact with our platform. We process personal data only for clearly defined, legitimate purposes and only to the extent necessary to fulfil those purposes. This Policy applies to all personal data collected through the xc99 website, mobile platform, customer support channels, and any other touchpoint through which you interact with xc99.

By registering an account or otherwise using the xc99 platform, you confirm that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the xc99 platform.

2 Data We Collect

xc99 collects personal data in a number of ways — directly from you when you register or interact with the platform, automatically through your use of the platform, and from third parties where permitted by law. The categories of personal data we collect include:

2.1 Registration & Identity Data

When you create an xc99 account, we collect your full legal name, date of birth, residential address in Bangladesh, email address, and mobile phone number. This information is required to create and manage your account and to verify your identity in accordance with our Know Your Customer (KYC) obligations.

2.2 Identity Verification Documents

To process withdrawals and comply with applicable verification requirements, xc99 may request copies of identity documents such as your Bangladesh National Identity Card (NID), passport, or driving licence. These documents are stored in secure, access-restricted systems and are used solely for identity verification and fraud prevention purposes.

2.3 Financial & Transaction Data

xc99 collects records of all deposits, withdrawals, and transactions conducted through your account. This includes payment method identifiers (such as your registered bKash, Nagad, or Rocket mobile number), transaction amounts in Bangladeshi Taka (৳), transaction timestamps, and transaction reference numbers. xc99 does not store full card numbers or payment account passwords.

2.4 Gaming Activity Data

We collect detailed records of your betting and gaming activity on the xc99 platform, including games played, bet amounts, win/loss records, session durations, and bonus usage. This data is used to operate the platform, detect fraud, and support responsible gaming monitoring.

2.5 Technical & Device Data

When you access the xc99 platform, our servers automatically collect certain technical information, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and pages visited. This data is collected for security monitoring, fraud prevention, and platform analytics.

2.6 Communications Data

When you contact xc99 support — whether by email, live chat, or any other channel — we retain records of those communications, including the content of messages and the timestamps of interactions. This data is used to respond to your enquiries and to improve our customer support services.

3 How We Use Your Data

xc99 uses the personal data we collect only for the specific purposes described below. We do not use your data for any purpose that is incompatible with the reason for which it was originally collected.

• Account Management: To create, maintain, and administer your xc99 player account, including processing your login credentials, managing your wallet balance, and applying bonuses or promotions to your account.
• Payment Processing: To process deposits and withdrawals in Bangladeshi Taka (৳) via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank, and to maintain accurate records of all financial transactions.
• Identity Verification: To verify your identity in accordance with our KYC policy, to prevent underage gambling (minimum age 21), and to prevent fraudulent account activity.
• Platform Security: To detect, investigate, and prevent fraudulent transactions, account abuse, bot activity, and other prohibited activities as defined in our Terms & Conditions.
• Responsible Gaming: To monitor gaming patterns that may indicate problem gambling behaviour, to apply deposit limits, session limits, or self-exclusion measures requested by the player, and to comply with our responsible gaming obligations.
• Customer Support: To respond to your enquiries, complaints, and support requests, and to maintain records of interactions for training and quality assurance purposes.
• Legal Compliance: To comply with applicable legal and regulatory obligations, including responding to lawful requests from competent authorities.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, usability, and content of the xc99 platform.
• Marketing Communications: Where you have given explicit consent, to send you promotional offers, bonus notifications, and platform updates. You may withdraw this consent at any time by contacting support or updating your account preferences.

4 Legal Basis for Processing

xc99 processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and xc99 (i.e., the Terms & Conditions you accepted at registration). This covers account creation, payment processing, game operation, and customer support.
• Legal Obligation: Processing is necessary to comply with a legal obligation applicable to xc99, including identity verification, record-keeping for financial compliance, and responding to lawful requests from authorities.
• Legitimate Interests: Processing is necessary for the legitimate interests pursued by xc99, where those interests are not overridden by your rights and interests. This includes fraud prevention, platform security, and improving our services through analytics.
• Consent: For certain processing activities — particularly direct marketing communications and non-essential cookies — xc99 relies on your freely given, informed, and specific consent. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

5 Data Sharing & Disclosure

xc99 does not sell, rent, or trade your personal data to any third party. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

5.1 Payment Service Providers

xc99 shares necessary transaction data with our payment processing partners — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank — to process deposits and withdrawals. These providers receive only the data required to complete the specific transaction and are contractually bound to use it for no other purpose.

5.2 Identity Verification Services

To fulfil our KYC obligations, xc99 may share identity information with authorised third-party identity verification providers. These providers verify the authenticity of documents and identity claims on our behalf and are subject to strict confidentiality obligations.

5.3 Technology Partners

xc99 uses third-party technology providers to operate certain platform functions, including game software providers (such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and others), analytics platforms, and infrastructure providers. These partners process data only under xc99's instruction and in accordance with data processing agreements that prohibit independent use of the data.

5.4 Legal & Regulatory Authorities

xc99 may disclose personal data to competent legal or regulatory authorities where required by law, court order, or valid legal process. xc99 will, where legally permitted, notify affected players of such disclosure requests before complying.

5.5 Business Transfers

In the event that xc99 undergoes a merger, acquisition, or sale of all or part of its business assets, player data may be transferred as part of that transaction. xc99 will notify affected players in advance of any such transfer and will ensure that the receiving party commits to data protection standards at least equivalent to those described in this Policy.

6 Cookies & Tracking Technologies

xc99 uses cookies and similar tracking technologies (such as web beacons and local storage) on our platform. A cookie is a small text file placed on your device by our server when you visit the platform. Cookies help us deliver a functional, secure, and personalised experience.

6.1 Essential Cookies

These cookies are strictly necessary for the xc99 platform to function. They maintain your login session, remember your account preferences, and enable core security features such as fraud detection. Essential cookies cannot be disabled without impairing platform functionality.

6.2 Analytics Cookies

xc99 uses analytics cookies to collect aggregated, anonymised data about how players use the platform — which pages are most visited, how long sessions last, and where technical errors occur. This data helps us improve the platform experience. Analytics cookies do not identify you personally.

6.3 Preference Cookies

Preference cookies remember your platform settings — such as language preferences and display options — so that you do not need to re-enter them each time you visit. These cookies enhance your experience but are not essential to core platform operation.

6.4 Managing Cookies

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of some features on the xc99 platform. Consult your browser's help documentation for guidance on managing cookies on your specific device and browser.

7 Data Retention

xc99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. The following retention periods apply as a general guide:

When data reaches the end of its applicable retention period, xc99 will securely delete or anonymise it so that it can no longer be associated with any identifiable individual.

8 Data Security

xc99 implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the xc99 platform is encrypted using industry-standard 256-bit SSL/TLS protocols.
• Encrypted Data Storage: Personal data and financial records stored on xc99 servers are encrypted at rest using strong encryption standards.
• Access Controls: Access to personal data is restricted to xc99 personnel who require it to perform their specific job functions. All such access is logged and subject to regular review.
• Multi-Factor Authentication: Administrative access to systems holding personal data requires multi-factor authentication to prevent unauthorised access.
• Regular Security Audits: xc99 conducts regular internal security reviews and works with independent security specialists to test and improve our platform defences.
• Incident Response Plan: xc99 maintains a documented data breach response plan. In the event of a breach that affects your personal data, xc99 will notify affected players promptly and take immediate steps to contain and remediate the breach.

9 Your Rights

As an xc99 player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact xc99 support at [email protected]. xc99 will respond to all data rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data xc99 holds about you, along with information about how it is being used and with whom it has been shared.
• Right to Rectification: You have the right to request that xc99 correct any personal data that is inaccurate or incomplete. You can update basic account information directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to xc99's legal retention obligations.
• Right to Restriction: You have the right to request that xc99 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to xc99 in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to xc99's processing of your personal data where that processing is based on legitimate interests. You may also object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where xc99 relies on your consent as the basis for processing (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

10 Third-Party Links

The xc99 platform may contain references to third-party services such as payment providers (bKash, Nagad, Rocket) and game software providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and others). While xc99 carefully selects its technology and payment partners, we do not control and are not responsible for the privacy practices of any third-party service.

When you interact with a third-party service — for example, when completing a bKash or Nagad transaction through that provider's own interface — you are subject to that provider's own privacy policy and data practices. xc99 encourages you to review the privacy policies of any third-party services you use in connection with the xc99 platform.

11 Children & Minors

The xc99 platform is strictly an adult service. xc99 does not knowingly collect personal data from individuals under the age of 21. The minimum age to register an account and use any xc99 service is 21 years. 21+

If xc99 becomes aware that personal data has been collected from an individual under the age of 21 without appropriate verification, xc99 will immediately close the relevant account, delete or anonymise all associated personal data, return any deposits to the original payment source, and forfeit any winnings generated by the underage account holder.

If you are a parent or guardian and believe that a person under the age of 21 in your care has registered an account with xc99, please contact us immediately at [email protected] so that we can take prompt remedial action.

12 Policy Updates

xc99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. When we make a material change to this Policy, we will update the "Last Updated" date at the top of this page and, where practicable, notify registered players via the email address associated with their account.

We encourage all players to review this Policy periodically to stay informed about how xc99 protects their personal data. The most current version of this Policy is always available at xc99.io/privacy-policy. Your continued use of the xc99 platform following publication of any updated Policy constitutes your acceptance of the revised terms.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or xc99's data practices, please contact our support team using the details below. All data protection enquiries should be submitted in writing to ensure a full and documented response.

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the account dashboard after login
• Response Time: xc99 aims to respond to all data protection enquiries within 30 days of receipt
• Support Hours: 24/7, Bangladesh Standard Time (BST, UTC+6)

xc99 takes all privacy enquiries seriously. Our support team will acknowledge your request promptly and escalate to the appropriate internal team where necessary. Response times may be slightly longer during major sporting events, public holidays such as Eid, Durga Puja, Victory Day (16 December), or Independence Day (26 March), and periods of high platform traffic.