Privacy Policy — How xz999 Collects, Uses & Protects Your Data

1. Information We Collect

xz999 collects personal data from you through several channels: directly when you register an account, indirectly through your use of the Platform, and in some cases from third-party service providers such as payment processors. The categories of personal data we collect are set out below.

1.1 Registration and Account Data

When you create a xz999 account, we collect the following information:

• Full legal name as it appears on your government-issued identity document.
• Date of birth, collected for the purpose of verifying that you meet the 18+ age requirement.
• Email address, used as your primary account identifier and communication channel.
• Mobile phone number, used for account security alerts and payment verification.
• Preferred username and encrypted account password.
• Residential address, collected as part of the identity verification process where required.

1.2 Identity Verification Data

In accordance with our know-your-customer (KYC) and age verification obligations, xz999 may request copies of the following documents at registration or at any point during your account lifecycle:

• National Identity Card (NID), passport, or other government-issued photo identification.
• Proof of address documentation such as a recent utility bill, bank statement, or official government correspondence.
• Payment method verification documentation, including screenshots or receipts confirming that the bKash, Nagad, Rocket, or bank account used for deposits belongs to the registered account holder.

1.3 Financial Transaction Data

xz999 records information relating to every financial transaction conducted on the Platform, including:

• Deposit amounts, timestamps, and the payment method reference associated with each transaction.
• Withdrawal requests, including the requested amount, destination payment method, and processing status.
• Bonus claims, bonus expiry events, and wagering activity related to promotional balances.

xz999 does not store full payment card numbers. Where card-based payments are supported, card data is handled exclusively by PCI-DSS-compliant payment processors. For bKash, Nagad, and Rocket transactions, only the mobile number and transaction reference are retained by xz999 — wallet PINs or passwords are never requested or stored.

1.4 Platform Activity and Technical Data

When you access and use the xz999 Platform, we automatically collect certain technical and behavioural data, including:

• IP address and approximate geographic location derived from IP.
• Device type, operating system, and browser version.
• Session start and end times, pages visited, and navigation patterns within the Platform.
• Game history, including all bets placed, game outcomes, and betting balances at the time of each wager.
• Error logs and crash reports generated during your Platform session.

1.5 Communications Data

If you contact the xz999 support team via email at [email protected], we retain records of that correspondence, including your contact details, the content of your message, and any files or attachments you submit. This data is used to resolve your query and to maintain a quality-assurance record of support interactions.

2. How We Use Your Data

xz999 processes your personal data only for legitimate, specified purposes. The table below summarises the primary purposes for which we use your data and the legal basis on which each processing activity rests.

xz999 will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your consent. We do not use your data for automated individual decision-making that produces significant legal effects without providing you with an opportunity to challenge the outcome.

Responsible Gaming Monitoring: xz999 uses certain Platform activity data — including session frequency, deposit amounts relative to historical averages, and changes in betting patterns — to identify players who may be experiencing gambling-related harm. This monitoring is conducted in the interest of player welfare and is not used for commercial profiling. For more information, please visit the Responsible Gaming page.

3. Data Sharing & Disclosure

xz999 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your data only in the following limited and controlled circumstances:

3.1 Payment Service Providers

To process deposits and withdrawals, xz999 shares necessary transaction data with our payment partners including bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, and the banking institutions involved in bank-transfer transactions. These providers receive only the minimum information required to execute the transaction and are contractually bound to process that data solely for the purposes of payment execution and fraud prevention.

3.2 Game Content Providers

Game studios and content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe operate the game engines that power titles on the xz999 Platform. To facilitate game play, certain session identifiers and non-personally identifiable data may be passed to these providers to initialise and manage individual game sessions. Full account data such as your name, address, or payment details are not shared with game providers.

3.3 Identity Verification Services

Where xz999 uses third-party KYC verification tools to assist with document verification and age confirmation, the personal data submitted during that process (such as ID document images) is shared with the relevant verification provider under strict data processing agreements. Verification providers are prohibited from retaining your data beyond the period required to complete the verification check.

3.4 Legal and Regulatory Disclosure

xz999 may be required to disclose your personal data to law enforcement agencies, regulatory authorities, or courts in response to a valid legal request, court order, or statutory obligation. In such cases, xz999 will disclose only the minimum data required to comply with the legal obligation and will, where legally permitted, notify the affected player of the disclosure request.

3.5 Business Transfers

In the event that xz999 undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via the email address registered on your xz999 account before your data becomes subject to a materially different privacy policy.

4. Cookies & Tracking Technologies

xz999 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file stored in your browser when you visit the xz999 website. The following categories of cookies are used on the Platform:

You can manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies from specific websites. Please note that disabling strictly necessary or security cookies will prevent you from logging into your xz999 account and using the Platform's core features.

xz999 does not use third-party advertising cookies or behavioural tracking cookies that follow you across other websites. Our tracking technologies are limited to first-party Platform operations.

5. Data Retention

xz999 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, to resolve disputes, and to enforce our agreements. The general retention periods applied by xz999 are as follows:

• Active Account Data: Retained for the full duration of your account's active status and for a minimum period of five (5) years following permanent account closure.
• Transaction Records: Financial transaction data, including deposit and withdrawal records, is retained for a minimum of five (5) years from the date of the transaction to satisfy financial record-keeping obligations.
• Identity Verification Documents: KYC documents are retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Support Correspondence: Records of communications with the xz999 support team are retained for three (3) years from the date of the last interaction.
• Marketing Preferences: Records of your marketing consent status (including opt-out records) are retained indefinitely to ensure we honour your stated communication preferences.
• Technical and Session Data: Anonymised or aggregated platform usage data may be retained indefinitely for analytics purposes. Data capable of identifying individual users is deleted or anonymised no later than twelve (12) months after collection.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not technically immediately possible (for example, data held in backup archives), the data will be isolated from active processing and deleted at the next scheduled backup purge cycle.

6. Data Security Measures

xz999 takes the security of your personal data seriously and implements a multi-layered set of technical and organisational controls to protect it against unauthorised access, disclosure, alteration, and destruction. Our security framework includes the following measures:

• SSL/TLS Encryption: All data transmitted between your device and the xz999 Platform is encrypted using industry-standard SSL/TLS protocols. This applies to all login sessions, financial transactions, and data submission forms on the Platform.
• Password Hashing: Account passwords are never stored in plain text. xz999 applies a strong cryptographic hashing algorithm with per-user salt values so that passwords cannot be recovered even in the event of a database breach.
• Access Controls: Access to personal data within xz999's internal systems is restricted to personnel who require it to perform their specific job functions. All internal access is logged and audited. Administrative access requires multi-factor authentication.
• Infrastructure Security: The xz999 Platform is hosted on secure infrastructure with network-level firewalls, intrusion detection systems, and regular vulnerability assessments. Server-side access is restricted to authorised technical personnel only.
• Incident Response: xz999 maintains a data breach response procedure. In the event of a confirmed data breach that is likely to result in a risk to players, affected individuals will be notified without undue delay, together with information on the nature of the breach and the steps being taken to mitigate harm.

While xz999 takes every reasonable precaution to secure your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying xz999 immediately at [email protected] if you suspect that your account has been accessed without your authorisation.

7. Your Privacy Rights

As a player on the xz999 Platform, you hold a number of rights in relation to your personal data. xz999 is committed to honouring these rights promptly and transparently. Your rights are as follows:

• Right of Access: You have the right to request a copy of the personal data that xz999 holds about you. We will provide this information within a reasonable timeframe following receipt of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You may update basic account information directly within your xz999 account settings, or by contacting [email protected] for changes that require manual review.
• Right to Erasure: In certain circumstances, you have the right to request that xz999 delete your personal data. This right is subject to overriding retention obligations — for example, xz999 is required to retain transaction records and KYC data for a minimum period regardless of an erasure request. Where erasure is possible, it will be carried out promptly.
• Right to Restrict Processing: You may request that xz999 restrict the processing of your personal data in specific circumstances, such as where you contest the accuracy of the data or where you have objected to processing based on legitimate interest.
• Right to Data Portability: Where processing is based on your consent or contract performance, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on xz999's legitimate interest. This includes the right to opt out of direct marketing communications at any time.
• Right to Withdraw Consent: Where xz999 processes your data on the basis of your consent (such as for promotional email communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the rights listed above, please contact the xz999 data team at [email protected] with the subject line "Privacy Rights Request". Include your registered email address and a clear description of the right you wish to exercise. We will acknowledge your request within 5 business days (Bangladesh Standard Time, UTC+6) and aim to fulfil it within 30 calendar days, subject to identity verification.

8. Contact & Policy Updates

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way xz999 handles your personal data, please contact us at the following address:

• Email: [email protected] (plain text — this address is not a clickable link)
• Subject Line for Privacy Queries: "Privacy Policy Enquiry" or "Privacy Rights Request"
• Response Time: We aim to acknowledge all privacy-related communications within 5 business days (Bangladesh Standard Time, UTC+6).

Policy Updates: xz999 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, to comply with updated legal requirements, or to improve clarity. All updates will be published on this page with a revised "Last Updated" date at the top. Where a change is material — meaning it significantly affects how we process your personal data or the rights available to you — we will notify you by email to your registered xz999 account address at least 14 calendar days before the change takes effect.

Your continued use of the xz999 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you should cease using the Platform and contact [email protected] to request account closure and data deletion in accordance with your rights under Section 7 above.