xx888 Privacy Policy

xx888 collects personal data from players through several channels: directly during account registration and KYC verification, automatically through your use of the platform, and occasionally from trusted third-party sources such as payment processors and identity verification services. The categories of data we collect are described in detail below.

Registration & Account Data

When you create an xx888 account, we collect the following information:

• Your full legal name as it appears on your government-issued identity document.
• Your date of birth (used to verify you meet the 18+ minimum age requirement).
• Your mobile phone number registered in Bangladesh.
• Your email address.
• Your division and district of residence within Bangladesh.
• Your chosen username and a hashed (never plain-text) version of your password.

Identity Verification (KYC) Data

To comply with our anti-money laundering obligations and to confirm player eligibility, xx888 requires identity verification before processing withdrawals. KYC data we collect includes:

• Scanned copy or photograph of a government-issued identity document (National Identity Card, passport, or birth certificate).
• A selfie or live photo confirmation for facial matching purposes.
• Proof of address (utility bill, bank statement, or official correspondence dated within the last three months) where enhanced due diligence is required.
• Proof of payment method ownership (screenshot or confirmation from bKash, Nagad, Rocket, or bank account) where required for withdrawal processing.

Financial Transaction Data

For every deposit and withdrawal processed on your xx888 account, we record:

• Transaction amount in BDT.
• Payment method used (e.g., bKash, Nagad, Rocket, Upay, bank transfer).
• Transaction reference numbers and timestamps (Bangladesh Standard Time, UTC+6).
• Account balance before and after each transaction.

xx888 does not store your full bKash PIN, bank account password, or any equivalent payment authentication credential. Payment authentication takes place on the respective payment provider's secure interface, not on the xx888 platform.

Gameplay & Betting Activity Data

xx888 maintains a full record of your gameplay and sports betting activity on the platform, including:

• Games played, bet amounts, outcomes, and session durations.
• Sports betting markets selected, stake amounts, odds accepted, and settlement outcomes.
• Bonus and promotion claims, wagering progress, and fulfilment status.
• Responsible gaming tool usage, including any deposit limits or self-exclusion periods you have activated.

Technical & Device Data

When you access the xx888 platform from any device, we automatically collect the following technical data to maintain platform security, detect fraud, and optimise the user experience:

• IP address and approximate geographic location (division/district level for Bangladesh players).
• Device type, operating system, and browser version.
• Session start and end times, pages visited, and features accessed.
• Referring URL (the page from which you navigated to xx888).

xx888 does not sell your personal data to any third party. Data is shared with external parties only in the limited circumstances described below, and only with partners who are contractually bound to handle your data securely and to use it only for the specified purpose.

Payment Service Providers

To process your deposits and withdrawals, xx888 shares the necessary transaction details with the payment service providers you select, including bKash, Nagad, Rocket, Upay, and partner banks such as Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank. The data shared is limited to what is strictly necessary to execute the transaction: your account reference, transaction amount, and payment method identifier. Payment providers are prohibited from using this data for any purpose other than transaction execution.

Identity Verification Partners

xx888 may engage specialist identity verification and KYC service providers to assist with the review of identity documents submitted by players. These partners operate under strict data processing agreements and are permitted to use your KYC data only for the purpose of identity verification on behalf of xx888. KYC data is never shared with unrelated third parties.

Game Content Providers

Game studios and live casino providers whose content is hosted on the xx888 platform — including Pragmatic Play, NetEnt, Microgaming, Spribe, Evolution Gaming, and Ezugi — may receive anonymised session and gameplay data for the purpose of game performance monitoring and fair play auditing. These providers do not receive your personal identity information or financial details.

Legal & Regulatory Disclosure

xx888 may disclose your personal data to law enforcement authorities, regulatory bodies, or courts when required to do so by applicable law, court order, or regulatory instruction. This includes disclosures required in connection with anti-money laundering investigations, fraud investigations, or other criminal proceedings. xx888 will notify affected players of such disclosures where legally permitted to do so.

Business Transfers

In the event that xx888 undergoes a merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. In such circumstances, xx888 will provide registered players with notice via their registered email address prior to the transfer taking effect, and the acquiring entity will be bound by the same privacy obligations as xx888.

xx888 applies industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security framework is reviewed and updated regularly to address evolving threats.

Technical Security Measures

• 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using 256-bit SSL/TLS protocols. The xx888 platform enforces HTTPS across all pages and rejects unencrypted HTTP connections.
• Password Security: Player passwords are never stored in plain text. They are hashed using a modern cryptographic hashing algorithm with per-user salts, making stored password data useless even in the unlikely event of a data breach.
• Access Controls: Access to production systems containing player data is restricted to authorised personnel only, using role-based access controls, multi-factor authentication, and comprehensive access audit logging.
• Intrusion Detection: xx888 operates automated intrusion detection and anomaly monitoring systems that flag unusual access patterns and trigger security alerts in real time.
• Penetration Testing: The xx888 platform undergoes periodic security penetration testing by qualified security professionals to identify and remediate vulnerabilities proactively.

Data Breach Response

In the event of a data security incident that may have exposed your personal data, xx888 will notify affected players via their registered email address as promptly as practicable. The notification will describe the nature of the incident, the categories of data potentially affected, the steps xx888 has taken to contain the breach, and the recommended actions you should take to protect yourself — such as changing your password and reviewing your recent account activity.

As a registered xx888 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact our data team at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 days of receiving your request.

Right of Access

You have the right to request a copy of all personal data that xx888 holds about you. This includes your account registration details, KYC submission records, transaction history, gameplay logs, and any marketing preference records. xx888 will provide this information in a structured, commonly used, machine-readable format (such as CSV or JSON) where technically feasible.

Right to Rectification

If any personal data held by xx888 is inaccurate or incomplete, you have the right to request that it be corrected. For data that can be updated directly in your account settings panel (such as your email address or phone number), you may make corrections yourself without contacting support. For data that requires manual review — such as your name or date of birth, which must match your identity documents — please contact the support team.

Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing only), or where you object to processing on legitimate interest grounds and xx888 has no overriding legitimate reason to continue. Erasure requests will be fulfilled subject to any mandatory legal retention obligations described in Section 6.

Right to Restrict Processing

You may request that xx888 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of your data is being contested, or while an objection to processing is being assessed. During a restriction period, xx888 will store your data but will not actively process it for any purpose other than the specific, restricted purpose you have agreed to.

Right to Object to Marketing

You have the absolute right to object to the use of your personal data for direct marketing purposes at any time. To opt out of all xx888 marketing communications, update your notification preferences in your account settings, or contact us at [email protected]. Opt-out requests are processed within 5 business days. Opting out of marketing will not affect the delivery of essential account communications.