xv999 Privacy Policy — Your Data, Your Rights

1 Introduction

This Privacy Policy ("Policy") sets out the basis on which xv999 ("xv999", "we", "us", "our") collects, processes, stores, and shares personal data relating to individuals who access and use the xv999 online casino and sports betting platform, available at xv999.io and all associated subdomains and mobile applications (collectively, the "Platform").

xv999 is committed to handling personal data responsibly, lawfully, and transparently. We recognise that the privacy of our players — the majority of whom are located in Bangladesh — is of fundamental importance, and we have designed our data practices accordingly. This Policy applies to all personal data collected through your use of the Platform, regardless of whether you are a registered account holder or a visitor browsing the Platform without logging in.

By registering an account on xv999 or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood its contents. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to arrange deletion of any data we may already hold about you.

2 Data Controller

For the purposes of applicable data protection law, xv999 acts as the data controller in respect of personal data collected through the Platform. As data controller, xv999 determines the purposes for which personal data is processed and the means by which that processing takes place.

All enquiries, requests, and complaints relating to the handling of your personal data should be directed to the xv999 data team. Contact details are provided in Section 16 of this Policy. xv999 aims to respond to all data-related correspondence within 30 calendar days of receipt.

3 Data We Collect

xv999 collects the following categories of personal data in connection with your use of the Platform:

xv999 does not collect or process special categories of personal data (such as biometric data, health data, religious beliefs, or political opinions) unless legally required to do so for identity verification purposes, in which case such data is processed under strict access controls and retained only for the minimum necessary period.

4 How We Collect Data

xv999 collects personal data through the following channels and mechanisms:

• Direct submission — data you actively provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting support, or submitting feedback through any Platform interface.
• Automated technical collection — data collected automatically when you access the Platform, including IP addresses, device identifiers, browser fingerprints, and session activity logs generated by our web servers and analytics infrastructure.
• Cookies and similar technologies — small data files stored on your device that help us maintain session state, remember preferences, detect fraud, and analyse aggregate usage patterns. See Section 8 for full details of our cookie practices.
• Third-party verification providers — identity and age verification data returned to xv999 by our contracted KYC (Know Your Customer) service providers when we submit a verification request on your behalf following account registration.
• Payment processors — transaction confirmation data, including payment reference numbers and partial account identifiers, returned to xv999 by our integrated payment partners such as bKash, Nagad, Rocket, and Upay.
• Fraud prevention services — risk signals and fraud indicators returned by our contracted fraud detection partners in response to account activity or transaction requests that trigger our automated risk assessment systems.

5 Legal Basis for Processing

xv999 processes personal data only where a valid legal basis exists for doing so. The primary legal bases on which xv999 relies are as follows:

• Contractual necessity — processing required to create and manage your account, process deposits and withdrawals, resolve disputes, and deliver the services you have contracted with xv999 to receive.
• Legal obligation — processing required for xv999 to comply with applicable anti-money laundering (AML) requirements, age verification obligations, fraud reporting duties, and other regulatory mandates.
• Legitimate interests — processing carried out in furtherance of xv999's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, where such interests are not overridden by your rights and interests.
• Consent — processing carried out on the basis of your freely given, informed consent, specifically in respect of non-essential cookies and optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

6 How We Use Your Data

xv999 uses the personal data it collects for the following specific purposes:

• To register and maintain your xv999 account, including verifying your identity and confirming that you meet the minimum age requirement of 21 years.
• To process deposits made via bKash, Nagad, Rocket, Upay, Bangladeshi bank transfer, Visa, and Mastercard, and to route withdrawal payments back to your nominated payment method.
• To detect, investigate, and prevent fraudulent activity, money laundering, account sharing, multi-accounting, bonus abuse, and other forms of prohibited conduct as defined in our Terms & Conditions.
• To provide customer support, including responding to account enquiries, processing responsible gaming requests (deposit limits, self-exclusion), and resolving disputes.
• To monitor platform usage and game activity for the purpose of identifying patterns consistent with problem gambling behaviour and intervening in accordance with our Responsible Gaming obligations.
• To send transactional communications relating to your account activity, including deposit confirmations, withdrawal notifications, security alerts, and material policy updates. These communications are not optional while you hold an active account.
• To send optional marketing communications about xv999 promotions, new games, and seasonal offers — but only where you have provided explicit consent to receive such communications. You may opt out at any time by contacting support.
• To analyse aggregate, anonymised usage patterns for the purpose of improving the Platform's features, performance, and user experience.
• To comply with applicable legal, regulatory, and law enforcement obligations, including the retention of transaction records for the minimum statutory period.

7 Sharing Your Data

xv999 does not sell, rent, or transfer your personal data to third parties for their own commercial purposes. We share data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment service providers — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and international card processors (Visa, Mastercard), to facilitate deposits and withdrawals. Data shared is limited to the minimum required to complete the transaction.
• Identity verification and KYC providers — contracted third-party providers who verify the authenticity of identity documents and confirm that players meet the 21+ age requirement. These providers are bound by strict data processing agreements.
• Fraud prevention and security partners — specialist services that analyse transaction and behaviour data to identify and prevent fraudulent activity. Data shared for this purpose is processed under confidentiality obligations.
• Game content providers — third-party game studios and live casino operators (including but not limited to Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive session identifiers and game-play data as a technical necessity of delivering their games through the xv999 Platform. No additional personal data beyond what is strictly required for game delivery is shared.
• Cloud infrastructure and hosting providers — xv999 uses third-party cloud infrastructure to host its platform and store data securely. These providers act as data processors under our instruction and are contractually prohibited from using your data for any purpose beyond service delivery.
• Legal and regulatory authorities — xv999 may be required by law, court order, or regulatory mandate to disclose personal data to law enforcement agencies, government bodies, or other competent authorities. In such cases, xv999 will disclose only the minimum data required by the applicable legal obligation.

All third-party service providers with whom xv999 shares personal data are required to enter into written data processing agreements confirming that they will handle your data lawfully, securely, and solely for the purposes specified by xv999.

8 Cookies & Tracking Technologies

xv999 uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device by your web browser when you visit the Platform. They serve several distinct functions:

• Strictly necessary cookies — essential for the Platform to function. These include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery, and cookies that maintain your responsible gaming limit settings. These cookies cannot be disabled without impairing Platform functionality.
• Functional cookies — store your preferences such as preferred game categories, display language, and notification settings to improve your experience across sessions.
• Analytics cookies — collect anonymised data about how visitors interact with the Platform (pages visited, session duration, navigation paths) to help xv999 identify areas for improvement. This data is aggregated and does not identify individual players.
• Security and fraud detection cookies — used by our fraud prevention systems to assign risk scores to sessions and identify anomalous behaviour patterns that may indicate account takeover attempts or automated bot activity.

You may configure your browser to refuse or delete cookies at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. Analytics and functional cookies may be disabled without affecting your access to the Platform.

9 Data Security

xv999 implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, and disclosure. Our security framework includes the following controls:

• TLS/SSL encryption for all data transmitted between players' devices and our Platform servers.
• AES-256 encryption for personal data stored at rest in our databases and cloud storage systems.
• Role-based access controls (RBAC) ensuring that xv999 staff can access personal data only to the extent required by their specific job function.
• Two-factor authentication (2FA) enforced for all xv999 staff accounts with access to player data systems.
• Regular third-party penetration testing and vulnerability assessments of our Platform infrastructure.
• Automated monitoring and alerting for anomalous data access patterns, with a defined incident response procedure for suspected data breaches.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, xv999 will notify the affected individuals without undue delay and take all reasonably practicable steps to contain and remediate the breach.

10 Data Retention

xv999 retains personal data for the periods set out below, after which data is securely deleted or irreversibly anonymised unless a longer retention period is required by applicable law:

Where retention beyond the periods above is required by a specific legal obligation or regulatory order, xv999 will retain the relevant data for the duration mandated and will delete it as soon as that obligation is discharged.

11 Your Rights

Subject to applicable law, you hold the following rights in respect of personal data that xv999 holds about you. To exercise any of these rights, contact us at support at xv999.io with your full name, registered email address, and a description of the right you wish to exercise. We will respond within 30 calendar days.

• Right of access — you may request a copy of the personal data xv999 holds about you, together with information about how it is used and with whom it is shared.
• Right to rectification — you may request correction of any inaccurate or incomplete personal data we hold about you. For account-level data (name, date of birth, contact details), you may also update information directly through the account settings interface.
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. This right is subject to overriding legal retention obligations.
• Right to restrict processing — you may request that xv999 temporarily restrict the processing of your personal data while a query about its accuracy or our legal basis for processing is being investigated.
• Right to data portability — where processing is based on consent or contractual necessity and is carried out by automated means, you may request a machine-readable copy of the personal data you provided to us directly.
• Right to object — you may object to processing of your personal data where xv999 relies on legitimate interests as the legal basis. xv999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent — where processing is based on your consent (e.g., marketing communications, non-essential cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

12 Children & Minors

The xv999 Platform is strictly intended for adults aged 21 years and above. xv999 does not knowingly collect or process personal data relating to individuals under the age of 21. Our registration process includes mandatory age verification steps specifically designed to prevent minors from accessing the Platform.

If xv999 becomes aware that personal data belonging to an individual under the age of 21 has been collected through the Platform, we will immediately suspend the associated account, delete the data without delay, and take appropriate steps to prevent future access by that individual.

If you have reason to believe that a minor has registered on the xv999 Platform, please contact us immediately at support at xv999.io so that we can investigate and take appropriate action.

13 International Data Transfers

The xv999 Platform serves players primarily located in Bangladesh. Some of our contracted service providers — including cloud infrastructure partners, game content providers, and fraud prevention services — may process personal data outside Bangladesh. Where such international transfers occur, xv999 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Bangladesh, including:

• Contractual data processing agreements incorporating standard data protection clauses between xv999 and the relevant third-party processor.
• Restriction of transferred data to the minimum required for the specific processing purpose.
• Regular due-diligence reviews of international processors to verify ongoing compliance with our data protection standards.

14 Third-Party Links

The xv999 Platform may contain links to third-party websites, game providers, or payment platforms that operate independently of xv999. This Privacy Policy applies exclusively to data collected through the xv999 Platform. xv999 accepts no responsibility or liability for the privacy practices of third-party sites or services.

We encourage you to review the privacy policies of any third-party service you access via the Platform before submitting any personal data to those services. xv999 has no control over the content, data practices, or security measures of third-party sites.

15 Policy Amendments

xv999 reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, or our internal data processing practices. When material amendments are made, xv999 will:

• Update the "Last Updated" date displayed at the top of this Policy.
• Post a prominent notice on the Platform informing registered players of the amendment and its effective date.
• Where practicable, send a notification to the email address registered to your xv999 account summarising the key changes made.

Your continued use of the Platform following the effective date of any amended Policy constitutes your acknowledgement of the updated terms. If you do not accept the amended Policy, you must cease using the Platform and contact us to close your account.

We recommend that you review this Privacy Policy periodically to remain informed of how xv999 handles your personal data. Previous versions of this Policy are available upon request by contacting our support team.

16 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which xv999 handles your personal data, please contact our data team using the details below. All correspondence should be submitted in English and should clearly state your registered account email address and the nature of your enquiry.

If you are not satisfied with xv999's response to your privacy complaint or request, you have the right to escalate your concern to the relevant data protection authority or regulatory body in your jurisdiction. xv999 will cooperate fully with any such regulatory enquiry.