xe666 Privacy Policy — How We Protect Your Personal Data

This Privacy Policy ("Policy") describes how xe666 ("xe666", "we", "us", "our") collects, uses, discloses and safeguards personal information obtained from players and visitors who access our online casino and sports betting platform at xe666.ws (the "Platform"). This Policy applies to all personal data collected through the Platform, whether provided by you directly during registration, generated through your use of our services, or obtained from third-party sources for identity and payment verification purposes.

By registering an account on the Platform or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please do not use the Platform. Questions about this Policy may be directed to our support team at [email protected].

xe666 collects personal data from you in three ways: information you provide directly, information generated automatically through your use of the Platform, and information obtained from trusted third-party sources. The categories of data collected are described below.

Information you provide directly:

• Registration data — your full name, date of birth, mobile number, and the mobile wallet details (bKash, Nagad, Rocket or Upay number) used to register your account.
• Identity and address verification documents — copies of your National ID card, passport or other government-issued identification submitted during KYC verification, together with any proof-of-address documentation requested.
• Communications data — the content of messages you send to our customer support team, including your query history and any attachments or screenshots you provide.
• Optional profile data — any additional information you choose to provide when updating your account profile, such as a preferred display name or communication preferences.

Information generated through your use of the Platform:

• Transaction data — records of all deposits, withdrawals, bets placed, game results and bonus activity associated with your account, including timestamps and payment method references.
• Technical and device data — your IP address, device type, operating system, browser type and version, screen resolution, session duration, and pages visited within the Platform. This data is collected automatically via cookies and server logs.
• Responsible gaming data — records of any deposit limits, session limits, reality check settings or self-exclusion requests you have activated, maintained to ensure those protections are properly enforced.

Information obtained from third-party sources:

• Identity verification services — where necessary to complete KYC checks, we may obtain identity verification data from regulated third-party identity verification providers. This data is used solely to confirm the accuracy of the information you have provided.
• Payment providers — bKash, Nagad, Rocket and Upay may share transaction confirmation data with xe666 for the purpose of reconciling deposits and withdrawals. xe666 does not have access to your full payment account credentials.
• Anti-fraud and AML screening — we may receive data from third-party anti-fraud and Anti-Money Laundering (AML) screening services that help us detect and prevent financial crime on the Platform.

xe666 uses your personal data only for specific, legitimate purposes. The table below summarises the primary purposes for which your data is used and the category of data involved in each case.

xe666 processes your personal data only where it has a lawful basis to do so. The legal bases on which we rely are:

• Contract performance — processing is necessary to operate your account, facilitate transactions, and deliver the services you have registered for on the Platform.
• Legal obligation — processing is necessary to comply with applicable legal requirements, including KYC/AML obligations, age verification requirements and record-keeping obligations imposed on us by applicable law.
• Legitimate interests — we process certain technical and usage data to maintain the security of the Platform, detect fraud and abuse, and improve our services. We process this data only where our legitimate interests are not overridden by your rights and interests.
• Consent — for optional processing activities such as marketing communications, we rely on your freely given, specific and informed consent. You may withdraw consent at any time by contacting [email protected], without affecting the lawfulness of prior processing.

Your personal data may be shared with the following categories of recipients, strictly for the purposes described:

• Payment service providers — bKash, Nagad, Rocket and Upay receive transaction data necessary to process your deposits and withdrawals. These providers process your data under their own privacy policies and are independent data controllers for the data they hold.
• Identity verification providers — regulated third-party KYC and identity verification services receive the identity documents and data necessary to complete verification checks required by our AML and age verification obligations.
• Technology and infrastructure providers — companies that provide hosting, cloud storage, content delivery, customer support software and cybersecurity services to xe666 may access certain personal data as data processors acting under our instruction and subject to binding confidentiality obligations.
• Regulatory and law enforcement authorities — where required by law, court order or regulatory direction, xe666 may be required to disclose personal data to law enforcement agencies, financial intelligence units or other competent authorities. xe666 will comply with all valid legal requests for data.

Where xe666 shares data with third-party processors, it does so under written data processing agreements that require those processors to implement appropriate technical and organisational security measures and to process data only on xe666's documented instructions.

xe666 uses cookies and similar tracking technologies (such as local storage tokens and session identifiers) to operate the Platform, remember your preferences, maintain your authenticated session, and analyse usage patterns. The types of cookies used are:

• Strictly necessary cookies — these cookies are essential for the Platform to function. They maintain your login session, enforce security settings and remember responsible gaming limits you have set. These cookies cannot be disabled without breaking core Platform functionality.
• Analytical cookies — these cookies collect anonymised usage data to help xe666 understand how players navigate the Platform, which features are most used and where technical errors occur. This information is used to improve the Platform's performance and user experience.
• Preference cookies — these cookies remember your language settings, display preferences and other personalisation choices so you do not need to reconfigure them each time you visit the Platform.

You can control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in and using core Platform features. Disabling analytical or preference cookies will not affect your ability to use the Platform but may reduce the quality of your experience. xe666 does not use cookies to display third-party advertising.

xe666 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and transaction data — retained for a minimum of 5 years from the date of account closure or the date of the last transaction, whichever is later. This retention period is required to comply with AML record-keeping obligations.
• KYC and identity documents — retained for a minimum of 5 years from account closure, consistent with AML and due diligence obligations. Where a suspicious activity report has been filed, data may be retained for longer as directed by the relevant authority.
• Customer support communications — retained for 2 years from the date of last interaction, unless the communication relates to an active dispute or legal claim, in which case it is retained until final resolution plus one year.

When retention periods expire, xe666 securely destroys or anonymises personal data so that it can no longer be attributed to any identifiable individual. Where data is anonymised rather than deleted, it may be retained indefinitely for aggregate statistical analysis.

Subject to applicable law and the limitations described in this Policy, you have the following rights in relation to the personal data xe666 holds about you:

• Right of access — you may request a copy of the personal data xe666 holds about you, together with information about how it is being used. Requests will be responded to within a reasonable timeframe.
• Right to rectification — if any personal data xe666 holds about you is inaccurate or incomplete, you may request that it be corrected or completed. Identity and transaction records may be subject to verification before amendment.
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis exists, or where the data has been processed unlawfully. This right is subject to legal retention obligations; xe666 cannot delete data it is legally required to retain.
• Right to restriction of processing — in certain circumstances (for example, while accuracy is contested or while an objection is being assessed) you may request that xe666 restricts processing of your data to storage only.
• Right to data portability — where processing is based on consent or contract and carried out by automated means, you may request a copy of your personal data in a structured, commonly used and machine-readable format.
• Right to object — where processing is based on legitimate interests, you may object to such processing. xe666 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless processing is necessary for legal claims.

To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request" and a description of your request. xe666 will respond within 30 days of receipt. We may need to verify your identity before processing your request.

xe666 takes the security of your personal data seriously and implements a comprehensive set of technical and organisational security measures to protect data against unauthorised access, loss, alteration or disclosure. These measures include:

• SSL/TLS encryption — all data transmitted between your device and the Platform is encrypted in transit using SSL/TLS protocols. This prevents interception of your personal and financial data during transmission.
• Access controls — access to personal data is restricted on a need-to-know basis. Only authorised xe666 personnel whose job responsibilities require access to specific data categories are granted such access, and all access is logged for audit purposes.
• Encryption at rest — sensitive personal data stored in xe666's databases is encrypted at rest using industry-standard encryption algorithms. Backup copies of data are subject to the same encryption standards.
• Security monitoring — xe666 operates continuous monitoring of the Platform for suspicious activity, attempted intrusions and data anomalies. Our security team responds to detected incidents promptly and follows established incident response procedures.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, xe666 will notify affected players without undue delay and take all reasonable steps to mitigate the impact of the breach.

xe666 accepts deposits and processes withdrawals via bKash, Nagad, Rocket and Upay. When you initiate a transaction through one of these payment methods, you are directed to interact with the payment provider's own interface. xe666 does not store your full mobile wallet PIN, password or authentication credentials. xe666 retains only the transaction reference number, the payment method used, the amount, the timestamp and the status of the transaction for account reconciliation and dispute resolution purposes.

All financial transaction records are stored in encrypted form and retained for a minimum of 5 years to meet AML compliance requirements. Access to financial records is restricted to xe666 compliance and finance personnel and is subject to strict internal access controls and audit logging.

The xe666 Platform is strictly intended for persons aged 21 and above. xe666 does not knowingly collect personal data from individuals under the age of 21. If xe666 discovers or has reason to believe that personal data has been collected from a person under 21, it will delete that data immediately and close the associated account. If you believe that a minor has registered on the Platform, please contact us immediately at [email protected]. Parents and guardians are encouraged to use device-level parental controls to prevent minors from accessing online gambling platforms.

xe666 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements or the services we offer. The revised Policy will be posted on the Platform with a new effective date. Where changes are material — for example, where we propose to use your data in a new way or share it with a new category of recipient — xe666 will notify you by SMS to your registered mobile number or by an in-account notification at least 14 days before the changes take effect.

Your continued use of the Platform after a revised Privacy Policy has been posted and notified constitutes your acceptance of the updated Policy. If you do not agree with any changes, you must stop using the Platform. Archived versions of this Policy are available on request by contacting [email protected].

If you have any questions, concerns or requests relating to this Privacy Policy or the way xe666 handles your personal data, please contact our support team at [email protected]. Our support team is available 24 hours a day, 7 days a week and will acknowledge your privacy query within 48 hours. For data rights requests, please include "Data Rights Request" in your message subject so your enquiry is routed to the correct team promptly.