xo99 Privacy Policy

For the purposes of this Privacy Policy, the data controller responsible for the personal information of all registered xo99 players is the xo99 platform operating entity ("xo99", "we", "us", "our"), which operates the website available at xo99.bio and all associated mobile and digital services.

As the data controller, xo99 determines the purposes for which personal data is collected, the means by which it is processed, the duration for which it is retained, and the circumstances under which it may be disclosed to third parties. All data processing activities carried out by xo99 are conducted in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

xo99 has appointed a responsible data protection contact who oversees compliance with this Privacy Policy and handles all player privacy enquiries. This individual reviews our data processing activities on an ongoing basis and ensures that xo99's practices remain aligned with applicable data protection obligations.

xo99 collects personal data from players through several channels: directly from you when you register an account or submit a support request, automatically as you use the platform, and from trusted third-party verification and payment service providers. The categories of personal data we collect are set out below.

xo99 processes your personal data only for specific, documented, and lawful purposes. The table below sets out every primary purpose for which xo99 uses player data, together with the lawful basis relied upon for each processing activity.

xo99 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share player data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

xo99 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and analyse how the platform is used. This section explains the types of cookies xo99 uses and how you can manage your cookie preferences.

You can manage your cookie preferences through your browser settings at any time. Most modern browsers allow you to view, block, or delete cookies on a per-site basis. Please note that disabling strictly necessary cookies will impair your ability to use the xo99 platform, including maintaining an active login session and completing payment transactions.

xo99 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as is required by applicable legal, regulatory, or contractual obligations. The retention periods below apply to the main categories of player data held by xo99.

• Active Account Data: Personal and contact data associated with an active player account is retained for the full duration of the account's active status and for a period of five (5) years following permanent account closure.
• Financial Transaction Records: Deposit, withdrawal, and transaction history records are retained for a minimum of seven (7) years from the date of the transaction to comply with financial record-keeping and anti-money laundering obligations.
• KYC Verification Documents: Identity documents submitted during the KYC process are retained for five (5) years following account closure, or longer where required by a specific legal obligation.
• Support Communications: Customer support correspondence is retained for three (3) years from the date of the last interaction in a given support thread.
• Game and Betting Logs: Detailed game session and sports betting activity logs are retained for five (5) years, during which they may be used to resolve disputes or investigate integrity concerns.
• Marketing Preferences: Records of your marketing consent status (including opt-out records) are retained indefinitely to ensure that opted-out players are not re-added to marketing communications without fresh consent.

Upon expiry of the applicable retention period, xo99 will securely delete or anonymise your personal data in a manner that prevents reconstruction or re-identification. Where technical constraints prevent immediate deletion, data will be isolated from active processing systems until secure deletion is completed.

As an xo99 player, you hold a comprehensive set of rights in relation to your personal data. xo99 is committed to honouring these rights promptly and without charge. To exercise any of the rights listed below, please contact [email protected] with the subject line "Privacy Rights Request" and include your registered account username.

xo99 takes the security of your personal data seriously and implements a layered set of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, destruction, or disclosure. The following security controls are maintained across all xo99 systems that store or process player data.

• Transport Layer Security: All data transmitted between your device and xo99 servers is encrypted using TLS 1.2 or higher. The platform enforces HTTPS across all pages and sub-domains. SSL certificates are maintained and renewed on a continuous basis.
• Encryption at Rest: Sensitive personal data — including identity documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption. Encryption keys are stored separately from the encrypted data and are subject to strict access controls.
• Access Controls: Access to personal data within xo99's internal systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is governed by role-based access controls, multi-factor authentication requirements, and comprehensive activity logging.
• Network Security: xo99's infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and DDoS mitigation services. Regular vulnerability assessments and penetration tests are conducted by independent security specialists.
• Password Security: Player account passwords are stored as salted, one-way hashed values. xo99 does not store plaintext passwords and cannot retrieve your password — only a password reset is possible. We strongly recommend that all players use a unique, strong password for their xo99 account.
• Incident Response: xo99 maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a risk to player rights and freedoms, xo99 will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

The xo99 platform integrates with a number of third-party service providers in order to deliver a complete gaming experience to players across Bangladesh. These integrations include game content providers, payment processors, and identity verification services. In each case, xo99 has entered into data processing agreements with the relevant third party that set out the permitted purposes of data processing, the security standards to be maintained, and the restrictions on further disclosure.

The xo99 platform may contain references to third-party brands and services — such as game studio names (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) and payment brands (bKash, Nagad, Rocket, Upay) — but does not host third-party websites directly. xo99 is not responsible for the privacy practices of any external website or service that you may access independently of the xo99 platform. Players who visit external websites do so at their own risk and are advised to review the privacy policies of those sites separately.

xo99 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing activities, applicable legal requirements, or best-practice standards. When material changes are made to this policy, xo99 will take the following steps to ensure that players are informed:

• The revised Privacy Policy will be published on this page with an updated effective date displayed at the top of the document.
• For changes that materially affect the way xo99 processes player personal data, registered players will receive an email notification to their registered email address at least 14 days before the changes take effect.
• In-platform notifications may also be displayed upon next login following a material policy update, prompting players to review the revised terms.
• Your continued use of the xo99 platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated policy. If you do not agree with the revised terms, you should cease using the platform and contact [email protected] to request account closure.

We recommend that all xo99 players review this Privacy Policy periodically — particularly before making a new deposit or claiming a promotional bonus — to remain informed about how their personal data is being processed.

If you have any questions, concerns, or requests relating to this Privacy Policy or to xo99's handling of your personal data, please contact our privacy team using the details below. xo99 is committed to resolving all privacy enquiries fairly, promptly, and transparently.

If you are not satisfied with xo99's response to a privacy complaint after engaging directly with our privacy team, you may have the right to escalate your complaint to a relevant data protection authority or supervisory body in your jurisdiction. xo99 will cooperate fully with any such authority in the investigation of a complaint.

• Complaint Acknowledgement: All formal privacy complaints will be acknowledged in writing within 48 hours of receipt.
• Investigation Period: xo99 aims to complete its investigation of a privacy complaint and provide a final response within 28 days. Complex complaints may require additional time, in which case xo99 will provide a progress update within the initial 28-day window.
• Escalation: If you remain dissatisfied with xo99's final response, you are entitled to seek independent review through an appropriate dispute resolution mechanism. xo99 will provide information on available escalation routes upon request.
• No Retaliation: xo99 does not take any adverse action against players who submit privacy complaints or exercise their data protection rights. Submitting a privacy request will not affect your account standing, bonus eligibility, or access to the xo99 platform.