xy999 Privacy Policy
At xy999, your privacy is a fundamental commitment, not an afterthought. This Privacy Policy explains in plain, formal English exactly what personal data we collect when you use the xy999 Platform, how we use it, who we share it with, and what rights you hold over your own information. Please read this document carefully before creating an account.
How xy999 Protects Your Data
Six core commitments that define the xy999 approach to data privacy. The complete legal text in the sections below takes precedence in all cases.
End-to-End Encryption
Every connection between your device and the xy999 Platform is protected by TLS 1.3 with 256-bit AES encryption. Sensitive account credentials are stored using industry-standard hashing algorithms — they are never stored in plain text.
No Data Selling
xy999 does not sell , share for advertising purposes, or rent your personal data to any third-party marketer. Your information is used solely to operate the xy999 Platform and fulfil our legal obligations.
Minimal Data Collection
xy999 collects only the personal data that is strictly necessary to provide our services, verify your identity, process transactions, and comply with applicable anti-money laundering regulations. We do not collect data speculatively.
Your Rights, Respected
You have the right to access, correct, restrict, and in certain circumstances erase the personal data xy999 holds about you. Submit a data request at any time by contacting our support team at [email protected] and we will respond within 30 days.
Regulated Data Partners
Where xy999 shares your data with third parties — such as payment processors like bKash and Nagad, or identity verification providers — those partners are contractually bound to process your data only for the specified purpose and under equivalent security standards.
Transparent Cookie Use
xy999 uses cookies and similar tracking technologies strictly for platform functionality, session management, fraud prevention, and analytics. We do not use third-party advertising cookies. You can manage cookie preferences through your browser settings at any time.
Contents
- Introduction & Scope
- Data Controller Identity
- Data We Collect
- Legal Basis for Processing
- How We Use Your Data
- Data Sharing & Disclosure
- International Data Transfers
- Data Retention
- Cookies & Tracking
- Your Privacy Rights
- Children's Privacy
- Security Measures
- Policy Amendments
- Contact & Complaints
1 Introduction & Scope
This Privacy Policy ("Policy") describes how xy999 ("the Company", "we", "us", "our") collects, uses, stores, and protects the personal information of individuals ("you", "your", "the User") who access or use the online betting and gaming platform operated at https://xy999.io ("the Platform").
This Policy applies to all personal data processed in connection with the xy999 Platform, including data collected through the website, mobile-optimised interfaces, customer support channels, and any communications between you and xy999. By registering an account on the Platform or otherwise interacting with our services, you acknowledge that you have read and understood this Policy and that you consent to the data practices described herein.
This Policy should be read alongside the xy999 Terms & Conditions, which govern the overall contractual relationship between you and the Company. In the event of any conflict between this Policy and the Terms & Conditions on matters of data processing, this Policy takes precedence.
2 Data Controller Identity
xy999 is the data controller responsible for the personal data you provide through the Platform. As data controller, xy999 determines the purposes and means of processing your personal information in connection with the services we provide.
For all data protection enquiries, including requests to exercise your privacy rights, please contact our Data Protection team directly using the contact details provided in Section 14 of this Policy. xy999 is committed to responding to all legitimate data requests within the timeframes required by applicable privacy regulations.
3 Data We Collect
3.1 Registration Data
When you create an xy999 account, we collect the personal information you provide during the registration process. This includes your full legal name, date of birth, residential address, email address, mobile phone number, and chosen username.
3.2 Identity Verification Data (KYC)
To comply with international anti-money laundering (AML) regulations and to verify that you meet the 21+ age requirement, xy999 may request and process copies of identity documents including government-issued photo identification, proof of residential address, and proof of the payment method used to fund your account.
3.3 Financial Transaction Data
We collect records of all deposits, withdrawals, and transaction histories associated with your xy999 account. This includes payment method identifiers (such as your registered bKash or Nagad mobile number), transaction reference numbers, amounts in BDT, and timestamps of all financial activity on the Platform.
3.4 Betting and Gaming Activity Data
xy999 records all betting and gaming activity conducted through your account, including markets wagered on, stake amounts, odds accepted, game sessions, and outcomes. This data is used to operate the Platform, settle wagers, detect fraud, and where applicable to fulfil responsible gaming obligations.
3.5 Technical and Device Data
When you access the Platform, our servers automatically collect certain technical information including your IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, session duration, and clickstream data. This information is used for security, fraud prevention, and Platform performance analysis.
3.6 Communications Data
If you contact xy999 customer support — whether by email, live chat, or any other channel — we retain records of those communications, including the content of messages, timestamps, and any supporting documentation you provide, for the purpose of resolving your query and improving our service quality.
| Data Category | Examples | Primary Purpose |
|---|---|---|
| Registration Data | Name, date of birth, email, phone number | Account creation, identity verification |
| KYC Documents | National ID, passport, utility bill | AML compliance, age verification |
| Financial Data | bKash / Nagad number, transaction history | Payment processing, fraud prevention |
| Gaming Activity | Bets placed, game sessions, outcomes | Service delivery, responsible gaming |
| Technical Data | IP address, device ID, browser type | Security, analytics, performance |
| Communications | Support chat transcripts, emails | Customer service, dispute resolution |
4 Legal Basis for Processing
xy999 processes your personal data only where a valid legal basis exists for doing so. The legal bases we rely upon are as follows:
- Contractual necessity: Processing that is required to perform the contract between you and xy999, including operating your account, processing deposits and withdrawals, and settling wagers.
- Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering checks, age verification, and record-keeping obligations.
- Legitimate interests: Processing that serves the legitimate business interests of xy999, such as fraud prevention, Platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your fundamental rights and freedoms.
- Consent: Where you have provided explicit consent for a specific processing activity, such as receiving promotional communications from xy999. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
5 How We Use Your Data
xy999 uses the personal data we collect for the following purposes:
- To create and manage your xy999 account and verify your identity in accordance with KYC requirements.
- To process deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and other supported payment methods.
- To operate, maintain, and improve the xy999 Platform and its features, including cricket betting, live casino, slots, and fishing games.
- To detect, investigate, and prevent fraudulent transactions, unauthorised account access, match-fixing, money laundering, and other prohibited conduct.
- To administer bonuses, promotions, and loyalty programmes in accordance with applicable promotion-specific terms.
- To enforce the xy999 Terms & Conditions and this Privacy Policy.
- To provide customer support and resolve disputes, complaints, and technical issues.
- To send you service-related notifications such as account security alerts, deposit confirmations, and withdrawal updates.
- To send you marketing and promotional communications, where you have consented to receive such communications.
- To monitor your gaming patterns for the purposes of responsible gaming obligations, including identifying signs of problem gambling.
- To comply with applicable laws, regulations, court orders, and requests from authorised regulatory or law enforcement bodies.
6 Data Sharing & Disclosure
xy999 does not sell your personal data to third parties. We may share your data with the following categories of recipients only to the extent necessary to fulfil the purposes described in this Policy:
6.1 Payment Service Providers
To process deposits and withdrawals, xy999 shares necessary financial data with payment service providers including mobile financial services operators such as bKash, Nagad, Rocket, and Upay, as well as card scheme processors for Visa and Mastercard transactions. These providers process your data solely for payment execution and fraud prevention purposes.
6.2 Identity Verification Providers
To fulfil KYC and AML obligations, xy999 may share identity documents and personal details with regulated third-party identity verification services. These providers are contractually bound to process your data only for the specified verification purpose.
6.3 Game Technology Providers
xy999 partners with certified game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi to deliver casino and live dealer games. These providers may receive your account identifiers and game session data as required to deliver and audit game outcomes.
6.4 Regulatory and Law Enforcement Authorities
xy999 may disclose your personal data to regulatory bodies, law enforcement agencies, or other government authorities where required to do so by law, or where we have reasonable grounds to believe that disclosure is necessary to prevent fraud, money laundering, terrorist financing, or other serious criminal activity.
6.5 Corporate Transactions
In the event of a merger, acquisition, restructuring, or sale of all or part of xy999's business assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations being assumed by the recipient.
7 International Data Transfers
xy999 operates in an international environment and some of the third-party service providers we engage — including game technology providers and cloud infrastructure services — may process your personal data in countries outside Bangladesh. Where such transfers occur, xy999 takes steps to ensure that appropriate safeguards are in place to protect your data, including the use of data processing agreements that incorporate internationally recognised data transfer mechanisms.
By using the xy999 Platform, you acknowledge that your personal data may be transferred to and processed in countries other than your country of residence. xy999 will not conduct such transfers without ensuring that an adequate level of data protection is maintained.
8 Data Retention
xy999 retains your personal data for no longer than is necessary for the purposes for which it was collected, taking into account applicable legal, regulatory, accounting, and reporting requirements. The following general retention periods apply:
- Account registration data is retained for the duration of your account and for a minimum of five years following account closure, in compliance with AML record-keeping requirements.
- KYC identity documents are retained for a minimum of five years following the completion of the verification process, or longer if required by applicable law.
- Financial transaction records are retained for a minimum of seven years to satisfy accounting and AML obligations.
- Customer support communications are retained for two years following resolution of the relevant query, or longer if required for ongoing dispute resolution.
- Technical and device data collected via server logs is retained for up to 12 months and then anonymised or deleted.
Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised so that it can no longer be associated with your identity.
9 Cookies & Tracking Technologies
9.1 What Are Cookies
Cookies are small text files placed on your device by a website when you visit it. xy999 uses cookies and similar technologies — including web beacons and local storage objects — to enable core Platform functionality, maintain your session, personalise your experience, and analyse how users interact with the Platform.
9.2 Types of Cookies We Use
- Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in and security tokens that prevent cross-site request forgery. These cookies cannot be disabled without severely impairing Platform functionality.
- Functional cookies: Enable enhanced features such as remembering your language preferences, storing your betting slip configuration, and maintaining your responsible gaming limit settings between sessions.
- Analytics cookies: Allow xy999 to measure how users navigate the Platform, which pages are visited most frequently, and where technical errors occur. This data is used in aggregate, anonymised form to improve Platform performance. xy999 uses self-hosted analytics tools and does not share this data with advertising networks.
- Fraud prevention cookies: Used to identify unusual activity patterns that may indicate bot usage, account takeover attempts, or other security threats.
9.3 Managing Cookies
You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the xy999 Platform. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.
10 Your Privacy Rights
Subject to applicable law, you hold the following rights with respect to the personal data xy999 processes about you. To exercise any of these rights, please submit a written request to [email protected]. xy999 will respond within 30 calendar days of receiving a verifiable request.
- Right of access: You may request a copy of the personal data xy999 holds about you and information about how it is processed.
- Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it.
- Right to erasure: In certain circumstances, you may request that xy999 delete the personal data we hold about you. This right is subject to legal and regulatory retention obligations that may require us to retain certain data regardless of your request.
- Right to restriction of processing: You may request that xy999 restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested.
- Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that xy999 provide your personal data to you in a structured, commonly used, machine-readable format.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- Right to object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, subject to the grounds of that legitimate interest being assessed against your specific situation.
11 Children's Privacy
The xy999 Platform is strictly intended for adults aged 21 and over. xy999 does not knowingly collect or process personal data relating to individuals under the age of 21. If you are a parent or guardian and believe that a minor has provided personal data to xy999 or has accessed the Platform, please contact us immediately at [email protected]. Upon confirmation, xy999 will take prompt steps to delete any data held in relation to that minor and close any associated account.
xy999 implements age verification controls at the point of registration and may request documentary proof of age at any time. Players who misrepresent their age to gain access to the Platform will have their account permanently suspended and any associated balances forfeited in accordance with the xy999 Terms & Conditions.
12 Security Measures
xy999 employs a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key measures include:
- All data transmitted between your device and the xy999 Platform is encrypted using TLS 1.3 with 256-bit AES encryption.
- Account passwords are stored using one-way cryptographic hashing with per-account salt; xy999 employees cannot view your password in plain text.
- Access to personal data within xy999 is restricted on a need-to-know basis and is subject to role-based access controls and audit logging.
- xy999's infrastructure is hosted on access-controlled servers with physical and network security measures in place to prevent unauthorised entry.
- Regular vulnerability assessments and penetration testing are conducted to identify and remediate security weaknesses before they can be exploited.
- An incident response plan is maintained to ensure prompt action in the event of a data breach, including notification to affected users where required by applicable law.
13 Policy Amendments
xy999 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made to this Policy, xy999 will notify registered users via email or an on-screen notification displayed upon next login to the Platform. The revised Policy will be published at https://xy999.io/privacy-policy with an updated effective date.
Your continued use of the xy999 Platform following the publication of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must discontinue use of the Platform and close your account in accordance with the account closure procedure described in the Terms & Conditions.
14 Contact & Complaints
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way xy999 processes your personal data, please contact our Data Protection team. All correspondence should be submitted in writing to our official support address:
Our team will acknowledge your enquiry within 48 hours and provide a substantive response within 30 calendar days. For complex or multi-issue requests, we will notify you within the initial 30-day period if additional time is required, along with a revised expected response date.
If you are not satisfied with xy999's response to a data-related complaint, you have the right to escalate your concern to the appropriate supervisory authority in your jurisdiction. xy999 encourages users to contact us directly in the first instance so that we have the opportunity to resolve your concern promptly and fairly.
Questions About Your Data? We're Here.
Our English-speaking support team is available around the clock to answer privacy questions, assist with data requests, or help you manage your account settings. You can also review our FAQ or log in to adjust your preferences directly.