xx9900 Privacy Policy

This Privacy Policy ("Policy") describes how xx9900 ("the Company", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you", "the Player", "the User") who access or use the xx9900 platform at xx9900.org (the "Platform"). This Policy is an integral part of our Terms & Conditions and should be read in conjunction with them.

By creating an account on xx9900 or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you must stop using the Platform immediately.

We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. We do not sell your personal data to third parties for marketing purposes, and we will never use your data in ways you would not reasonably expect.

This Policy may be updated from time to time. When material changes are made, we will notify registered players via the email address on file or through a prominent notice on the Platform. The "Last updated" date at the top of this page always reflects the most current version.

2.1 Registration Data

When you create an xx9900 account, we collect the information you provide directly, including your full legal name, date of birth, email address, phone number, and the username and password you choose. This information is required to open and maintain your account. Without it, we cannot provide the Platform's services.

2.2 Identity Verification Data

To comply with our obligations to prevent fraud, money laundering, and underage gambling, xx9900 may ask you to submit identity documents (such as a national identity card or passport), proof of address (such as a utility bill or bank statement), and in some cases source-of-funds documentation. These documents are processed securely and are used exclusively for identity verification purposes.

2.3 Financial Data

We collect information related to your deposits and withdrawals, including the payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard), transaction amounts in BDT, transaction timestamps, and transaction reference numbers. We do not store full card numbers or mobile banking PINs — these are handled directly by your payment provider using their own secure systems.

2.4 Gameplay & Activity Data

xx9900 automatically records data about your activity on the Platform, including games played, bets placed, bet amounts, game outcomes, session durations, bonus usage, and account transaction history. This data is used to deliver the service, resolve disputes, identify problem gambling patterns, and comply with our responsible gaming obligations.

2.5 Technical & Device Data

When you access the Platform, our servers automatically collect certain technical information, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and pages visited. This data helps us maintain Platform security, investigate fraud, and improve user experience.

2.6 Communications Data

If you contact our support team via live chat, email, or Telegram, we retain records of those communications including the content of messages and the dates and times they were sent. This allows us to maintain continuity of support and investigate any complaints effectively.

2.7 Data from Third Parties

In certain cases, xx9900 may receive personal data about you from third-party sources, including identity verification service providers, payment processors, fraud detection agencies, and publicly available databases. This data is used solely to supplement our own records for verification and compliance purposes.

xx9900 does not sell your personal data. We may share your data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

4.1 Payment Processors

To process your deposits and withdrawals, we share the minimum necessary transaction data with our payment partners including bKash, Nagad, Rocket, Upay, Visa, and Mastercard. Each payment partner operates under its own privacy policy and security standards. xx9900 does not receive or store your full payment credentials.

4.2 Identity Verification Services

We work with third-party KYC (Know Your Customer) and identity verification providers to validate the documents you submit. These providers are contractually bound to use your data solely for verification purposes and to maintain appropriate security standards.

4.3 Game Software Providers

The games on xx9900 are powered by licensed third-party software providers including Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, and Spribe. These providers may receive anonymised or pseudonymised session data to operate game logic and certify RNG outcomes. They do not receive your full identity information.

4.4 Regulatory and Law Enforcement Authorities

Where required by applicable law or in response to a valid legal request, xx9900 may disclose your personal data to regulatory bodies, law enforcement agencies, or courts. We will notify you of such disclosures where legally permitted to do so.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of the business, your personal data may be transferred to the successor entity as part of that transaction. We will notify you in advance of any such transfer and of any changes to this Privacy Policy that may result.

4.6 No Third-Party Marketing

We do not share your personal data with any third party for their own marketing or advertising purposes. Any marketing communications you receive will originate from xx9900 directly and only where you have consented to receive them.

xx9900 implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and our servers.
• One-way cryptographic hashing of account passwords — we cannot retrieve your password in plain text, only reset it.
• Access controls limiting which staff members can access personal data, on a strict need-to-know basis.
• Regular security audits and vulnerability assessments of our Platform infrastructure.
• Fraud detection systems that monitor for unusual login activity and flag suspicious transactions for review.

Whilst we take all reasonable precautions to safeguard your data, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and interests, we will notify affected players without undue delay. You are also responsible for keeping your account credentials confidential. If you suspect your account has been compromised, contact our support team immediately.

xx9900 retains your personal data for as long as your account remains active and for such additional period as is required to fulfil our legal, regulatory, and contractual obligations. In practice, this means:

• Account and identity data is retained for a minimum of five years from the date your account is closed, to comply with anti-money laundering record-keeping requirements.
• Transaction and financial records are retained for five years from the date of each transaction.
• Support communications are retained for two years from the date of the last interaction, unless the subject matter requires longer retention.
• Technical and device logs are retained for up to twelve months for security and fraud investigation purposes.
• Marketing preferences are retained until you withdraw your consent or close your account, whichever is earlier.

Once the applicable retention period expires, your personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual.

xx9900 reserves the right to update or amend this Privacy Policy at any time. When we make changes, we will update the "Last updated" date at the top of this page. Where changes are material — meaning they significantly affect how we collect or use your data, or the rights you hold — we will notify you by email or through a prominent in-platform notice at least 14 days before the changes take effect.

Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with the revised Policy, you must stop using the Platform and close your account.