xe88 Privacy Policy

1.Introduction and Scope

xe88 ("xe88", "we", "us", "our") is committed to protecting the personal data of all individuals who interact with the xe88 platform accessible at xe88.vu ("Platform"). This Privacy Policy ("Policy") describes the categories of personal data xe88 collects, the purposes for which it is processed, the parties with whom it may be shared, the measures taken to protect it, and the rights available to individuals whose data xe88 holds ("Data Subjects", "you").

This Policy applies to all personal data processed in connection with your registration, use, and ongoing access to the xe88 Platform, including data collected via the website, customer support interactions, payment processing, and responsible gaming tools. This Policy should be read in conjunction with the xe88 Terms & Conditions and, where applicable, individual product terms.

By creating an xe88 account or using the Platform, you confirm that you have read and understood this Policy. If you do not agree with the terms of this Policy, you must not use the xe88 Platform.

2.Data Controller

For the purposes of applicable data protection law, xe88 is the data controller responsible for your personal data collected through the xe88 Platform. xe88 determines the purposes and means of processing your personal data as described in this Policy. Where xe88 engages third-party processors, it does so under data processing agreements that contractually bind those parties to process data only on xe88's documented instructions and in accordance with applicable law.

3.Personal Data We Collect

xe88 collects the following categories of personal data from players and prospective players:

• Identity Data: Full legal name, date of birth, nationality, gender, and government-issued identification document details (MyKad number, passport number, or equivalent).
• Contact Data: Email address, mobile phone number, and, where provided, residential address.
• Verification Data: Copies of identification documents, selfies, and proof of payment method ownership submitted during KYC verification.
• Financial Data: Payment method identifiers (eWallet account names, partial bank account numbers), transaction amounts, deposit and withdrawal history, and MYR account balances.
• Gaming Activity Data: Betting history, game session records, wager amounts, outcomes, bonus eligibility and usage, and responsible gaming tool settings.
• Technical Data: IP address, device type and identifiers, browser type and version, operating system, session tokens, and access timestamps.
• Communication Data: Records of live chat interactions, email correspondence, and support ticket content where you have contacted xe88.
• Preference Data: Language preferences, marketing communication preferences, and account notification settings.

4.How We Collect Your Data

xe88 collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your account profile.
• Automated Collection: Technical data collected automatically when you access the xe88 Platform, including IP address, device information, session data, and cookies.
• Third-Party Sources: Identity verification data from KYC service providers; fraud and AML screening data from licensed compliance screening services; payment confirmation data from payment processors including Touch n Go eWallet, Boost, and FPX-connected banks such as Maybank, CIMB, and Public Bank.

5.Legal Bases for Processing

xe88 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including AML obligations, KYC verification mandates, and tax reporting obligations where applicable.
• Legitimate Interests: Processing conducted in pursuit of xe88's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent, including the sending of marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

6.How We Use Your Personal Data

xe88 uses your personal data for the following purposes:

• To create, verify, and manage your xe88 account;
• To process deposits, withdrawals, and account transactions in MYR;
• To conduct identity verification and KYC checks as required by our regulatory obligations;
• To detect, investigate, and prevent fraud, money laundering, and other prohibited activities;
• To enforce the xe88 Terms & Conditions and other applicable policies;
• To operate and administer the Platform's responsible gaming tools, including deposit limits, self-exclusion, and session monitoring;
• To provide customer support and respond to inquiries and complaints;
• To send you transactional communications necessary for the operation of your account, including security alerts and payment confirmations;
• To send you marketing communications where you have opted in, and to personalise promotional offers based on your gaming activity;
• To analyse Platform usage and improve our products, services, and user experience;
• To maintain Platform security and investigate technical issues.

7.Disclosure of Personal Data to Third Parties

xe88 does not sell or rent your personal data to any third party. xe88 may share your personal data with the following categories of recipients:

• Payment Service Providers: Touch n Go eWallet, Boost, and FPX-connected banks (Maybank, CIMB, Public Bank, RHB, Hong Leong, and others) for the purpose of processing transactions.
• Identity Verification Providers: Licensed KYC and AML screening service providers engaged to assist with regulatory compliance obligations.
• Game Software Providers: Third-party game studios within the xe88 network, to the extent necessary for game operation, RNG certification, and player dispute resolution.
• Customer Support Platforms: Live chat and ticketing service providers engaged to facilitate player support interactions.
• Regulatory and Law Enforcement Authorities: Where xe88 is required by law, court order, or regulatory direction to disclose personal data to governmental authorities, it will do so. Where legally permissible, xe88 will attempt to notify the affected individual prior to disclosure.
• Professional Advisers: Legal, accounting, and audit professionals engaged by xe88, under strict confidentiality obligations.

All third-party service providers engaged by xe88 are required to process personal data only in accordance with xe88's documented instructions and under contractual data protection obligations no less protective than those described in this Policy.

8.International Data Transfers

In the course of operating the xe88 Platform and engaging third-party service providers, personal data may be transferred to and processed in jurisdictions outside Malaysia. Where such transfers occur, xe88 takes appropriate steps to ensure that your personal data is afforded a level of protection consistent with this Policy and applicable data protection requirements. This may include reliance on contractual data transfer mechanisms or equivalent safeguards.

9.Data Retention

xe88 retains personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your xe88 account plus a minimum of five (5) years following account closure, as required by AML regulations.
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of the relevant transaction.
• KYC Documentation: Retained for a minimum of five (5) years from account closure or the completion of the KYC process, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the interaction.
• Technical and Log Data: Retained for up to twelve (12) months, subject to security investigation requirements.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with xe88's data disposal procedures.

10.Cookies and Tracking Technologies

The xe88 Platform uses cookies and similar technologies for the following purposes:

• Strictly Necessary Cookies: Session management cookies required for the operation of the Platform, including maintaining your logged-in state and preserving account security settings. These cannot be disabled without impacting core Platform functionality.
• Performance Cookies: First-party analytics cookies used to measure Platform performance, identify technical errors, and understand aggregate usage patterns. No personally identifiable information is shared externally through these cookies.
• Preference Cookies: Cookies that remember your language settings and display preferences across sessions.

xe88 does not deploy third-party advertising or tracking cookies. You may configure your browser to block or delete cookies, but doing so may impair your ability to use certain features of the xe88 Platform, including maintaining an active login session.

11.Data Security

xe88 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your browser and the xe88 Platform;
• Encryption at rest for databases containing personal and financial data;
• Hashing and salting of authentication credentials — passwords are never stored in readable form;
• Access controls limiting internal data access to personnel with a documented need for that data;
• Regular security assessments and penetration testing of the Platform infrastructure;
• Two-factor authentication options available to all account holders.

While xe88 takes reasonable steps to protect your data, no online platform can guarantee absolute security. You are also responsible for maintaining the security of your login credentials and for using a secure device and network connection when accessing your xe88 account.

12.Your Rights as a Data Subject

Subject to applicable law and any overriding regulatory obligations (including AML retention requirements), you have the following rights in respect of your personal data held by xe88:

• Right of Access: To request a copy of the personal data xe88 holds about you.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to Restriction: To request that xe88 restricts processing of your personal data in certain circumstances, such as where accuracy is contested.
• Right to Object: To object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: To withdraw consent to processing at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact xe88 through the live chat or email address provided in Section 15. xe88 will respond to all valid data subject requests within fourteen (14) business days. We may require you to verify your identity before processing your request.

13.Children and Minors

The xe88 Platform is strictly intended for individuals aged 21 years and above. xe88 does not knowingly collect personal data from individuals under the age of 21. If xe88 becomes aware that personal data has been collected from a minor, it will take immediate steps to delete that data and close the associated account. Any bets placed or balances accumulated by an underage account holder will be voided. Parents or guardians who believe a minor may have accessed the xe88 Platform should contact customer support immediately.

14.Amendments to This Policy

xe88 may update this Privacy Policy periodically to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Material changes will be notified to registered account holders via the Platform or by email at least seven (7) days prior to taking effect, except where earlier implementation is required by law. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Continued use of the xe88 Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms.

15.Contact and Complaints

If you have questions, concerns, or requests relating to this Privacy Policy or xe88's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 via the xe88 Platform.
• Email: [email protected]

xe88 will acknowledge all privacy-related inquiries within two (2) business hours during Malaysia Standard Time (MST, UTC+8) and will provide a substantive response within fourteen (14) business days. If you are not satisfied with xe88's response to a privacy complaint, you may have the right to escalate your complaint to a relevant data protection supervisory authority in your jurisdiction.