xe88 Privacy Policy for Malaysian Users

Introduction and Scope

This Privacy Policy applies to all personal data processed by xe88 in connection with the website at xe88.casa, registered user accounts, gaming information services, payment functions and any associated communications. References to "we", "us" or "our" mean xe88. References to "you" or "user" mean any individual whose personal data is processed by xe88.

By accessing or using xe88, creating an account or submitting personal information through any xe88 channel, you acknowledge that you have read this Privacy Policy and understand how your data may be collected and used. If you do not agree, you should not use xe88 services.

This policy is reviewed periodically. Where changes are material, xe88 will make reasonable efforts to communicate them through the website or account interface. Continued use of xe88 after an updated policy takes effect constitutes acceptance to the extent permitted by applicable law.

Definitions

Personal Data means any information that identifies or can reasonably identify a living individual, including name, identification number, contact details, financial information and device identifiers. Processing means any operation performed on personal data, including collection, storage, use, sharing and deletion.

Data Controller means the xe88 entity responsible for determining the purposes and means of processing. Data Processor means a party that processes personal data on behalf of xe88 under appropriate instructions and controls. Sensitive Data may include identity documents, proof-of-address records and payment instrument ownership information collected for KYC and compliance purposes.

Data We Collect

xe88 may collect the following categories of personal data depending on how you interact with the platform:

• Identity data: Full name, date of birth, gender, nationality and images from identity documents such as MyKad, Malaysian driving licence or passport submitted for age and KYC verification.
• Contact data: Email address, mobile number, correspondence address and preferred language. Users in Kuala Lumpur, Penang, Shah Alam, Petaling Jaya, Johor Bahru and other Malaysian locations should ensure contact details are accurate.
• Account data: Username, hashed password, account history, preferences, support interactions and session activity.
• Financial data: Payment method type, masked payment instrument identifiers, transaction amounts in MYR, deposit and withdrawal records. Where USDT or other supported crypto is used, applicable wallet address information may be collected.
• Verification data: Selfie images, proof-of-address documents such as utility bills or bank statements issued within three months, and related correspondence.
• Technical data: IP address, device type, browser version, operating system, session timestamps, cookie data and approximate location signals used for security and fraud-prevention.
• Behavioural data: Gameplay records, wagering history, login frequency and interaction patterns used for responsible gambling monitoring and service improvement.
• Communication data: Records of support queries, feedback and live chat transcripts retained for quality and dispute-resolution purposes.

How We Collect Data

xe88 collects personal data through direct interactions, automated technical means and third-party sources, as described below.

Direct interactions include account registration, identity verification, deposit and withdrawal requests, support messages, feedback submissions and any other action where a user voluntarily provides information.

Automated collection includes cookies, server logs, device fingerprinting and session analytics that operate when you access xe88. These technical signals help with authentication, fraud detection and maintaining a stable user experience.

Third-party sources may include payment processors such as DuitNow, FPX and supported e-wallet providers, identity verification services, fraud-intelligence partners and, where applicable, publicly available records used to validate account information.

Legal Bases and Purposes of Data Processing

xe88 processes personal data only where a recognised legal basis applies. The primary bases and corresponding purposes are summarised in the table below.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect lawfulness of prior processing and may limit access to certain features where consent-based processing is necessary to deliver them.

How We Share Personal Data

xe88 does not sell, rent or trade personal data. Sharing is limited to the following categories:

• Payment service providers: Processors handling MYR transactions, DuitNow, FPX, Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, Public Bank, Hong Leong and supported cryptocurrency channels receive only the data required to process a specific transaction.
• Identity and KYC verification partners: Trusted services that assist with document authentication, fraud screening and age confirmation under appropriate data processing agreements.
• Technology and infrastructure providers: Hosting, security, analytics and communication tools that process data under instructions and appropriate contractual protections.
• Regulatory and law enforcement bodies: Where xe88 is required by applicable law, court order, licence obligation or investigation request to disclose personal data.
• Responsible gambling and support services: Where a user's data must be shared to administer a self-exclusion request, apply a cooling-off period or respond to a welfare concern.
• Corporate transactions: In the event of a merger, acquisition, sale of assets or restructuring, personal data may be transferred with appropriate safeguards and notification.

xe88 requires third parties processing data on its behalf to maintain appropriate technical and organisational security measures and to use personal data only for the specified purpose.

Cookies and Tracking Technologies

xe88 uses cookies, web beacons, local storage and similar tracking technologies to support authentication, security, session management, performance monitoring and, where consent is provided, analytics and personalisation.

Strictly necessary cookies enable basic account functions and security checks. These cannot be disabled without materially affecting service access. Performance cookies help xe88 understand page load, error rates and navigation patterns. Functional cookies remember preferences such as language or display settings. Analytics and targeting cookies are only deployed with prior consent.

Users may manage cookie preferences through their browser settings or any consent mechanism provided by xe88. Disabling certain cookie types may affect account security, login persistence or page functionality.

Data Retention

xe88 retains personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected, meet applicable compliance or legal obligations, resolve disputes and enforce agreements.

Account information and KYC records may be retained for a period after account closure in accordance with anti-money laundering, age-verification and regulatory recordkeeping requirements. Financial transaction records may be kept for a longer period where required by taxation or financial reporting obligations. Anonymised or aggregated data from which individuals cannot be identified may be retained for analytics and service development purposes without a fixed end date.

When data is no longer required, xe88 aims to delete, destroy or permanently anonymise it in a controlled manner using appropriate technical procedures.

Data Security

xe88 applies technical and organisational measures designed to protect personal data from unauthorised access, alteration, disclosure or loss. These include HTTPS encryption for data in transit, access controls on internal systems, secure credential storage using hashing and regular review of security practices.

No method of transmission or storage is completely secure. xe88 cannot guarantee absolute data security and asks users to take responsibility for their own device security, password choices and account hygiene. If you suspect unauthorised access to your xe88 account, you should secure the account and contact support promptly.

Users should never share passwords, one-time codes, MyKad images, payment credentials or authentication details through unsolicited messages, unofficial channels or unknown contacts claiming to represent xe88.

International Data Transfers

xe88 services may involve personal data being stored or processed in locations outside Malaysia. Where such transfers occur, xe88 will implement appropriate safeguards such as contractual clauses, equivalent data protection standards or other mechanisms to protect personal data in a manner consistent with applicable requirements.

By using xe88, Malaysian users acknowledge that personal data may be transferred to and processed in other jurisdictions where the applicable data protection framework may differ from Malaysia. xe88 will take reasonable steps to ensure that an adequate level of protection is maintained for any such transfers.

Children and Minors

xe88 services are strictly intended for eligible adults aged 21 and above. xe88 does not knowingly collect personal data from persons below the minimum age requirement. If xe88 becomes aware that a minor has provided personal data, steps will be taken to delete that information and close the associated account as permitted by applicable law.

Parents and guardians are encouraged to monitor online activity and device usage by minors and to ensure that access to gambling-related platforms is restricted. If you believe a minor has registered or used an xe88 account, please contact support immediately.

User Rights

Subject to applicable law and any overriding legal obligations, users may exercise the following rights in relation to their personal data held by xe88:

• Access: Request a copy of personal data held by xe88 about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of personal data where retention is no longer required or justified, subject to legal and regulatory retention obligations.
• Restriction: Request that processing be limited in certain circumstances, such as during a dispute about accuracy.
• Objection: Object to processing based on legitimate interests, particularly where it relates to direct marketing.
• Portability: Where technically feasible and lawfully applicable, receive account data in a structured, commonly used format.
• Consent withdrawal: Withdraw consent for any processing activity specifically based on consent, without affecting prior processing.

Requests should be submitted in writing to the xe88 support team. xe88 may need to verify identity before fulfilling a data rights request. Some requests may be declined or limited where applicable law, fraud-prevention obligations or regulatory recordkeeping requirements take precedence.

Responsible Gambling and Data

xe88 may process gameplay, deposit, loss and behavioural data to identify users who may benefit from responsible gambling interventions, to administer self-exclusion requests and to apply account limits. This processing supports player welfare and is treated as a legitimate interest of xe88 and its users.

Information used for responsible gambling purposes, such as a self-exclusion record or a cooling-off period marker, may be retained for a period after account closure to prevent re-registration during an active exclusion. This retention is necessary to fulfil the purpose for which the control was requested.

Links and Third-Party Services

xe88 may reference or interact with third-party payment services including DuitNow, FPX, and Malaysian bank and e-wallet channels. These services have their own privacy policies and data handling practices. xe88 is not responsible for how third-party platforms collect, use or protect personal data once a user interacts directly with them.

Users should review the privacy notices of any payment provider, identity verification service or support channel they use in connection with their xe88 account.

Changes to This Privacy Policy

xe88 may update this Privacy Policy to reflect changes in services, technology, applicable law or internal data handling practices. The date of the most recent review is displayed in the sidebar of this page. Where changes are considered material, xe88 will make reasonable efforts to notify users through the website or account interface.

Continued use of xe88 after a revised Privacy Policy takes effect constitutes acceptance of the update to the extent permitted by applicable law. Users who do not accept the revised terms should stop using xe88 and may request account closure through the support contact below.

Contact Us

For questions, concerns or requests relating to this Privacy Policy or the personal data xe88 holds about you, please contact the xe88 support team. Website email: [email protected]. This address is displayed as plain text only and is not a clickable link.

When submitting a data rights request, please include your full name, account identifier and a clear description of the request. Never include your password, complete payment credentials or one-time authentication codes in any correspondence.

xe88 aims to acknowledge data rights requests promptly and to respond within a reasonable period consistent with applicable obligations. Where a request is complex or involves a volume of data, a longer period may apply, and xe88 will provide an explanation where necessary.