xx67 Privacy Policy

xx67 (referred to in this document as "xx67", "we", "us", or "the Platform") is an online sports betting and casino gaming platform serving the Bangladesh market. The Platform is accessible at xx67.io and all associated subdomains and mobile-optimised pages.

We understand that the privacy of your personal data is important to you, and we are committed to handling it with care, transparency, and respect. This Privacy Policy describes in plain terms the categories of personal data we collect from users of the xx67 platform, the purposes for which that data is processed, the parties with whom it may be shared, the measures we take to keep it secure, and the rights you have in relation to your own data.

This Privacy Policy should be read alongside our Terms and Conditions, which are available at xx67.io/terms-conditions, and our Responsible Gaming Policy at xx67.io/responsible-gaming. Where this Privacy Policy conflicts with any other document, this Privacy Policy shall govern in relation to matters of data protection.

xx67 collects personal data in the following categories, depending on how you interact with the Platform:

2.1 — Registration Data

When you create an account on xx67, we collect the information you provide during registration, which typically includes: your full legal name, date of birth, residential address, email address, mobile phone number, and your chosen username. This data is required to establish your account and verify your eligibility to use the Platform.

2.2 — Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, we may request documentary evidence to verify your identity and age. This may include: a copy of your national identity card (NID), passport, driving licence, or other government-issued identification document; a recent utility bill or bank statement as proof of address; and in some cases a selfie or photograph for biometric verification. KYC documents are processed securely and retained only for as long as required.

2.3 — Financial and Payment Data

When you make deposits or withdrawals via bKash, Nagad, Rocket, Upay, or Visa, xx67 collects transaction-related data including: your payment method identifier (such as your bKash or Nagad mobile number), transaction amounts in Bangladeshi Taka (BDT), transaction timestamps, and transaction reference numbers. Full card or wallet credentials are handled directly by the respective payment provider — xx67 does not store full card numbers or mobile wallet PINs on its own servers.

2.4 — Gameplay and Betting Data

xx67 records a full history of your activity on the Platform, including: bets placed and settled, games played (slots, live casino, Plinko, cricket markets, and others), wager amounts, winnings and losses, session durations, and game-specific activity logs. This data is used for account management, dispute resolution, and responsible gaming monitoring.

2.5 — Technical and Device Data

When you access the xx67 platform through a browser or mobile device, we automatically collect certain technical data, including: your IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited within the Platform, and session timestamps. This data is collected via server logs and analytics tools and is used to maintain platform security and improve user experience.

2.6 — Communications Data

If you contact xx67 support by email or any other channel, we retain a record of that correspondence, including the content of your messages, the date and time of contact, and any attachments or documents you provide. This data is used to manage your enquiry and to maintain a service history for your account.

xx67 uses the personal data it collects for the following clearly defined purposes:

• Account Management: To create, maintain, and administer your xx67 player account, including processing login sessions, managing account settings, and applying responsible gaming tools you have requested.
• Identity and Age Verification: To confirm that you are at least 21 years of age and that the identity you have provided is genuine, as required by our Terms and Conditions and responsible gaming obligations.
• Payment Processing: To facilitate deposits and withdrawals in Bangladeshi Taka (BDT) via bKash, Nagad, Rocket, Upay, and Visa, and to maintain accurate financial records of all transactions on your account.
• Fraud Detection and Prevention: To monitor account activity for signs of fraudulent behaviour, money laundering, bonus abuse, multi-accounting, or any other form of prohibited conduct as defined in our Terms and Conditions.
• Platform Security: To protect the integrity and security of the xx67 platform, including detecting and responding to technical attacks, unauthorised access attempts, and suspicious traffic patterns.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide assistance with account-related matters.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling behaviour, to apply deposit limits and self-exclusion measures you have requested, and to provide timely interventions where appropriate.
• Legal and Regulatory Compliance: To comply with applicable legal obligations, including maintaining financial transaction records, responding to lawful requests from competent authorities, and fulfilling any reporting obligations applicable to the Platform.
• Platform Improvement: To analyse aggregated, anonymised usage data in order to improve the functionality, design, and content offering of the xx67 platform.

xx67 does not use your personal data for automated decision-making that produces significant legal effects without human oversight, nor do we use it for unsolicited marketing communications unless you have explicitly opted in to receive such communications.

xx67 processes personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract between you and xx67 — including account creation, payment processing, bet settlement, and KYC verification — is carried out on the basis of contractual necessity.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and service improvement is based on the legitimate interests of xx67 and its user community, where those interests are not overridden by your own rights and interests.
• Legal Obligation: Processing required to comply with applicable laws — including financial record-keeping and responding to lawful authority requests — is carried out on the basis of legal obligation.
• Consent: Where xx67 relies on your consent as the legal basis for a specific processing activity (such as optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

xx67 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device by a web server when you visit a website. Cookies allow the Platform to recognise your device across sessions and to deliver a more consistent user experience.

5.1 — Types of Cookies We Use

• Essential Cookies: Required for the basic operation of the Platform, including maintaining your login session and remembering your account preferences. These cannot be disabled without impairing Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users navigate the Platform, which pages are most visited, and where technical errors occur. This data helps us improve the Platform.
• Security Cookies: Used to detect and prevent fraudulent activity, including session hijacking, credential stuffing, and bot traffic.
• Preference Cookies: Used to remember your chosen settings, such as language and display preferences, so that you do not need to re-enter them on each visit.

5.2 — Managing Cookies

You can manage or disable cookies through your browser settings at any time. Please note that disabling essential cookies may prevent you from logging in or using certain features of the xx67 platform. Detailed cookie management instructions are available in the help section of all major browsers.

xx67 does not sell your personal data to third parties. We may share your data with carefully selected third-party service providers and partners who assist in the operation of the Platform, subject to strict contractual data protection obligations. The categories of third parties with whom data may be shared are as follows:

• Payment Processors: bKash, Nagad, Rocket, Upay, and Visa receive transaction data necessary to process your deposits and withdrawals. Each provider operates under its own privacy and security framework.
• Identity Verification Providers: Third-party KYC service providers may process identity documents on behalf of xx67 for age and identity verification purposes. These providers are contractually prohibited from using your data for any purpose other than the verification service.
• Game Software Providers: Game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, Play'n GO, and Hacksaw Gaming may receive session-level data necessary to deliver their games through the xx67 platform. No additional personal data beyond what is necessary for game delivery is shared with game providers.
• Fraud Prevention and Security Services: Specialist fraud detection and platform security providers may receive technical data (such as IP addresses and device fingerprints) to assist in identifying and preventing fraudulent activity.
• Legal and Regulatory Authorities: xx67 may disclose personal data to competent legal authorities where required by applicable law, court order, or in connection with the prevention or investigation of fraud or other serious misconduct.

In all cases, xx67 requires third-party recipients to maintain appropriate technical and organisational security measures and to process personal data only for the specific purpose for which it was shared.

xx67 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• SSL/TLS Encryption: All data transmitted between your device and the xx67 platform is encrypted using industry-standard SSL/TLS protocols. The padlock indicator in your browser confirms that your connection is secured.
• Encrypted Data Storage: Personal data held in xx67's databases is stored in encrypted form. Encryption keys are managed through secure key management processes with restricted access.
• Access Controls: Access to personal data within xx67's internal systems is restricted on a strict need-to-know basis. All staff members with access to personal data are subject to confidentiality obligations and regular security awareness training.
• Intrusion Detection: xx67 operates real-time intrusion detection and network monitoring systems to identify and respond to suspicious access attempts or anomalous activity on the Platform infrastructure.
• Regular Security Reviews: The Platform's security posture is reviewed and tested on a regular basis, including vulnerability assessments and penetration testing by qualified security personnel.

Despite these measures, no online platform can guarantee absolute security. In the unlikely event of a personal data breach that poses a risk to your rights and interests, xx67 will notify affected users promptly and take all reasonable steps to contain and remediate the breach.

xx67 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention guidelines apply:

Once a retention period expires, xx67 will securely delete or anonymise the relevant data in accordance with our internal data lifecycle procedures. Anonymised data (from which no individual can reasonably be identified) may be retained indefinitely for statistical and analytical purposes.

As a user of the xx67 platform, you have a number of rights in relation to the personal data we hold about you. These rights are summarised below. To exercise any of these rights, please contact the xx67 support team at [email protected] with the subject line "Data Rights Request".

• Right of Access: You have the right to request a copy of the personal data xx67 holds about you, along with information about how it is being processed. We will respond to access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You can update certain details (such as contact information) directly within your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent on which processing is based. Note that certain data may be required to be retained for legal compliance reasons even after an erasure request.
• Right to Restriction: You may request that xx67 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to Data Portability: Where processing is based on your consent or on a contractual basis, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where xx67 relies on legitimate interests as the legal basis, and where you believe your own interests override those of xx67.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

The xx67 platform is strictly for adults aged 21 years and above. xx67 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under 21 years of age, we will immediately close the relevant account, delete the collected data to the extent permitted by our legal obligations, and report the matter in accordance with our safeguarding procedures.

Parents and guardians who believe that a minor may have registered on the xx67 platform or submitted personal data without appropriate consent are encouraged to contact us immediately at [email protected]. We take such reports seriously and will investigate and respond promptly.

xx67 primarily stores and processes personal data within secure server infrastructure. In certain cases — for example, where third-party service providers such as game studios or KYC verification partners operate servers in other countries — your personal data may be transferred to and processed in jurisdictions outside Bangladesh.

Where international transfers occur, xx67 takes steps to ensure that appropriate safeguards are in place to protect your personal data, including: contractual data protection obligations with the recipient entity; technical security measures consistent with those applied to data processed within Bangladesh; and restrictions on the use of transferred data to the specific purpose for which it was shared.

By using the xx67 platform and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data in the circumstances described above, subject to the safeguards outlined in this section.

xx67 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of our services. When material changes are made, we will provide reasonable notice to registered users via a prominent notice on the Platform or by email to the address associated with your account.

The "Last updated" date displayed at the top of this document will be revised each time changes are published. We encourage you to review this Privacy Policy periodically to stay informed about how xx67 protects your data. Your continued use of the Platform following the publication of any update constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data xx67 holds about you, please contact our support team using the details below. We are committed to addressing all privacy-related enquiries promptly and transparently.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Data Rights Request" or "Privacy Enquiry"
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Response Target: Within 24 hours for general enquiries; within 30 days for formal data rights requests

When submitting a data rights request, please include your registered username or email address and a clear description of the request so that we can verify your identity and process your enquiry efficiently. xx67 will never charge a fee for handling a legitimate data rights request submitted in good faith.