Privacy Policy — xe88ios

This Privacy Policy ("Policy") issued by xe88ios ("Platform", "we", "us", "our") and applies to all personal data processed in connection with the xe88ios website located at xe88ios.cam and all associated services, games, betting markets, account management functions, and customer support channels (collectively, "Services").

xe88ios is committed to processing personal data in accordance with applicable data protection legislation and the principles of lawfulness, fairness, and transparency. This Policy is intended to inform you — as a registered Player, prospective user, or visitor to our website — of your rights and our obligations with respect to your personal information.

By accessing the xe88ios Platform or creating an Account, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this Policy, you should not access the Platform or provide us with any personal data.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial data, device identifiers, and behavioural data — where that person can be directly or indirectly identified.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, alteration, or deletion.
• "Data Subject" means the natural person to whom Personal Data relates — in most cases, a registered Player or website visitor.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, xe88ios is the Data Controller.
• "Data Processor" means an entity that processes Personal Data on behalf of the Data Controller, such as a payment service provider or cloud hosting partner.
• "Consent" means freely given, specific, informed, and unambiguous agreement by a Data Subject to the processing of their Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity verification process required under anti-money laundering and regulatory compliance obligations.

xe88ios acts as the Data Controller in respect of all Personal Data collected and processed through the Platform and Services. As Data Controller, xe88ios is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently, and that appropriate technical and organisational measures are in place to protect it.

Where xe88ios engages third-party service providers — such as payment processors, fraud detection services, KYC verification providers, and cloud infrastructure partners — those parties act as Data Processors and are bound by data processing agreements that impose obligations consistent with applicable data protection law. xe88ios remains responsible for the overall lawfulness of processing even where it is carried out by a Data Processor.

For enquiries regarding data protection or to exercise your rights as a Data Subject, please contact xe88ios using the details provided in Section 15 of this Policy.

xe88ios collects Personal Data from the following sources and in the following categories:

Data Provided Directly by You

Data Collected Automatically

xe88ios processes Personal Data only where a lawful basis for doing so exists. The lawful bases relied upon are as follows:

• Contractual Necessity: Processing required to open and maintain your Account, process deposits and withdrawals in MYR, provide access to games and betting markets, and give effect to any applicable bonuses or promotions.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML) legislation, KYC regulatory requirements, tax reporting obligations, and any other statutory or regulatory duties imposed on xe88ios.
• Legitimate Interests: Processing carried out in the legitimate interests of xe88ios or third parties, including fraud prevention, platform security, responsible gambling monitoring, and the improvement of Services — where those interests are not overridden by your rights and freedoms.
• Consent: Processing for optional purposes — such as sending promotional communications — where you have provided explicit, freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

The Personal Data we collect is used for the following purposes:

• To create, manage, and maintain your xe88ios Account
• To process deposits and withdrawals in MYR via Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay,TC, and USDT
• To conduct identity verification (KYC) and anti-money laundering (AML) checks as required by applicable law
• To deliver the games, sports betting markets, and live dealer services you have requested
• To administer promotional offers and verify eligibility for bonuses
• To monitor account activity for fraud, collusion, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions
• To provide customer support in English, Bahasa Melayu, and Chinese
• To enforce responsible gambling obligations, including monitoring for signs of problem gambling and applying self-imposed limits
• To improve the Platform through aggregated usage analytics
• To send account-related communications — such as transaction confirmations, security alerts, and policy updates
• To send marketing and promotional communications, where you have consented to receive them

xe88ios does not sell Personal Data to third parties. We share Personal Data with external parties only in the following limited circumstances:

Service Providers (Data Processors)

We engage trusted service providers to support the operation of the Platform. These include:

• Payment processors and banking partners — to facilitate deposits and withdrawals via local channels including Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay
• KYC and identity verification providers — to conduct document verification and biometric checks
• Fraud detection and AML screening services — to identify and prevent financial crime
• Cloud infrastructure and hosting providers — to store and process platform data securely
• Customer support software providers — to enable live chat and ticket-based support

All service providers are bound by written data processing agreements requiring them to process Personal Data only on our documented instructions and to apply appropriate security measures.

Legal and Regulatory Disclosure

We may disclose Personal Data to regulatory authorities, law enforcement agencies, courts, or other governmental bodies where required to do so by applicable law, court order, or regulatory directive. xe88ios will disclose only the minimum data necessary to satisfy the legal obligation.

Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of xe88ios's assets, Personal Data held by the Platform may be transferred to the acquiring entity as part of that transaction. Affected Players will be notified of any such transfer and any material changes to data processing practices that result from it.

xe88ios retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Account Data: Retained for the duration of the active Account relationship, and for a period of up to five (5) years following Account closure, to meet AML and regulatory record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years following the end of the Account relationship, in accordance with applicable financial crime prevention requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, to support financial reporting and regulatory compliance.
• Communication Records: Customer support communications are retained for three (3) years from the date of the last communication, unless a longer period is required by law or ongoing investigation.
• Marketing Consent Records: Retained for as long as you remain opted in to marketing communications, and for a further two (2) years following withdrawal of consent.

When data is no longer required, it is securely deleted using methods that ensure it cannot be recovered, or irreversibly anonymised so that it can no longer be attributed to an individual Data Subject.

xe88ios implements a layered set of technical and organisational security measures proportionate to the nature and sensitivity of the Personal Data we process. Key measures include:

• Encryption in transit: All data transmitted between your browser or device and the xe88ios Platform is encrypted using 256-bit TLS/SSL protocols. Connections lacking valid certificates are rejected.
• Encryption at rest: Sensitive stored data — including KYC documents, financial information, and account credentials — is encrypted at rest using strong symmetric encryption.
• Access controls: Access to Personal Data is restricted to authorised staff on a least-privilege basis. Multi-factor authentication is required for all internal administrative access.
• Fraud and anomaly monitoring: Real-time monitoring detects unusual account activity, unauthorised access attempts, and patterns consistent with fraud or data exfiltration.
• Penetration testing and security audits: The xe88ios infrastructure and codebase are subject to regular security reviews and penetration testing by qualified security personnel.
• Incident response: xe88ios maintains an incident response plan for data security events. In the event of a data breach that is likely to result in significant harm to Data Subjects, xe88ios will notify affected Players and relevant authorities in accordance with applicable law.

The xe88ios Platform uses cookies and similar technologies — including local storage, session tokens, and pixel tags — to operate certain essential functions and, where consent has been given, to analyse usage patterns and improve the Services.

Types of Cookies Used

• Strictly Necessary Cookies: Required for basic Platform functions such as maintaining your session, retaining login state, and ensuring secure page delivery. These cookies cannot be disabled without impairing core functionality.
• Functional Cookies: Store preferences such as language settings, last-visited game categories, and display configurations. These improve your experience but are not essential.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Players use the Platform — such as most-visited sections and session duration — to inform product improvements. Used only with your consent.
• Security Cookies: Support fraud detection functions by tracking session integrity and identifying anomalous browsing patterns.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to use the Platform. Disabling analytics or functional cookies will not prevent access to the Services.

As a Data Subject, you hold the following rights in respect of your Personal Data processed by xe88ios. These rights may be exercised by contacting us using the details in Section 15 of this Policy.