Privacy Policy

This Privacy Policy ("Policy") describes how xe888 ("xe888", "the Company", "we", "us", "our") collects, uses, stores, and shares personal data obtained from individuals who register for an account, access, or otherwise interact with the xe888 platform at https://xe888.cam (the "Platform").

xe888 takes the privacy and security of your personal data seriously. This Policy has been prepared in accordance with applicable data protection and privacy regulations and reflects our obligations as an internationally licensed online gaming operator serving players across Malaysia.

By registering an account, making deposit, placing a wager, or otherwise using the Platform, you confirm that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions.

In this Policy, the following terms have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and IP address.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, erasure, or any combination thereof.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is xe888.
• "Data Subject" — the natural person to whom personal data relates; in this context, you as a registered player or site visitor.
• "Third Party" — any natural or legal person other than xe888 and the Data Subject, including payment processors, identity verification providers, and regulatory authorities.
• "Cookie" — a small data file placed on your device by the Platform for purposes including session management, analytics, and personalisation.

xe888 acts as the Data Controller in respect of personal data collected through the Platform. As Data Controller, xe888 is responsible for determining the purposes and means of processing your personal data and ensuring that such processing is conducted lawfully, fairly, and transparently.

Where xe888 engages third-party service providers to process personal data on its behalf (for example, payment processors or identity verification providers), such entities act as Data Processors and are contractually obligated to process data only in accordance with xe888's documented instructions and compliance with applicable data protection laws.

xe888 collects personal data through several channels, including the registration form, the KYC verification process, your ongoing use of the Platform, and communications with our customer support team. The categories of personal data we may collect include:

xe888 processes your personal data one or more of the following legal bases, depending on the purpose of processing:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and xe888 — including account registration, processing deposits and withdrawals in MYR, and providing access to games and betting markets.
• Legal Obligation: Processing is required to comply with our legal and regulatory obligations, including Know Your Customer (KYC) verification, Anti-Money Laundering (AML) checks, and record-keeping obligations imposed by our operating licence.
• Legitimate Interests: Processing is necessary for the purposes of xe888's legitimate interests, including fraud detection and prevention, platform security monitoring, and improving our services — provided such interests are not overridden by your fundamental rights.
• Consent: Where required, we will obtain your consent prior to processing, for example in relation to direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing conducted prior to withdrawal.

xe888 uses the personal data we collect for the following specific purposes:

• To create, manage, and maintain your xe888 player account.
• To verify your identity and age (21+) in compliance with KYC requirements.
• To process deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and other supported payment channels.
• To detect, investigate, and prevent fraud, money laundering, collusion, and other prohibited activities on the Platform.
• To provide customer support via live chat and email.
• To administer bonuses, promotions, and the xe888 VIP loyalty programme.
• To comply with applicable laws, regulations, and requests from regulatory or law enforcement authorities where legally required.
• To send you service-related communications, including account notifications and security alerts.
• To improve the Platform through analysis of aggregated, anonymised usage data.
• To fulfil our responsible gambling obligations, including monitoring for signs of problem gambling and enforcing self-exclusion requests.

xe888 does not sell, rent, or trade your personal data. We may share personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment Processors: Malaysian payment service providers including DuitNow, FPX gateway operators, and e-wallet providers (Touch 'n Go, Boost, GrabPay) require certain transaction data to process deposits and withdrawals on your behalf.
• Identity Verification Providers: Third-party KYC and AML compliance service providers who assist xe888 in verifying the identity, age, and source of funds of account holders.
• Game Providers: Licensed third-party game suppliers may receive anonymised or pseudonymised session data necessary to deliver their games on the Platform.
• Regulatory Authorities: Where required by applicable law or our operating licence, xe888 may disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, or other competent authorities.
• IT & Hosting Providers: Service providers responsible for hosting, maintaining, and securing the Platform's technical infrastructure.
• Professional Advisers: Legal, audit, and compliance advisers who are bound by professional confidentiality obligations.

In all cases, xe888 ensures that data sharing arrangements are governed by written agreements that impose data protection obligations consistent with applicable law.

xe888 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

In particular, the following retention principles apply:

• Account data and transaction records are retained for a minimum of five (5) years following account closure, in accordance with AML and gaming licence record-keeping obligations.
• KYC documentation is retained for the duration of the account relationship and for minimum of five (5) years thereafter.
• Customer support communications are retained for up to three (3) years from the date of the last interaction.
• Technical log data (including IP addresses and session logs) is retained for up to twelve (12) months, unless a longer retention period is required for fraud investigation or legal proceedings.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with you as an individual.

xe888 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and the Platform.
• Encrypted storage of sensitive data at rest, including financial and identity records.
• Role-based access controls ensuring that only authorised personnel with a legitimate business need can access personal data.
• Regular penetration testing and security vulnerability assessments conducted by qualified third-party specialists.
• Multi-factor authentication requirements for internal system access by xe888 staff.
• Formal incident response procedures with defined escalation paths in the event of a data security incident.

While xe888 takes all reasonable measures to protect your data, no transmission over the internet or electronic storage system is entirely free from risk. Players are also responsible for maintaining the security of their own account credentials and should not share their username or password with any third party.

The xe888 Platform uses cookies and similar tracking technologies to deliver and improve its services. Cookies are small data files stored on your device when you access the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your visit. They cannot be disabled without affecting core Platform functionality.
• Performance & Analytics Cookies: Collect anonymised information about how visitors use the Platform — for example, which games are most played or which pages receive the most traffic. This data is used solely to improve the Platform experience.
• Functional Cookies: Store preferences such as your selected language, display settings, or preferred payment method to personalise your experience on subsequent visits.
• Security Cookies: Support fraud detection and prevention features, including identification of unusual login patterns or suspicious account activity.

You may configure your browser to block or delete cookies; however, disabling strictly necessary cookies may prevent you from accessing certain features of the Platform, including account login and the cashier.

Subject to applicable law and any overiding regulatory obligations, you hold the following rights in relation to your personal data held by xe888:

To exercise any of the above rights, please contact xe888's Data Protection team via the live chat facility or at the email address listed in Section 15 of this Policy. xe888 will respond to all verifiable data rights requests within thirty (30) days. In complex cases, this period may be extended by a further two months with prior notification.

xe888's services are strictly intended for persons aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21.

If xe888 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete such data and close the associated account. All deposited funds associated with such an account may be forfeited in accordance with our Terms & Conditions.

In the course of operating an internationally licensed gaming platform, xe888 may transfer personal data to third-party service providers or regulatory bodies located outside of Malaysia. Such transfers may be necessary for the purposes of KYC verification, technical infrastructure hosting, or compliance with gaming licence obligations.

Where personal data is transferred internationally, xe888 ensures that appropriate safeguards are in place to protect the data at standard equivalent to that required under applicable Malaysian data protection laws and the requirements of our operating jurisdiction. These safeguards may include contractual data processing agreements with standard protective clauses.

xe888 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The most current version of this Policy will always be accessible on the Platform at https://xe888.cam/privacy-policy.

Where changes are material, xe888 will endeavour to notify registered players via their registered email address or through an in-platform notification prior to the changes taking effect. The date of the most recent update is indicated at the top of this page.

Your continued use of the Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease use of the Platform and contact our support team to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which xe888 processes your personal data, please contact us through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly on the xe888 Platform. Live chat is the fastest channel for urgent privacy-related queries.
• Email: support@xe888.cam — please include "Privacy Query" in your subject line to ensure your message is directed to the appropriate team. Responses within one business day.

xe888 is committed to resolving all privacy-related enquiries in a timely, transparent, and fair manner. All requests relating to your data rights will be acknowledged within 48 hours and resolved within the timeframes prescribed by applicable data protection law.