XE88 Privacy Policy – Our Commitment to Protecting the Personal Data of Malaysian Members

XE88 collects your personal data to enable us to provide safe, fair, and responsible online betting services. We adhere to the principle of data minimisation — we only collect what is strictly necessary, nothing more.

There are two main categories of data we collect — data you provide to us directly, and data collected automatically through your use of the XE88 platform. Both categories are essential for us to deliver a secure, personalised, and high-quality experience to every member.

• Data you provide directly: Full name, date of birth, Malaysian phone number, bank account or digital wallet details (TNG eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u, CIMB Clicks), MyKad number for verification purposes, and any other information you enter into forms on the XE88 platform.
• Automatically collected data: IP address, cookie data, device and browser information, in-platform activity history including games played and bets placed, as well as general usage patterns that help us improve the user experience.
• Data from third-party sources: In certain situations, we may receive information from Malaysian local payment providers (such as transaction confirmations from TNG eWallet or GrabPay) or from identity verification agencies used for fraud prevention purposes.

Your personal data is collected through several channels as you interact with the XE88 platform. Understanding these channels helps you know when and how your data is transferred to us.

• Account registration form: When you register a new XE88 account, you will be asked to provide basic information such as a Malaysian phone number and a password. Additional details such as your full name and date of birth may be requested for age eligibility verification.
• Financial transactions: Every time you make a deposit using TNG eWallet, GrabPay, DuitNow, FPX, or any other local payment method, the transaction details are collected and stored as part of your account records.
• Platform usage: Your activity on the XE88 platform — including games you play, bets you place on Malaysia Super League or EPL football, MPL Malaysia esports sessions, and virtual sports you participate in — is recorded automatically.
• Cookies and tracking technologies: The XE88 platform uses cookies and similar technologies to remember your preferences, maintain your login session, and help us understand how users interact with our platform.
• Customer support communications: When you contact the XE88 support team via LiveChat or WhatsApp, the contents of that conversation are recorded for quality assurance, training, and future reference purposes.

XE88 uses collected personal data solely for purposes that are lawful, relevant, and directly related to the services we offer. Below are the primary purposes for which your personal data is used.

• Account management: To create, manage, and maintain your XE88 account — including securing your login, updating your profile, and processing password changes.
• Financial transaction processing: To process your deposits via your chosen Malaysian local payment method, credit winnings to your account, and handle your withdrawal requests securely and promptly.
• Identity verification and fraud prevention: To verify that you meet the minimum age requirement of 18 years, identify fraudulent attempts or unauthorised account use, and protect all XE88 members from harmful activity.
• Provision of gaming and betting services: To ensure you can access all the games and betting services available to you, maintain your betting history, and process winnings accurately and fairly.
• Customer support: To allow our Bahasa Melayu-speaking support team to better understand your account history and issues, enabling faster and more effective resolution.
• Legal compliance: To comply with applicable Malaysian legal requirements, including anti-money laundering obligations, and to cooperate with legitimate authority investigations where required.
• Platform improvement: To analyse usage patterns in aggregate and anonymised form, helping us identify areas for improvement on the XE88 platform for the benefit of all members.

XE88 does not sell, rent, or share your personal data with third parties for their marketing purposes. However, there are limited situations where we need to share certain information with specific parties in order to provide our services to you.

• Payment service providers: We share the necessary transaction details with Malaysian local payment providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u, and CIMB Clicks solely for the purpose of processing your financial transactions. These providers maintain their own privacy policies and are responsible for managing the data shared with them.
• Technology service providers: We use trusted cloud infrastructure and technology providers to operate the XE88 platform. These providers may have technical access to your data but are bound by strict confidentiality agreements and may only use that data for specified technical purposes.
• Competent authorities: XE88 may be required to disclose personal data to Malaysian government authorities, law enforcement, or relevant regulatory bodies if directed to do so through a valid legal process, or where we reasonably believe such disclosure is necessary to prevent or investigate criminal activity.
• Business transfer: In the event of a merger, acquisition, or material asset transfer involving XE88, user data may form part of the transferred assets. We will notify you in advance via an in-platform notice and ensure the receiving party is bound by equivalent privacy protections.

Protecting your personal data from unauthorised access, loss, or misuse is XE88's top priority. We continuously invest in the latest security technologies and processes to ensure your data remains protected at the highest level.

• 256-bit SSL Encryption: All data transmitted between your device and XE88's servers is protected by 256-bit SSL (Secure Socket Layer) encryption, active at all times. This is the same encryption standard used by major banking institutions worldwide, including Maybank and CIMB.
• Secure password storage: Your XE88 account password is never stored in plain text. We use strong hashing algorithms, meaning even XE88 staff cannot view your actual account password.
• Strict internal access controls: Access to member data within the XE88 system is restricted to staff who require it to perform their duties (need-to-know principle). All access is logged and monitored automatically through our internal audit system.
• Regular security audits: We undergo regular security audits and penetration testing by qualified third parties to identify and address any vulnerabilities in our systems before they can be exploited.
• Continuous threat monitoring: XE88's security monitoring system operates 24/7 to detect and respond to any security threats, intrusion attempts, or suspicious activity in real time.

While we take all reasonable steps to protect your data, no security system in the world can guarantee absolute 100% protection at all times. We therefore also encourage you to take your own protective measures, such as using a strong, unique password and never sharing your login credentials with anyone.

XE88 retains your personal data for as long as your account remains active or as long as is necessary to provide services to you. Once your account is closed, we will retain certain data for a period determined by our legal and operational requirements.

• Active account data: For as long as your XE88 account remains active, all your personal data and activity records will be retained to enable us to provide uninterrupted service and resolve any disputes that may arise.
• Financial transaction records: Deposit, withdrawal, and other financial transaction records are retained for a minimum of 7 years in accordance with Malaysian financial laws and anti-money laundering requirements.
• Betting history: Your full betting activity history is retained for the duration your account is active and for up to 3 years after account closure, for dispute resolution and legal compliance purposes.
• Support communication records: Interaction logs with the XE88 support team are retained for 2 years for quality control purposes and for reference should you or the relevant authorities require them.
• Identity verification data: Identity verification documents such as MyKad copies are retained for the duration your account is active and for the period required under Malaysian law after account closure, after which they are securely deleted.

Under Malaysia's Personal Data Protection Act 2010 and XE88's own privacy policy, you hold several important rights regarding the personal data we process. We are fully committed to respecting and facilitating each of these rights.

• Right to access: You have the right to request a copy of all personal data we hold about you. We will provide this information in a readable format within 21 calendar days of receiving a valid request.
• Right to rectify: If you find that the personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. We will update our records promptly upon receipt of appropriate verification.
• Right to erasure: In certain circumstances permitted by law, you have the right to request the deletion of your personal data. Please note that this right is not absolute and may be limited by applicable legal requirements or ongoing contractual obligations.
• Right to restrict processing: You may request that we limit how we use your data in certain situations — for example, while you are awaiting the outcome of a correction request or an objection to processing.
• Right to object to processing: You may object to the processing of your personal data for specific purposes, such as direct marketing communications. You can opt out of receiving marketing communications from XE88 at any time by contacting our support team.
• Right to withdraw consent: Where the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.

To exercise any of the rights above, please contact the XE88 support team via LiveChat, WhatsApp, or email at support@xe88-app.com. Clearly state your request and include sufficient account information for us to verify your identity before processing it.

The XE88 platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and help us understand how our platform is used so we can continue improving it over time.

• Essential cookies: These cookies are required for the core functionality of the XE88 platform, including maintaining your login session, saving items in your betting cart, and ensuring security features operate correctly. This type of cookie cannot be disabled as it is critical to platform operation.
• Performance cookies: These cookies collect information about how you use the XE88 platform — which pages you visit most, any error messages you encounter, and so on. All information is collected in aggregate and anonymised form. It helps us identify areas of the platform that need improvement.
• Functionality cookies: These cookies allow the XE88 platform to remember the preferences you have set — such as language, state in Malaysia, and any other personal preferences — so you do not need to reconfigure them each time you log in.
• Managing cookies: You can manage your cookie settings through your web browser preferences. Please note that disabling certain cookies may affect the functionality of the XE88 platform and your overall user experience.

XE88 is a platform designed exclusively for adults aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

• We strictly enforce the minimum age requirement of 18 through a verification process at registration and during withdrawal processing, which requires identity verification.
• Should we discover that personal data belonging to a minor has been collected inadvertently, we will immediately delete that data and close the associated account without delay.
• If you are a parent or guardian who believes your underage child may have registered an XE88 account, please contact our support team immediately via LiveChat or email at support@xe88-app.com for prompt action.

In the course of its operations, XE88 may need to store or process your personal data on servers located outside Malaysia. This may occur when we use cloud infrastructure services from trusted international providers.

• Any transfer of personal data outside Malaysia is only carried out with service providers that maintain data protection standards equivalent to or higher than those required under Malaysian law.
• We ensure that all data processing agreements with international providers include adequate data protection clauses to safeguard your privacy rights, even when data is processed outside Malaysia.
• Financial data and transaction information relating to Malaysian local payments are stored on servers in regions that comply with the highest financial security standards.

If you have any questions, concerns, or complaints about how XE88 handles your personal data, or if you wish to exercise any of the privacy rights outlined in this document, please reach out to us through the following channels.

• In-platform LiveChat: The fastest way to get immediate privacy assistance. Our Malay-speaking support team is available 24 hours a day, 7 days a week, without interruption.
• WhatsApp: Contact the XE88 support team via WhatsApp for enquiries that do not require an immediate response. We typically reply within 1 hour during normal operating hours.
• Email: For more formal or detailed privacy enquiries or complaints, please email support@xe88-app.com with the subject line "Privacy Enquiry" and include your XE88 account username to help us process your request faster.
• Response time: We are committed to acknowledging all privacy enquiries within 24 hours and providing a substantive response within 21 calendar days of receiving a complete enquiry.