Privacy Policy

01Introduction

This Privacy Policy ("Policy") describes how xpbet ("we", "us", "our", "Platform") collects, uses, stores, and protects personal information provided by users ("you", "Player") of the website located at xpbet.app and all associated mobile and web applications. xpbet is committed to handling personal data responsibly, transparently, and in a manner consistent with recognised data protection principles.

By registering an account, logging in, or otherwise using the xpbet platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your data as described herein. This Policy is incorporated by reference into the xpbet Terms and Conditions. If you do not agree with this Policy, you should not use the platform.

02Data We Collect

xpbet collects personal data in three broad categories. We collect only the data that is necessary for the legitimate purposes described in Section 03 of this Policy.

Identity and Contact Data

This category of data is collected at registration and during KYC verification. It is required to confirm your identity, verify your age (21+ requirement), and comply with anti-money-laundering obligations. You are obligated to ensure this information is accurate and up to date at all times.

Financial and Transaction Data

We record transaction data for every deposit, withdrawal, and bet placed on xpbet. This information is necessary to process payments, resolve disputes, calculate and pay winnings, apply bonus terms, and meet financial reporting obligations. Payment method details such as bKash wallet numbers are stored in tokenised form — we do not store full card numbers or mobile banking PINs.

Technical and Usage Data

We automatically collect technical data when you visit xpbet. This includes your IP address, browser type, operating system, device identifiers, pages visited, time spent on each page, and links clicked. This data is used to ensure platform security, detect fraud, improve the user experience, and diagnose technical issues. We do not use IP address data to identify your precise physical location beyond the country level.

03How We Use Your Data

xpbet uses personal data strictly for the following purposes. We do not use your data for purposes that are incompatible with those listed below without first obtaining your explicit consent.

• Account creation and management — to register your account, verify your identity and age, and maintain your account in good standing.
• Payment processing — to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to record transaction history for your account.
• Platform security and fraud prevention — to monitor for suspicious activity, prevent unauthorised account access, detect multi-accounting, and investigate reported incidents.
• Customer support — to respond to your enquiries, process disputes, and communicate updates about your account or ongoing promotions.
• Legal and regulatory compliance — to meet our obligations under applicable anti-money-laundering, know-your-customer, and responsible gaming regulations.
• Service improvement — to analyse aggregated, anonymised usage patterns that help us improve platform performance, fix technical issues, and develop new features for Bangladesh players.

04Legal Basis for Processing

xpbet processes personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity — processing your identity and financial data is necessary to provide the betting and gaming services you have contracted for when creating your xpbet account.
• Legal obligation — certain processing activities (particularly KYC and AML checks) are required by law. We cannot provide services to you without conducting these checks.
• Legitimate interests — technical data collected for fraud prevention, platform security, and service improvement serves the legitimate interests of xpbet and its users, provided those interests are not overridden by your privacy rights.
• Consent — where we process data for optional purposes (such as sending promotional communications about new game launches, seasonal offers tied to Eid or Pohela Boishakh, or BPL betting promotions), we will first obtain your explicit consent and you may withdraw that consent at any time.

05Data Sharing and Third Parties

xpbet does not sell, rent, or trade your personal data. We may share data with carefully selected third-party service providers only where strictly necessary to operate the platform. All third-party data processors are bound by data processing agreements that require them to handle your data in accordance with this Policy and applicable data protection standards.

Categories of Third-Party Recipients

• Payment processors — bKash, Nagad, Rocket, Upay, Visa, and Mastercard network operators receive the minimum transaction data necessary to authorise and settle deposits and withdrawals. These providers operate under their own privacy policies and regulatory obligations.
• Identity verification providers — third-party KYC and age verification services receive the identity documents you submit during the verification process. These providers are prohibited from using your documents for any purpose other than the verification they perform on our behalf.
• Fraud prevention and security services — we share behavioural and technical data with fraud detection platforms to identify suspicious patterns and protect all players on xpbet. This data is processed on an aggregated or pseudonymised basis where possible.
• Regulatory and legal authorities — xpbet may disclose personal data to law enforcement agencies, courts, or regulatory bodies when required to do so by law, by a valid court order, or where disclosure is necessary to protect the rights, property, or safety of xpbet or its users.

06Payment and Financial Data Handling

xpbet treats financial data with the highest level of sensitivity. All payment transactions on the platform are processed over encrypted connections. Wallet identifiers (such as your bKash or Nagad number) are stored in tokenised form — meaning we hold a reference token issued by the payment provider , not the actual wallet number itself.

Transaction records are retained for the period specified in Section 08 of this Policy in order to meet financial audit and regulatory compliance requirements. Access to financial data within xpbet is restricted on a strict need-to-know basis and is subject to role-based access controls and internal audit logging.

07Cookies and Tracking Technologies

xpbet uses cookies and similar client-side storage technologies to operate and improve the platform. A cookie is a small text file placed on your device by the website. Cookies do not contain viruses or malicious code and cannot access other files on your device.

Types of Cookies We Use

• Essential cookies — required for core platform functions such as maintaining your login session, remembering your language preference, and processing bets. These cookies cannot be disabled without breaking the platform.
• Analytics cookies — collect anonymised data about how players navigate the platform (e.g. which game categories are most visited, average session duration). This data is used in aggregate form to guide product improvements.
• Security cookies — track login attempts, flag unusual session behaviour, and support our fraud detection systems. These are necessary for the safe operation of the platform and cannot be disabled.
• Preference cookies — store your platform settings such as language selection and notification preferences so you do not need to re-enter them on each visit.

You can manage cookie preferences through your browser settings. Please note that disabling non-essential cookies may affect certain platform features. xpbet does not use third-party advertising cookies or cross-site tracking technologies that profile your activity outside of xpbet.app.

08Data Retention

xpbet retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active account data — retained for the full duration of your account's active period and for a minimum of 5 years after account closure to comply with anti-money-laundering record-keeping requirements.
• Transaction records — retained for a minimum of 7 years from the date of each transaction, consistent with financial record-keeping obligations.
• KYC documents — retained for the duration of the account and for 5 years after account closure. Documents submitted in relation to a declined or incomplete verification will be deleted within 30 days of the decision.

After the applicable retention period has expired, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised, aggregated data derived from your account activity may be retained indefinitely for statistical and product improvement purposes.

09Your Data Rights

As a user of xpbet, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected]. We will respond to all valid requests within 30 days.

• Right of access — you may request a copy of all personal data we hold about you, along with information about how it is being used.
• Right to rectification — if any personal data we hold about you is inaccurate or incomplete, you may request that we correct or complete it.
• Right to erasure — subject to our legal retention obligations, you may request the deletion of your personal data. Requests will be honoured once all mandatory retention periods have been satisfied.
• Right to restrict processing — you may ask us to pause the processing of your personal data in certain circumstances, such as while a dispute about its accuracy is being resolved.
• Right to data portability — you may request a machine-readable copy of the personal data you provided to us, so that you can transfer it to another service provider if you choose.
• Right to withdraw consent — where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10Data Security Measures

xpbet employs a multi-layered security framework to protect your personal data from unauthorised access, alteration, disclosure, or destruction. Our security measures include, but are not limited to, the following:

• SSL/TLS encryption for all data transmitted between your device and xpbet servers, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• At-rest encryption for stored sensitive data, including KYC documents, financial records, and account credentials, using industry-standard AES-256 encryption.
• Role-based access controls ensuring that only authorised xpbet personnel with a verified business need can access personal data, with all access logged and subject to regular internal audit.
• Regular security assessments and penetration testing conducted to identify and remediate vulnerabilities in our infrastructure before they can be exploited.

While xpbet implements robust technical and organisational security measures, no system is entirely immune to risk. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, xpbet will notify affected users without undue delay and will take immediate steps to contain and remediate the breach.

11Children's Privacy

xpbet is strictly an adult platform. Our services are not directed at, and are not intended to be used by, individuals under the age of 21. We do not knowingly collect personal data from anyone under 21. If we become aware that personal data has been collected from a person under 21 — whether through a false age declaration during registration or any other means — we will immediately suspend the relevant account, delete all associated personal data, and return any remaining balance to the source payment method.

12Third-Party Links and Services

The xpbet platform may contain references to game providers (such as Pragmatic Play, Evolution Gaming, Spribe, or Ezugi) whose game interfaces operate within our platform environment. While these providers supply the game content and software, the personal data processing described in this Policy is performed by xpbet, not by the game providers directly.

xpbet is not responsible for the privacy practices or content of any external websites or services that are outside our control. If you follow a link to an external site, we encourage you to review that site's own privacy policy before providing any personal information.

13International Data Transfers

xpbet primarily serves players in Bangladesh and stores the majority of user data on servers located in the Asia-Pacific region. In certain circumstances, personal data may be processed by our third-party service providers in other jurisdictions — for example, where a payment processor or fraud prevention service operates data centres outside Bangladesh.

Where personal data is transferred internationally, xpbet ensures that appropriate safeguards are in place — including contractual data processing agreements with each provider — to ensure that your data receives a level of protection consistent with the principles set out in this Policy, regardless of the country in which it is processed.

14Updates to This Privacy Policy

xpbet may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, or platform features. When we make a material change to this Policy, we will notify registered users via the email address associated with their account and post a prominent notice on the platform for a minimum of 14 days before the change takes effect.

Your continued use of xpbet following the effective date of any Policy update constitutes your acceptance of the revised Policy. The date shown at the top of this page reflects the date on which the most recent version became effective. We recommend that you review this Policy periodically to stay informed about how xpbet handles your data.

15Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to how xpbet handles your personal data, please contact our support team by email. Please include your registered mobile number or email address in your message so that we can verify your identity before processing your request.