xz77 Privacy Policy

Introduction

xz77 ("we", "us", "our") is an online betting and casino platform accessible at xz77.io, providing cricket sportsbook, live casino, slots, and related gambling entertainment services primarily to players located in Bangladesh. This Privacy Policy describes, in formal English, how xz77 collects, uses, stores, shares, and protects the personal data of all individuals ("you", "the player") who interact with the xz77 platform, including visitors who browse xz77.io without registering an account.

This Privacy Policy forms part of the xz77 Terms & Conditions and must be read in conjunction with that document. Defined terms used in the Terms & Conditions and not separately defined here carry the same meaning in this Privacy Policy.

xz77 is committed to handling all personal data with transparency, integrity, and in accordance with broadly recognised data protection principles. While Bangladesh does not yet have a comprehensive standalone data protection statute directly equivalent to the EU General Data Protection Regulation ("GDPR"), xz77 voluntarily aligns its data practices with GDPR principles as a baseline standard of care for all players, including those based in Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh, and Cox's Bazar.

If you have any questions about this Privacy Policy or about the way xz77 handles your personal data, please contact the xz77 support team. Contact details are provided in Section 15 of this document.

Data Controller

For the purposes of this Privacy Policy, xz77 acts as the data controller in respect of all personal data collected from players who use the xz77 platform. As data controller, xz77 determines the purposes for which personal data is processed and the means by which that processing is carried out.

Third-party service providers engaged by xz77 — including payment processors (such as bKash, Nagad, and Rocket), game software studios (such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, and Microgaming), and identity verification partners — act as data processors on xz77's behalf. These processors are contractually bound to process personal data only on xz77's instructions and in accordance with appropriate data security standards. xz77 remains responsible to you for ensuring that such processors handle your data in compliance with this Privacy Policy.

If at any time xz77 engages a new third-party data processor that will have access to a category of player personal data not previously shared with any processor, xz77 will update this Privacy Policy to reflect that arrangement before the processing commences.

Data We Collect

xz77 collects the following categories of personal data from players. The specific data points collected depend on the nature of your interaction with the xz77 platform and whether you have completed the full account registration and KYC verification process.

xz77 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data (beyond the context of responsible gaming self-assessments voluntarily submitted by the player), or biometric data, except where a player voluntarily provides such information in a support communication.

How We Collect Your Data

xz77 collects personal data through the following channels:

• Direct submission: Data you provide actively during account registration, KYC document upload, deposit and withdrawal requests, live chat support sessions, and email correspondence with the xz77 team.
• Automated technical collection: Data collected automatically when you visit xz77.io or use the xz77 platform, including IP address logging, browser fingerprinting for fraud detection, session activity tracking, and cookie-based behavioural analytics (see Section 8 — Cookies & Tracking for full details).
• Payment provider data sharing: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a Bangladesh bank transfer, the relevant payment provider shares transaction confirmation data with xz77 sufficient to credit your BDT wallet or confirm a successful withdrawal. xz77 does not have direct access to your mobile banking PIN or password.
• Identity verification partners: Where xz77 engages a third-party KYC verification service to cross-check the authenticity of the identity documents you submit, that service may return a verified or unverified status, a risk score, or supplementary identity data sourced from public databases.
• Game studios: Third-party game providers (e.g., Pragmatic Play, Evolution Gaming, Spribe) share game round results and session data with xz77 via their platform APIs to enable accurate balance crediting, bonus tracking, and dispute investigation.

How We Use Your Data

xz77 uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your xz77 account, maintain your player profile, process your login credentials, and manage your BDT wallet balance.
• Identity and age verification: To verify that you are at least 21 years of age and that the personal details on your account are accurate, in fulfilment of xz77's responsible gaming obligations applicable to Bangladesh players.
• Payment processing: To process deposits made via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other supported Bangladesh payment methods, and to process withdrawal requests to your verified payment account in BDT.
• Gameplay and betting services: To operate the xz77 casino, sportsbook (cricket BPL, IPL, T20 World Cup, football, kabaddi, hockey), live casino, and slots platforms; to record game round results; and to settle bets accurately.
• Bonus and promotions administration: To track your eligibility for xz77 welcome bonuses, reload offers, free spins, and seasonal promotions (e.g., Eid promotions, Pohela Boishakh offers, BPL betting specials) and to ensure that wagering requirements are correctly applied.
• Customer support: To respond to your queries, complaints, and dispute submissions via live chat and email, and to maintain records of those communications as required for quality assurance and dispute resolution.
• Fraud prevention and security: To detect and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and any other prohibited conduct described in the xz77 Terms & Conditions. This includes automated risk-scoring of account activity based on Technical Data and Gaming Data.
• Responsible gaming: To monitor your gameplay patterns for signs of potential problem gambling behaviour, to administer self-exclusion and deposit limit tools you have activated, and to contact you if our responsible gaming monitoring systems flag a concern about your account.
• Legal and regulatory compliance: To comply with anti-money-laundering obligations, to respond to lawful requests from competent authorities, and to maintain financial records as required by applicable law.
• Marketing communications (opt-in only): To send you promotional emails, SMS messages, or in-platform notifications about xz77 bonuses, new games, and seasonal offers — but only where you have explicitly opted in to receive such communications during registration or subsequently via your account settings. You may opt out at any time by contacting xz77 support or using the unsubscribe link in any marketing email.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the xz77 user interface, game selection, and payment processing speed for the Bangladesh market.

Legal Basis for Processing

In accordance with GDPR-aligned principles voluntarily adopted by xz77, all personal data processing is grounded in one or more of the following lawful bases:

• Contractual necessity: Processing required to perform the contract between you and xz77 — specifically, to operate your account, process your deposits and withdrawals in BDT, and deliver the gambling services you have registered to use.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money-laundering regulations, age verification requirements, and financial record-keeping mandates.
• Legitimate interests: Processing necessary for xz77's legitimate interests — including fraud prevention, platform security, bonus integrity, and responsible gaming monitoring — provided those interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given, specific, and informed consent — principally in the context of optional marketing communications. Consent may be withdrawn at any time without detriment to your account standing or access to xz77 services.

Data Sharing & Third Parties

xz77 shares personal data with third parties only in the specific, limited circumstances described below. xz77 does not sell, rent, or exchange your personal data with any third party for advertising, profiling, or data brokerage purposes.

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other payment partners receive only the minimum transaction data necessary to process your deposit or withdrawal (e.g., your registered mobile number, transaction reference, and BDT amount). These providers operate under their own privacy policies and are independently regulated under Bangladesh financial services law.
• Identity verification services: Where a third-party KYC provider is used to authenticate your National ID Card, passport, or other identity documents, the relevant document images and identity data are transmitted securely to that provider solely for the purpose of identity verification. The provider is contractually prohibited from retaining or using your data for any other purpose.
• Game software providers: Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, Microgaming, Habanero, Red Tiger, and other studio partners receive session tokens and anonymised player identifiers necessary to operate their games within the xz77 platform. These providers do not receive your full personal profile, financial data, or Bangladesh residential address.
• Legal and regulatory authorities: xz77 will disclose personal data to competent courts, law enforcement agencies, or regulatory bodies where required to do so by applicable law, a valid court order, or in connection with the investigation of serious fraud or money laundering. xz77 will, where legally permitted, notify the affected player before such disclosure is made.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of xz77's business assets, player personal data may be transferred to the acquiring entity as part of that transaction. In such circumstances, xz77 will notify affected players in advance and the acquiring entity will be required to honour the commitments in this Privacy Policy.

Cookies & Tracking Technologies

xz77 uses cookies and similar web tracking technologies on the xz77.io website to provide a functional, secure, and personalised experience for Bangladesh players. The following categories of cookies are in use:

• Strictly necessary cookies: Required for core platform functionality, including session management (keeping you logged in across pages), BDT wallet balance display, game loading, and payment flow state. These cookies cannot be disabled without rendering xz77 non-functional. No consent is required for strictly necessary cookies.
• Security cookies: Used by xz77's fraud detection and bot-prevention systems to distinguish human players from automated scripts. These include CSRF tokens and device fingerprinting identifiers used to flag anomalous login attempts.
• Analytics cookies: Used to collect anonymised data about how Bangladesh players navigate xz77.io — including which pages are visited most frequently, how long players spend on the casino lobby versus the sportsbook, and which payment method selection screen causes the most drop-off. This data is used to improve the xz77 platform and is not linked back to individual player identities. Analytics cookies require your consent, which you may provide or withdraw via the xz77 cookie preference centre.
• Preference cookies: Store your platform preferences such as your default deposit method (e.g., bKash vs. Nagad), language display setting, and responsible gaming reminder intervals. These improve convenience and are set only after you have interacted with the relevant platform settings.

xz77 does not use third-party advertising or retargeting cookies. No xz77 player data is shared with advertising networks such as Google Ads, Meta Ads, or programmatic display networks via cookie-based tracking mechanisms.

You may manage your cookie preferences at any time via the cookie preference centre accessible in the xz77.io footer, or by configuring your browser to block or delete cookies. Note that blocking strictly necessary cookies will impair your ability to use core xz77 features including login and payment processing.

Data Retention

xz77 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

• Account and identity data: Retained for the duration of your active xz77 account and for a minimum of five (5) years following account closure, in compliance with anti-money-laundering and financial record-keeping obligations.
• Transaction data (deposits and withdrawals in BDT): Retained for a minimum of five (5) years from the date of each transaction.
• KYC documents (ID copies, proof of address): Retained for the duration of the active account relationship and for five (5) years post-closure. Original document images are stored in encrypted form and accessible only to authorised compliance personnel.
• Gaming data (bet history, game round logs): Retained for a minimum of ninety (90) days for dispute resolution purposes. Aggregated, anonymised gaming statistics may be retained indefinitely for platform improvement analysis.
• Customer support communications: Retained for three (3) years from the date of the last communication in a support thread, to facilitate escalation handling and quality assurance review.
• Marketing consent records: Retained for the duration of your active marketing opt-in status, plus three (3) years after you withdraw consent, as evidence of the consent history.
• Technical/session data (IP logs, device data): Retained for twelve (12) months from the date of each session, for security monitoring and fraud investigation purposes.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any individual player. Where data must be retained beyond the standard period due to an ongoing dispute, regulatory investigation, or legal proceeding, xz77 will retain the relevant data until that matter is fully resolved.

Your Data Rights

As an xz77 player, you hold the following rights in respect of the personal data that xz77 processes about you. To exercise any of these rights, contact the xz77 support team using the details in Section 15:

• Right of access: You may request a copy of all personal data that xz77 holds about you. xz77 will provide this in a structured, commonly used, machine-readable format within a reasonable timeframe.
• Right to rectification: If any personal data held by xz77 is inaccurate or incomplete, you have the right to request that it be corrected or supplemented. You may update certain account details (such as your contact number or residential address) directly via your xz77 account settings.
• Right to erasure ("right to be forgotten"): You may request that xz77 delete all personal data it holds about you. This right applies where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other lawful basis applies), or where the data has been unlawfully processed. xz77 may decline an erasure request where retention is required by law (e.g., the five-year financial records obligation described in Section 9).
• Right to restriction of processing: In certain circumstances — for example, while a data accuracy dispute is being resolved — you may request that xz77 restrict its processing of your personal data to storage only, pending resolution of the dispute.
• Right to data portability: Where xz77 processes your personal data based on consent or contractual necessity, you may request that your data be provided in a portable format or transferred directly to another service provider where technically feasible.
• Right to object: You may object at any time to xz77 processing your personal data based on legitimate interests (e.g., fraud prevention profiling). xz77 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights, or the processing is required in connection with legal claims.
• Right to withdraw consent: Where xz77 processes your data based on consent — principally for marketing communications — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

Data Security

xz77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• SSL/TLS encryption: All data transmitted between your browser or device and xz77.io is encrypted using industry-standard Transport Layer Security (TLS 1.2 or higher). This applies to login sessions, deposit and withdrawal flows, and KYC document uploads.
• Encryption at rest: Sensitive data stored in xz77's databases — including KYC document files, financial transaction records, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to player personal data within xz77's internal systems is restricted to authorised personnel on a strictly defined need-to-know basis. All internal access is logged and subject to periodic audit.
• Penetration testing: xz77 conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities in its platform infrastructure before they can be exploited.
• Incident response: xz77 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to the rights and freedoms of Bangladesh players, xz77 will notify affected players as promptly as practicable and take immediate remediation steps.
• Employee training: All xz77 personnel with access to player personal data receive data protection training and are bound by confidentiality obligations under their employment or contractor agreements.

While xz77 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are also responsible for protecting your own account: use a strong, unique password for your xz77 account, do not share your login credentials with any third party, and contact xz77 support immediately if you suspect that your account has been accessed without your authorisation.

Children and Minors

xz77 is strictly an adult gambling platform. Access to, or use of, the xz77 platform by any individual under 21 years of age is absolutely prohibited. xz77 does not knowingly collect, store, or process personal data belonging to any individual under the age of 21.

As part of the registration and KYC process, xz77 verifies the age of all players. Any account found to belong to a person under 21 years of age will be immediately closed, all associated deposits returned to the original payment method, and all winnings (including any bonus-derived winnings) forfeited.

If you are the parent or guardian of a minor and you believe that your child has accessed or registered on xz77.io, please contact the xz77 support team immediately at the contact details provided in Section 15. xz77 will investigate and take prompt action to close the account and remove all associated personal data.

xz77 strongly recommends that adults with responsibility for children use available parental control software to restrict access to online gambling websites, in addition to maintaining open conversations about the risks of gambling. Relevant responsible gaming information is available on the xz77 Responsible Gaming page.

Third-Party Links

The xz77 platform may, from time to time, contain references to game providers, payment service names, or sports event organisers that operate their own independent websites or platforms (for example, the websites of Pragmatic Play or Evolution Gaming). This Privacy Policy applies exclusively to data processed by xz77 in connection with the xz77.io platform.

xz77 is not responsible for the privacy practices, data security measures, or content of any third-party website, application, or platform to which reference is made on xz77.io. If you navigate to a third-party website from a reference on xz77, you do so at your own risk and your interaction with that third party is governed by that third party's own privacy policy and terms of service. xz77 encourages you to review the privacy policies of any third-party platforms with which you interact.

Changes to This Privacy Policy

xz77 reserves the right to update, revise, or replace this Privacy Policy at any time. The current version will always be accessible at xz77.io/privacy-policy and the effective date at the top of this page will reflect the date of the most recent revision.

Where a revision constitutes a material change — meaning a change that meaningfully alters the scope of data xz77 collects, the purposes for which it is used, or the rights available to players — xz77 will notify registered Bangladesh players via the contact details held on their account with a minimum of seven (7) days advance notice before the change takes effect.

For non-material changes (such as clarifications of existing practices, corrections of typographical errors, or formatting updates that do not affect substance), xz77 may update this Privacy Policy without prior individual notice. The updated effective date on the page serves as notification of such minor revisions.

Your continued use of the xz77 platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree with any revision, you must cease using the xz77 platform and contact support to request account closure before the revision takes effect.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way xz77 processes your personal data, please contact the xz77 Data & Privacy team using the following details:

• Email: [email protected]
• Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)
• Response Language: English
• Subject Line: Please use "Privacy Request — [Your Username]" in the subject line of any privacy-related email to ensure your request is routed to the correct team promptly.

xz77 is committed to resolving all privacy-related queries and data rights requests in a professional, timely, and transparent manner. All communications received via the above contact details are treated as confidential and handled exclusively by authorised xz77 personnel.

If you are not satisfied with xz77's response to your privacy concern, you may escalate the matter through any applicable dispute resolution mechanism available under the laws of your jurisdiction. xz77 will cooperate fully with any such process.