Your Privacy & Data Protection Policy

xx67 collects personal information from users in a number of ways, both directly (when you provide it to us during registration or account management) and automatically (through the normal operation of the platform and its technical infrastructure). We collect only the data that is necessary, proportionate, and relevant to the purposes described in this Privacy Policy.

Registration Data: When you create an xx67 account, we collect your full name, date of birth, email address, phone number, and a username and password of your choosing. This information is required to create and manage your account, verify your identity, and comply with age-verification obligations. Providing inaccurate registration data is a breach of the xx67 Terms & Conditions.

Identity Verification (KYC) Data: In order to process withdrawals and comply with responsible gaming obligations, xx67 may request copies of government-issued identification documents such as your National Identity Card (NID), passport, or driving licence. We may also request proof of address in the form of a utility bill or bank statement issued within the past three months.

Financial Data: When you make a deposit or withdrawal, we collect transaction-related information including your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank), transaction reference numbers, and deposit and withdrawal amounts in Bangladeshi Taka (৳). We do not store full payment card numbers — card transactions are processed through PCI-DSS compliant third-party payment gateways.

Gameplay and Betting Data: We record your betting and gaming activity on the xx67 platform, including games played, bet amounts, wager outcomes, bonus usage, session duration, and betting history. This data is used for account management, dispute resolution, responsible gaming monitoring, and platform improvement.

Technical and Device Data: We automatically collect technical data when you access xx67, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and pages visited. This data is used for security monitoring, fraud prevention, and platform analytics.

Communications Data: When you contact xx67 via live chat, email, or any other support channel, we retain records of that correspondence, including the content of messages, timestamps, and the resolution of any issues raised.

xx67 uses the personal data we collect for specific, legitimate purposes. We do not use your data for purposes that are incompatible with the reasons for which it was originally collected. The primary purposes for which xx67 processes personal data are as follows:

• Account Management: To create, maintain, and administer your xx67 player account, process your deposits and withdrawals, and manage bonuses and promotions on your behalf.
• Identity and Age Verification: To confirm that you are who you say you are, that you are aged 18 or above, and that you are not a self-excluded individual or a person on any applicable restricted-persons list.
• Payment Processing: To facilitate deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank) and to maintain accurate financial records in Bangladeshi Taka (৳).
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and other prohibited conduct on the xx67 platform.
• Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behaviour, to enforce self-exclusion and deposit limit settings, and to provide targeted responsible gaming interventions where appropriate.
• Legal and Regulatory Compliance: To fulfil our obligations under applicable anti-money-laundering (AML) regulations and to respond to lawful requests from regulatory or law enforcement authorities.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance via our live chat and email support channels.
• Platform Improvement: To analyse aggregated usage data, improve the xx67 product offering, personalise your experience, and test new features.
• Marketing Communications: Where you have opted in to receive promotional communications, to send you information about xx67 bonuses, seasonal promotions (such as BPL season offers, Eid specials, and Pohela Boishakh promotions), and new game announcements. You may opt out of marketing communications at any time by contacting support.

xx67 relies on the following legal bases for processing personal data: (a) the performance of a contract (account and payment management); (b) legitimate interests (fraud prevention, platform security, responsible gaming monitoring); (c) legal obligation (AML compliance, regulatory reporting); and (d) consent (marketing communications, non-essential cookies).

xx67 does not sell your personal data to third parties. We do not trade, rent, or otherwise commercially exploit your personal information. However, in order to operate our platform and fulfil our legal obligations, we share certain data with the following categories of carefully selected third parties:

Payment Service Providers: When you make a deposit or request a withdrawal, your transaction data is shared with the relevant payment service provider (such as bKash, Nagad, Rocket, Upay, Visa/Mastercard networks, Dutch-Bangla Bank, or BRAC Bank) to the extent necessary to process that transaction. Each payment partner operates under its own privacy and data security policies.

Identity Verification Partners: To fulfil our KYC obligations, we may share identity document data with third-party identity verification services. These partners are bound by strict data processing agreements and may not use your data for any purpose other than identity verification on behalf of xx67.

Game Software Providers: The games available on the xx67 platform are provided by licensed international game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and PG Soft. When you play a game provided by one of these studios, limited technical and gameplay data (such as session identifiers and bet outcomes) may be shared with the provider for game auditing, RNG certification, and technical support purposes.

Fraud and Security Services: We work with specialist fraud detection and cybersecurity providers who analyse technical and behavioural data (such as IP addresses and device fingerprints) to identify and prevent suspicious activity on the platform.

Regulatory and Law Enforcement Authorities: xx67 is obligated to disclose personal data to competent regulatory or law enforcement authorities when required by applicable law, including in connection with AML investigations, court orders, or other lawful demands. We will notify you of any such disclosure where we are legally permitted to do so.

Business Transfers: In the event that xx67 undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such change and of any choices you may have regarding your data at that time.

xx67 uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and support our security infrastructure. A cookie is a small text file placed on your device by a web server. Cookies cannot execute programs or transmit viruses to your device.

Essential Cookies: These cookies are strictly necessary for the xx67 platform to function. They include session authentication tokens that keep you logged in during your visit, CSRF protection tokens, and load-balancing identifiers. You cannot opt out of essential cookies while using the xx67 platform.

Analytics Cookies: We use analytics cookies to understand how users navigate the xx67 platform — which pages are visited most, how long sessions last, and which features are used most frequently. This data is aggregated and anonymised before analysis. Analytics cookies are set with your implicit consent through continued use of the platform.

Preference Cookies: These cookies remember your settings such as your preferred language, display preferences, and previously selected payment methods, making return visits to xx67 faster and more convenient.

Security Cookies: xx67 uses cookies to support fraud detection and account security, including device fingerprinting cookies that help identify unusual login behaviour or suspicious transaction patterns.

Managing Cookies: You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Note that blocking essential cookies will prevent you from using core xx67 platform features including logging in and placing bets. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

xx67 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security infrastructure includes the following layers of protection:

• TLS 1.3 Encryption: All data transmitted between your device and the xx67 platform is encrypted using TLS 1.3, the current industry standard for secure web communications. The xx67 domain is protected by an SSL certificate, indicated by the padlock symbol in your browser's address bar.
• Encrypted Data Storage: Sensitive data fields including passwords (stored as salted hashes, never in plain text), KYC document images, and financial records are stored using AES-256 encryption on secured servers.
• Access Controls: Access to personal data within the xx67 organisation is restricted on a strict need-to-know basis. Staff members are permitted to access only the data categories required for their specific role. All internal data access is logged and audited.
• Two-Factor Authentication (2FA): xx67 supports and encourages the use of two-factor authentication for player accounts to provide an additional layer of login security beyond username and password.
• Regular Security Audits: The xx67 platform undergoes periodic security assessments and penetration testing by qualified third-party security professionals to identify and remediate potential vulnerabilities before they can be exploited.
• Fraud Monitoring: Our fraud detection systems operate continuously to identify and flag unusual patterns of account access, deposit behaviour, and withdrawal requests for manual review by our security team.

Despite these measures, no platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a risk to your rights and freedoms, xx67 will notify affected users as soon as reasonably practicable and will take all appropriate steps to contain and investigate the breach.

xx67 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting obligations. The following retention periods apply to the main categories of personal data held by xx67:

As a user of the xx67 platform, you hold a number of rights in respect of the personal data we hold about you. xx67 is committed to honouring these rights in a timely and transparent manner. To exercise any of the rights described below, please contact our support team at [email protected]. We will respond to all valid requests within a reasonable timeframe, typically within 30 days of receiving a complete and verified request.

• Right of Access: You have the right to request a copy of the personal data xx67 holds about you. We will provide this information in a structured, commonly used format. There is no charge for a standard access request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account information (such as your email address or phone number) directly through your xx67 account settings. For other corrections, contact our support team.
• Right to Erasure: In certain circumstances, you may request that xx67 delete your personal data. This right is subject to limitations — in particular, we are not able to erase data that we are required to retain by law (such as AML-related financial records and KYC documents) or data that is necessary for the defence of a legal claim.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing on the basis of legitimate interests.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you have the right to receive your personal data in a structured, machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on xx67's legitimate interests. You also have an absolute right to object to your data being used for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent (for example, for marketing communications or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before the withdrawal.

Verification of Identity: To protect your personal data, xx67 will verify your identity before processing any access, rectification, or erasure request. We may ask you to confirm your registered email address and provide additional information to confirm your identity.

xx67 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When a material change is made to this policy, we will update the effective date displayed at the top of this page and, where appropriate, notify registered users via email or an in-platform notification.

We encourage you to review this Privacy Policy periodically to stay informed about how xx67 handles your personal data. Continued use of the xx67 platform following the posting of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with the revised policy, you should cease using the platform and contact our support team to discuss your options.

Contact for Privacy Matters: If you have any questions, concerns, or requests relating to this Privacy Policy or the way xx67 handles your personal data, please contact our dedicated support team. We are available 24 hours a day, 7 days a week, including Bangladesh public holidays such as Victory Day (December 16), Independence Day (March 26), and Eid.

Contact details (plain text — not clickable links):

• Email: [email protected]
• Support channel: 24/7 live chat available within the xx67 platform
• Response time: Within 30 days for formal data rights requests; within 24 hours for general support queries

This Privacy Policy was last reviewed and updated on 1 January 2026 and applies to all users of the xx67 platform operating in the Bangladesh market.