🔒 🛡

Data & Privacy

Privacy Policy — How xbate Protects Your Data

Your privacy matters to us. This Privacy Policy explains exactly what personal data xbate collects from players in Bangladesh, why we collect it, how it is stored and protected, and the rights you hold over your own information. We are committed to handling your data with full transparency and in line with applicable data protection standards.

Last Updated: January 2026

Language: English

SSL Encrypted Platform

Bangladesh Players

Scope of This Policy: This Privacy Policy applies to all personal data collected by xbate through its website at xbate.net, its mobile platform, and any communication channels including live chat and email. By registering an account or using the xbate platform, you acknowledge that you have read and understood this policy. If you do not agree with how xbate handles personal data, you should not create or continue to use an account.

Our Core Privacy Commitments

How xbate Safeguards Your Information

Before we dive into the full legal detail, here is a plain-English summary of the six commitments that underpin everything xbate does with your personal data.

Minimal Data Collection

xbate collects only the personal data that is strictly necessary to operate your account, process payments, and comply with legal obligations. We do not collect data for its own sake.

No Data Selling

xbate will never sell, rent, or trade your personal data to third-party marketers or data brokers. Your information is used solely to provide and improve the xbate service.

SSL Encryption

All data transmitted between your device and the xbate platform is protected by industry-standard SSL/TLS encryption. Sensitive data such as payment details and identity documents are encrypted both in transit and at rest.

Your Control

You have the right to access, correct, and request deletion of your personal data at any time. xbate provides clear mechanisms for exercising all data rights described in this policy.

Transparent Sharing

When xbate must share data with third parties — such as payment processors like bKash or Nagad, or identity verification partners — we tell you exactly who receives your data and why.

Defined Retention Periods

xbate does not hold onto your data indefinitely. Retention periods are defined by the type of data and the legal obligations attached to it. Once the retention period expires, data is securely deleted.

1 Data We Collect

xbate collects personal data from you in the following categories. The table below describes each data type, its source, and the legal basis under which it is processed.

Data Category	Examples	Source	Legal Basis
Identity Data	Full name, date of birth, NID/passport number, photograph	Provided by you at registration and KYC verification	Contractual necessity; legal obligation (AML/KYC)
Contact Data	Email address, phone number, residential address (district/city)	Provided by you at registration or account update	Contractual necessity
Financial Data	bKash/Nagad account number, transaction IDs, deposit/withdrawal amounts	Provided by you; generated by platform during transactions	Contractual necessity; legal obligation (AML)
Technical Data	IP address, browser type, device type, operating system, session tokens	Collected automatically when you access the platform	Legitimate interest (security and fraud prevention)
Usage Data	Pages visited, games played, bet history, session duration, click patterns	Collected automatically via cookies and server logs	Legitimate interest (platform improvement); consent (marketing)
Communications Data	Live chat transcripts, support email content, feedback submissions	Provided by you when contacting xbate support	Contractual necessity; legitimate interest (dispute resolution)
Marketing Preferences	Opt-in/opt-out status for promotional emails and SMS	Provided by you during registration or account settings	Consent

xbate does not collect any special categories of sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data — except where explicitly required for identity verification as part of the KYC process mandated by anti-money laundering obligations.

Players from Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, and Mymensingh are all subject to the same data collection practices described in this policy. No region-specific data collection variations apply within Bangladesh.

2 How We Use Your Data

xbate uses the personal data it collects for a defined set of purposes only. We do not repurpose data for uses that are incompatible with the original purpose for which it was collected without first notifying you and, where required, obtaining your consent.

The primary purposes for which xbate processes your data are as follows:

Account creation and management: Processing your registration, verifying your identity and age (18+ requirement), maintaining your account record, and managing login security.
Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, USDT, Visa, and Mastercard; maintaining transaction records for accounting and regulatory compliance.
Service delivery: Providing access to casino games, sports betting markets, live dealer tables, and all other platform features you use on xbate.
Fraud prevention and security: Monitoring accounts and transactions for suspicious activity, detecting duplicate accounts, and preventing money laundering, identity fraud, and chargeback abuse.
Regulatory compliance: Meeting our obligations under applicable anti-money laundering (AML), know-your-customer (KYC), and counter-terrorism financing (CTF) requirements. This includes reporting obligations to relevant financial intelligence authorities where legally mandated.
Responsible gaming: Identifying player behaviour patterns that may indicate problem gambling and enforcing self-exclusion, deposit limits, and cooling-off periods requested by players or triggered by our responsible gaming monitoring systems.
Customer support: Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of communications for quality assurance.
Platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, payment speed, and user experience for all xbate players.
Marketing communications: Sending promotional emails, SMS notifications, or in-platform messages about bonuses, new games, BPL cricket betting offers, and seasonal promotions — only if you have provided explicit consent to receive such communications. You may withdraw consent at any time via your account settings or by contacting [email protected].

Marketing Opt-Out: If you no longer wish to receive promotional communications from xbate, you can unsubscribe at any time by updating your preferences in your account settings or by emailing [email protected]. Opting out of marketing does not affect service-critical communications such as account security alerts, KYC requests, or withdrawal confirmations.

3 Data Sharing & Third Parties

xbate does not sell or rent personal data to any third party. However, to operate the platform effectively and comply with legal obligations, xbate must share certain categories of data with carefully selected third-party partners. All third-party data processors are bound by contractual data processing agreements that require them to handle your data securely and only for the purposes specified by xbate.

The categories of third parties with whom xbate may share your data are:

Payment processors: bKash, Nagad, Rocket, Upay, USDT network validators, Visa and Mastercard issuing banks, and any intermediary payment gateway required to facilitate your transactions. These parties receive only the financial data necessary to process your specific transaction.
Identity verification providers: Third-party KYC and age verification services that help xbate confirm the identity and age of players during registration and at withdrawal milestones. These providers process identity documents and compare them against databases to detect fraud.
Game content providers: Studios such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session identifiers to deliver game content and maintain game integrity. These providers do not receive your name, address, or payment details.
Analytics and fraud detection services: Technology platforms used for detecting fraudulent account activity, bot traffic, and suspicious betting patterns. These services process technical data (IP addresses, device fingerprints, session data) only.
Legal and regulatory authorities: xbate is legally required to disclose certain player data — including transaction records and identity information — to financial intelligence units, law enforcement agencies, or courts when served with a valid legal request or where xbate is under a mandatory reporting obligation related to AML/CTF compliance. xbate will notify affected players of such disclosures where permitted by law.
Professional advisers: Solicitors, accountants, auditors, and insurers who require access to data in the ordinary course of providing professional services to xbate. These parties are bound by strict professional confidentiality obligations.

xbate does not transfer personal data to third parties located outside of the jurisdiction without implementing appropriate data transfer safeguards. Where data is transferred internationally for the purposes of payment processing or KYC verification, xbate ensures equivalent levels of protection are applied through contractual data transfer agreements.

Legal Disclosures: Where xbate is compelled by law to share your data with regulatory or law enforcement authorities, we are sometimes legally prohibited from informing you that such a disclosure has occurred. We will always act in accordance with applicable law in these circumstances.

4 Cookies & Tracking

xbate uses cookies and similar tracking technologies (including pixel tags and session tokens) to operate the platform, remember your preferences, analyse usage patterns, and detect fraudulent activity. The following categories of cookies are used on xbate:

Strictly necessary cookies: These cookies are essential for the basic operation of the xbate platform. They maintain your login session, remember items in your game queue, and ensure security features such as CSRF protection function correctly. These cookies cannot be disabled without breaking core platform functionality.
Performance and analytics cookies: These cookies collect anonymised data about how players navigate the xbate platform — including which pages are visited most frequently, where players spend the most time, and what causes sessions to end. This data is used solely to improve the platform experience. No personally identifiable information is included in analytics data.
Functional cookies: These cookies remember your language preference, display settings, and previously selected payment methods to provide a more convenient experience on return visits. They do not track your activity across other websites.
Security and fraud detection cookies: These cookies record technical identifiers such as device fingerprints, browser characteristics, and session timestamps to help xbate detect and prevent unauthorised access, bot activity, and duplicate account creation.
Marketing and preference cookies: Where you have given explicit consent, xbate may use cookies to track which promotions you have viewed or claimed, and to personalise the bonus offers and game recommendations displayed in your account. You may withdraw consent for marketing cookies at any time via your account settings.

Cookies set by xbate are first-party cookies only — they are associated with the xbate.net domain and do not track your activity across third-party websites. xbate does not use cross-site tracking cookies, advertising network cookies, or social media retargeting pixels.

Most web browsers allow you to control cookie settings through the browser's privacy or settings menu. You can choose to block or delete cookies at any time; however, disabling strictly necessary cookies will prevent you from logging into your xbate account and using core platform features.

When you first access xbate, you will be presented with a cookie preference notice that allows you to accept or decline non-essential cookie categories. You can update your cookie preferences at any time by accessing the privacy settings in your account dashboard.

5 Data Security

xbate takes the security of your personal data extremely seriously. We implement a comprehensive set of technical and organisational security measures designed to protect your data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures include:

SSL/TLS encryption: All data transmitted between your browser or mobile device and the xbate platform is encrypted using TLS 1.2 or higher. The padlock icon visible in your browser's address bar confirms that your connection to xbate is always encrypted.
Encryption at rest: Sensitive data stored in xbate's databases — including identity documents, financial records, and KYC documentation — is encrypted at rest using AES-256 encryption.
Two-factor authentication (2FA): xbate supports two-factor authentication for player accounts and enforces 2FA for all internal staff accounts that have access to player data.
Access controls: Access to player data within xbate's systems is strictly controlled on a need-to-know basis. Customer support staff can only access the data relevant to resolving a player's specific query. Full database access is restricted to a small number of authorised technical personnel.
Penetration testing and security audits: xbate conducts regular internal security reviews and periodic third-party penetration tests to identify and remediate vulnerabilities before they can be exploited.
Incident response: In the event of a data security incident that affects your personal data, xbate will notify affected players promptly and take all necessary steps to contain the incident, assess its impact, and prevent recurrence.

While xbate implements robust security measures, no online platform can guarantee absolute security against all possible threats. You can help protect your own data by using a strong, unique password for your xbate account, enabling two-factor authentication, and ensuring your device's operating system and browser are kept up to date.

If you suspect that your xbate account has been compromised or that your personal data has been accessed without your authorisation, please contact the support team immediately at [email protected].

6 Data Retention

xbate retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Data Type	Retention Period	Reason
Account & Identity Data	Duration of account + 5 years after closure	AML/KYC legal obligation; dispute resolution
Financial Transaction Records	7 years from the date of each transaction	Financial record-keeping and regulatory compliance
KYC Documents	5 years from account closure	Anti-money laundering legal obligation
Betting & Game History	3 years from the date of each session	Dispute resolution; responsible gaming monitoring
Support Communications	2 years from the date of the last communication	Quality assurance; dispute evidence
Marketing Preferences	Until consent is withdrawn or account is closed	Consent management
Technical / Log Data	90 days from collection	Security monitoring; fraud detection

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that means it can no longer be linked back to you as an individual. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and platform improvement purposes.

If you request deletion of your account and personal data before the end of the applicable retention period, xbate will delete all data that we are not legally required to retain and clearly inform you of any categories of data that must be held for the remainder of the mandatory retention period.

7 Your Privacy Rights

As a player on xbate, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our data team at [email protected] with the subject line "Privacy Rights Request". xbate will respond to all verified requests within 30 days.

Right of Access You have the right to request a copy of all personal data xbate holds about you. This is sometimes called a Subject Access Request (SAR). xbate will provide a structured summary of your data free of charge within 30 days of a verified request.

Right to Rectification If any personal data xbate holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (e.g., contact number or address), you can update your details directly in your account settings. For corrections to identity data, please contact support with supporting documentation.

Right to Erasure You have the right to request that xbate delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing. Note that erasure requests cannot override xbate's legal obligations to retain certain data under AML/KYC regulations.

Right to Restrict Processing You have the right to request that xbate restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while you are waiting for a response to an erasure request. Restricted data will be stored but not actively processed.

Right to Data Portability Where xbate processes your data by automated means on the basis of consent or contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) so that you can transfer it to another service provider if you choose.

Right to Object You have the right to object to xbate processing your personal data for direct marketing purposes at any time — and xbate must stop processing for that purpose immediately upon receipt of a valid objection. You may also object to processing carried out on the basis of legitimate interests, in which case xbate will review whether those interests are overridden by your rights.

Rights Related to Automated Decision-Making xbate uses automated systems for fraud detection and responsible gaming monitoring. Where such automated processing produces a decision that significantly affects you (for example, account suspension triggered by automated fraud detection), you have the right to request human review of that decision by contacting [email protected].

To protect your privacy, xbate will verify your identity before processing any privacy rights request. You may be asked to confirm your registered email address, phone number, or provide a copy of your identity document. This verification step is necessary to prevent unauthorised third parties from accessing or deleting your data.

8 Policy Updates & Contact

xbate reviews and updates this Privacy Policy periodically to reflect changes in data protection law, platform functionality, payment partner relationships, and operational practices. When material changes are made, xbate will notify registered players via email to their registered address and display a prominent notice on the xbate platform for a period of at least 14 days following the update.

The date at the top of this policy ("Last Updated: January 2026") indicates when the most recent version was published. We recommend saving or bookmarking this page and reviewing it at least once every six months to stay informed of how your data is handled.

If you continue to use the xbate platform after a policy update has been published and the 14-day notice period has elapsed, that continued use constitutes your acceptance of the updated policy. If you do not accept a material change to the policy, you have the right to close your account by contacting [email protected] before the notice period ends.

Contact details for privacy-related enquiries:

Email: [email protected] — please use the subject line "Privacy Enquiry" or "Privacy Rights Request"
Live Chat: Available within the xbate platform after login, 24 hours a day, 7 days a week
Response Time: Privacy rights requests acknowledged within 5 business days and fulfilled within 30 calendar days (Bangladesh Standard Time, UTC+6)

We Are Here to Help: If you have any concern about how xbate handles your personal data — however small — please do not hesitate to reach out. We treat all privacy enquiries seriously and aim to resolve them transparently and promptly. Your trust is the foundation of the xbate platform.

Ready to Play at xbate with Confidence?

Now that you understand how xbate protects your personal data, explore everything the platform has to offer — from live cricket betting and slots to Teen Patti and live casino tables.

View FAQ Responsible Gaming About Us