xv9 Privacy Policy — How We Collect, Use, and Protect Your Data

This Privacy Policy ("Policy") is published by xv9 ("xv9", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at xv9.club. It sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by xv9. This Policy applies to all current and prospective registered players of the xv9 platform, including individuals accessing the platform from any location within Bangladesh or from any other territory where xv9 services are available.

By creating a player account, making a deposit, or otherwise using the xv9 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not consent to the practices described in this Policy, you must not create an account or use the xv9 platform.

This Policy should be read together with the xv9 Terms & Conditions and the Responsible Gaming policy, both of which form part of the overall agreement between you and xv9.

xv9 collects personal data from players through several channels: directly when you register an account or interact with the platform, automatically through technical systems as you browse and play, and occasionally from third-party verification partners as part of our identity and payment screening processes. The categories of personal data we collect are as follows:

Registration and Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth — collected for mandatory age verification to confirm you are 18 years of age or older.
• Bangladeshi National ID (NID) number or passport number — requested at the account verification stage and used solely for identity confirmation purposes.
• Residential address, including city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or other), postal code, and country.
• Mobile phone number — used for account verification, OTP-based two-factor authentication, and critical account communications.
• Email address — used for account notifications, promotional communications (where opted in), and support correspondence.

Financial and Transaction Data

• The mobile wallet number or bank account reference associated with your bKash, Nagad, Rocket, Upay, DBBL, or BRAC Bank transactions — stored in tokenised form only.
• Transaction amounts, timestamps, and reference IDs for all deposits and withdrawals processed through your xv9 account.
• Your account balance history and wagering activity, retained for regulatory compliance and anti-money-laundering (AML) audit purposes.

Technical and Usage Data

• IP address and approximate geographic location derived from IP at the time of each session.
• Device type, operating system, browser type and version, and screen resolution.
• Session duration, pages visited, game titles played, wager amounts per session, and in-platform navigation patterns.
• Referring URL (the page from which you arrived at xv9.club) and exit URL.

Communications Data

• The content of support tickets, live chat transcripts, and email correspondence exchanged between you and the xv9 support team.
• Records of any responsible gaming requests, self-exclusion submissions, or deposit limit adjustments you have made.

xv9 processes personal data only where we have a lawful basis for doing so. The table below maps each processing activity to its specific purpose and the lawful basis on which it rests.

Where processing is based on consent — such as receiving promotional communications — you may withdraw that consent at any time by updating your notification preferences within your account settings or by contacting the support team. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

xv9 does not sell, rent, or otherwise transfer your personal data to any third party for their own commercial marketing purposes. We share personal data only in the limited circumstances described below, and only to the extent necessary for the specific purpose identified.

Game and Technology Providers

The games available on xv9 are supplied by certified third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers receive session tokens and anonymised player identifiers to deliver their game engines. They do not receive your full name, national ID, or payment details unless this is strictly necessary for a specific product feature and explicitly disclosed at the time.

Payment Processing Partners

To process deposits and withdrawals, xv9 shares relevant transaction data — including the amount, currency (BDT), timestamp, and your registered payment reference — with the payment channel operator (bKash, Nagad, Rocket, Upay, DBBL, BRAC Bank, or another designated processor). This sharing is limited to what is necessary to complete the transaction and comply with financial regulations. xv9 does not transmit full NID numbers or passport numbers to payment partners.

Identity Verification Services

Where enhanced identity verification is required — for example, for high-value withdrawal requests or flagged AML checks — xv9 may engage a third-party identity verification service to cross-reference the documents you have provided. These services are bound by strict data processing agreements and are prohibited from using your data for any purpose other than the verification task xv9 has engaged them to perform.

Legal and Regulatory Disclosure

xv9 will disclose personal data to law enforcement, financial intelligence units, or other competent authorities where we are required to do so by a valid legal instrument — such as a court order, statutory notice, or regulatory investigation mandate. In such cases, xv9 will disclose the minimum data required to comply with the lawful request and will, where legally permissible, notify the affected player that a disclosure has been made.

Business Transfers

In the event that xv9 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, player data held by xv9 may be transferred to the acquiring or successor entity as part of that transaction. In such an event, xv9 will notify affected players via their registered email address prior to their data being transferred, and the successor entity will be required to honour the commitments made in this Policy.

xv9 uses cookies and similar technologies (including local storage and session tokens) to operate the platform, remember your preferences, maintain your authenticated session, and understand how players interact with different areas of the site. The following cookie categories are in use on xv9.club:

Strictly Necessary Cookies

These cookies are essential for the xv9 platform to function. They maintain your login session, protect against cross-site request forgery (CSRF), enforce account security controls, and ensure that game sessions load correctly. Strictly necessary cookies cannot be disabled without preventing core platform features from working.

Functional Cookies

Functional cookies remember your preferences such as your preferred language setting, your display preferences within your account dashboard, and your most recently played game category. These cookies improve your experience on xv9 but are not required for core functionality.

Analytics Cookies

xv9 uses first-party analytics to understand which pages and features players use most frequently, how long sessions last, and where players encounter friction in the deposit or withdrawal flow. This data is aggregated and anonymised before being reviewed by the xv9 product team. xv9 does not use Google Analytics or any other third-party analytics service that sends raw player session data to an external provider.

Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most modern browsers allow you to refuse all cookies, accept only certain categories, or delete existing cookies stored on your device. Please note that disabling strictly necessary cookies will impair or prevent your ability to use the xv9 platform. Instructions for managing cookies in common browsers are available in your browser's help documentation.

xv9 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the main categories of data we hold:

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised aggregated data — from which no individual can be identified — may be retained indefinitely for statistical and product improvement purposes.

Data Storage Location

xv9 stores player data on secure servers. All data at rest is encrypted using AES-256 encryption. Data in transit between your device and xv9's servers is protected by TLS 1.3 (Transport Layer Security). Access to production databases containing player personal data is restricted to a limited number of authorised xv9 personnel on a strict need-to-know basis, with all access logged and audited.

xv9 respects your rights over your own personal data. You may exercise any of the following rights at any time by submitting a written request to the xv9 support team at [email protected]. We will respond to all valid requests within 30 calendar days of receipt. In exceptional circumstances involving complex or high-volume requests, we may extend this period by a further 30 days and will notify you of the extension in writing.

• Right of Access: You have the right to request a copy of all personal data that xv9 holds about you, together with information about how it is being processed, the categories of recipients with whom it has been shared, and the retention period applicable to each data category.
• Right to Rectification: If any personal data held by xv9 is inaccurate or incomplete, you have the right to request that it be corrected. You can update certain account details (such as your contact email and address) directly within your account settings without needing to contact support.
• Right to Erasure: You may request that xv9 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other lawful basis applies), or where the data has been processed unlawfully. Please note that where xv9 is required by law to retain certain data — for example, transaction records for AML compliance — we cannot fulfil an erasure request with respect to that specific data until the mandatory retention period has elapsed.
• Right to Restriction of Processing: You may request that xv9 restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of the data, or while an objection to processing is being considered.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), and to transmit that data to another service provider.
• Right to Object: You have the right to object to the processing of your personal data where xv9 relies on legitimate interests as the lawful basis. xv9 will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Marketing Consent: If you have opted in to receive promotional communications from xv9, you may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or by contacting the support team. Withdrawal of marketing consent does not affect the delivery of essential transactional account communications.

xv9 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. While no online platform can guarantee absolute security, xv9's security programme is built around industry-standard best practices and is reviewed regularly.

Technical Controls

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or mobile device and xv9 servers is encrypted in transit using TLS 1.3, the current industry standard. HTTP connections are automatically redirected to HTTPS.
• AES-256 Encryption at Rest: All databases containing personal data, including player profiles and transaction records, are encrypted at rest using AES-256 encryption.
• Payment Tokenisation: xv9 does not store raw bKash wallet numbers, Nagad account credentials, or bank card numbers on its servers. These are replaced with secure tokens at the point of entry and the raw credentials are not accessible to xv9 systems after initial processing.
• Two-Factor Authentication (2FA): Players are offered optional 2FA via OTP to their registered Bangladeshi mobile number. Internal xv9 administrative staff with access to player data are required to use 2FA as a mandatory control.
• Penetration Testing: xv9's platform undergoes periodic security assessments, including vulnerability scanning and penetration testing by qualified security professionals, to identify and remediate weaknesses before they can be exploited.
• Web Application Firewall (WAF): A WAF is deployed in front of all public-facing xv9 infrastructure to block common web application attacks including SQL injection, cross-site scripting (XSS), and distributed denial-of-service (DDoS) attempts.

Organisational Controls

• Access to systems and databases holding player personal data is restricted to xv9 staff who require access to perform their specific job function. Access privileges are reviewed quarterly and revoked immediately upon role change or employment termination.
• All xv9 staff with access to personal data are subject to confidentiality obligations and receive privacy and data security training as part of their onboarding and annual compliance programmes.
• xv9 maintains an incident response plan that is activated in the event of a suspected data breach. Affected players will be notified without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Amendments to This Policy

xv9 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they affect the nature of data collected, the purposes for which it is processed, or the rights available to players — xv9 will notify registered players by email to their registered email address at least 14 calendar days before the revised Policy takes effect. The updated Policy will also be published on this page with a revised "Last updated" date at the top. Continued use of the xv9 platform after the effective date of any amendment constitutes acceptance of the revised Policy.

Contact for Privacy Matters

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by xv9, please contact the xv9 support team in writing at [email protected]. Please mark your email with the subject line "Privacy Request" to ensure it is routed to the appropriate team member promptly.

All privacy-related correspondence is handled in English. The xv9 support team operates 24 hours a day, every day of the year, with average first-response times during peak Bangladesh Standard Time hours (7 PM – 1 AM BST, UTC+6) of under five minutes for live chat and under two hours for email.

Relationship with Other xv9 Policies

This Privacy Policy forms part of the broader set of agreements governing your use of the xv9 platform. It should be read in conjunction with the Terms & Conditions, which governs account and gameplay rules, and the Responsible Gaming policy, which sets out the tools and resources available to players who want to manage their gambling activity. In the event of any conflict between this Policy and the Terms & Conditions on a matter relating to personal data, this Privacy Policy shall prevail.