xbat Privacy Policy

1Introduction and Scope

This Privacy Policy describes how xbat ("xbat", "we", "us" or "our") collects, uses, stores, shares and protects personal data relating to individuals who register for or use the xbat online casino and sports betting platform at https://xbat.one (the "Platform"). By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

This Policy applies to all players using the Platform from Bangladesh and any other location. It covers data collected via the website, customer support channels, and any xbat promotional activities. This Policy should be read alongside our Terms and Conditions, which are incorporated herein by reference.

2What Personal Data We Collect

xbat collects the following categories of personal data, depending on the nature of your interaction with the Platform:

3How We Use Your Personal Data

xbat processes personal data only where a lawful basis exists. The following sets out the primary purposes for which your data is used:

• Account creation, identity verification and KYC compliance — necessary to fulfil our contractual obligations to you and to comply with applicable law.
• Processing deposits, withdrawals and payment method verification — required to perform the financial services you have requested.
• Platform security, fraud detection and prevention — we monitor account activity to protect you and the integrity of the Platform.
• Responsible gaming monitoring — we use gameplay data to identify players who may be exhibiting problematic gambling behaviour and to offer appropriate interventions.
• Customer support — to resolve queries, complaints and disputes you raise with the xbat support team.

4Sharing Your Personal Data

xbat does not sell, rent or trade your personal data to third parties. We share personal data only in the following limited circumstances, and only to the minimum extent necessary:

• Payment processors and mobile wallet operators (bKash, Nagad, Rocket, Upay and affiliated bank partners) — to process your deposits and withdrawals securely.
• Identity verification service providers — to perform KYC checks and age verification as required before withdrawal processing or at any time under our compliance obligations.
• Game software providers (including Evolution Gaming, Pragmatic Play, Spribe, Ezugi and NetEnt) — limited technical data may be shared to enable game delivery, RTP auditing and malfunction resolution.
• Law enforcement, regulatory authorities or courts — where xbat is legally obligated to disclose information in response to a valid legal demand, court order or regulatory enquiry.

5Data Retention

xbat retains personal data only for as long as is necessary to fulfil the purposes set out in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

• Account and identity data: retained for the duration of the active account plus a minimum period of 5 years following account closure, to meet anti-money-laundering record-keeping obligations.
• Financial transaction data: retained for a minimum of 5 years from the date of each transaction, as required for financial compliance and dispute resolution purposes.
• Customer support communications: retained for 3 years from the date of the last communication, to enable resolution of any related disputes that arise after closure.
• Technical and gameplay data: retained for up to 2 years from collection for analytics and responsible gaming purposes, unless a longer period is required for an ongoing dispute or investigation.

6Cookies and Tracking Technologies

xbat uses cookies and similar tracking technologies to operate the Platform, enhance your experience, and gather analytics data. Cookies are small text files stored on your device. We use the following categories of cookies: (a) Strictly necessary cookies — essential for the Platform to function, including session management and security tokens. These cannot be disabled. (b) Analytics cookies — used to understand how players navigate the Platform, which pages are visited most frequently, and where errors occur. This data is aggregated and anonymised. (c) Preference cookies — used to remember your language preference, theme settings and notification preferences. You can manage analytics and preference cookies via the settings panel available on the Platform. Disabling analytics or preference cookies will not affect your ability to use the Platform's core features.

xbat does not use advertising or cross-site tracking cookies. We do not share cookie data with advertising networks, social media platforms or data brokers.

7Data Security

xbat implements a range of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include:

• SSL/TLS encryption on all data transmitted between your device and xbat's servers, ensuring that your login credentials, personal data and payment information cannot be intercepted in transit.
• Encrypted storage of sensitive data at rest. Passwords are stored as salted cryptographic hashes and are never accessible in plain text by xbat staff or systems.
• Strict access controls ensuring that personal data is only accessible to xbat staff who have a legitimate operational need to view it, with access logs maintained for audit purposes.
• Regular security assessments and penetration testing of the Platform's infrastructure to identify and remediate vulnerabilities before they can be exploited.
• In the event of a personal data breach that poses a risk to your rights, xbat will notify affected players promptly and take all reasonable steps to mitigate the impact of the breach.

8Marketing Communications

xbat sends promotional emails, SMS messages and in-platform notifications only to players who have explicitly opted in to receive marketing communications at the time of registration or subsequently via account settings. If you have opted in, you may receive communications about new game releases, seasonal promotions (such as Eid, Pohela Boishakh and BPL season offers), deposit bonuses, and responsible gaming reminders.

You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your account settings or by contacting xbat customer support. Opting out of marketing will not affect your ability to receive transactional communications related to your account, such as deposit confirmations, withdrawal notifications and security alerts.

9Your Privacy Rights

As an xbat player, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team at [email protected]. xbat will respond to all valid requests within a reasonable timeframe.

• Right of access — you may request a copy of all personal data xbat holds about you, along with information about how it is used and with whom it has been shared.
• Right to rectification — if any personal data xbat holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations xbat is required to comply with.
• Right to restriction of processing — in certain circumstances you may request that xbat restricts the processing of your personal data while a dispute or verification request is pending.
• Right to object — where xbat processes your data on the basis of legitimate interests, you have the right to object to such processing. xbat will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

Please note that exercising some of these rights may affect your ability to continue using the Platform. For example, a request to erase all personal data will necessarily result in account closure, as xbat cannot operate an account without the minimum data required for KYC compliance.

10Changes to This Privacy Policy

xbat reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable law. When material changes are made, we will update the Last updated date at the top of this page and, where practicable, notify registered players by email or via a prominent in-platform notice.

Your continued use of the xbat Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically so that you remain informed about how your data is handled.

11Contact and Privacy Queries

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, want to report a privacy concern, or need to contact us for any data-related matter, please reach our customer support team who are available 24/7. We aim to respond to all privacy-related requests within 10 business days.

Privacy support email: [email protected]