Xbagee Privacy Policy – How we keep your information safe

1 Introduction & Scope

Xbagee (xbagee.my) places the highest importance on the privacy of its members in Bangladesh. This Privacy Policy is designed so you can clearly understand which of your data is collected, why it is retained, and how it is used.

This policy applies to the Xbagee website, mobile app, and all associated services. By using our services, you agree to this policy. If you do not agree with any part of it, you may stop using the services or contact us directly.

Xbagee believes that in the digital age, the security of personal information is a fundamental right. Everything stated here reflects not just our legal obligations, but our ethical commitment to you.

2 What Information We Collect

Xbagee collects two types of data – information you provide directly, and information generated automatically as you use the site.

3 How the information we collect is used

Xbagee uses collected data solely for specific, legitimate purposes. The key uses are outlined below:

• Account management: Completing registration, verifying login, and securing your account.
• Payment Processing: Processing deposits and withdrawals successfully and maintaining transaction records.
• Fraud & Security: Detecting suspicious activity, preventing multiple accounts, and maintaining platform security.
• Gaming services: Tracking game history, calculating bonus eligibility, and tallying loyalty points.
• Responsible Gaming: Analyzing member gaming patterns to identify problematic behavior and provide appropriate support.
• Customer support: Reviewing issue history to provide faster and more effective assistance.
• Legal Obligation: Meeting the requirements of applicable laws and regulatory authorities.
• Service improvement: Analysing overall usage patterns to improve the platform – without identifying individual users.

Xbagee does not use your information beyond the purposes stated above. If a new use ever becomes necessary in the future, you will be informed in advance.

4 Who your information may be shared with

Xbagee does not sell your data. However, in limited circumstances, certain information may be shared with specific third parties:

• Payment Processors: Only the information required to process transactions is shared with bKash, Nagad, and Rocket. Each of these providers has its own privacy policy.
• Game providers: Only the information necessary to manage game sessions is shared with providers such as Pragmatic Play and Evolution Gaming.
• KYC & Security Services: Trusted third-party services may be used for identity verification purposes.
• Legal Authorities: Information may be disclosed in response to a court order or a lawful request from a legal authority. Where legally permitted, members will be notified in advance.

5 Data protection practices

To keep your data secure, Xbagee uses multiple layers of protection:

• Transmission Encryption: Every connection to the site is encrypted using the TLS 1.3 protocol. If you see https in the URL, your connection is secure.
• Storage Encryption: Sensitive data stored on servers (passwords, payment references) is protected with AES-256 encryption.
• Access Controls: Only designated staff can access specific data as required by their role. All access is logged.
• Regular audits: A full system audit is conducted annually by an independent cybersecurity auditor.
• Data breach response plan: In the event of a data breach, our policy is to notify affected members within 72 hours.
• Two-factor verification: If a suspicious login is detected on your account, additional security is enforced via SMS verification.

That said, no one can guarantee 100% security on the internet. Keep your account password strong and never share it with anyone.

6 Cookie Policy

Cookies are small files stored in your browser. Xbagee uses cookies to enhance your experience. Types of cookies:

Optional cookies can be disabled at any time through your browser settings or the site's cookie manager. Disabling cookies may limit certain features, but core services will continue to function.

7 Data Retention Period

Xbagee retains your data only for as long as necessary. Specific retention periods:

• Active accounts: All information is retained for as long as the account remains active.
• Financial Transaction Records: Retained for up to 5 years after the last transaction to meet legal obligations.
• Gaming Logs: Retained for up to 1 year after the last game for dispute resolution purposes.
• Support conversations: Retained for up to 3 years after resolution.
• Cookie Data: 30 days to 1 year, depending on type.
• Closed accounts: Retained for 5 years after account closure for legal compliance, then permanently deleted.

Once the retention period expires, data is automatically and permanently deleted or anonymised.

8 Your Data Rights

Every member of Xbagee has the following rights over their own data:

9 Children's and minors' data

Xbagee's services are intended for users aged 18 and above only. Data from minors is never collected or retained.

If a parent or guardian discovers that their child has created an account on Xbagee, they should contact support@xbagee.my immediately. The account will be closed without delay and all associated data will be deleted.

If a user is found to be a minor, all associated account data will be permanently deleted within 7 business days.

10 Privacy Policy Updates

Xbagee may update this policy due to business changes or legal requirements. Before any changes take effect:

• For significant changes, a notice will be sent to your registered email at least 7 days in advance.
• The "Last Updated" date at the top of the page will be revised.
• Continued use of the site after an update is considered acceptance of the revised policy.
• If you do not agree to the updated policy, you may close your account and notify our support team.

This Privacy Policy was last updated January 2026Updated on.

11 Data-Related Enquiries

For any questions, requests, or complaints regarding your data, please contact our Data Protection team directly:

To request data deletion, send an email with "Data Deletion Request" in the subject line and include your registered mobile number. Once your identity is verified, action will be taken within 30 days.