Privacy Policy xx68 – Your Data Rights & Protection

This Privacy Policy is issued by xx68 and applies to all individuals who use, register with, or interact with the xx68 platform via xx68.ws, the mobile app, or any other official xx68 service channel.

Xx68 is an online gambling platform operating in the Malaysian market, offering services including Sports Betting on the Malaysia Super League and EPL, Live Casino, poker, online slots, 4D and Toto lottery, and a wide range of other games. In operating these services, we are required to collect and process certain personal data to ensure the platform functions safely and effectively.

This policy is formulated to comply with Personal Data Protection Act 2010 (PDPA) Malaysia and global data protection industry best practices. By registering for or using the xx68 platform, you agree to the collection and use of data as described in this document.

Xx68 collects your personal data through three main channels: information you provide directly during registration and platform use, data collected automatically as you use the platform, and in some cases, data received from legitimate third parties.

2.1 Data You Provide Directly

2.2 Automatically Collected Data

• IP address and approximate location data (state/city)
• Device type, operating system, and browser version
• Platform activity history – games played, bets placed, session duration
• Log data including access times, pages visited, and in-app actions
• Cookie and other tracking technology data (see Section 8 for more information)

Xx68 uses collected personal data solely for legitimate and necessary purposes in operating the platform. Below is the full list of data usage purposes:

• Managing member accounts – registration, login, profile management, and account security
• Processing financial transactions – deposits via Touch 'n Go eWallet, GrabPay, DuitNow, FPX Maybank2u, FPX CIMB Clicks, Boost, ShopeePay; and withdrawal processing
• Verifying identity and age – ensuring only eligible individuals (aged 21 and above) access the platform
• Providing customer support – resolving complaints, responding to enquiries, and assisting with technical issues
• Fraud detection and security – monitors suspicious activity and protects all members from unlawful conduct
• Fulfilling legal obligations – including anti-money laundering (AML) requirements
• Improving our services – analysing platform usage to improve the user experience
• Account-related communications – security notifications, transaction confirmations, and important updates

xx68 does not sell, rent, or trade members' personal data to any third party for marketing or commercial purposes. This is an absolute policy with no exceptions.

However, in the course of operating our services, there are limited situations where xx68 may need to share certain data with specific parties:

4.1 Payment Service Providers

To process deposits and withdrawals, xx68 needs to share the necessary transaction details with payment providers such as e-wallet platforms and banks via FPX. Data shared is kept to a minimum – only what is required to complete the relevant transaction.

4.2 Technical Service Providers

Xx68 uses third-party service providers for certain technical functions such as server infrastructure and platform analytics. All such providers are bound by strict data protection agreements and are prohibited from using data for any purpose beyond what has been specified.

4.3 Legal Requirements

Xx68 will disclose personal data where required by a valid court order, an investigation by a Malaysian statutory authority, or to meet legal obligations relating to anti-money laundering. In such circumstances, xx68 will notify the relevant members if permitted by law to do so.

Xx68 invests seriously in security infrastructure to protect the personal and financial data of all members. The following are the layers of protection we have in place:

Despite all these measures, no system is 100% breach-proof. In the event of a data breach involving your information, xx68 is committed to notifying you within 72 hours after the incident has been identified, and to take immediate action to contain any damage.

Xx68 does not retain your personal data for longer than necessary. The data retention schedule is as follows:

Once the retention period expires, data is permanently deleted or fully anonymised so it can no longer be linked to any individual.

As an xx68 member, you have the following rights regarding your personal data, in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA):

Xx68 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Cookies are small text files stored on your device when you visit the xx68 platform.

8.1 Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as maintaining login sessions and security. These cookies cannot be disabled without affecting platform functionality.
• Analytics Cookies: Helps us understand how members use the platform so we can improve it. Data is collected in aggregate form and does not directly identify individuals.
• Preference Cookies: Saves your preferences such as language and display settings for a more convenient experience on your next visit.

You can manage cookies through your browser settings. However, disabling essential cookies may affect your ability to log in and use the xx68 platform fully.

Member financial data is held to the strictest protection standards within the xx68 security ecosystem. Information relating to your payment methods – whether Touch 'n Go eWallet, GrabPay, DuitNow, FPX via Maybank2u or CIMB Clicks, Boost, or ShopeePay – is handled under rigorous security protocols:

• Xx68 never stores card numbers, e-wallet passwords, or bank account PINs on our servers
• All transactions are processed through payment gateways that comply with industry security standards
• Bank account numbers and e-wallet details are stored in encrypted format with strictly limited access
• Every withdrawal request goes through a multi-layer verification process before it is processed
• For withdrawals exceeding RM5,000, additional identity verification is required as a security measure

Xx68 actively takes steps to prevent underage individuals from accessing the platform. Our platform is not intended for children or individuals under the age of 21.

Should xx68 identify that personal data belonging to a minor has been collected without appropriate consent, we will immediately take the following steps:

• Suspending the relevant account immediately
• Permanently deleting all personal data belonging to that individual from our systems
• Refunding any existing deposits to the original payment method
• Reporting incidents to the relevant authorities where deemed necessary

Parents and guardians who suspect their child has registered on xx68 without permission are urged to contact us at support@xx68.ws immediately.

Xx68 reserves the right to amend this Privacy Policy at any time in response to changes in law, industry practices, or operational requirements. We are committed to keeping members informed of any material changes:

• Notice of material amendments will be sent to your registered email at least 14 days before taking effect
• In-app notifications on xx68 will be displayed to all active members
• The date of the latest update will always be displayed at the top of this document
• Previous versions of the Privacy Policy are archived and available upon request by any member

Continued use of the xx68 platform after the effective date of any amendment will be considered acceptance of the updated Privacy Policy. If you do not agree, please close your account before the effective date and contact us to request data deletion.

For any questions, concerns, or requests relating to this Privacy Policy and your personal data, you may contact xx68 through the following channels:

You also have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia if you believe that xx68 has not processed your data in accordance with the Personal Data Protection Act 2010.