xx77 Privacy Policy
Your privacy is a fundamental commitment at xx77, not a legal formality. This Privacy Policy explains in plain English exactly what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you hold over your own information as a player on Bangladesh's trusted online casino and cricket betting platform.
Six Privacy Principles at xx77
Before reading the full legal text, here is a plain-English summary of the six core commitments that shape how xx77 handles your personal data.
xx77 (referred to in this policy as "xx77", "we", "us", or "our") operates the online casino and cricket betting platform accessible at xx77.io. xx77 is the data controller in respect of the personal data collected and processed through the platform. As data controller, xx77 determines the purposes and means by which your personal data is processed and is responsible for ensuring that processing activities comply with applicable data protection principles.
The xx77 platform provides services to players located primarily in Bangladesh. Our support team operates on Bangladesh Standard Time (BST, UTC+6), 24 hours a day, seven days a week, and communicates exclusively in English. All data processing described in this Privacy Policy is carried out in accordance with the principles of data minimisation, purpose limitation, transparency, and security.
If you have any questions about this Privacy Policy or about how xx77 handles your personal data, you may contact our Data Support team at any time using the contact details provided in Section 14 of this document.
xx77 collects and processes the following categories of personal data from players and platform visitors:
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, national ID number, selfie photograph | Registration and KYC verification |
| Contact Data | Email address, Bangladeshi mobile number | Registration and account updates |
| Financial Data | bKash / Nagad / Rocket / Upay account numbers, Visa / Mastercard details (last four digits only), transaction history | Deposit and withdrawal processing |
| Account Data | Username, hashed password, account balance, bonus history, wagering activity, game history | Ongoing account usage |
| Technical Data | IP address, device type, browser type and version, operating system, device fingerprint, session timestamps | Each platform session |
| Usage Data | Pages visited, games played, bet amounts, session duration, clickstream data | Each platform session |
| Communication Data | Support chat transcripts, email correspondence, complaint records | When you contact xx77 support |
| Responsible Gaming Data | Deposit limits set, time-out requests, self-exclusion records | When responsible gaming tools are used |
xx77 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, or biometric data for identification purposes (other than where a selfie photograph is required as part of our Know Your Customer process, in which case it is used solely for age and identity verification).
xx77 collects personal data through the following channels:
- Direct collection: Information you provide when you register an account, complete identity verification, make a deposit or withdrawal, contact support, submit a complaint, or update your account settings.
- Automated collection: Technical and usage data collected automatically when you access the xx77 platform, including through cookies, session tracking technologies, device fingerprinting tools, and server-side logging.
- Payment providers: Transaction confirmation data received from payment partners including bKash, Nagad, Rocket, Upay, Visa, and Mastercard when you initiate a deposit or withdrawal.
- Game providers: Bet settlement, game result, and RTP data received from our certified game technology partners including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi for the purpose of account reconciliation and dispute resolution.
- Fraud prevention partners: Risk and device intelligence data received from third-party fraud prevention services used to protect the integrity of the xx77 platform and the security of your account.
xx77 does not purchase personal data lists from third-party data brokers and does not collect data from social media platforms without your explicit consent.
xx77 uses your personal data for the following documented purposes:
- Account management: Creating and maintaining your xx77 account, authenticating your login sessions, and enabling you to access platform features.
- Identity and age verification: Confirming that you are aged 21 or above and that your identity matches the registration information provided, in compliance with our responsible gaming obligations.
- Payment processing: Facilitating BDT deposits and withdrawals via your chosen payment method, reconciling transaction records, and resolving payment disputes.
- Responsible gaming enforcement: Monitoring gaming behaviour for signs of problem gambling, applying deposit limits and self-exclusion restrictions upon request, and enforcing platform-wide responsible gaming standards.
- Fraud and security: Detecting and preventing fraudulent activity, money laundering, duplicate account creation, and unauthorised account access using technical and behavioural analysis.
- Customer support: Responding to your enquiries, resolving complaints, and maintaining records of support interactions for quality assurance purposes.
- Platform improvement: Analysing aggregated and anonymised usage data to identify technical issues, improve game offerings, and enhance the overall player experience.
- Legal compliance: Fulfilling obligations under applicable law, responding to lawful requests from regulatory or law enforcement authorities, and maintaining records required for audit purposes.
- Marketing communications: Sending you promotional offers, bonus notifications, and seasonal campaign updates via email or SMS — but only where you have explicitly opted in to receive such communications. You may opt out at any time by contacting [email protected].
xx77 processes your personal data only where a lawful basis exists for doing so. The primary legal bases relied upon are as follows:
- Contract performance: Processing your identity, contact, financial, and account data is necessary to fulfil the contractual agreement established when you register an xx77 account and accept the Terms & Conditions.
- Legitimate interests: Processing technical, usage, and fraud-related data to protect the security and integrity of the platform, prevent financial crime, and improve platform performance is carried out on the basis of xx77's legitimate interests, balanced against your rights and freedoms.
- Legal obligation: Processing required to comply with applicable laws, respond to lawful regulatory requests, or maintain mandatory records is carried out on the basis of legal obligation.
- Consent: Processing for direct marketing communications is carried out only on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time by contacting [email protected], without affecting the lawfulness of processing carried out prior to withdrawal.
Where xx77 relies on legitimate interests as a legal basis, we carry out a balancing assessment to ensure that our interests do not override your fundamental rights and freedoms. If you wish to obtain further information about any such assessment, please contact us using the details in Section 14.
xx77 does not sell your personal data to any third party. We share your data only in the following limited and necessary circumstances, and only with partners who are bound by contractual data protection obligations:
- Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive only the transaction data necessary to process your deposit or withdrawal. xx77 does not share your gaming history, game preferences, or browsing data with payment partners.
- Game technology providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified studio partners receive pseudonymised session identifiers and bet data strictly necessary to run game sessions, calculate outcomes, and settle results. They do not receive your full identity or payment data.
- Identity verification services: Third-party KYC (Know Your Customer) service providers receive identity documents and selfie photographs solely for the purpose of verifying your age and identity. These providers are contractually prohibited from using your data for any other purpose.
- Fraud prevention services: Device fingerprinting and risk intelligence partners receive technical data for the purpose of detecting fraud and protecting account security. No personally identifiable financial data is shared with these partners.
- Legal and regulatory authorities: xx77 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law or in response to a lawful formal request. xx77 will, where legally permitted, notify affected players of such disclosures.
- Business transfers: In the event that xx77's business or assets are transferred to or acquired by a third party, player data may be transferred as part of that transaction. You will be notified of any such transfer via the email address registered to your account prior to the transfer taking effect.
xx77 uses cookies and similar tracking technologies to maintain session continuity, prevent fraud, analyse platform usage, and improve your experience. Cookies are small data files stored on your device by your browser when you visit xx77.io.
The following categories of cookies are used on the xx77 platform:
| Cookie Type | Purpose | Retention |
|---|---|---|
| Essential | Session management, login state, security tokens. Required for the platform to function. Cannot be disabled. | Session / up to 24 hours |
| Functional | Remembering your language preference, game display settings, and responsible gaming notification states. | Up to 90 days |
| Analytical | Collecting aggregated, anonymised data about page visits, session duration, and feature usage to improve the platform. | Up to 12 months |
| Security | Device fingerprinting data used for fraud detection and duplicate account identification. | Up to 12 months |
You may configure your browser to refuse or delete cookies. However, disabling essential cookies will prevent you from logging in and using the xx77 platform. Disabling functional or analytical cookies will not affect your ability to play games or make transactions, but may affect your user experience.
xx77 does not use third-party advertising cookies or retargeting pixels. No browsing data collected on xx77.io is shared with advertising networks.
xx77 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required to comply with applicable legal obligations. The following indicative retention periods apply:
- Account and identity data: Retained for the duration of your active account relationship with xx77, plus a minimum of five (5) years following account closure to comply with anti-money laundering and financial record-keeping obligations.
- Transaction records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with applicable financial record-keeping requirements.
- Support and complaint records: Retained for three (3) years from the date of the final communication in the relevant support thread.
- Marketing consent records: Retained for the duration of your active marketing consent, plus three (3) years following withdrawal of consent or account closure, as evidence of lawful processing.
- Technical and session data: Retained for twelve (12) months from the date of collection, after which it is aggregated and anonymised or deleted.
- Responsible gaming records: Retained for the duration of any active self-exclusion period, plus five (5) years, to support re-exclusion requests and responsible gaming enforcement.
Upon expiry of the applicable retention period, personal data is either securely deleted using industry-standard data destruction methods or irreversibly anonymised so that it can no longer be linked to you as an individual. Anonymised data may be retained indefinitely for statistical and platform improvement purposes.
xx77 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our key security measures include:
- Transport encryption: All data in transit between your device and xx77.io is encrypted using TLS 1.3, the current industry standard for secure web communications.
- Password security: User passwords are never stored in plaintext. They are processed using a one-way salted cryptographic hashing algorithm. xx77 staff cannot retrieve your password — only a password reset is available if credentials are lost.
- Two-factor authentication: Suspicious login attempts trigger SMS-based two-factor verification to the mobile number registered on your account.
- Access controls: Access to production player data is restricted to a limited number of authorised xx77 personnel on a strict need-to-know basis. All internal data access is logged and audited.
- Infrastructure security: The xx77 platform is hosted on hardened server infrastructure with firewall protection, intrusion detection systems, and regular vulnerability scanning.
- Regular audits: xx77 conducts periodic security audits and penetration testing of its platform and data handling infrastructure.
As a data subject, you hold the following rights in respect of your personal data held by xx77. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". xx77 will respond within 30 calendar days of receiving a valid request.
Your Data Rights at xx77
These rights apply to all personal data xx77 holds about you as a registered player. Submit a request to [email protected] at any time.
If you are a parent or guardian and believe that your child has registered an account on xx77, please contact us immediately at [email protected] with the subject line "Minor Account — Urgent". We will investigate and take immediate action to close the account and delete all associated data without delay. We take our obligations regarding the protection of minors extremely seriously and employ age verification checks at the point of withdrawal for all accounts.
The xx77 platform integrates with a number of third-party technology and service providers in order to deliver a complete gaming experience. While xx77 carefully vets all third-party partners and requires them to maintain appropriate data protection standards, xx77 is not responsible for the independent privacy practices of these third parties.
The key third-party services integrated into the xx77 platform are as follows:
- Game studios and content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified game providers operate their own game engines, which may process pseudonymised session data to render game outcomes. Each provider maintains its own data protection standards as required by their respective certification bodies.
- Payment gateway providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard each operate under their own privacy policies and terms of service. When you initiate a payment transaction, your financial data is transmitted directly to the relevant provider's secure processing environment. xx77 does not store full card or mobile wallet credentials on its own servers.
- Identity verification providers: Our KYC partners process identity documents and verification photographs solely for the purpose of confirming age and identity. These providers are bound by contractual data processing agreements and are prohibited from using your data for any secondary purpose.
- Analytics and performance tools: xx77 may use privacy-respecting, anonymised analytics tools to monitor platform performance and identify technical issues. These tools process only aggregated, non-personally-identifiable data.
xx77 does not embed social media widgets, share buttons, or third-party advertising pixels on its platform. No data collected during your xx77 session is transmitted to social media companies or advertising networks.
If you follow a link from the xx77 platform to any external website (for example, a payment provider's own site), that external site's privacy policy will govern the data practices applicable to your visit there. xx77 has no control over and accepts no responsibility for the content or data practices of any external website.
xx77 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the features and services offered on the platform. The effective date displayed in the hero section of this page will be updated whenever a new version of this Privacy Policy is published.
When material changes are made to this Privacy Policy — that is, changes that significantly affect the way we collect, use, or share your personal data — xx77 will notify registered players by sending an email to the address on file and by displaying a prominent notice on the platform for a minimum of seven (7) days before the changes take effect.
Minor, non-material updates (such as clarifications of existing practices, corrections of typographical errors, or reorganisation of existing content without substantive change) may be made without prior notice. The updated policy will be effective immediately upon publication in such cases.
Your continued use of the xx77 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated version. If you do not accept the revised Privacy Policy, you must discontinue your use of the platform and contact us to request account closure before the revised policy takes effect.
We encourage you to review this Privacy Policy periodically to stay informed about how xx77 protects your data. Previous versions of this policy are available upon request by contacting [email protected].
If you have any questions, concerns, or requests relating to this Privacy Policy or the way xx77 handles your personal data, please contact our support team using the details below. All data-related enquiries are handled in English and are responded to within 30 calendar days of receipt of a valid, complete request.
- Email: [email protected] (plain text — not a clickable link)
- Subject line for data rights requests: "Data Rights Request — [Your Username]"
- Subject line for minor account reports: "Minor Account — Urgent"
- Live Chat: Available inside your xx77 account dashboard after login
- Support hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
Formal written complaints regarding xx77's data processing practices should be submitted by email to [email protected] with the subject line "Privacy Complaint — [Your Username]". xx77 aims to acknowledge all formal privacy complaints within 24 hours and to provide a substantive written response within five (5) business days of receipt.
Questions About Your xx77 Account?
Review our FAQ for quick answers on account security, deposits, and withdrawals, or log in to your xx77 account to access live chat support directly.