Privacy Policy XC 88 – Our Commitment to Protecting Your Data

XC 88 (xc88.express) is an online entertainment platform serving Malaysian players, covering online casino, Sports Betting, poker, progressive jackpots and related games. As a platform that handles players' financial and personal information, we understand that trust is the foundation of our relationship with every member.

This Privacy Policy applies to all personal information collected through:

• The xc88.express website and all associated subdomains.
• Registration and account management process XC 88.
• Financial transactions including deposits and withdrawals.
• Interact with our customer support team XC 88.
• Participation in promotions, contests and loyalty programmes.

This Policy has been established to comply with Personal Data Protection Act 2010 (PDPA) Malaysia as well as relevant international data protection guidelines. Any use of the platform XC 88 after the last updated date shown above will be considered as acceptance of the latest version of the Privacy Policy.

XC 88 only collects data that is strictly necessary to provide a safe, fair and compliant service. The following are the categories of data we collect:

Data We Do NOT Collect: XC 88 does not collect sensitive data such as health information, religious beliefs, political affiliations or biometric data unless specifically required by applicable law and with your explicit consent.

Financial data such as credit card numbers and bank account details are not stored directly in our systems — they are processed through certified payment gateways (DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX Maybank2u, CIMB Clicks) that maintain their own recognised security standards.

XC 88 uses your personal data only for the following legitimate and transparent purposes:

• Account Management: Creating, verifying and managing your account XC 88 yours, including the login process, identity verification and password management.
• Transaction Processing: Processing your deposits and withdrawals through supported Malaysian payment methods – DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX Maybank2u and CIMB Clicks – securely and accurately.
• Service Provision: Allows you to access all games and services on the platform XC 88 including slots, live casino, poker, football Sports Betting, cricket, e-sports and progressive jackpots.
• Fraud Prevention & Security: Identifying and preventing fraudulent activity, bonus abuse, money laundering, unauthorized access, and other security threats to the platform and its users.
• Legal Compliance: Fulfilling legal obligations including KYC (Know Your Customer), AML (Anti-Money Laundering) and reporting requirements as prescribed by applicable Malaysian law.
• Customer Support: Handling enquiries, complaints, and support requests submitted to our support team XC 88 in Bahasa Melayu via live chat, WhatsApp, or email.
• Responsible Gaming: Monitoring gaming habits to identify signs of problematic behaviour and providing appropriate assistance through responsible gaming control tools.
• Communications: Sending important communications regarding your account, policy changes, security notices, and (with your consent) relevant promotional offers.
• Platform Improvement: Analyzing aggregated usage data (without identifying individuals) to understand usage patterns and improve platform performance and user experience XC 88.

XC 88 does not sell or rent your personal data to third parties. However, in certain limited situations, we may share data with the following parties:

• Payment Service Providers: Data required to process transactions is shared with authorized payment providers including the DuitNow system, Touch 'n Go eWallet network, GrabPay, Boost, ShopeePay, and FPX. These providers are bound by strict data protection agreements and their own industry security standards.
• Game Providers: Minimum technical data required to run games is shared with licensed game providers such as Pragmatic Play, Evolution Gaming and PG Soft solely for game operation purposes. These providers do not receive your full personal identity data.
• Regulatory Bodies & Authorities: XC 88 will disclose data when required by law, court order, or a lawful request from a Malaysian law enforcement agency. This includes investigations related to money laundering or financial crimes.
• Independent Auditors & Testers: Certified audit firms may access data within a limited scope solely for compliance audit and game fairness verification purposes. All access is subject to strict confidentiality agreements.
• Cloud Services & Infrastructure: Data is stored on servers operated by certified cloud service providers that comply with international security standards. All such providers are bound by data processing agreements that meet Malaysia's PDPA requirements.

In all of the data sharing situations described above, XC 88 ensuring that recipients are bound by equivalent data protection obligations and that data is shared only to the minimum extent necessary for the relevant purpose.

XC 88 continuously invest in the latest security technologies and procedures to protect your personal data against unauthorised access, loss, misuse or disclosure. The following are the key security measures we practise:

• Data Encryption in Transit: All communication between your web browser and the XC 88 protected by TLS 1.3 protocol with AES-256 encryption – the highest commercially available banking-grade security standard.
• Data Encryption at Rest: Sensitive data stored in our databases is encrypted using robust encryption algorithms. Account passwords are never stored in plain text – only irreversible hash values are retained.
• Strict Access Controls: Internal-level access to user data XC 88 operates on a role-based access control system. Only staff who require access to carry out their duties are granted permission, and all access is logged for audit purposes.
• Two-Factor Authentication (2FA): Internal systems XC 88 containing sensitive user data are protected by multi-factor authentication. Players are also encouraged to enable 2FA on their accounts for an added layer of protection.
• 24/7 Security Monitoring: An automated monitoring system operates around the clock to detect unauthorised access attempts, cyberattacks, traffic anomalies and other security threats. Our security team responds to alerts in real time.
• Independent Security Audit: Comprehensive security audits are conducted by certified independent cybersecurity firms at least once a year to identify and address any security vulnerabilities.
• Incident Response Plan: XC 88 maintains a comprehensive data security incident response plan. In the event of a data breach, affected users will be notified within the timeframe required by applicable law.

While we take all reasonable steps to protect your data, no security system is 100% impenetrable. We encourage you to play your part in keeping your account secure by choosing a strong password and not sharing your login credentials.

Platform XC 88 uses cookies and related tracking technologies to enhance user experience, maintain security, and understand how our platform is being used.

Types of cookies we use:

• Essential Cookies (Required): These cookies are required for the platform's core functions — login, session security, authentication and basic navigation. Without them, the platform will not work properly. This type of cookie does not require your consent as it is essential to operations.
• Performance & Analytics Cookies: We use analytics tools to understand how players interact with the platform – which pages are visited most often, how long a typical session lasts, and where users encounter difficulties. This information is used in aggregated form without identifying any individual, for the purpose of platform improvement.
• Functional Cookies: These cookies store your preferences such as language selection, display settings and game preferences so you do not need to reconfigure them each time you log in to XC 88.
• Security Cookies: Used to identify suspicious activity, prevent fraud and protect your account from unauthorised access. These cookies compare your current usage patterns against your login history.

Cookie Controls: You can manage and delete cookies through your web browser settings. Please note that disabling all cookies may affect the functionality of the platform XC 88. Essential cookies cannot be disabled without affecting the core functionality of the platform.

XC 88 retains your personal data only for as long as necessary to fulfil the original purpose of collection or to comply with applicable legal requirements.

Once the retention period expires, data is securely deleted using methods that ensure it cannot be recovered. For data held in physical format, the relevant documents are destroyed in accordance with data security standards.

Please note that XC 88 cannot delete data that must be retained to fulfil legal obligations, even upon a user's request. In such cases, we will provide a clear explanation as to why the data in question cannot be removed.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and our commitment XC 88 regarding privacy, you have the following rights in relation to your personal data:

To exercise any of the rights above, please contact the XC 88 Data Privacy Officer by email at privacy@xc88.express or via the in-platform live chat. Please include your account information and a clear description of your request. We will verify your identity before processing any data-related request to ensure security.

If you are not satisfied with our response to your privacy rights request, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

XC 88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements or user feedback. Any material changes will be communicated to you through:

• A notice displayed on the xc88.express homepage at least 14 days before the changes take effect.
• An email notification will be sent to your registered email address outlining the key changes made.
• In-account notification upon your next login after the changes take effect.

The "Last Updated" date shown at the top of this page reflects when this Policy was last reviewed. Use of the platform XC 88 continued use of the platform after the effective date of any changes will be considered acceptance of the amended policy.

For changes we consider significant, we may request your explicit re-consent before you continue using certain services. This is an additional step we take beyond the minimum legal requirements, out of respect for your privacy rights.

If you have any questions, concerns or complaints regarding this Privacy Policy or the way XC 88 handling your personal data, please do not hesitate to contact us:

• Privacy Email: privacy@xc88.express — for all privacy and data protection enquiries and complaints. We are committed to responding within 5 business days.
• General Support Email: support@xc88.express – for general enquiries related to your account and services.
• Live Chat: Available 24/7 within the platform for immediate enquiries in Bahasa Melayu.
• WhatsApp: Available 24/7 for enquiries in Bahasa Malaysia.

When contacting us regarding privacy, please include:

• Username or account email address XC 88 yours (for identity verification).
• A clear description of your enquiry or concern.
• For data rights requests – specify the type of right you wish to exercise (access, correction, deletion, etc.).

XC 88 takes every privacy-related complaint seriously and will handle it with the appropriate level of priority. A full response to complex privacy complaints will be provided within 14 working days. Cases requiring in-depth investigation may take longer, during which we will keep you informed of the progress.

This Privacy Policy is governed by Malaysian law, specifically the Personal Data Protection Act 2010 (PDPA). The Bahasa Malaysia version of this document is the official version.