Data Protection

Your Privacy Matters at xk88

The xk88 Privacy Policy explains exactly what personal data we collect, why we collect it, how we use and protect it, and what rights you hold over your information. Transparency is central to how we operate as a platform serving players across Bangladesh.

Effective: January 1, 2026

256-bit SSL Encrypted

Bangladesh Market

Language: English

Our Commitment

Six Privacy Principles That Guide xk88

Before you read the full policy below, here are the six core principles that underpin the way xk88 handles every piece of data associated with your account.

Minimum Data Collection

xk88 collects only the personal data that is strictly necessary to deliver our services, verify your identity, and meet our legal obligations. We do not harvest data speculatively or for purposes beyond those disclosed in this policy.

Bank-Grade Encryption

All data transmitted between your browser and the xk88 platform is protected using 256-bit SSL/TLS encryption. Stored personal data is further secured using industry-standard encryption and access-control protocols that restrict staff access on a strict need-to-know basis.

No Third-Party Data Sales

xk88 never sells, rents, or trades your personal data to third parties for marketing or commercial purposes. Data shared with third parties is limited to service providers who require it to fulfil platform operations — such as payment processors and KYC verification partners — under strict contractual obligations.

Lawful Basis for Processing

Every data processing activity at xk88 has an identified lawful basis — whether that is the performance of our contract with you, compliance with a legal obligation, or your explicit consent. We do not process personal data without a clear and documented lawful reason.

Defined Retention Periods

xk88 retains personal data only for as long as it is needed to fulfil the purpose for which it was collected, or as required by applicable law. When data is no longer needed, it is securely deleted or anonymised in accordance with our data retention schedule.

Your Rights Are Respected

Players have clear rights over their personal data, including the right to access, correct, and in certain circumstances request deletion of their data. xk88 responds to all verified data subject requests promptly and without undue delay.

Contents

1. Who We Are
2. Data We Collect
3. How We Collect Data
4. How We Use Your Data
5. Lawful Basis
6. Data Sharing
7. Cookies & Tracking
8. Data Security
9. Data Retention
10. Your Rights
11. Children's Privacy
12. Third-Party Links
13. Policy Changes
14. Contact Us

Important Notice: This Privacy Policy ("Policy") describes how xk88 ("we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "your", "the Player") who access or use the xk88 online betting platform at xk88.io. By registering an account or using any feature of the platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must not use the xk88 platform.

Section 1

Who We Are

xk88 is an international online betting and casino platform operating at xk88.io, with a primary focus on serving English-speaking players based in Bangladesh. We offer sports betting (including cricket, football and kabaddi), live casino games, slot machines, table games and a range of other wagering products.

For the purposes of this Privacy Policy, xk88 is the data controller responsible for the personal data processed through the xk88.io platform. All enquiries relating to this Policy or to your personal data should be directed to our support team at [email protected].

Data Controller: xk88 | Platform: xk88.io | Contact: [email protected] | Support Hours: 24/7, 365 days a year

Section 2

Personal Data We Collect

xk88 collects personal data across several categories depending on the services you use and the stage of your relationship with the platform. The following table summarises the main categories of data we collect:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, nationality, government-issued ID number	Account registration, age verification (21+), KYC compliance
Contact Data	Email address, mobile number, city of residence (e.g., Dhaka, Chittagong, Sylhet)	Account communications, support, transactional notifications
Financial Data	Payment method type (bKash, Nagad, Rocket, Upay, bank name), transaction amounts in ৳, deposit/withdrawal history	Processing deposits and withdrawals, fraud prevention, AML compliance
Account Data	Username, account ID, account balance, betting history, game activity, bonus usage	Platform operation, responsible gaming monitoring, customer support
Technical Data	IP address, browser type and version, device type, operating system, time zone (BST/UTC+6), session data	Security monitoring, fraud detection, platform optimisation
Usage Data	Pages visited, features used, clickstream data, session duration, search queries within the platform	Platform analytics, user experience improvement
Communications Data	Content of support chat messages, emails to [email protected], complaint correspondence	Customer support resolution, dispute management, quality assurance
Verification Documents	Copies of National ID card, passport, driving licence, proof of address, payment method screenshots	KYC identity verification prior to withdrawal processing

Sensitive Data: xk88 does not deliberately collect special category personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data) unless you voluntarily disclose such information in the context of a responsible gaming request or support interaction. Any such data is treated with the highest level of confidentiality and is not used for any commercial purpose.

Section 3

How We Collect Your Data

xk88 collects personal data through the following channels:

3.1 Direct Collection

You provide data to us directly when you complete the account registration form, submit KYC verification documents, make a deposit or withdrawal request, contact our support team, participate in a promotion or competition, or respond to a survey or feedback request.

3.2 Automated Collection

As you interact with the xk88 platform, we automatically collect Technical Data and Usage Data using server logs, cookies, pixel tags, and similar tracking technologies. This automated collection occurs from the moment you load any page on xk88.io and continues throughout your session. See Section 7 for full details of our cookie and tracking practices.

3.3 Third-Party Sources

In certain circumstances, xk88 may receive personal data about you from third-party sources, including:

Payment service providers (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank) who confirm transaction status and payment method ownership details.
Identity verification and KYC service providers who assist in validating the documents you submit during the verification process.
Fraud prevention and anti-money-laundering (AML) screening services that cross-reference account details against known risk databases.
Analytics and attribution partners who provide aggregated information about how players discover and access the xk88 platform.

Section 4

How We Use Your Personal Data

xk88 uses the personal data it collects for the following specific purposes:

Account Creation and Management: To register your xk88 account, verify your identity and age (21+), manage your account settings, and provide access to all platform features.
Transaction Processing: To process deposits and withdrawals in Bangladeshi Taka (৳) via your chosen payment method (bKash, Nagad, Rocket, Upay, or bank transfer), and to maintain accurate financial records of all account transactions.
Platform Delivery: To deliver sports betting markets, casino games, slot products and all other wagering services offered on the xk88 platform.
Customer Support: To respond to your enquiries, resolve complaints, process account adjustments, and communicate important account information to you via email or in-platform notification.
Legal and Compliance Obligations: To meet our obligations under applicable anti-money-laundering (AML) regulations, know-your-customer (KYC) requirements, and any other legal duties imposed on the platform.
Fraud and Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, multi-accounting, bonus abuse, and any other activity that threatens the integrity of the platform or the security of player accounts.
Responsible Gaming: To monitor betting patterns that may indicate problem gambling behaviour, to action responsible gaming tool requests (deposit limits, cooling-off periods, self-exclusion), and to comply with our responsible gaming obligations.
Marketing Communications: Where you have provided explicit consent, to send you promotional communications about bonuses, new games, and relevant offers. You may withdraw consent to marketing communications at any time by contacting [email protected].
Platform Improvement: To analyse usage patterns, identify technical issues, improve the user interface, and develop new features that enhance the player experience.

Section 5

Lawful Basis for Processing

xk88 processes your personal data only where it has a clear and documented lawful basis to do so. The lawful bases applicable to our main processing activities are as follows:

Contractual Necessity: Processing required to deliver the services you have contracted for under the xk88 Terms & Conditions — including account management, transaction processing, and game delivery.
Legal Obligation: Processing required to comply with applicable legal requirements — including KYC identity verification, AML transaction monitoring, and record-keeping obligations.
Legitimate Interests: Processing undertaken for xk88's legitimate business interests where those interests are not overridden by your data protection rights — including fraud detection, security monitoring, and platform analytics. We conduct a balancing assessment before relying on this basis.
Consent: Processing based on your freely given, specific and informed consent — primarily applicable to direct marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

No Automated Decision-Making: xk88 does not make solely automated decisions that produce legal or similarly significant effects on players, except where required for real-time fraud screening. Where automated screening flags an account for review, a member of the xk88 compliance team will conduct a manual review before any account action is taken.

Section 6

Data Sharing and Disclosure

xk88 does not sell, rent or trade your personal data. We share personal data only in the following limited circumstances:

6.1 Service Providers

xk88 works with a small number of carefully selected third-party service providers who process personal data on our behalf to enable platform operations. These include payment processors (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank), KYC and identity verification providers, IT infrastructure and hosting partners, and customer support tooling providers. All service providers are bound by data processing agreements that require them to process personal data only on xk88's documented instructions and to implement appropriate security measures.

6.2 Legal Requirements

xk88 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so, or where such disclosure is necessary to protect the rights, property or safety of xk88, its players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of xk88's assets, personal data held by xk88 may be transferred to the acquiring entity. In such circumstances, xk88 will notify affected players via email and will ensure that the acquiring entity is bound by data protection obligations at least as protective as those in this Policy.

6.4 Aggregated and Anonymised Data

xk88 may share aggregated, anonymised statistical data — from which no individual player can be identified — with analytics partners, industry research bodies, and for general platform reporting purposes. This data sharing does not constitute personal data disclosure and is not subject to the restrictions in this section.

International Transfers: Some of xk88's service providers may process personal data outside Bangladesh. Where such international data transfers occur, xk88 ensures that appropriate safeguards — including contractual protections equivalent to standard data protection clauses — are in place to maintain the security and integrity of your personal data.

Section 7

Cookies and Tracking Technologies

xk88 uses cookies and similar tracking technologies on the xk88.io platform to enable core functionality, analyse usage patterns, and improve the player experience. The following categories of cookies are used:

Cookie Type	Purpose	Duration
Strictly Necessary	Enable core platform functions including login session management, account security tokens, and payment flow integrity. Cannot be disabled without breaking platform functionality.	Session / up to 24 hours
Functional	Remember your preferences such as language settings, game lobby display options, and responsible gaming tool configurations.	Up to 12 months
Analytics	Collect anonymised usage data (pages visited, time on page, click paths) to help xk88 understand how the platform is used and where improvements can be made.	Up to 24 months
Security	Detect and prevent fraudulent activity, bot traffic, and unauthorised access attempts by fingerprinting device and session characteristics.	Session / up to 30 days

You may manage or disable non-essential cookies through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the xk88 platform. xk88 does not use advertising or retargeting cookies that track your activity across third-party websites.

Section 8

Data Security

xk88 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures include:

256-bit SSL/TLS Encryption: All data in transit between your device and xk88 servers is encrypted using industry-standard 256-bit SSL/TLS protocols.
Encryption at Rest: Sensitive personal data stored on xk88 servers — including identity documents, financial records and account credentials — is encrypted at rest using AES-256 encryption.
Access Controls: Access to personal data is restricted to authorised xk88 personnel who require it to perform their job functions. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
Multi-Factor Authentication: Administrative access to xk88's data systems requires multi-factor authentication. Players are also encouraged to enable additional verification steps on their accounts.
Intrusion Detection: xk88 employs real-time intrusion detection and monitoring systems to identify and respond to suspicious activity affecting platform infrastructure.
Penetration Testing: The xk88 platform undergoes periodic security assessments and penetration testing conducted by qualified security professionals to identify and remediate vulnerabilities.
Incident Response: xk88 maintains a documented data breach response plan. In the event of a personal data breach that is likely to result in a high risk to affected individuals, we will notify impacted players without undue delay.

Your Responsibility: While xk88 takes extensive measures to protect your data, you are also responsible for maintaining the security of your account. Use a strong, unique password, do not share your login credentials with any third party, and contact [email protected] immediately if you suspect your account has been compromised.

Section 9

Data Retention

xk88 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following general retention periods apply:

Account Data: Retained for the duration of your active account relationship with xk88, plus a minimum of 5 years following account closure, to meet our AML and legal record-keeping obligations.
Identity and KYC Documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later, in accordance with applicable financial crime prevention requirements.
Transaction Records: All deposit and withdrawal records are retained for a minimum of 5 years from the date of the transaction.
Support Communications: Email and chat correspondence with the xk88 support team is retained for 3 years from the date of the last message in each ticket.
Technical and Usage Data: Server logs and analytics data are retained for up to 24 months, after which they are anonymised or deleted.
Marketing Consent Records: Records of your marketing consent status are retained for as long as you maintain an active account and for 3 years following account closure.

Upon the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any individual.

Section 10

Your Data Protection Rights

As a player on the xk88 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request" and your registered account username.

Right of Access: You have the right to request a copy of all personal data xk88 holds about you, along with information about how it is being used. We will respond to access requests within 30 days.
Right to Rectification: If any personal data xk88 holds about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay. You can update basic account information directly through your account settings panel.
Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where processing is unlawful. This right is subject to exceptions — for example, we cannot delete data we are legally required to retain under AML regulations.
Right to Restrict Processing: You may request that xk88 restrict the processing of your data in certain circumstances — for example, while a rectification request is being assessed, or where you have objected to processing.
Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to request that it be transferred to another controller where technically feasible.
Right to Object: You have the right to object to processing carried out on the basis of xk88's legitimate interests. xk88 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to the withdrawal.

Response Timeframe: xk88 will acknowledge all data rights requests within 5 working days and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

Section 11

Children's Privacy

The xk88 platform is strictly intended for adults aged 21 years and over. xk88 does not knowingly collect, store, or process personal data from individuals under the age of 21. Age verification is conducted as part of the account registration process, and any account found to belong to an individual under 21 will be immediately closed and all associated data deleted.

If you are a parent or guardian and believe that a minor has registered an account or provided personal data to xk88 without your consent, please contact us immediately at [email protected]. We will take prompt action to close the account and remove all associated personal data from our systems.

Section 12

Third-Party Links

The xk88 platform may contain references to third-party service names — such as payment providers bKash, Nagad, Rocket, and Upay — whose own privacy practices apply when you interact with their services directly. xk88 is not responsible for the privacy practices of third-party payment providers, and we encourage you to review the privacy policies of any third-party services you use in connection with your xk88 account.

xk88 does not embed third-party advertising, social media widgets, or external tracking scripts on its platform that would allow third-party companies to collect your data without your knowledge.

Section 13

Changes to This Privacy Policy

xk88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or the services we offer. When a material change is made to this Policy, we will notify registered players via the email address associated with their account or through a prominent notice displayed on the xk88 platform, at least 14 days before the revised Policy takes effect.

The date at the top of this Policy indicates when it was last updated. Your continued use of the xk88 platform after the effective date of any revised Policy constitutes your acceptance of the changes. We recommend reviewing this Policy periodically to stay informed about how your data is handled.

Current Version: This Privacy Policy was last updated and became effective on January 1, 2026. All data collected from this date onward is processed in accordance with the terms set out in this version of the Policy.

Section 14

Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or to the personal data xk88 holds about you, please contact our data protection team using the details below:

Email: [email protected] — use the subject line "Privacy Enquiry" for data-related requests
Response Time: All privacy-related enquiries are acknowledged within 5 working days and receive a substantive response within 30 calendar days
Support Availability: 24 hours a day, 7 days a week, 365 days a year
Communication Language: English
Time Zone: Bangladesh Standard Time (BST, UTC+6)

Formal Complaints: If you are not satisfied with xk88's response to a data rights request or privacy complaint, you may escalate your complaint by emailing [email protected] with the subject line "Formal Privacy Complaint". xk88 will acknowledge formal privacy complaints within 24 hours and provide a full response within 14 working days. For further guidance on your rights, you may also wish to consult the applicable data protection authority in your jurisdiction.

Questions About Your Data or Account?

Our support team is available around the clock to help with any privacy enquiries, account requests, or general questions about the xk88 platform.

View FAQ Explore Casino xk88 Login