x599 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1 Introduction

1.1  x599 is committed to protecting the privacy and security of all personal data that passes through its platform. We recognise that the personal information you share with us is sensitive and that you trust us to handle it responsibly. This Policy sets out in full detail how we meet that responsibility.

1.2  This Policy applies to all personal data collected through the x599 website at x599.io, any mobile-optimised version of that website, and through direct communications between you and the x599 customer support team. It covers data collected from registered account holders, visitors browsing the platform without a registered account, and individuals who contact x599 via email or other channels.

1.3  This Policy is written in plain English to the greatest extent possible while remaining legally precise. Where technical or legal terms are used, we have endeavoured to explain their meaning in plain language. If you have any questions about this Policy that are not answered below, please contact us at [email protected].

2 Data Controller

2.1  For the purposes of applicable data protection law, x599 acts as the data controller in respect of personal data collected from players and platform visitors. As data controller, x599 determines the purposes for which and the means by which personal data is processed.

2.2  x599 operates as a cross-border South Asia online betting platform, serving players primarily across Bangladesh and the broader South Asia region. The platform accepts deposits and withdrawals in BDT (Bangladeshi Taka) and INR (Indian Rupee) and is designed specifically for players in these markets.

2.3  All data protection queries, requests, and complaints should be directed to: [email protected] with the subject line "Privacy" or "Data Subject Request" to ensure prompt routing to the relevant team.

3 Data We Collect

3.1  The personal data x599 collects can be grouped into the following categories:

3.1 Identity Data

Includes your full legal name, date of birth, nationality, gender, and copies of government-issued identification documents provided during the KYC (Know Your Customer) verification process — such as your National Identity Card (NID), passport, or driver's licence.

3.2 Contact Data

Includes your email address, mobile phone number, and residential address. This data is collected at registration and may be updated by you at any time via the account settings panel or by contacting [email protected].

3.3 Financial Data

Includes your registered payment method details (e.g., bKash wallet number, Nagad wallet number, Rocket account, Upay account, bank card details, or bank account information), deposit history, withdrawal history, and transaction records. x599 does not store full debit or credit card numbers on its own servers — card transactions are handled by certified payment processors.

3.4 Account & Betting Activity Data

Includes your x599 username, account creation date, login history (including IP address and device information at time of login), betting history (all bets placed, markets, stakes, odds, and outcomes), casino game session records, bonus redemptions, and balance history.

3.5 Technical Data

Includes your IP address, browser type and version, device type and operating system, screen resolution, time zone, and the pages of the x599 platform you visit along with timestamps and navigation paths. This data is collected automatically when you access the platform and is used primarily for security, fraud prevention, and platform optimisation purposes.

3.6 Communications Data

Includes records of all communications between you and the x599 customer support team, including emails, live chat transcripts, and any attachments or documents you provide in the course of those communications.

4 How We Collect Your Data

4.1  x599 collects personal data through the following channels:

• Direct collection: Data you provide voluntarily when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or participating in any promotion or survey.
• Automated collection: Technical and behavioural data collected automatically when you access or use the x599 platform, through server logs, cookies, and similar tracking technologies (see Section 9 for full cookie details).
• Third-party sources: Identity verification and fraud screening data received from our third-party KYC and AML (Anti-Money Laundering) service providers; payment confirmation data received from our payment processing partners (bKash, Nagad, Rocket, Upay, and card processors); and device fingerprinting data from our fraud prevention technology partners.

5 Why We Use Your Data

5.1  The table below sets out the specific purposes for which x599 processes your personal data, together with the legal basis for that processing:

5.2  Where x599 relies on consent as the legal basis for processing — specifically for promotional and marketing communications — you have the right to withdraw that consent at any time by clicking "Unsubscribe" in any marketing email, or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

5.3  Where x599 relies on legitimate interests as the legal basis, x599 has assessed that its interests in processing the data (e.g., preventing fraud, improving platform security) are not overridden by your interests or fundamental rights. You may object to processing carried out on the basis of legitimate interests by contacting [email protected].

6 Sharing Your Personal Data

6.1  x599 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Personal data is shared with third parties only in the specific circumstances described in this section.

6.1 Payment Processors

To process your deposits and withdrawals, x599 shares the minimum necessary financial and identity data with your chosen payment provider — which may include bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, or card processing partners. These providers process your data only for the purpose of completing your transaction and are contractually bound to protect your data in accordance with applicable standards.

6.2 Identity Verification & AML Providers

To comply with our legal obligations around identity verification and anti-money laundering, x599 shares identity and document data with certified third-party KYC and AML screening service providers. These providers are engaged under strict data processing agreements and are not permitted to use your data for any purpose other than the verification service they provide to x599.

6.3 Game Software Providers

The casino games available on x599 are supplied by third-party software studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive technical session data (such as your session token and game round data) necessary to deliver their games within the x599 platform. They do not receive your full identity or financial data.

6.4 Fraud Prevention & Security Partners

x599 uses third-party fraud detection and device fingerprinting services to protect the platform and its players from fraudulent activity. These services process technical and behavioural data under data processing agreements with x599.

6.5 Legal & Regulatory Disclosure

x599 may disclose your personal data to competent authorities, law enforcement agencies, or financial intelligence units where required to do so by applicable law, court order, or regulatory obligation. In such cases, x599 will disclose only the minimum data required to satisfy the legal obligation.

7 Data Retention

7.1  x599 retains your personal data only for as long as is necessary for the purposes set out in this Policy, subject to any applicable legal retention obligations. The following retention periods apply:

7.2  Where x599 no longer has a lawful basis to retain your personal data, it will be securely deleted or anonymised so that it can no longer be associated with you. Anonymised data (data from which all identifying information has been permanently removed) may be retained indefinitely for statistical and analytical purposes.

8 Data Security

8.1  x599 takes the security of your personal data seriously and has implemented a range of technical and organisational measures designed to protect against unauthorised access, accidental loss, alteration, disclosure, or destruction of personal data. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and x599 servers.
• Encryption at rest for all personal data stored on x599 infrastructure, using industry-standard symmetric encryption.
• Access controls ensuring that only x599 personnel with a legitimate operational need can access personal data, with access granted on a strict least-privilege basis.
• Two-factor authentication available to all account holders and mandatory for all x599 internal staff with access to production systems.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Incident response procedures to detect, investigate, contain, and notify affected parties in the event of a personal data breach.

8.2  In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, x599 will notify you without undue delay via the email address registered on your account, providing details of the nature of the breach, the data affected, the likely consequences, and the steps x599 has taken or proposes to take to address it.

8.3  While x599 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is entirely secure. You also have a responsibility to keep your x599 login credentials secure and to notify x599 immediately if you suspect any unauthorised access to your account.

9 Cookies & Tracking Technologies

9.1  x599 uses cookies and similar tracking technologies (including pixel tags and local storage) on the x599 platform. A cookie is a small text file placed on your device by a web server that allows the server to recognise your device on subsequent visits. Cookies do not contain executable code and cannot access other files on your device.

9.2  The following categories of cookies are used on the x599 platform:

• Strictly Necessary Cookies: Required for the platform to function correctly. These include session management cookies that keep you logged in during your x599 session, and security cookies that help protect your account. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences (such as your account currency setting) to provide a more personalised experience. These cookies do not track your browsing activity on other websites.
• Analytics Cookies: Help x599 understand how players use the platform by collecting anonymised data on page visits, session duration, and navigation paths. This data is used to improve platform performance and usability. x599 uses privacy-respecting analytics tools for this purpose.
• Security & Fraud Prevention Cookies: Used by x599's fraud detection systems to identify suspicious patterns of device behaviour. These cookies process technical data only and do not identify you by name or other personally identifying information.

9.3  You can control and manage cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and configure alerts when new cookies are set. Please note that disabling cookies may affect the functionality of the x599 platform — in particular, strictly necessary cookies must be enabled for you to log in and place bets.

9.4  x599 does not use cookies to serve third-party advertising, to track your browsing activity across unrelated third-party websites, or to build advertising profiles about you.

10 Your Data Rights

10.1  Subject to applicable law, you have the following rights in respect of your personal data held by x599:

10.2  To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Subject Request". Include your full name, the email address registered on your x599 account, and a clear description of the right you wish to exercise. x599 will respond within 30 days of receiving your request. x599 reserves the right to verify your identity before acting on any data subject request.

10.3  x599 will not charge a fee for responding to a data subject request unless the request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may be applied.

11 Minors

11.1  The x599 platform is strictly for adults aged 21 years and over. x599 does not knowingly collect personal data from any individual under the age of 21. Our registration process requires all applicants to confirm their date of birth, and we use automated and manual KYC processes to verify age as part of the account verification procedure.

11.2  If x599 discovers that it has collected personal data from an individual who is under 21 years of age, that account will be immediately suspended and the personal data in question will be deleted as soon as reasonably practicable, in accordance with our legal obligations. Any deposits made by an underage account holder will be returned to the originating payment method.

11.3  If you are a parent or guardian and believe that a minor under your care has registered an account on x599 without authorisation, please contact [email protected] immediately with the subject line "Underage Account Report" so that we can investigate and take appropriate action without delay.

12 International Data Transfers

12.1  As a cross-border South Asia platform, x599 may process or store some personal data outside your country of residence. In particular, some of our third-party service providers — including KYC verification providers, fraud prevention partners, and game software studios — may be located in countries other than Bangladesh.

12.2  Where personal data is transferred to a country that does not provide a level of data protection equivalent to that in Bangladesh, x599 takes steps to ensure that appropriate safeguards are in place — such as standard contractual clauses or data processing agreements — to protect your data to a standard consistent with this Policy.

12.3  By using the x599 platform and accepting this Policy, you acknowledge and consent to the transfer of your personal data as described in this section, in accordance with the safeguards described above.

13 Changes to This Privacy Policy

13.1  x599 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. The most current version of this Policy will always be available at x599.io/privacy-policy. The "Last updated" date at the top of this document reflects the date the most recent version took effect.

13.2 &nbsp ;Where changes to this Policy are material — meaning they significantly affect your rights or how x599 uses your personal data — x599 will notify registered account holders by email to the address on file at least 14 days before the changes take effect. Your continued use of the x599 platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

13.3  If you do not agree with any changes to this Policy, you should stop using the x599 platform and may request account closure by contacting [email protected]. x599 will process your closure request in accordance with the account closure procedures described in the Terms & Conditions.

14 Contact Us

14.1  If you have any questions, concerns, or complaints about this Privacy Policy or the way x599 handles your personal data, please contact us using the details below. Our data protection team is available 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6).

14.2  x599 is committed to resolving all data protection queries and complaints fairly and promptly. If you are not satisfied with the response you receive from our team, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.

14.3  x599 serves players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and all regions of Bangladesh. Regardless of which city or region you are based in, your data rights under this Policy apply equally and in full.