Privacy Policy
What Data This Site Collects, Uses and Keeps
Nadia Rahman
Managing editor
A gambling account collects more data than most online services, for reasons that have nothing to do with marketing: identity has to be verified before money leaves, and transaction records have to be retained even after an account closes. This page sets out what is collected at xtc88.my, what each category is actually used for, how long it is held, and what you can ask us to do with it.
It is written as a plain summary rather than a legal instrument. The binding privacy notice is the version presented in the account area, and where the two differ, that version governs. Nothing below narrows a right you hold under Malaysian data protection law.
What is collected
Data falls into four groups, worth separating because they are used and retained differently. Registration data is what you type in. Verification data is supplied once, at a first withdrawal. Transaction data is generated by using the account. Technical data comes from your device by loading a page.
| Category | Examples | Why it is held | How long |
|---|---|---|---|
| Registration | Name, date of birth, email, phone | Account opening, age checks | Life of the account |
| Verification | Identity document, proof of account ownership | Confirming identity before a payout | Kept after closure |
| Transaction | Deposits, withdrawals, bets, bonus history | Settling play, disputes, VIP tiers | Kept after closure |
| Technical | IP address, device type, session logs | Security, fraud detection, sign-in | Short retention |
What the data is used for
Four uses cover almost everything: running the account, from crediting deposits to calculating rebate on net loss; meeting verification and anti-fraud obligations, including confirming you are 18 or over and that the funding source is in your name; security, such as spotting a sign-in that does not look like yours; and support, so an agent can resolve a transaction without re-proving basic facts. Your data is not sold, and marketing messages follow your own preference setting.
Who it is shared with
Sharing is limited to parties that need the data for the service to work: payment providers and banks processing a transaction, game studios operating the titles you play, verification providers, and infrastructure suppliers. Disclosure may also be required by a legal obligation. Each party receives only what its function needs: a payout provider does not get your bet history.
How long data is kept
Registration data is held while the account is open. Transaction and verification records are kept after closure, because financial and anti-money-laundering record-keeping rules require it; this is not discretionary. Technical logs are held briefly. Self-exclusion is a deliberate exception — those records are retained so the exclusion can be enforced against a new registration, which is what makes the tool on the responsible gaming page work.
Your rights over your data
You can request a copy of the personal data held about you, ask for inaccurate details to be corrected, and withdraw marketing consent at any time. A deletion request is honoured for everything outside statutory retention rather than refused outright. Correcting registration details is worth doing promptly: a name or bank detail that does not match at verification is the most common cause of a delayed first payout. Routes are on the contact page.
Cookies and tracking
Cookies here do three jobs. Essential cookies keep you signed in and attach a session to the right account. Preference cookies remember settings such as language. Analytics cookies measure aggregate page usage, so we can see which guides are read. Browser controls can block or clear cookies at any point — blocking essential ones signs you out. Conditions governing the account itself sit in the terms of use.
Ready to play
Open the XTC88 lobby
Slots, live dealer tables and the cashier in one account, in ringgit.
Nadia Rahman
Managing editor
Frequently Asked Questions
Why do I have to send an identity document at all?
Because a payout cannot be released to an unverified identity. The check happens once, before a first withdrawal, and confirms your age and that the funding source belongs to you.
Can I delete my account and all its data?
An account can be closed, and personal data outside statutory retention can be deleted. Transaction and verification records are held after closure because record-keeping rules require it.
Can I turn off analytics cookies?
Yes, through your browser's cookie controls. Essential cookies cannot be disabled without breaking sign-in.
