Privacy Policy

What Data This Site Collects, Uses and Keeps

Nadia Rahman, Managing editor at XTC88 Malaysia

Nadia Rahman

Managing editor

Reviewed by Nadia Rahman · Last updated 3 August 2026

A gambling account collects more data than most online services, for reasons that have nothing to do with marketing: identity has to be verified before money leaves, and transaction records have to be retained even after an account closes. This page sets out what is collected at xtc88.my, what each category is actually used for, how long it is held, and what you can ask us to do with it.

It is written as a plain summary rather than a legal instrument. The binding privacy notice is the version presented in the account area, and where the two differ, that version governs. Nothing below narrows a right you hold under Malaysian data protection law.

What is collected

Data falls into four groups, worth separating because they are used and retained differently. Registration data is what you type in. Verification data is supplied once, at a first withdrawal. Transaction data is generated by using the account. Technical data comes from your device by loading a page.

Data categories, purpose and retention
CategoryExamplesWhy it is heldHow long
RegistrationName, date of birth, email, phoneAccount opening, age checksLife of the account
VerificationIdentity document, proof of account ownershipConfirming identity before a payoutKept after closure
TransactionDeposits, withdrawals, bets, bonus historySettling play, disputes, VIP tiersKept after closure
TechnicalIP address, device type, session logsSecurity, fraud detection, sign-inShort retention

What the data is used for

Four uses cover almost everything: running the account, from crediting deposits to calculating rebate on net loss; meeting verification and anti-fraud obligations, including confirming you are 18 or over and that the funding source is in your name; security, such as spotting a sign-in that does not look like yours; and support, so an agent can resolve a transaction without re-proving basic facts. Your data is not sold, and marketing messages follow your own preference setting.

Who it is shared with

Sharing is limited to parties that need the data for the service to work: payment providers and banks processing a transaction, game studios operating the titles you play, verification providers, and infrastructure suppliers. Disclosure may also be required by a legal obligation. Each party receives only what its function needs: a payout provider does not get your bet history.

How long data is kept

Registration data is held while the account is open. Transaction and verification records are kept after closure, because financial and anti-money-laundering record-keeping rules require it; this is not discretionary. Technical logs are held briefly. Self-exclusion is a deliberate exception — those records are retained so the exclusion can be enforced against a new registration, which is what makes the tool on the responsible gaming page work.

Your rights over your data

You can request a copy of the personal data held about you, ask for inaccurate details to be corrected, and withdraw marketing consent at any time. A deletion request is honoured for everything outside statutory retention rather than refused outright. Correcting registration details is worth doing promptly: a name or bank detail that does not match at verification is the most common cause of a delayed first payout. Routes are on the contact page.

Cookies and tracking

Cookies here do three jobs. Essential cookies keep you signed in and attach a session to the right account. Preference cookies remember settings such as language. Analytics cookies measure aggregate page usage, so we can see which guides are read. Browser controls can block or clear cookies at any point — blocking essential ones signs you out. Conditions governing the account itself sit in the terms of use.

Ready to play

Open the XTC88 lobby

Slots, live dealer tables and the cashier in one account, in ringgit.

Play at XTC88
Nadia Rahman, Managing editor at XTC88 Malaysia

Nadia Rahman

Managing editor

Reviewed by Nadia Rahman · Last updated 3 August 2026

Frequently Asked Questions

Why do I have to send an identity document at all?

Because a payout cannot be released to an unverified identity. The check happens once, before a first withdrawal, and confirms your age and that the funding source belongs to you.

Can I delete my account and all its data?

An account can be closed, and personal data outside statutory retention can be deleted. Transaction and verification records are held after closure because record-keeping rules require it.

Can I turn off analytics cookies?

Yes, through your browser's cookie controls. Essential cookies cannot be disabled without breaking sign-in.