X Poker Privacy Policy – Data Protection for Malaysia Members

This Privacy Policy applies to all information you provide to X Poker during account registration, platform use, financial transactions, and any interactions with our customer support team. It also covers information collected automatically through standard tracking technologies used on our platform.

X Poker is the data controller for all personal information collected through this platform. We are fully responsible for ensuring your information is processed lawfully, fairly, and transparently in accordance with applicable data protection laws in Malaysia.

X Poker collects several categories of information to provide, manage, and improve platform services for Malaysia members. Below are the details of the data we collect:

A. Information You Provide Directly:

• Full name and username chosen during registration.
• A valid Malaysian mobile number for account verification.
• An active email address for account communications and notifications.
• Date of birth for age verification of the 18+ requirement.
• Additional identity information (such as your Malaysian identification card number) that may be required during the identity verification process for fund withdrawals.
• Payment method details such as e-wallet account numbers (Touch 'n Go, GrabPay, DuitNow) or FPX details for transaction processing.

B. Information Collected Automatically:

• The IP address of the device used to access the platform.
• The type and version of the web browser or application used.
• Device information including operating system and phone model.
• In-platform activity data — games played, session duration, betting history, and general usage patterns.
• Cookie data and similar tracking technologies (see Section 6 for details).
• Real-time access logs for security and fraud prevention purposes.

X Poker uses the information collected for the following legitimate and necessary purposes in the operation of the platform:

• Account Management: Creating, verifying, and managing your X Poker member account, including the login process and account security.
• Transaction Processing: Processing deposits via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, and FPX, as well as your winnings withdrawals.
• Identity Verification: Verifying member identities to meet the anti-money laundering (AML) and know your customer (KYC) requirements mandated by law.
• Service Provision: Delivering the games, promotions, bonuses, and all X Poker services that you use.
• Communications: Sending you important notifications about your account, transactions, policy changes, or relevant promotional offers.
• Security & Fraud Prevention: Monitoring and detecting suspicious activity, preventing multi-account usage, and protecting the platform from abuse.
• Responsible Gambling: Identifying play patterns that may indicate problem gambling and providing appropriate support to members who need it.
• Platform Improvement: Analysing aggregated usage data (without identifying individuals) to improve the user experience, platform performance, and game selection.
• Legal Compliance: To comply with legal obligations, court orders, or lawful requests from authorised authorities in Malaysia.

X Poker recognises that your privacy is something you entrust to us. We do not sell, rent, or share members' personal information with third parties for their own marketing purposes. However, there are limited situations where data sharing is necessary for platform operations:

A. Trusted Service Providers:

X Poker shares necessary data with service providers acting on our behalf, including:

• Licensed game providers (such as Evolution Gaming, PG Soft, Pragmatic Play) that need to verify account status in order to deliver gameplay.
• Payment processors handling financial transactions via e-wallet and Malaysia FPX.
• Technology and cloud infrastructure providers that host the X Poker platform.
• Analytics service providers that help us understand platform usage on an aggregated basis.

All third-party service providers are bound by strict confidentiality agreements and are prohibited from using your data for any purpose other than those assigned by X Poker.

B. Legal Obligations:

X Poker may be required to disclose member information to the following parties when mandated by law:

• Malaysian law enforcement authorities acting under a valid court order.
• Financial regulatory authority for AML/KYC compliance purposes.
• Malaysian tax authorities where required under tax legislation.

Protecting members' personal and financial data is X Poker's top technical priority. We implement multiple comprehensive layers of security to keep your data safe at all times:

• 256-bit SSL Encryption: All communications between your browser or app and X Poker's servers are encrypted using 256-bit SSL/TLS standards — the same technology used by leading Malaysian banks such as Maybank and CIMB.
• Stored Data Encryption: Sensitive data stored in X Poker's database is encrypted at rest using AES-256 encryption.
• Two-Factor Authentication (2FA): X Poker offers 2FA for all member accounts as an additional layer of security against unauthorised access.
• Continuous Monitoring: Our systems are monitored around the clock by a cybersecurity team that detects and responds to threats in real time.
• Penetration Testing: The X Poker platform undergoes regular security testing by independent cybersecurity experts to identify and address any technical vulnerabilities.
• Employee Access Controls: Access to member data among X Poker employees is governed by a strict need-to-know principle — only staff who require the data to perform their duties are granted access, and every access is automatically logged.

While X Poker takes all reasonable steps to protect your data, no system can be guaranteed 100% secure against every threat. We encourage you to take your own precautions as well — such as using a strong password, enabling 2FA, and never sharing your login details with anyone.

X Poker uses cookies and similar tracking technologies to enhance your experience, maintain platform security, and analyse general platform usage. Cookies are small text files stored on your device when you visit the X Poker platform.

You can manage cookie settings through your web browser. However, disabling mandatory cookies may affect the functionality of the X Poker platform, including the ability to log in and play. Optional cookies can be disabled without affecting core platform functionality.

X Poker retains members' personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by applicable Malaysian law.

• Active Account Data: Retained for the duration of your active account and for 7 years after account closure, in compliance with legal and financial audit requirements.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysian financial law and AML requirements.
• Security Logs: Retained for 90 days for security incident investigation purposes.
• Customer Support Correspondence: Retained for 3 years for reference and dispute resolution purposes.
• Aggregated Analytics Data: Anonymised data (which cannot be used to identify any specific individual) may be retained for a longer period for platform trend analysis purposes.

Once the retention period ends, your personal data will be securely deleted or anonymised using methods approved by industry standards. If you request account deletion, we will honour that request subject to any mandatory data retention obligations under applicable law.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have several important rights regarding the personal data held by X Poker. We fully respect and facilitate the exercise of these rights:

To exercise any of the rights above, please contact the X Poker privacy team by email at support@xpoker.online with the subject line "Personal Data Rights Request". We will acknowledge receipt of your request within 3 business days.

X Poker is a platform intended exclusively for individuals aged 18 and above. We do not knowingly collect or process personal data from anyone under the age of 18.

If you are a parent or guardian and believe that your child under the age of 18 has registered for or used the X Poker platform without your knowledge, please contact us immediately at support@xpoker.online. X Poker will take immediate action to:

• Suspending and investigating the account in question.
• Deleting all such children's personal data from our systems once identity has been verified.
• Refunding any deposited funds, where applicable, to the original payment method.

X Poker reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legislative changes, or platform improvements. Any material changes will be communicated to members via:

• An email notification sent to your registered email address at least 14 days before the changes take effect.
• A prominent notice within the X Poker platform when you log in.
• Updates to the "Last Updated" date at the top of this page.

Your continued use of the X Poker platform after the effective date of any Privacy Policy changes will be considered your acceptance of the updated policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way X Poker processes your personal data, please do not hesitate to get in touch:

• Privacy Email: support@xpoker.online (Subject: "Privacy Policy Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week within the X Poker platform
• Language: Bahasa Melayu and English are accepted
• Response Time: Within 3 business days for privacy-related enquiries

For formal privacy complaints requiring investigation, please send full details via email with the subject line "Formal Privacy Complaint – [Your Account Number]". X Poker will acknowledge receipt of your complaint within 24 hours and provide a full update within 14 business days.

If you are not satisfied with X Poker's response to your privacy complaint, you have the right to escalate the matter to Malaysia's Personal Data Protection Department (PDPA) or the relevant regulatory authority.