xe8my Privacy Policy — How We Protect Your Data

1. Personal Data We Collect

Xe8my collects your personal data from various sources in the course of your use of our platform. The types of data collected and their respective sources are as follows:

1.1 Data You Provide Directly

When registering an account or using xe8my's services, you provide the following information directly to us:

• Registration Information: Full name, Malaysian phone number, email address and your chosen password.
• Identity Verification Information: Where required for withdrawal or legal compliance — a copy of your identification document (MyKad or passport) and a selfie for facial verification.
• Payment Information: Account details required to process deposits and withdrawals — including your Touch 'n Go account number, DuitNow account, GrabPay account number, Boost, ShopeePay, or FPX banking information. xe8my does not store credit or debit card numbers directly — card transactions are processed through a PCI-DSS certified payment gateway.
• Contact Information: Any information you share when contacting the xe8my customer support team via live chat or email.

1.2 Automatically Collected Data

When you use the xe8my platform, our systems automatically collect certain information for security, performance, and service improvement purposes:

• Technical Log Data: IP address, browser type, device operating system, screen resolution, and device identifier.
• Session Data: Login and logout times, session duration, pages visited within the platform and navigation sequences.
• Betting Activity Data: Betting history, amounts wagered, games played, wins and losses — retained for record-keeping, security and legal compliance purposes.
• Cookie Data: Information stored in your browser cookies for functional and analytics purposes — as further explained in Section 5.
• General Location Data: Your country or region based on your IP address, for eligibility verification and legal compliance purposes. xe8my does not collect precise GPS location data from your device without your consent.

2. Purposes and Legal Basis for Data Processing

Xe8my uses your personal data only for legitimate purposes as outlined below. Each purpose is supported by a valid legal basis under Malaysia's PDPA 2010:

• Account Management: Creating and maintaining your account, processing logins, and managing account settings — required for the performance of the service contract between you and xe8my.
• Financial Transaction Processing: Processing deposits via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and FPX, as well as withdrawals to your bank account or e-wallet — required for the performance of a contract.
• Identity Verification and Fraud Prevention: Verifying that you are who you claim to be, and preventing fraud, money laundering and unauthorised access — based on legal obligations and xe8my's legitimate interests.
• Legal Compliance: To comply with the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), PDPA 2010, and other applicable Malaysian laws — required for legal compliance.
• Customer Support: Handling your enquiries, complaints and assistance requests — required for the performance of our contract and xe8my's legitimate interests.
• Platform Security: To detect and prevent unauthorised access, fraud, spam, and other harmful activity on the platform — based on xe8my's legitimate interests.
• Service Improvement: To analyse usage patterns and improve the functionality, performance, and user experience of the xe8my platform — based on xe8my's legitimate interests and with your consent where applicable.
• Service Communications: To send important notifications relating to your account, transactions, and policy changes — required for the performance of our contract with you.
• Marketing (with Consent): Sending promotions, special offers and service-related updates from xe8my — only with your explicit consent, which you may withdraw at any time.

3. Data Storage and Security

Xe8my stores your personal data in a secure server environment with stringent access controls. All data is held in data centres that meet international industry security standards. The technical and organisational security measures we have in place include:

• 256-bit SSL/TLS encryption for all communications between your browser and xe8my's servers.
• Data-at-rest encryption for all sensitive information stored in our databases.
• Role-based access control (RBAC) — only staff who require access to specific data to carry out their duties are permitted to do so.
• Round-the-clock security monitoring with automated intrusion detection systems.
• Periodic security audits and penetration testing conducted by independent third parties.
• Tested and documented security incident response procedures.
• Two-factor authentication (2FA) for staff access to internal systems containing user data.

While xe8my takes all reasonable steps to protect your data, no security system can guarantee absolute protection against every threat. In the event of a data breach affecting your personal information, xe8my will notify you within the timeframe stipulated by PDPA 2010 and take immediate action to contain and remediate the situation.

4. Sharing Data with Third Parties

Xe8my does not sell, rent, or transfer your personal data to third parties for marketing purposes. However, there are certain situations where we need to share your personal data with specific parties in order to operate the platform:

4.1 Authorised Service Providers

Xe8my shares only the minimum necessary personal data with trusted service providers who help us operate the platform — including payment gateway providers (for processing Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay and FPX transactions), cloud service providers, gaming software providers and analytics service providers. All such providers are bound by strict data confidentiality agreements and are only permitted to process your data in accordance with xe8my's instructions and for the stated purposes.

4.2 Legal Requirements

Xe8my may be required to disclose your personal data to Malaysian authorities where compelled by law — including the police, courts, the Malaysian Anti-Corruption Commission (MACC), Bank Negara Malaysia, or other government agencies with the legal authority to request such information. In all such cases, xe8my will verify that the request is legitimate and legally valid before disclosing any information.

4.3 Business Transfers

If xe8my is involved in a merger, acquisition or business asset transfer, members' personal data may be transferred as part of that transaction. In such cases, members will be notified in advance, and the new entity receiving the data will be bound by this Privacy Policy or an equivalent policy.

5. Cookies and Tracking Technologies

Xe8my uses cookies and similar tracking technologies to enhance the user experience, maintain platform security, and understand how our platform is used. The types of cookies used by xe8my are:

• Essential Cookies: Required for core platform functionality — such as maintaining your login session and remembering your security settings. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: To store your preferences such as display language, game display settings, and frequently used account information for a more convenient experience on return visits.
• Performance and Analytics Cookies: Collects anonymised data on how users interact with the xe8my platform — such as the most frequently visited pages, time spent in each section, and errors encountered. This data helps us improve the platform.
• Security Cookies: Used to detect suspicious activity, prevent fraud, and protect your account from unauthorised access.

You can manage cookie use through your browser settings. However, disabling essential cookies will affect the functionality of the xe8my platform. For information on how to manage cookies in your browser, please refer to the help section of your browser.

6. Cross-Border Data Transfers

In the context of online entertainment platform services, some xe8my service providers — such as international game software providers — may operate outside Malaysia. Where your personal data needs to be transferred outside Malaysia for legitimate processing purposes, xe8my ensures that:

• Transfers are made only to countries or entities that provide a level of data protection equivalent to or higher than the PDPA 2010 Malaysia standard.
• Appropriate data transfer agreements — such as recognised Standard Contractual Clauses — are in place with all international data recipients.
• Every cross-border data transfer is limited to the minimum data required for the specific purpose only.
• Xe8my maintains records of all cross-border data transfers and ensures they comply with the requirements of PDPA 2010.

7. Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal data held by xe8my. xe8my respects and facilitates the exercise of the following rights:

• Right of Access: You have the right to request a copy of the personal data we hold about you. Requests will be processed within 21 working days and may be subject to a reasonable nominal fee in accordance with PDPA 2010.
• Right to Correction: If the personal data xe8my holds about you is inaccurate or out of date, you have the right to request a correction. You may also update most of your profile information directly in your xe8my account settings.
• Right to Erasure: In certain circumstances — particularly upon account closure where no applicable legal retention requirement exists — you have the right to request the deletion of your personal data. Deletion requests will be processed within 30 business days.
• Right to Restriction of Processing: You have the right to request that xe8my restrict the processing of your data under certain circumstances — for example, while the accuracy of disputed data is under investigation.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests in certain circumstances.
• Right to Withdraw Consent: Where we process your personal data based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal.

To exercise any of the rights above, please contact the xe8my privacy team by email at support@xe8my.click with the subject line "Personal Data Rights Request — [Your Full Name and Account Number]". We may need to verify your identity before processing your request to ensure the security of your personal data.

8. Data Retention and Deletion

Xe8my retains your personal data for as long as necessary to fulfil the original purpose of collection, or for as long as required under applicable Malaysian law — whichever is longer. xe8my's data retention periods are as follows:

• Active Account Data: Retained for the duration your account is active, plus a minimum of 7 years after account closure in accordance with Malaysian financial and tax legal requirements.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with AMLA and the Malaysian Income Tax Act requirements — whether the account is active or closed.
• Security Logs: Retained for 2 years for security incident and fraud investigation purposes.
• Support Communication Records: Retained for 3 years for training, quality control and dispute resolution purposes.
• Identity Verification Data (KYC): Retained for 7 years after the business relationship ends, in accordance with AMLA requirements.

Once the retention period expires and there is no other legal basis for retaining the data, xe8my will securely delete or destroy your personal data using methods that ensure it cannot be recovered by any party.

9. Children's Privacy

The xe8my platform is exclusively for adults aged 18 and above. xe8my does not knowingly collect, process or store the personal data of anyone under the age of 18. Should we discover that personal data belonging to a minor has been collected without our knowledge, we will take immediate action to delete that data and close the account in question.

Parents or guardians who discover that a child under the age of 18 has registered for or used the xe8my platform are requested to contact our support team immediately at support@xe8my.click so that we can take the appropriate action promptly.

10. Changes to This Privacy Policy

Xe8my reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements, or changes to the services we offer. Where material amendments are made — meaning those that significantly affect how we use your personal data — we will:

• Publishing a clear notice on the xe8my platform homepage at least 14 days before any amendment takes effect.
• Updating the "Last Updated" date at the top of this Privacy Policy page.
• Sending a notification to the email address or phone number registered to your account for amendments that materially affect your privacy rights.

Your continued use of the xe8my platform after any amendment takes effect constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you have the right to close your account and request deletion of your data before the amendment comes into force.

11. How to Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by xe8my, please contact us via:

• Privacy Email: support@xe8my.click (use the subject line "Data Privacy Enquiry")
• Live Chat: Via the Live Chat button within the xe8my platform — available 24 hours a day, 7 days a week
• Response Time: We will respond to privacy-related enquiries within 5 business days

If you are dissatisfied with xe8my's response to your privacy enquiry or complaint, you have the right to lodge a complaint with Malaysia's Personal Data Protection Department (PDPD) — the regulatory body responsible for overseeing PDPA 2010 compliance in Malaysia.