Privacy Policy xe8my — Member Data Protection & Information Security

This Privacy Policy explains the data collection and processing practices of xe8my ("we", "Platform") in connection with all services we offer through the xe8my website, mobile app and any official communication channels.

We take your privacy seriously. In today's digital world, personal data is a trust that users place in the platforms they choose — and xe8my is committed to honouring that trust fully. Every decision we make regarding user data is grounded in the principles of transparency, minimum necessity and the highest level of security.

This Privacy Policy applies to all registered members, website visitors, app users and anyone who interacts with the xe8my platform. By using any of our services, you agree to the practices described in this document.

Xe8my collects personal data only when it is required to provide our services safely, efficiently, and responsibly. The following are the categories of data we collect:

A. Data You Provide Directly

• Identity information: Full name, MyKad number, date of birth, gender, and nationality.
• Contact information: Email address, mobile number and residential address.
• Financial information: Bank account number, bank name, account holder name, and payment methods used.
• KYC documents: MyKad copy, bank statement, or other identity verification documents submitted during the verification process.
• Support communications: Conversation content with the xe8my support team via live chat or email.

B. Data Collected Automatically

• Device data: Device type, operating system, phone model and unique device identifier.
• Network data: IP address, internet service provider (ISP) and general location based on IP.
• Activity data: Login activity, session times, wagering records, transaction records, and platform usage patterns.
• Cookie data: Session cookies, preference cookies, and analytics cookies that help us understand how users interact with the platform.

The personal data we collect is used for specific, legitimate purposes. xe8my does not use your data for purposes other than those stated here without obtaining additional consent from you.

Xe8my does not sell, rent, or trade member personal data to third parties for marketing or commercial purposes. However, there are limited circumstances where data may be shared:

• Payment service providers: Required transaction information is shared with licensed payment processors such as banks and e-wallet providers to process deposits and withdrawals.
• Licensed game providers: Minimum technical data required is shared with gaming platform providers to ensure account functionality operates correctly.
• Authorities: xe8my will disclose data to the Royal Malaysia Police (PDRM), Bank Negara Malaysia, or other relevant authorities when required by law or court order.
• Security safeguards: Data may be shared with cybersecurity firms we engage to detect and prevent fraud and cyberattacks.

All third parties receiving xe8my member data are bound by strict confidentiality agreements and may only use that data for the specified purposes.

Your data security is a technical responsibility we take extremely seriously. xe8my implements multiple layers of security to protect your personal data from unauthorized access, breaches, or loss.

• 256-bit SSL encryption: All communications between your browser or app and xe8my's servers are encrypted using TLS 1.3 — the same standard used by leading banking institutions worldwide.
• Two-factor authentication (2FA): An additional security layer for account login that requires verification through a registered device.
• Internal access control: xe8my staff may only access user data based on their work requirements. Access is logged, monitored, and reviewed on a regular basis.
• Regular security testing: The xe8my platform undergoes regular penetration testing and security audits by independent third parties.
• Backup and disaster recovery: Data is automatically backed up to separate data centres to ensure availability and integrity in unexpected situations.

Xe8my uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Cookies are small text files stored on your device when you visit our website.

Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as login verification and session security. These cookies cannot be disabled.
• Preference Cookies: Saves your preferences such as language and display theme to make your experience more comfortable.
• Analytics Cookies: Collects information about how you use the platform to help us make improvements. This data is collected in aggregate and does not identify individuals.
• Security Cookies: Helps detect and prevent fraudulent activity and ensures every session is legitimate.

You can manage or disable non-essential cookies through your browser settings. However, disabling essential cookies may affect platform functionality and prevent you from logging in or using certain features.

Xe8my retains your personal data only for as long as necessary for the stated purposes or as required by applicable Malaysian law. The following are general data retention guidelines:

• Active account data: Retained for the duration of the active account plus 7 years after account closure (financial compliance requirement).
• Transaction records: Retained for 7 years in accordance with Malaysia financial reporting legal requirements.
• Support communication logs: Retained for 2 years from the date of communication.
• Analytics cookie data: Deleted within 13 months from the date of collection.
• KYC documents: Retained for 5 years after account closure in accordance with anti-money laundering (AML) requirements.

When data is no longer required, xe8my will dispose of or anonymise it using secure methods. Deletion requests made by members will be processed within 30 business days, subject to applicable legal retention requirements.

As a xe8my member and data subject, you have certain rights regarding your personal data. xe8my fully respects and facilitates the exercise of these rights.

We will process all data rights requests within 30 business days. In complex cases, this period may be extended to 60 days with prior notice to you.

Xe8my does not intentionally collect personal data from individuals under the age of 18. Our platform is exclusively for adults and we take active steps to prevent registration by minors.

If we discover that we have collected personal data from an individual under the age of 18, we will take immediate steps to delete that information and close the associated account. Parents or guardians who find that their child has registered on our platform are requested to contact the xe8my support team immediately.

Xe8my reserves the right to amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform improvements. Members will be notified of any material amendments via in-app notification or email at least 14 days before they take effect.

The latest version of the Privacy Policy is always available on the xe8my website with a clear update date. We encourage you to review this Privacy Policy periodically to stay informed about how we manage your data.

Continued use of the xe8my platform after an amendment takes effect constitutes acceptance of the revised Privacy Policy. If you do not agree with any amendment, you have the right to close your account before it takes effect.

If you have any questions, concerns, or requests regarding this Privacy Policy or xe8my's management of your personal data, our team is ready to assist. We are committed to providing accurate, clear responses within a reasonable timeframe.

• Live chat: The fastest method — available 24/7 directly in the xe8my app or web platform.
• Privacy email: [email protected] — for formal written requests regarding data rights.
• Response time: Most inquiries are answered within 24 hours; formal requests within 5 business days.

For serious privacy issues such as suspected data breaches or unauthorized access, please use live chat and mark your request as "PRIVACY — URGENT" to ensure it receives immediate priority attention.