x5bet Privacy
Policy

1 Introduction

This Privacy Policy ("Policy") is published by x5bet ("we", "us", "our", "the Platform", "x5bet"), operator of the online sports betting and live casino platform accessible at https://x5bet.casa. This Policy applies to all personal data collected and processed by x5bet in connection with the registration, operation, and support of member accounts on the Platform.

x5bet serves players across Malaysia — including members in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond. We are committed to processing personal information in a responsible, transparent, and lawful manner consistent with applicable data protection legislation and international best practices.

This Policy should be read alongside our Terms & Conditions, which govern the broader legal relationship between x5bet and its members, and our Responsible Gambling Policy, which explains how we use certain data to protect vulnerable players.

2 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to a name, identification number, location data, email address, or online identifier.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" means the individual to whom the Personal Data relates — in the context of this Policy, that is the registered x5bet member or visitor.
• "Data Controller" means x5bet, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of x5bet in accordance with x5bet's instructions.
• "KYC Data" means identity, age, and address verification documents submitted by Members as part of the Know Your Customer process.
• "Sensitive Data" means Personal Data warranting heightened protection, including (where collected) financial account details and government-issued identification numbers.

3 Data Controller

x5bet acts as the Data Controller in respect of all Personal Data collected through the Platform. As Data Controller, x5bet is responsible for determining why and how Personal Data is processed, and for ensuring that such processing complies with applicable data protection obligations.

All data protection enquiries, rights requests, and complaints relating to x5bet's processing activities should be directed to our support team using the contact details set out in Section 16 of this Policy.

4 Data We Collect

x5bet collects the following categories of personal data in the course of providing and managing the Platform:

4.1 Registration & Account Data

• Full legal name;
• Date of birth (for age verification);
• Email address;
• Mobile phone number;
• Residential address (city, state, postcode — e.g. Kuala Lumpur, Selangor, Penang);
• Username and encrypted password hash.

4.2 KYC & Identity Verification Data

• Government-issued photo identification (Malaysian MyKad, passport, or equivalent);
• Proof of address documentation;
• Payment method ownership verification documents;
• Source of funds documentation (where applicable for higher-value transactions).

4.3 Financial & Transaction Data

• Deposit and withdrawal transaction records (amounts in MYR, dates, payment method types);
• Payment method identifiers (e.g., last four digits of account, e-wallet account reference) — full payment credentials are not stored by x5bet;
• Bonus and promotional transaction history;
• Account balance history.

4.4 Betting & Gaming Activity Data

• Sports bets placed (market, stake, odds, outcome, settlement);
• Casino game sessions (game title, wagers, wins, session duration);
• Betting preferences and browsing behaviour within the Platform.

4.5 Technical & Device Data

• IP address and geolocation data (country/city level);
• Device type, operating system, and browser version;
• Session timestamps, login history, and Platform navigation data;
• Cookie and tracking technology data (see Section 10).

4.6 Communications Data

• Live chat transcripts and email correspondence with our support team;
• Complaint and dispute records;
• Marketing preference settings (opt-in/opt-out records).

5 How We Collect Your Data

x5bet collects Personal Data through the following channels:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey;
• Automatically — through cookies, web beacons, and server logs as you navigate and interact with the Platform (see Section 10);
• From payment service providers — transaction confirmation data received from Malaysian payment processors including DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay, as well as banking partners such as Maybank, CIMB, Public Bank, and Hong Leong Bank;
• From identity verification services — where we use third-party KYC and anti-fraud tools to confirm the identity and age of Members;
• From fraud prevention and security partners — risk assessment signals used to detect and prevent fraudulent activity.

6 Purposes & Legal Basis for Processing

The table below sets out the principal purposes for which x5bet processes Personal Data, together with the legal basis relied upon for each processing activity.

7 Data Sharing & Disclosure

x5bet does not sell, rent, or trade your Personal Data to third parties. We share data only in the circumstances described below, and only to the extent necessary for the stated purpose:

7.1 Service Providers (Data Processors)

x5bet engages third-party service providers who process Personal Data on our behalf and under our instruction. These include:

• Payment processors: Malaysian payment infrastructure providers (DuitNow, FPX operators, e-wallet platforms) to facilitate deposits and withdrawals in MYR;
• KYC and identity verification partners: Services that verify the authenticity of government-issued identification documents;
• Fraud and risk management providers: Tools that analyse transaction and behavioural patterns to detect fraudulent activity;
• Cloud infrastructure providers: Secure server and data storage services used to host Platform data;
• Analytics providers: Services used to analyse Platform usage in aggregated, non-personally-identifiable form.

All Data Processors engaged by x5bet are bound by contractual obligations that restrict their use of your data to the specific services they provide to x5bet and require them to maintain appropriate security standards.

7.2 Legal and Regulatory Obligations

x5bet may disclose Personal Data to competent authorities, regulators, law enforcement agencies, or courts where required to do so by applicable law, regulation, court order, or in response to a lawful request by a public authority. This includes obligations under anti-money laundering, counter-terrorism financing, and problem gambling legislation.

7.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or other business restructuring involving x5bet, Personal Data held by x5bet may be transferred to the acquiring or successor entity as part of the transaction, subject to the same privacy protections described in this Policy.

8 International Data Transfers

Some of x5bet's service providers and infrastructure partners are located outside Malaysia. Where Personal Data is transferred to recipients in other countries, x5bet takes steps to ensure that appropriate safeguards are in place to protect your data, including:

• Entering into data processing agreements incorporating standard contractual clauses or equivalent safeguards;
• Ensuring that recipient countries provide an adequate level of data protection as assessed by relevant authorities;
• Applying technical and organisational security measures to data transmitted across borders.

x5bet will not transfer Personal Data internationally in circumstances where adequate protections cannot be assured.

9 Data Retention

x5bet retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve disputes or enforce agreements. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification.

10 Cookies & Tracking Technologies

x5bet uses cookies and similar tracking technologies to operate, secure, and improve the Platform. Cookies are small text files stored on your device that help us recognise returning visitors and understand how the Platform is used.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function correctly — enabling login sessions, security checks, and load balancing. These cannot be disabled without impairing Platform functionality;
• Functional Cookies: Remember your preferences such as language settings and betting interface configurations between sessions;
• Analytics Cookies: Collect aggregated, anonymised data about how visitors use the Platform to help us identify usability improvements. No individual visitor is identified through analytics cookies;
• Security Cookies: Used to detect and prevent fraudulent activity, protect against account takeover, and enforce session security.

10.2 Managing Cookies

You may configure your browser settings to block or delete cookies. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

11 Security Measures

x5bet implements a layered set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security framework includes:

• Transport Layer Security (TLS 1.2+): All data transmitted between your device and x5bet's servers is encrypted in transit using industry-standard TLS protocols;
• Password security: Member passwords are stored as salted cryptographic hashes — x5bet staff cannot view plaintext passwords;
• Two-Factor Authentication (2FA): Available to all members to provide an additional layer of Account security;
• Access controls: x5bet staff access to Personal Data is restricted on a need-to-know basis, with role-based access permissions and audit logging;
• Intrusion detection: Continuous monitoring of network traffic and system logs for anomalous activity;
• Data isolation: Payment credentials (full bank account numbers, card numbers) are not stored on x5bet's servers — they are handled directly by our certified payment processors.

12 Your Rights as a Data Subject

Subject to applicable law, you have the following rights in relation to the Personal Data that x5bet holds about you. To exercise any of these rights, contact our support team using the details in Section 16. We will respond to valid requests within 30 days of receipt.

Please note that some rights are subject to conditions and exceptions, particularly where processing is required for legal compliance, fraud prevention, or the performance of our contract with you. Where we are unable to comply with a request, we will explain the reason in writing.

13 Children & Minors

x5bet's services are strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the Account registration and KYC process.

If x5bet becomes aware that Personal Data has been collected from a person under the age of 21, we will take immediate steps to close the relevant Account, secure and delete the data, and, where appropriate, return any deposited funds to their verified source. If you believe that a minor has registered an Account with x5bet, please contact our support team immediately.

14 Third-Party Links

The x5bet Platform may contain links to third-party websites, payment portals, or service providers (for example, navigating to your bank's online banking portal to complete an FPX payment). This Privacy Policy applies solely to data processed by x5bet through the Platform. x5bet has no control over, and accepts no responsibility for, the privacy practices of third-party websites or services accessed via links from the Platform.

We encourage you to review the privacy policies of any third-party services before providing your personal information to them.

15 Amendments to This Policy

x5bet reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, or our internal data processing practices. Where amendments are material, we will notify registered Members by posting a prominent notice on the Platform or by sending an email to the address associated with your Account.

The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. We recommend reviewing this page periodically to remain informed of any changes.

16 Contact Us

If you have any questions, requests, or concerns relating to this Privacy Policy or x5bet's data processing activities, please contact our team using the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the live chat icon on the Platform. Average response under 90 seconds. This is the fastest channel for routine enquiries.
• Email: [email protected] — please use the subject line "Privacy Request" for data rights enquiries. Our team is based in Malaysia and operates on MYT (UTC+8).

We will acknowledge all data rights requests within 5 business days and provide a substantive response within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days with prior notification to you.