XE88 takes your privacy seriously. This Privacy Policy clearly explains what data we collect, how it is used, who it is shared with, and your rights as a player to control your personal information on the xe88 platform.
This is how xe88 approaches your personal data protection – not merely as a legal obligation, but as a responsibility we take seriously
XE88 only collects the personal data that is strictly necessary for platform operations — account registration, financial transaction processing, and legal compliance. We do not collect data for third-party sales or advertising purposes.
All data transmitted between your browser and xe88's servers is protected by 256-bit SSL encryption — the same standard used by international-grade banking institutions. Data at rest is also encrypted using the latest industry standards.
XE88 has never and will never sell, rent, or trade players' personal data to any third party for marketing or advertising purposes. Your data belongs to you — not xe88.
Access to players' personal data within xe88's internal systems is restricted to staff with a legitimate business need only. All access is logged and regularly audited by the xe88 security team.
The xe88 Privacy Policy is designed to comply with Malaysia's Personal Data Protection Act 2010 (PDPA). You have the right to access, correct, and request the deletion of your personal data in accordance with the provisions of this Act.
In the event of any security incident involving player data, xe88 is committed to notifying affected players within the timeframe required by Malaysian law and taking immediate remediation steps.
This Privacy Policy describes XE88's data collection and management practices. By registering for or using the xe88 platform, you agree to the collection and use of your data as described in this document. This policy should be read together with Terms & Conditions xe88 forms the entire agreement between you and our platform. For any privacy-related inquiries, please email support@xe88.express.
This Privacy Policy ("Policy") is published by XE88 ("we", "xe88", or "Platform") and applies to all users and registered members of the xe88 online casino platform, accessible via the xe88 website and mobile web application. This Policy explains how xe88 collects, stores, uses, discloses, and protects your personal information ("Personal Data") in the context of providing digital entertainment services to players in Malaysia.
XE88 is committed to protecting the privacy of all players and operates in accordance with the Personal Data Protection Act 2010 (PDPA) Malaysia and relevant international data protection standards. We understand that your trust in xe88 to handle your personal information responsibly is the foundation of the long-term relationship we aim to build with every player in Malaysia.
Our Core Commitments: XE88 does not sell, rent, or trade your personal data to any third party for marketing, advertising, or any other commercial purpose unrelated to the direct provision of xe88 services to you. This is a line we do not cross.
This policy applies to all Personal Data we collect across various channels, including: (a) the account registration process, (b) gaming activity and financial transactions on the platform, (c) interactions with our customer support team, (d) use of platform features such as live chat and the internal messaging system, and (e) visits to the xe88 website even without a registered account.
When you register and use the xe88 platform, you provide several categories of personal data directly to us:
| Data Category | Specific Examples | When Collected |
|---|---|---|
| Identity Data | Full name, identity card (IC) number, date of birth | Account verification & withdrawals exceeding the limit |
| Contact Data | Malaysian phone number, email address | Account registration |
| Financial Data | Bank account number, e-wallet account holder name | Withdrawal processing |
| Address Data | Delivery address (for physical VIP gifts) | Gold VIP Rewards Programme and above |
| Communications Data | Customer support chat logs, email content | During interactions with the support team |
In addition to the data you provide directly, xe88 also collects certain categories of data automatically when you use the platform:
Gaming activity data is collected for legitimate platform operational purposes — it is required to calculate VIP cashback, detect fraudulent activity, ensure game fairness, and meet legal compliance reporting requirements. You cannot request the deletion of gaming activity data while your account remains active, as it is necessary for the operation of the service.
XE88 uses collected Personal Data solely for legitimate purposes directly related to providing you with online casino platform services. These purposes are as follows:
Regarding Marketing Communications: XE88 will send you emails and notifications about current promotions, exclusive offers, and platform updates. You can opt out of marketing communications at any time by clicking the "Unsubscribe" link in the relevant email or by adjusting your notification settings in your xe88 account. Important account-related notifications (such as transaction confirmations and security alerts) cannot be disabled.
XE88 does not share your Personal Data with third parties except in the following situations, all of which are either necessary for platform operations or required by law:
To process your deposits and withdrawals, xe88 needs to share limited transaction data with relevant Malaysian payment service providers — DuitNow (via Malaysian banking institutions), Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and banks involved in FPX processing. Data shared is limited strictly to what is necessary to process the relevant transaction, and these providers are bound by strict confidentiality agreements with xe88.
The xe88 platform uses gaming software from approved game technology providers. These providers may receive limited game session data (such as anonymous account IDs, account balances, and wagering information) necessary for the technical operation of the games. They do not receive your contact information, financial information, or identity data.
XE88 may be required to disclose Personal Data to Malaysian government authorities when:
In all of the above situations, xe88 will disclose only the minimum data necessary and will inform you of such disclosure where permitted by law.
What We Do Not Do: XE88 does not share your data with advertising companies, social media platforms, data brokers, or any third party for purposes not directly related to xe88's services to you. Your privacy is not a commodity we trade.
XE88 implements multiple layers of technical and organisational security to protect your Personal Data against unauthorised access, alteration, disclosure, or accidental destruction. The key security measures we have in place are:
Within the xe88 organisation, access to player Personal Data is governed by a least-privilege principle – only staff who require access to specific data in order to perform their assigned duties are granted that access. All access to systems containing Personal Data is logged and periodically audited. xe88 staff who handle Personal Data are bound by strict confidentiality agreements and undergo ongoing data security training.
While xe88 implements all reasonable security measures, no system is completely immune to cyber threats. In the event of a data breach involving your Personal Data, xe88 will:
XE88 uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored in your browser when you visit the xe88 platform. They allow the platform to "remember" your preferences and deliver a more personalised, seamless experience.
| Cookie Type | Purpose | Can It Be Declined? |
|---|---|---|
| Essential Cookies | Maintaining your login session, account security, and core platform functionality | No – required for the platform to function |
| Preference Cookies | Saving your language preference, platform display, and interface settings | Yes – via cookie settings |
| Analytics Cookies | Helps us understand how players use the platform for improvement purposes (aggregated data with no personal identifiers) | Yes – via cookie settings |
| Security Cookies | Detecting suspicious login attempts and protecting your account from unauthorised access | No – required for account security |
You can manage cookies through your web browser settings. Most browsers allow you to view stored cookies, delete existing ones, and block new cookies from being saved. Please note that blocking or deleting essential cookies may affect the functionality of the xe88 platform and you may need to log in again each time a session ends. For specific instructions on managing cookies in your browser (Chrome on Android, Safari on iPhone, and so on), please refer to your browser's help section.
As a xe88 player based in Malaysia, you have certain privacy rights under the Personal Data Protection Act 2010 (PDPA) Malaysia. XE88 respects these rights and provides clear channels for you to exercise them:
You have the right to request a copy of the Personal Data xe88 holds about you. Data access requests can be submitted by email to support@xe88.express, stating "Data Access Request" in the subject line. Xe88 will process your request within 21 business days and provide the data in a readable format.
If you find that your Personal Data held by xe88 is inaccurate or outdated, you have the right to request a correction. For basic details such as your phone number and email address, you can update these directly in your account settings. For more sensitive information such as your name or IC number, please contact xe88 support with the relevant supporting documents.
You have the right to request that xe88 delete your Personal Data under certain circumstances — particularly when the data is no longer needed for the purpose it was collected, or when you withdraw your consent to its processing. Please note that this right has limitations — xe88 may be required to retain certain data for periods stipulated under Malaysian law for compliance, accounting, or dispute resolution purposes, even after an account is closed.
To submit any request relating to your privacy rights, please email support@xe88.express with the following information: full name, xe88 account number, type of request (access / correction / deletion / other), and specific details of the relevant data. Xe88 will verify your identity before processing the request to ensure the security of your data. All requests will be responded to within 21 working days.
XE88 retains your Personal Data for as long as it is needed for the purposes stated in this Policy, or for as long as your account remains active, whichever is longer. After an account is closed, certain categories of data may be retained for a longer period for legitimate reasons:
Once the relevant retention period expires, the data will be securely deleted or anonymised so that it can no longer be linked back to you as an individual. Anonymised data may continue to be used for aggregate analytics purposes.
The xe88 platform may contain links or references to third-party services required for platform operations — such as payment providers (DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX) and game providers. When you interact with these third-party services through the xe88 platform, the respective third party's privacy policy will apply to your interactions with them.
XE88 is not responsible for the privacy practices of third parties involved in processing your payment transactions. However, xe88 only works with payment service providers that comply with Malaysian financial industry data security standards and have signed data protection agreements with xe88.
When you make a deposit using DuitNow, Touch 'n Go eWallet, or any other Malaysian e-wallet, you are also interacting with that e-wallet provider's own privacy policy. XE88 encourages you to read each provider's privacy policy separately for a complete understanding of how they handle your data.
XE88 reserves the right to update this Privacy Policy from time to time to reflect changes in our data handling practices, developments in Malaysia's data protection laws, or changes to the services we offer. When material amendments are made, we will notify you via:
Continued use of the xe88 platform after an amended Privacy Policy takes effect constitutes your acceptance of the updated policy. If you do not agree with the changes made, you have the right to close your xe88 account and request data deletion as described in Section 7.
For any inquiries, concerns, or requests regarding this Privacy Policy or xe88's handling of your Personal Data, please contact us via:
Last Updated: 1 January 2026. The current version of this Privacy Policy is always available on this page. We encourage you to review this page periodically, especially before providing additional personal information or using new features on the xe88 platform. Thank you for trusting xe88 to look after your privacy.
When you register on any online casino platform – including xe88 – you are entrusting it with some fairly sensitive information: your phone number, email address, and when making withdrawals, your bank account or e-wallet details. This is information that, if it falls into the wrong hands, can be exploited for various forms of fraud and identity abuse. That is why choosing a platform that takes data protection seriously is not just a matter of convenience – it is a matter of your financial and personal security.
In Malaysia, the Personal Data Protection Act 2010 (PDPA) sets out the minimum obligations that organisations processing Malaysians' personal data must comply with. However, meeting the legal minimum does not necessarily mean following privacy best practices. The difference between a platform that merely "complies with the law" and one that genuinely respects player privacy is visible in the details — in the clarity of their data-sharing terms, in how easily players can manage their own data, and in the actions taken when a security incident occurs.
A large part of the privacy concerns among Malaysian online casino players centres on financial transactions — deposits via DuitNow or Touch 'n Go eWallet, and withdrawals to bank accounts. xe88 understands this sensitivity and has designed our payment processing flow to minimise financial data exposure. When you make a deposit using DuitNow, for example, xe88 only receives confirmation that the payment was successful and the amount received — we do not store your banking login credentials or the account number of your source bank account unless you specifically register a withdrawal account.
For withdrawals, xe88 requires you to register a receiving bank account or e-wallet under the same name as your xe88 account. This recipient account information is stored in encrypted form within the xe88 system and is accessible only by the withdrawal processing system and authorised finance personnel. It is never used for any purpose other than processing your withdrawals and is not shared with any third party not directly involved in the processing of those transactions.
An online casino platform necessarily records players' gaming activity — this is a fundamental requirement for accurate winnings calculations, correct VIP cashback crediting, and compliance with legal audit obligations. xe88 wants to be transparent about how your gaming activity data is used so you have a full picture of what happens behind the scenes.
First, your gaming activity data — bets placed, games played, and the outcome of each round — is stored and used to calculate your account balance in real time. Without these records, the system would have no way of knowing how much you have won or lost. Second, your monthly wagering data is aggregated to determine your VIP tier and the cashback you are entitled to — a direct benefit to you. Third, gaming activity data in aggregate form (with no individual identifiers) is analysed to understand platform usage patterns, helping xe88 improve the overall user experience. Every new game launched and every interface improvement is a result of this data analysis.
The xe88 VIP Rewards Programme involves an additional layer of data use beyond that of regular players — particularly for Gold-tier members and above who receive physical gifts and have a dedicated personal account manager. Once you reach Gold VIP status and qualify for monthly physical gifts, xe88 will request your delivery address. This information is used solely for gift delivery and is only shared with the courier service to the minimum extent necessary to complete the delivery.
Your VIP account manager has access to the account information and gaming history needed to perform their role effectively — such as assisting with priority withdrawals or keeping you informed about relevant promotions. However, this access is limited and monitored. xe88 VIP account managers cannot access your password, full bank account details, or any information not required for their role. All access is logged and reviewed periodically by the xe88 security team.
Answers to the most frequently asked questions about privacy and data protection on the xe88 platform
XE88 protects your personal data with bank-grade encryption, never sells data to third parties, and is fully compliant with Malaysia's PDPA. Register for free today and enjoy a safe, transparent, and enjoyable online casino experience in Malaysia.
21+ only • Gamble responsibly • Terms & Conditions applicable