Privacy Policy —
Your Data, Protected by xhtab1

xhtab1 ("we", "us", "our", "the Platform") operates the online casino and sports betting website located at xhtab1.cam and associated digital services. We are committed to protecting the privacy and personal data of all Users ("you", "your") who interact with our Platform, including players based in Malaysia and other permissible jurisdictions.

This Privacy Policy ("Policy") sets out how xhtab1 collects, uses, stores, shares, and protects your personal information in connection with your use of the Platform. It also describes your rights in relation to that data and how you may exercise them.

This Policy applies to all Users of xhtab1.cam, including registered Account holders, visitors who browse the Platform without registering, and individuals who contact our customer support team. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read alongside our Terms & Conditions.

The following definitions apply throughout this Policy:

• "Personal Data" means any information that identifies or could reasonably identify a living individual, directly or indirectly — including name, email address, IP address, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Controller" means xhtab1, as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Processor" means a third party that processes Personal Data on behalf of xhtab1 under a data processing agreement — for example, payment service providers or cloud hosting partners.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a specified purpose.
• "KYC" means Know Your Customer — the identity verification and age verification process required by xhtab1 prior to certain transactions, in compliance with applicable anti-money laundering and responsible gambling obligations.

xhtab1 collects Personal Data through several channels in the course of providing its services. The categories of data we may collect are set out below:

When you create an Account on xhtab1, we collect information you provide directly, including your full name, date of birth, email address, username, password (stored in hashed form), country and city of residence (including Malaysian cities such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam), preferred currency (MYR), and preferred language.

To comply with our regulatory obligations, we collect identity and age verification documents including: a valid Malaysian government-issued identity document (MyKad, Passport, or Driver's Licence), proof of residential address (utility bill, bank statement, or similar document dated within 3 months), and in certain cases, a selfie or photograph taken whilst holding your identity document. This data is processed solely for compliance purposes and is stored securely with restricted internal access.

When you make deposits or withdrawals, we record transaction amounts, payment method used (including Malaysian payment methods such as Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, DuitNow, FPX, and cryptocurrency wallets), timestamps, and transaction reference numbers. We do not store full card numbers or full e-wallet account credentials — payment processing is handled by our regulated payment service providers.

We maintain records of your betting and gaming activity on the Platform, including wagers placed, game sessions, sports markets accessed (EPL, Liga Super Malaysia, UFC, and others), bonus usage, and Account balance history. This data is required for contractual performance, dispute resolution, and regulatory compliance.

When you access the Platform, we automatically collect technical information including your IP address, device type, operating system, browser type and version, screen resolution, referring URL, pages visited, session duration, and time zone. This data helps us optimise the Platform experience and detect fraudulent or suspicious activity.

If you contact our customer support team — via live chat, email, or any other channel — we retain records of those communications, including the content of your messages and our responses. This assists with quality assurance, dispute resolution, and staff training.

xhtab1 processes your Personal Data for the following purposes:

xhtab1 processes your Personal Data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Performance: Processing necessary to fulfil our obligations under the Terms & Conditions you accepted when registering your Account — including Account creation, payment processing, and bet settlement.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC verification, AML obligations, and responses to lawful authority requests.
• Legitimate Interests: Processing necessary for xhtab1's legitimate business interests — such as fraud prevention, Platform security, and improving service quality — provided those interests are not overridden by your rights and freedoms.
• Consent: Processing for which you have provided explicit, informed consent — primarily marketing communications. You retain the right to withdraw consent at any time without affecting the lawfulness of prior processing.

xhtab1 does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We may share your data with the following categories of recipients only to the extent necessary and under appropriate safeguards:

• Payment Service Providers: Malaysian payment processors including DuitNow, FPX, and e-wallet operators (Touch 'n Go, Boost, GrabPay) receive transactional data required to process your deposits and withdrawals. Cryptocurrency transactions are processed via regulated blockchain infrastructure.
• KYC & Identity Verification Partners: Third-party identity verification services that assist us in meeting our age verification and AML obligations. These partners operate under strict data processing agreements.
• Cloud Infrastructure & Hosting Providers: Secure cloud hosting partners that provide the infrastructure on which xhtab1 operates. All infrastructure providers are bound by contractual data protection obligations.
• Game Content Providers: Licensed international game studios receive session data necessary to operate the games you play. These providers do not receive your financial or identity data.
• Regulatory Authorities & Law Enforcement: xhtab1 may disclose Personal Data to regulatory authorities, licensing bodies, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or to protect the rights and safety of xhtab1, its Users, or third parties.
• Professional Advisers: Legal advisers, auditors, and compliance consultants acting in their professional capacity may access data under applicable confidentiality obligations.

xhtab1 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. The types of cookies used on xhtab1 are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These enable core features such as Account login sessions, security tokens, and payment session management. They cannot be disabled without impairing Platform functionality.
• Analytical / Performance Cookies: Used to collect anonymised data on how Users interact with xhtab1 — including pages visited, time on site, and error events. This data helps us improve Platform performance and stability.
• Functional Cookies: Remember your preferences such as language selection (English, Bahasa Melayu, Mandarin), preferred currency (MYR), and responsible gambling settings.
• Marketing / Targeting Cookies: Where you have consented, these cookies enable us to deliver relevant promotional content. You may withdraw consent at any time via your browser settings or Account preferences.

You may control cookie preferences through your web browser settings. Please note that disabling certain cookies may affect your ability to access some features of the Platform. xhtab1 does not use cookies to serve advertising from third-party ad networks.

xhtab1 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any applicable legal retention obligations. Our general retention periods by data category are as follows:

Upon the expiry of applicable retention periods, Personal Data is securely deleted or anonymised in accordance with our internal data management procedures. Where data is anonymised rather than deleted, the anonymised data can no longer be linked back to you and falls outside the scope of this Policy.

Subject to applicable law and certain limited exceptions, you hold the following rights in relation to your Personal Data held by xhtab1. To exercise any of these rights, please contact our support team at [email protected]. We will respond to all verified requests within 30 calendar days.

xhtab1 implements appropriate technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and xhtab1's servers — verifiable by the padlock icon in your browser's address bar at xhtab1.cam.
• Encryption at rest for sensitive data categories including KYC documents, hashed passwords, and financial records stored on our infrastructure.
• Two-factor authentication (2FA) available to all Account holders as an additional security layer to prevent unauthorised Account access.
• Role-based access controls limiting internal staff access to Personal Data on a strict need-to-know basis, with access logs maintained and audited.
• Regular security assessments including vulnerability scanning and penetration testing of Platform infrastructure.
• Incident response procedures providing for prompt investigation and, where legally required, notification of any data security incident to affected Users and relevant authorities.

Whilst xhtab1 takes all reasonable steps to protect your data, no system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your own Account login credentials and for taking appropriate steps to secure your own devices.

As an internationally licensed platform serving Malaysian players, xhtab1 may transfer Personal Data to servers or service providers located outside of Malaysia. Where such transfers occur, xhtab1 ensures that appropriate safeguards are in place to protect your data, including:

• Transfers to countries or organisations that provide an adequate level of data protection as recognised by applicable standards.
• Data processing agreements incorporating standard contractual clauses that impose equivalent data protection obligations on recipient processors.
• Binding corporate rules or equivalent frameworks where transfers occur within a group of affiliated entities.

Where you wish to obtain further information about the safeguards applicable to specific international data transfers, you may submit a written enquiry to [email protected].

xhtab1 is strictly a 21+ only platform. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21. If we discover or are notified that Personal Data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated Account without payment of any winnings.

Our KYC process is designed to verify both identity and age before any withdrawal is processed. If you have reason to believe that a minor has registered on xhtab1, please notify us immediately at [email protected]. We will investigate all such notifications promptly and in confidence.

xhtab1 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Where changes are material, we will provide reasonable advance notice to registered Users — typically via email notification or a prominent in-Platform notice.

The "Last updated" date displayed in the Table of Contents reflects the date of the most recent material revision to this Policy. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by xhtab1, please contact our support team through the following channels:

• Support Email: [email protected] — for all data rights requests and privacy enquiries.
• Live Chat: Available 24/7 through the xhtab1 website — average response time of 3–5 minutes.
• Languages: English, Bahasa Melayu, and Mandarin — all queries welcome.
• Operating Hours: 24 hours a day, 7 days a week, Malaysian Time (GMT+8).

If you are unsatisfied with our response to a privacy concern or data rights request, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.