Xx5 understands that your trust is our most valuable asset. When you register and play with us, you are entrusting us with your personal information — and we do not take that responsibility lightly. This Privacy Policy is written in plain, straightforward language rather than legal jargon, because we want you to truly understand how your data is handled.
This document describes the types of data we collect, why we need it, how it is protected, and the rights you have as the owner of that data. This policy applies to all xx5 platform users, including our website and mobile app.
By using the xx5 platform, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please discontinue use of the platform and contact us to close your account.
1. Introduction & Scope of This Policy
This Privacy Policy is issued by xx5 and applies to all services, products and platforms operated under the xx5 brand, including the official website at xx5.plus and the mobile app available for download via the Download us.
We are fully compliant with Personal Data Protection Act 2010 (PDPA) Malaysia, which governs how organisations collect, process and store personal data in Malaysia. This compliance is more than an obligation — it is part of xx5's commitment to being the most trusted online gambling platform in Malaysia.
- This policy applies to all registered members and website visitors
- Data collection begins from your very first visit to our website
- We act as the data controller for all information you provide
- Any privacy-related disputes will be resolved in accordance with Malaysian law
2. Personal Data We Collect
We only collect information that is strictly necessary to deliver a safe, seamless and compliant service. The following are the categories of data we collect:
A. Information You Provide Directly
- Full name as shown on your identification card or passport
- Date of birth (to verify you are 21 years of age or older)
- Active mobile number registered in your name
- Personal email address
- Current residential address
- Bank account details and payment information for deposits and withdrawals
- Copies of identity documents (KYC) when required
B. Data Collected Automatically
- IP address and geolocation information (city/state level)
- Device type, operating system and web browser version
- History of gaming activity and transactions on the platform
- Login time, session duration and usage patterns
- Cookie data and session identifiers
| Data Category | Purpose of Collection | Retention Period |
|---|---|---|
| Personal Identity | Account verification & KYC | Throughout the active account period + 7 years |
| Financial Information | Deposit & withdrawal processing | 7 years (tax compliance) |
| Activity Data | Security & fraud detection | 2 years after account closure |
| Technical Data | Platform improvement & security | 90-day rolling |
| Communication Data | Customer support records | 3 years after last interaction |
3. How We Use Your Data
Every piece of data we collect has a clear and legitimate purpose. We do not retain unnecessary data, nor do we use your data for purposes unrelated to xx5 services.
- Identity verification — verifying you are who you claim to be and that you meet the minimum age requirement
- Financial transaction processing — deposits, withdrawals, and accurate account records
- Fraud detection and prevention — protecting you and the platform from unlawful activity
- Legal compliance — meeting AML (Anti-Money Laundering) and regulatory reporting requirements
- Service improvement — analysing usage patterns to make the platform better
- Service communications — transaction notifications, security updates, and important alerts
- Customer Support — resolving your complaints and enquiries effectively
Xx5 not use your data to make automated decisions that negatively affect you without human review. Any account suspension will be manually reviewed by our team.
4. Data Sharing With Third Parties
Our principle is simple: your data is not sold, not rented, and not traded to any third party for their own commercial purposes. However, there are limited situations where data sharing is necessary to operate our services:
Trusted Service Providers
We share limited data with third-party service providers who help us operate the platform, such as payment processors, cloud infrastructure providers and identity verification companies. All such providers are bound by strict data confidentiality agreements and may only use your data for purposes we have specified.
Legal & Regulatory Requirements
Xx5 will disclose required information to lawful authorities when mandated by Malaysian law, including in financial crime investigations, money laundering cases, or court orders. We will notify you of such disclosures where the law permits us to do so.
All third-party service providers we engage have undergone rigorous security assessments and comply with international data protection standards. We do not use services from providers that fail to meet our security standards.
5. Data Security — How We Protect Your Information
Data security is a core investment at xx5. We employ a combination of cutting-edge technology and industry best practices to keep your personal information safe at all times:
- 256-bit SSL encryption for all data transmitted between your device and our servers
- Encryption of data at rest (at-rest encryption) for all databases storing personal information
- Two-factor authentication (2FA) available to all member accounts
- 24/7 security monitoring by a dedicated cybersecurity team
- Penetration testing (penetration testing) conducted periodically by independent security firms
- Role-based access control — only staff who require access to specific data are permitted
- Full audit logs for every access to sensitive member data
While we take all reasonable precautions, no system is 100% immune to cyber threats. You also play an important role in keeping your account secure by using a strong password, not sharing your login credentials, and reporting any suspicious activity to us promptly.
In the event of a data breach affecting your information, xx5 will notify you within 72 hours after we become aware of the incident, in line with industry best practices.
6. Cookies & Tracking Technologies
Xx5 uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how our platform is used. Cookies are small text files stored on your device when you visit our website.
Types of Cookies We Use
- Essential Cookies — required for core platform functions such as login and session security. These cookies cannot be disabled.
- Performance Cookies — helping us understand how users interact with the platform for continuous improvement
- Functional Cookies — saving your preferences such as language, location, and display settings
- Security Cookies — detecting and preventing fraudulent activity and unauthorised access
You can manage your cookie settings through your web browser at any time. However, disabling essential cookies will affect platform functionality and may prevent you from logging in or completing transactions.
7. Your Rights as a Data Owner
Under Malaysia's PDPA 2010 and global best practices, you have the following rights regarding your personal data held by xx5:
Right of Access
You may request a copy of all personal data we hold about you at any time.
Right to Rectification
If any of your data is inaccurate or outdated, you have the right to request that we correct it.
Right to Erasure
You may request the deletion of your data, subject to our legal record-keeping obligations.
Right to Object
You have the right to object to the processing of your data for direct marketing purposes at any time.
Right to Portability
You may request your data in a structured, machine-readable format for portability.
Restriction Rights
You may request that we restrict the processing of your data under certain circumstances provided by law.
To exercise any of the above rights, contact our privacy team via live chat or support email. We will process your request within 30 days calendar days from the date of receipt.
8. Data Retention Period
Xx5 does not retain your personal data longer than necessary. Retention periods are determined based on the original purpose of collection and applicable legal compliance requirements.
When you voluntarily close your xx5 account, we will retain your identity information and financial records for 7 years after account closure to comply with the Income Tax Act requirements and AML regulations. After this period, your data will be permanently deleted or anonymised.
Technical data and system logs are retained for a rolling 90 days. Customer support communication data is retained for 3 years for reference and resolution of any disputes that may arise later.
9. Protection of Minors
Xx5 is a platform dedicated exclusively to individuals aged 21 years and above. We do not intentionally collect, store or process any personal data from individuals below the stipulated minimum age.
Should we discover that we have inadvertently collected data from an individual who is underage, we will take immediate action to delete all such data and close the relevant account without any compensation. Parents or guardians who become aware that a minor under their care has registered on our platform are encouraged to contact us immediately.
10. How to Contact Us Regarding Privacy
If you have any questions, concerns or wish to exercise your data rights, the xx5 privacy team is here to help. We are committed to responding to all privacy-related enquiries within a reasonable timeframe.
You can reach our support team via live chat available 24 hours a day, 7 days a week, directly within the platform. All privacy-related enquiries are handled by a dedicated team trained in data management and PDPA compliance.
For complaints that cannot be resolved through our internal channels, you have the right to submit a complaint to Department of Personal Data Protection Malaysia under the Ministry of Communications and Digital.
Why Your Privacy Is Safe with xx5
Six concrete reasons why xx5 members can play with complete peace of mind without worrying about their personal data.
End-to-End Encryption
Every bit of data moving between your device and xx5 servers is protected by 256-bit SSL encryption — the same standard used by leading banks in Malaysia.
No Direct Sale of Data
Your data has never been sold to advertisers, data brokers or any third party for their commercial gain. This is an absolute commitment by xx5, not merely a promise written in a document.
Malaysia PDPA Compliance
Xx5 operates in full compliance with Malaysia's Personal Data Protection Act 2010. We undergo regular compliance reviews to ensure our practices remain aligned with the latest legal requirements.
You Are in Control
Through your account settings, you can easily manage your privacy preferences, manage cookies and request data deletion. You hold full control over your personal data.
Regular Security Audits
Independent cybersecurity firms conduct penetration testing and security audits on xx5's infrastructure on a regular basis to identify and close any vulnerabilities before they can be exploited.
Immediate Breach Notification
In the event of a security incident involving your data, we are committed to notifying you within 72 hours — well ahead of what many privacy laws require.