Xltoto Privacy Policy — Our Commitment to Protecting Your Information

Xltoto (https://xltoto.click) is a trusted online Sports Betting and lottery platform in Bangladesh. We place the highest importance on the privacy of our users. This Privacy Policy ("Policy") explains how xltoto collects, uses, stores, and protects your personal information.

By using our website or app, you are considered to have read and accepted this Privacy Policy. If you do not agree, please stop using our platform and contact us to close your account.

This Privacy Policy is an integral part of xltoto's Terms and Conditions. Our approach to data protection is fully transparent — we believe you have the right to know exactly how your information is used. This Privacy Policy has been developed in accordance with applicable data protection laws in Bangladesh and international best practices.

Xltoto collects different types of information for different purposes. The table below provides full details:

We only collect information that is strictly necessary to provide our services. Collecting excessive or unnecessary data is contrary to our Privacy Policy.

Xltoto uses the information it collects for the purposes listed below. In each case, we follow a minimum data use principle.

• Personal information is used to create, manage, and verify your account.
• Financial information is used to process deposits and withdrawals.
• Technical data is analyzed to detect fraud, money laundering, and suspicious activity.
• Your usage history is used to personalize betting offers and promotions based on your preferences.
• Your contact details are used to provide customer support and resolve any issues you raise.
• Aggregated usage data is analyzed to improve platform performance and usability.
• Data required to meet legal obligations is retained and used accordingly.
• Your contact details are used to send promotional emails and SMS with your consent.

Xltoto does not generally share your personal information with third parties. However, there are specific circumstances where sharing may be necessary.

• Payment Providers: Only the minimum necessary information is shared with mobile banking services such as bKash, Nagad, and Rocket to process transactions.
• Legal Obligation: Data may be disclosed under legal obligation in response to lawful requests from Bangladeshi law enforcement or regulatory authorities.
• Fraud Prevention: Relevant information may be shared to assist in investigations related to fraud or cybercrime.
• Technical Partners: Limited data may be shared with technical partners for hosting and server management purposes, and all such partners are bound by strict confidentiality agreements.
• Business Changes: In the event of a change of ownership or merger involving xltoto, your information may be transferred to the new owner, but this Policy will remain in effect.

For any data sharing, we follow a minimum necessary data policy and ensure confidentiality agreements are in place with the receiving party.

Xltoto uses cookies on its website and app to enhance your experience. Cookies are small text files stored on your device. We use the following types of cookies:

• Essential Cookies: These cookies are essential for maintaining your login session and ensuring security. They cannot be disabled.
• Functional Cookies: Used to remember your language preference, display settings, and other personalized configurations.
• Analytics Cookies: Anonymous usage statistics are collected to understand which parts of the platform are used most.
• Security Cookies: Helps detect suspicious login attempts and fraudulent activity.

You can disable cookies through your browser settings. Please note, however, that disabling essential cookies may prevent some xltoto features from working correctly. Contact our customer support team for help managing your cookie preferences.

Xltoto has implemented industry-standard security measures to protect your personal information. Our security framework operates across the following layers:

• Transmission Protection: All data transferred between your device and our servers is protected by TLS 1.3 protocol and 256-bit SSL encryption.
• Storage Protection: Sensitive data stored in our database, such as passwords, is encrypted using AES-256 encryption.
• Access Control: Only authorized personnel within xltoto can access your data, and all access is logged.
• Security Audits: Regular penetration tests and security audits are conducted by independent third-party security experts.
• Two-Factor Authentication: You can enable 2FA on your account to protect it from unauthorized access.
• Incident Response: In the event of a security breach, affected users will be notified within 72 hours.

Under xltoto's Privacy Policy, you have the following rights over your own data. Contact us to exercise any of these rights.

• Right of Access: You can find out at any time what information xltoto holds about you. Submit a request and receive a full report of your data.
• Right to Rectification: You can request corrections to any inaccurate information we hold about you.
• Right to Erasure: You may request the deletion of your personal data under certain circumstances, though information required by legal obligations must be retained.
• Right to Restrict Processing: You may request that we stop processing your information for specific purposes.
• Right to Portability: You can request an export of your data in a standard format such as CSV.
• Marketing Opt-Out: You can opt out of promotional communications at any time.

To exercise any of these rights, email us at support@xltoto.click. We will process your request within 30 days.

Xltoto does not retain your data longer than necessary. Retention periods by data type are outlined below:

• Account Information: Retained for the duration of the active account and for 5 years after closure.
• Financial Transaction Data: Retained for 7 years as required by legal obligations.
• KYC Documents: Retained for 5 years after verification.
• Betting History: For the duration of account activity and 3 years after account closure.
• Cookies & Session Data: Up to 30 days after the session ends.
• Customer Support Contact: Retained for up to 2 years after resolution.

Once the retention period expires, data is securely deleted or anonymized.

Xltoto is strictly for adults aged 18 and above. We do not knowingly collect personal information from anyone under the age of 18.

• Age verification is mandatory during the registration process.
• Age is verified through a National ID card or birth registration certificate.
• Any account identified as belonging to a minor is immediately closed and all associated data is deleted.
• If you believe your child has registered on xltoto, please contact us immediately.

Xltoto may update this Privacy Policy as needed. When changes are made, we will follow the process outlined below:

• For significant changes, you will be notified by email or SMS at least 14 days before they take effect.
• A clear notice will be displayed at the top of the website.
• The "Last Updated" date at the top of this page will always be kept current.
• Continued use of the platform after any changes will be considered acceptance of the updated Privacy Policy.
• If you do not agree to the updated policy, you will have the option to close your account and any eligible balance will be refunded.

We recommend visiting this page regularly. Previous versions of the Privacy Policy are available upon request.

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out to our dedicated Privacy Team:

We are committed to responding to privacy-related complaints within 30 days. For urgent matters, an initial response will be provided within 7 business days.