Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") is published by xin77, operator of the online sports betting and live casino platform accessible at https://xin77.casa (the "Platform"). xin77 is committed to protecting the privacy and personal data of all individuals who interact with the Platform.

This Policy applies to all personal data collected from users ("Members", "Players", "you") when you visit the Platform, register an account, make a deposit or withdrawal, place a bet, use any game or service, or communicate with our support team. It also covers data collected from visitors who browse the Platform without registering an account.

By accessing or using the xin77 Platform, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, please discontinue use of the Platform. This Policy should be read in conjunction with our Terms & Conditions.

For the purposes of this Policy, the following definitions apply:

xin77 is the Data Controller responsible for personal data collected through the Platform at https://xin77.casa. As Data Controller, xin77 determines the purposes for which personal data is collected and the means by which it is processed.

xin77 has designated a point of contact for all privacy-related enquiries, requests, and complaints. Contact details are provided in Section 15 (Contact Us) of this Policy. We aim to respond to all data-related correspondence within 14 calendar days of receipt.

Where xin77 engages third-party service providers to process personal data on its behalf (such as payment processors, KYC verification providers, and cloud infrastructure providers), such processors are contractually required to process data only in accordance with xin77's instructions and to implement appropriate technical and organisational security measures.

xin77 collects personal data through several channels. The categories of data we collect are set out below:

4.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, and chosen username.
• Contact details: Phone number and, where provided, residential address.
• KYC documentation: Government-issued identity documents (e.g., MyKad, passport), proof of address, and source-of-funds documentation where required for enhanced due diligence.
• Financial information: Payment account details (e.g., bank account numbers, e-wallet identifiers for DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong) as required to process deposits and withdrawals in MYR.
• Communications: Messages, complaints, and other correspondence submitted to our support team via live chat, email, or WhatsApp.

4.2 Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage data: Pages visited, features accessed, session duration, click paths, and platform navigation patterns.
• Transaction data: Full history of deposits, withdrawals, bets placed, games played, bonuses received, and account balance movements.
• Location data: Approximate geographic location derived from IP address, used for fraud prevention and access control purposes.
• Cookie and tracking data: As described in Section 11 of this Policy.

4.3 Data From Third Parties

• Identity verification results from KYC providers engaged by xin77 to confirm User eligibility and age.
• Fraud screening and risk assessment signals from payment processors and fraud prevention services.
• Referral attribution data where a User registers via a referral link.

The following table sets out the primary purposes for which xin77 processes personal data and the categories of data involved:

xin77 does not use personal data for automated decision-making that produces significant legal effects on Users, unless required by law or as part of fraud detection processes where the User is notified and afforded the right to human review.

xin77 processes personal data only where a valid legal basis exists. The applicable legal bases are:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions — including account management, bet settlement, and payment processing.
• Legal Obligation: Processing required to comply with applicable laws, including KYC/AML obligations, age verification requirements, and regulatory reporting duties.
• Legitimate Interests: Processing conducted in pursuit of xin77's legitimate business interests — such as fraud prevention, platform security, responsible gambling monitoring, and internal analytics — where those interests are not overridden by the User's rights.
• Consent: Processing for optional purposes — primarily promotional communications — where we have obtained your specific, informed, and freely given consent. You may withdraw consent at any time without affecting prior processing.

xin77 does not sell, trade, or rent personal data to third parties. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to written data processing agreements:

• Payment processors: Including providers of DuitNow, FPX, and e-wallet gateway services, who require transaction data to process MYR deposits and withdrawals on behalf of xin77.
• KYC and identity verification providers: Third-party services engaged to verify User identity documents and confirm age eligibility in compliance with applicable law.
• Fraud prevention and AML services: Providers of risk-scoring, sanctions screening, and behavioural analytics tools used to detect and prevent financial crime.
• Cloud infrastructure and hosting providers: Companies providing secure server, database, and content delivery infrastructure on which the xin77 platform operates.
• Customer communications platforms: Providers of live chat, email, and messaging infrastructure used to deliver support services.
• Regulatory and law enforcement authorities: Where disclosure is required or permitted by applicable law, court order, or regulatory direction.
• Responsible gambling organisations: Anonymised or pseudonymised data may be shared with licensed problem gambling support organisations where required by regulation or in connection with self-exclusion programmes.

In the event of a merger, acquisition, or sale of xin77 assets, personal data held by xin77 may be transferred to the successor entity, subject to equivalent privacy protections. Users will be notified of any such transfer in advance where practicable.

Some of xin77's third-party service providers and infrastructure partners may be located in countries outside Malaysia. Where personal data is transferred internationally, xin77 ensures that appropriate safeguards are in place to protect that data to an equivalent standard as required under applicable data protection legislation.

Safeguards employed for international transfers include:

• Contractual clauses that impose data protection obligations equivalent to those applicable within Malaysia on all recipient processors.
• Transfers only to jurisdictions with recognised adequacy determinations, where applicable.
• Technical security measures — including end-to-end encryption in transit — applied to all cross-border data transmissions.

Users may request information regarding specific international transfer mechanisms applicable to their data by contacting xin77 via the contact details provided in Section 15.

xin77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

On expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised. Anonymised data — which can no longer be linked to any identifiable individual — may be retained indefinitely for aggregate statistical analysis.

xin77 implements a layered set of technical and organisational security measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between User devices and xin77 servers.
• AES-256 encryption at rest for sensitive personal data stored in xin77 databases.
• Two-factor authentication (2FA) available to all registered Users, and mandatory for administrative access.
• Role-based access controls ensuring that xin77 personnel access personal data only to the extent required for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• 24/7 intrusion detection and security monitoring with automated alerting for anomalous access patterns.
• Documented incident response procedures specifying actions to be taken in the event of a data breach, including notification timelines for affected Users and, where applicable, regulatory authorities.

xin77 uses cookies and similar tracking technologies (such as local storage and session tokens) to operate the Platform, maintain session security, remember User preferences, and analyse platform performance. We do not use third-party advertising cookies or cross-site tracking technologies.

The categories of cookies used on the xin77 Platform are:

• Strictly Essential Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load balancing cookies. These cannot be disabled without breaking core platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Users navigate the Platform — such as pages most visited and features most used. This information is used solely to improve the platform experience and is not linked to individual User identities.
• Functional Cookies: Used to remember User preferences such as language selection, display settings, and previously used payment methods, to improve the User experience on return visits.

Users may manage cookie preferences through their browser settings. Disabling non-essential cookies will not affect your ability to use the core betting and gaming features of the Platform, but may impact certain preference-based functionality. Note that blocking strictly essential cookies will prevent login and session maintenance.

As a data subject, you have the following rights with respect to your personal data held by xin77. These rights may be subject to certain limitations where compliance would conflict with xin77's legal obligations — for example, the retention of transaction records required by AML legislation.

To exercise any of the above rights, please contact xin77 via the details provided in Section 15. We will verify your identity before processing any data rights request and will respond within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days, with advance notice provided.

The xin77 Platform is strictly intended for individuals aged 21 years and above. xin77 does not knowingly collect, process, or retain personal data from individuals under the age of 21. All registrations are subject to age verification as part of the KYC process.

If xin77 becomes aware that personal data has been collected from an individual under the age of 21 without parental or guardian consent, that data will be immediately deleted and the associated account will be suspended. Any deposits received from an underage User will be returned.

If you believe that a minor has registered or is actively using a xin77 account, please contact our support team immediately via live chat or at the email address in Section 15. Reports of this nature are treated as urgent and will be actioned within 24 hours.

xin77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business practices, or platform functionality. The "Last Updated" date at the top of this page will be revised whenever material changes are made.

Where changes are material — meaning they significantly affect how your data is processed or your rights in relation to it — xin77 will notify registered Users by email and/or by displaying a prominent notice on the Platform prior to the changes taking effect.

For non-material amendments (such as clarifications or typographical corrections), the updated Policy will be published without individual notification. Your continued use of the Platform following the publication of an updated Policy constitutes acceptance of the revised terms.

Prior versions of this Policy are archived and may be requested from our support team for reference purposes.

For all privacy-related enquiries, data rights requests, or complaints regarding how xin77 handles your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 on the Platform in English, Bahasa Melayu, and Mandarin — the fastest route for urgent matters.
• Email: [email protected] (plain text only — this is not a clickable link)

When submitting a data rights request, please include your full name, registered email address, and a description of your request to enable us to identify your account and respond accurately.

If you are dissatisfied with xin77's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority or regulatory body in your jurisdiction.

This Privacy Policy was last updated on 1 January 2026 and supersedes all previously published versions. By continuing to use the xin77 platform after this date, you confirm your acceptance of this Policy in its current form.