This Privacy Policy describes how x1bet handles personal data in connection with the use of the website x1bet-khelo.com and the x1bet mobile app. By using any x1bet service, you consent to the collection and use of your personal data as described in this document. If you do not agree with this Privacy Policy, please discontinue use of our platform.
At x1bet, we believe every member deserves to know exactly what happens to their personal information when they use our platform. This is not merely a legal obligation — it is part of how we honour the trust you place in us each time you register, deposit funds, or play on x1bet.
As an online betting platform operating in Malaysia and serving over 500,000 members, x1bet processes a significant volume of personal data every day — from registration information to financial transaction records and gaming activity. All of this data is managed to strict security standards and used solely for legitimate, transparent purposes.
This Privacy Policy is written in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) — the primary data protection legislation governing how organisations in Malaysia may collect and process the personal data of Malaysian citizens and residents. x1bet fully complies with all provisions of the PDPA and goes further in several areas to ensure the best possible protection for our members.
We encourage you to read this document carefully. If any section is unclear or you have specific questions about how we handle your data, x1bet's Privacy Officer team is reachable by email at support@x1bet-khelo.com.
X1bet collects several categories of personal data during and after the registration process. Below is a complete list of the data categories we collect, along with specific examples:
| Data Category |
Specific Information Examples |
Required? |
| Identity Data |
Full name, date of birth, MyKad number, identity card image |
Yes (KYC) |
| Contact Data |
Malaysian phone number, email address, residential address |
Yes |
| Financial Data |
EWallet account number (Touch 'n Go, GrabPay), bank account number for FPX/DuitNow |
Yes |
| Transaction Data |
Deposit records, withdrawal records, betting history, wins and losses |
Automatic |
| Technical Data |
IP address, device type, operating system, browser version, session time |
Automatic |
| Usage Data |
Pages visited, games played, session duration, settings preferences |
Automatic |
| Communication Data |
Customer support chat records, emails sent to x1bet |
Dependent |
X1bet does not collect sensitive personal data such as health information, political views, religious beliefs, or biometric data without your explicit consent, except where required by law for fraud prevention or compliance purposes.
Your personal data is collected by x1bet through several different channels:
- Directly from you: When you register an account, complete your profile, submit KYC documents, make a deposit or withdrawal, contact customer support, or fill in any form on the platform.
- Collected automatically during your use of the platform: When you access and use the x1bet platform, our systems automatically record technical and usage data via cookies, server logs, and similar tracking technologies. This data is collected to ensure the platform functions correctly and to improve the overall user experience.
- From third-party payment providers: When you deposit funds via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, these providers may share the necessary transaction information with x1bet for payment verification and processing purposes.
- From identity verification providers: For the KYC process, x1bet may engage accredited third-party services to verify the authenticity of the identity documents you submit.
- From public sources: In certain cases related to fraud prevention or anti-money laundering compliance, x1bet may refer to publicly available sources or databases permitted by law.
X1bet does not purchase or acquire personal data lists from commercial sources for marketing purposes. All data we hold is data you have provided to us directly or that has been generated through your use of our platform.
X1bet uses collected personal data solely for the purposes listed below. We do not use your data for any purpose not stated here without obtaining your additional consent:
- Service provision: Enables you to register an account, log in, deposit and withdraw funds, play games, and access all features on the x1bet platform.
- Identity verification (KYC): Verifying that you meet the minimum age requirement of 18 years and that your identity is valid, in line with legal requirements for anti-money laundering and counter-terrorism financing.
- Financial transaction processing: Processing all deposits and withdrawals accurately and securely, including verification with payment providers such as Touch 'n Go and DuitNow.
- Fraud prevention and security: Identifying and preventing fraudulent activity, unauthorised access, money laundering, and breaches of terms of service including duplicate account registration.
- Customer support: Enables our support team to assist you effectively and maintain an interaction history for service continuity.
- Platform improvements: Analysing usage patterns in aggregate (not at the individual level) to identify areas for improvement in the x1bet platform's interface, performance, and user experience.
- Service communications: Sending important account-related notifications such as deposit confirmations, withdrawal alerts, security warnings, and updates to the terms of service.
- Marketing communications (with consent): Sending information about promotions, bonuses, and exclusive offers to members who have given their consent to receive such communications. You may withdraw this consent at any time from your account settings.
- Responsible gaming: Monitoring gameplay patterns to identify members who may need support related to problem gambling, and enabling us to reach out with appropriate assistance resources.
- Legal compliance: Fulfilling the legal and regulatory obligations applicable to x1bet's operations, including reporting obligations to the relevant authorities where required by law.
X1bet does not sell, rent, or share your personal data with third parties for their own marketing or commercial purposes. This is an absolute commitment that will not change.
However, in the course of operating the platform, x1bet may need to share your personal data with selected third parties in the following circumstances:
- Payment service providers: Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and banks that process FPX transactions such as Maybank and CIMB — to process your deposits and withdrawals. These providers have their own privacy policies and are bound by industry security standards.
- Game software providers: Evolution Gaming, Ezugi, Pragmatic Play Live, Pragmatic Play, PG Soft, and other providers hosting games on the x1bet platform receive the session data required to operate live casino, slots, and other games. This data is strictly limited to what is necessary for game functionality.
- KYC service providers: An accredited identity verification company that assists x1bet in processing and validating members' identity documents during the KYC process.
- Technology infrastructure provider: Cloud computing and server hosting companies that store x1bet data — all are bound by strict data protection agreements and are not permitted to use your data for their own purposes.
- Legal authorities: x1bet will disclose personal data to the police, courts, or relevant government authorities when required to do so by Malaysian law, court order, or to assist with a legitimate criminal investigation.
All third parties that receive data from x1bet are bound by legally enforceable data protection agreements and are required to handle your data to a standard of security equivalent to or higher than that applied by x1bet itself.
X1bet invests significantly in security infrastructure to ensure your personal data is protected against unauthorised access, disclosure, alteration, or destruction. The key security measures we employ are:
- 256-bit SSL/TLS Encryption: All data transmitted between your device and x1bet's servers is encrypted using TLS 1.3 — the highest available standard for web communication security.
- Data encryption at rest: Personal and financial data stored in x1bet's databases is encrypted using AES-256, ensuring the data remains unreadable even in the event of a server compromise.
- Internal access controls: Only x1bet staff with a clear operational need are permitted to access user data. All access is logged and audited on a regular basis.
- Two-factor authentication (2FA): Members are encouraged to enable 2FA for an additional layer of account protection. All internal x1bet administrative access mandatorily requires 2FA.
- 24/7 security monitoring: Our automated monitoring system detects and flags suspicious activity in real time — from repeated failed login attempts to unusual transaction patterns.
- Regular security testing: x1bet conducts regular penetration testing and security audits by independent third parties to identify and patch any security vulnerabilities.
- Staff training: All x1bet staff who handle personal data receive regular data privacy and security awareness training.
While we take all reasonable precautions, no security system is entirely infallible. In the event of a data breach affecting your rights or interests, x1bet will notify you within the timeframe stipulated by PDPA and take immediate steps to mitigate the impact.
SSL 256-bit Encryption
AES-256 Data at Rest
2FA Available
24/7 Monitoring
Regular Security Audits
X1bet retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required under Malaysian law. The following outlines our data retention guidelines:
- Active account data: For the duration that your account remains active on x1bet, plus a further 5 years after account closure, in line with Malaysia's anti-money laundering legal requirements.
- Financial transaction records: A minimum of 7 years from the transaction date, in line with Malaysian tax and financial legal requirements.
- KYC documents: For the duration of the active account period plus 5 years — required to meet statutory reporting obligations.
- Customer support communication records: 2 years from the date of last interaction — required for service continuity and dispute resolution.
- Technical log data: 90 days for standard access logs; up to 2 years for logs related to security incidents.
- Marketing data (with consent): Until you withdraw your consent to receive marketing communications. Withdrawing consent does not affect the retention of other data required for service purposes.
Once the retention period has ended, x1bet will securely delete or anonymise your data in accordance with established procedures. Data deletion is an irreversible process.
As a data subject under Malaysia's PDPA 2010, you have the following rights regarding the personal data x1bet holds about you. x1bet is committed to respecting and facilitating the exercise of all these rights:
01
Right of Access
You have the right to request a copy of the personal data x1bet holds about you. We will provide the data in a readable format within 21 days of receiving your request.
02
Right to Rectification
If you find that personal data held by x1bet is inaccurate, incomplete, or out of date, you have the right to request a correction. We will update the relevant data within 14 days.
03
Marketing Opt-Out Rights
You have the right to object to the use of your personal data for direct marketing purposes at any time. This can be done from your account settings or by contacting our team. Opting out will not affect any other services you receive.
04
Right to Restrict Processing
In certain situations — such as when you dispute the accuracy of your data or question the legal basis for its processing — you may request that x1bet restrict how your data is processed while the matter is being resolved.
05
Right to Erasure
In situations where data is no longer needed for its original purpose or where there is no legal basis to continue processing, you may request deletion of your data. This right is subject to x1bet's legal obligations to retain certain data.
06
Right to Lodge a Complaint with the PDPD
If you are dissatisfied with how x1bet has handled your privacy request, you have the right to file a complaint with the Personal Data Protection Director (PDPD) of Malaysia — the regulatory body for PDPA. However, we encourage you to contact us first so we can resolve any issues directly.
To exercise any of the rights above, please contact x1bet's Privacy Officer at support@x1bet-khelo.com with the email subject "Data Privacy Request". We will respond within 3 business days and fulfil the request within the timeframe stipulated by the PDPA.
X1bet uses cookies and similar tracking technologies on our website and mobile app. Cookies are small text files stored on your device that help us remember your preferences and improve your experience on the x1bet platform. The following are the types of cookies we use:
Required for the core functionality of the x1bet platform — including verifying your login session, form security, and language preferences. These cookies cannot be disabled as they are essential to the platform's operation. They do not store any personal information that could be used for marketing purposes.
Helps us understand how members use the platform — which pages are visited most, how long sessions last, and where users encounter difficulties. This data is collected in aggregate and anonymised form for product improvement purposes. You may disable these cookies without affecting the core functionality of the platform.
Stores your personal preferences such as your chosen language, display settings, favourite games, and last selections. These cookies allow the x1bet platform to deliver a more personalised experience each time you return. Can be disabled without affecting core functionality.
Used by x1bet's security systems to detect and prevent fraudulent activity — including blocking duplicate account registrations, flagging suspicious login attempts, and protecting against automated bot attacks. These cookies are essential to your account security and cannot be disabled.
You can manage your cookie preferences from your browser settings. However, disabling cookies categorised as "Essential" may significantly affect the functionality of the x1bet platform.
As a platform that works with international game providers such as Evolution Gaming (headquartered in Riga, Latvia), Pragmatic Play Live (studios across multiple countries), and global cloud infrastructure providers, your personal data may be processed or stored on servers located outside Malaysia.
In such cases, x1bet ensures that any cross-border data transfers are carried out with adequate safeguards through:
- Legally binding data processing agreements with all third-party recipients, requiring data protection standards equivalent to Malaysia's PDPA.
- Giving preference to providers operating in countries with data protection laws recognised as equivalent to Malaysia's, such as EU countries subject to GDPR.
- Standard data protection clauses approved by the relevant regulatory authority, used as the basis for secure international data transfers.
Data transferred is limited to what is strictly necessary to deliver the service — for example, session data required by live casino studio Evolution Gaming to operate the live baccarat or roulette tables you access through x1bet.
X1bet's services are intended solely for users aged 18 and above. x1bet does not knowingly collect personal data from individuals under the age of 18. Our registration process requires date of birth verification, and the KYC process requires official identity documents confirming age.
If x1bet discovers that personal data belonging to an individual under the age of 18 has been collected — whether through inaccurate information provided during registration or by any other means — we will take immediate steps to:
- Suspending and subsequently terminating the account in question.
- Permanently deletes all personal data associated with that account.
- Returning any available cash balance to the payment method used for the original deposit.
If you are a parent or guardian who believes that your child under the age of 18 has registered an x1bet account, please contact us immediately at support@x1bet-khelo.com. We will take prompt action upon receiving any such report.
X1bet employs a multi-layered age verification approach, including date of birth checks at registration, identity document verification during KYC, and ongoing monitoring of usage patterns to detect activity inconsistent with adult users.
X1bet has appointed a Data Privacy Officer responsible for ensuring the platform's compliance with PDPA 2010 and for handling all privacy-related enquiries, requests, and complaints from members.
To reach x1bet's Privacy Officer, you may use the following channels:
- Email: support@x1bet-khelo.com (with the subject line "Data Privacy Enquiry" or "PDPA Rights Request")
- Live Chat: Available on the x1bet platform 24 hours a day, 7 days a week — request to be connected with the privacy team
- Response time: General enquiries — within 3 business days; Data access / erasure requests — within 21 calendar days
X1bet will update this Privacy Policy from time to time to reflect changes in our practices or applicable legal requirements. Any significant changes will be communicated to active members via email or in-platform notification at least 7 days before they take effect. The date of the most recent update is always displayed at the top of this document.
Continued use of the x1bet platform after the effective date of an updated Privacy Policy will be deemed acceptance of those changes.