Introduction
Xhjili is the data controller for personal information processed in connection with the Xhjili platform and related services. This Privacy Policy explains what data we collect, how we use it, with whom we share it, and your rights regarding that data. If you have questions about our practices, contact our Data Protection Officer at [email protected].
What data we collect
We collect categories of personal data directly from you, as well as from third parties and through your use of our services. Data categories include:
- Identity and contact details: name, date of birth, postal address, email address, and telephone number.
- Verification and regulatory information: documents proving identity and address, photos or scans as required for identity verification and AML/CFT compliance.
- Financial information: transaction history related to deposits and withdrawals and limited payment details necessary to process payments (for example, the last four digits of a payment method).
- Login credentials: username and password used to access the Xhjili platform.
- Technical data: IP address, device type, operating system, browser, language, time zone, and geolocation data when available.
- Communications and interactions: correspondence with our support teams, in-app messages, and service communications.
- Marketing preferences: records of consent or opt-out for marketing communications.
- Other data provided by you or obtained from permitted public or private sources in accordance with applicable laws.
How we use your data (legal bases)
We process personal data under the following lawful bases:
- Contractual necessity: to register and manage your account, provide betting and gaming services, process transactions, and communicate about service issues.
- Legal obligations: AML/CFT compliance, age verification, identity verification, recordkeeping, and reporting to competent authorities as required by law.
- Legitimate interests: to improve our services, enhance security, detect and prevent abuse of our terms, and support customer service. Where legitimate interests apply, we balance them against your rights and freedoms.
- Consent: for marketing communications and certain consent-based activities, which you may withdraw at any time.
Purposes of data use
We use data to provide and improve our services, verify your identity, process payments, communicate with you, comply with legal obligations, prevent fraud and money laundering, and tailor your experience where permissible.
Data sharing and recipients
We may disclose or provide access to your personal data to the following categories of recipients:
- Service providers: payment processors, identity verification providers, customer support, IT and hosting services, analytics, and marketing vendors acting on our instructions.
- Affiliates and group companies as necessary to deliver services.
- Regulators, financial intelligence units, and other competent authorities when required by law or to protect our rights or safety.
- Third parties in connection with corporate transactions (for example, a merger, acquisition, or sale of assets), with prior notice where required by law.
- Other recipients with your consent or as permitted by applicable law.
Cross-border transfers: We may transfer data to jurisdictions outside the European Economic Area where service providers operate. We rely on adequacy decisions or appropriate safeguards, including standard contractual clauses, to protect your data. You may request information about safeguards applicable to transfers.
Data retention
We retain personal data for a period of six (6) years following the closure of your account or termination of the contractual relationship, to satisfy AML/CFT obligations and legal prescription periods. This period also supports prevention of repeated registrations. Data retention timelines may be extended where required by law. We may anonymize data for analytics once retention periods have expired.
Security of your data
We implement reasonable administrative, technical, and physical measures designed to protect personal data. This includes access controls, encryption in transit (TLS) for data transmissions, encryption at rest where feasible, incident monitoring, and regular security assessments. Access to personal data is limited to personnel and contractors who require it to perform their duties and who are bound by confidentiality obligations.
Your rights
You have rights under applicable data protection laws. To exercise any right, you may contact our Data Protection Officer or support team, and you may be required to verify your identity. Rights include:
- Right of access: obtain confirmation of whether we process your data and a copy of the data we hold.
- Right to rectification: request correction of inaccurate or incomplete data.
- Right to erasure: request deletion where there is no lawful basis to continue processing; AML/CFT retention requirements may prevent immediate deletion.
- Right to restrict processing: request limited use of your data for specific purposes while preserving information.
- Right to data portability: receive your data in a structured, commonly used format and transmit to another controller where feasible.
- Right to object: object to processing based on legitimate interests or direct marketing; we will evaluate and respond in accordance with law.
- Right to withdraw consent: withdraw consent for processing based on consent without affecting lawfulness of prior processing.
Marketing communications
We may send promotional communications if you opt in to receive them. You may opt out at any time via your account settings or by contacting us. Opting out stops marketing messages; transactional and service-related communications may continue as necessary.
Responsible gaming and self-exclusion
Xhjili supports responsible gaming. If you self-exclude, we will record the request, apply platform-wide restrictions, and suspend account access in accordance with applicable laws. We will provide information about self-help resources and available support services. You may request cooperation with our support team to adjust or remove restrictions where appropriate and lawful.
Children and age restrictions
Our services are intended for adults. We do not knowingly collect personal data from individuals under the minimum age required by law. Age verification is performed during account opening, and accounts opened for underage individuals will be closed with any winnings handled in accordance with applicable law.
Changes to this policy and contact
We may update this Privacy Policy from time to time. We will notify users of material changes as required by law. For questions or to exercise rights, contact our Data Protection Officer at [email protected] or [email protected].