Privacy Policy

"XGB" / "we" means XGAMBET (XGB), a company registered in the Republic of Cyprus, and its affiliates. We also work with teams in multiple countries for research and development of iGaming platform software.

For personal data collected through https://xgb.app and related marketing sites we operate, XGB acts as the data controller unless we state otherwise below.

This Policy covers three situations. Please read the one that applies to you:

• Website visitors — people who browse xgb.app, open Livechat, submit demo/contact forms, or otherwise interact with our marketing site.
• B2B Client accounts — operators and their authorised staff who use XGB Platform back office, APIs, or support under an Order Form.
• End players — individuals who gamble or play on a Client’s branded site. In that case the Client is typically the data controller; XGB processes player data as a processor under the Client’s instructions and any Data Processing Agreement (DPA) or Order Form.

If you are an end player, please contact the operator whose site you use. XGB cannot handle player rights requests as if we were the controller of that brand.

We design this Policy to meet the EU General Data Protection Regulation (GDPR) and the laws of Cyprus, where XGB is registered.

Where you or your business is located elsewhere, we also take into account other data-protection laws that apply to that relationship.

Depending on how you interact with us, we may process:

• Identity and contact data — name, email, phone, company, job title, messenger IDs you share.
• Business and enquiry content — demo requests, package questions, chat transcripts, attachments you send.
• Account and technical data (Clients) — login identifiers, role/permissions metadata, API usage logs, security events.
• Device and usage data — IP address, browser/device type, pages viewed, approximate location derived from IP, cookie/similar identifiers.
• Security and anti-abuse data — CAPTCHA/Turnstile outcomes, rate-limit signals, fraud or abuse indicators.

We process personal data only for stated purposes, for example:

• Respond to sales, demo, and support requests you initiate — contract steps / legitimate interests in answering B2B enquiries.
• Provide and secure the Website and Platform (hosting, abuse prevention, troubleshooting) — legitimate interests / contract.
• Operate Livechat and related support tools so we can reply to you — contract steps / legitimate interests.
• Understand aggregate Website usage (analytics via tools such as Google Tag Manager / Google Analytics) to improve content and reliability — after you consent via our cookie banner; we use Google Consent Mode v2 with analytics denied until then (see Cookie Policy).
• Comply with law, enforce agreements, or establish/defend legal claims — legal obligation / legitimate interests.

We do not send automated product newsletters or promotional campaigns by default. We contact you about topics you requested (demo, package, support) or that are needed to perform a contract.

We do not sell personal data. We may share data with categories of providers who help us run the Website and Services, under contracts that limit their use of the data:

• Hosting, CDN, and infrastructure
• Livechat / customer messaging
• Analytics and tag management
• Security and bot protection
• Professional advisers (legal, accounting, compliance) when needed
• Authorities when required by law

Providers may be inside or outside the European Economic Area (EEA). You may request a fuller list of current providers via Livechat or contact@xgb.app.

Because we operate globally and use cloud providers, personal data may be transferred to or accessed from countries outside Cyprus / the EEA.

Where GDPR applies, we use appropriate safeguards such as European Commission adequacy decisions or Standard Contractual Clauses (SCCs), together with contractual and technical measures.

We keep personal data only as long as needed for the purposes in this Policy, or longer when required to meet legal, accounting, or dispute-related obligations. When data is no longer needed, we delete or anonymise it where practicable.

We apply technical and organisational measures appropriate to the risk — including encrypted transport (HTTPS/TLS), access controls, and monitoring. No method of transmission or storage is perfectly secure; please protect your own credentials and devices.

Subject to GDPR and other applicable law, you may have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase data in certain cases
• Restrict or object to certain processing
• Data portability where applicable
• Withdraw consent where processing is based on consent (without affecting prior lawful processing)
• Lodge a complaint with a supervisory authority — in particular in your EU Member State of residence, workplace, or the place of the alleged infringement

To exercise these rights for Website or B2B account data we control, contact us via Livechat on xgb.app or email privacy@xgb.app (or contact@xgb.app). We may need to verify your identity before responding.

Our Website and Services are directed at business operators, not children. We do not knowingly collect personal data from children for marketing the Platform.

We may update this Policy by publishing a new version on this page. The “Last updated” date and version number will change. Material changes may also be highlighted on the Website.

Questions about this Policy or data-subject requests:

• Livechat on https://xgb.app (topic: Privacy / Legal)
• Email (privacy / data rights): privacy@xgb.app
• Email (general): contact@xgb.app
• In-person meetings: book an appointment via Livechat or email for the relevant country first; we will then send an invitation to our Office

• Terms of Service
• Cookie Policy
• Disclaimer