Your privacy matters to us. This Privacy Policy explains exactly what personal data xtaya collects, how we use it, who we share it with, and the rights you hold as a player on our platform.
Privacy at a Glance
We believe you deserve to know exactly how your information is handled. Here are the core principles that guide xtaya's approach to data privacy.
Every session on xtaya is protected by industry-standard SSL/TLS encryption. Your personal data and financial information are transmitted securely at all times — from login to withdrawal.
xtaya does not sell, rent, or trade your personal data to third parties for marketing purposes. Your information is used solely to operate and improve the xtaya platform and to comply with legal obligations.
xtaya processes personal data in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA). Your rights as a data subject under Philippine law are fully respected.
xtaya only collects the personal data that is strictly necessary to provide our services, verify your identity, process transactions, and meet our regulatory obligations. We do not collect data beyond what is needed.
You have the right to access and correct any inaccurate personal data we hold about you at any time. Simply contact our support team and we will process your request promptly and without unnecessary delay.
xtaya retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. Data no longer needed is securely deleted or anonymised.
xtaya ("xtaya," "we," "us," or "our") operates the online gaming platform accessible at https://xtaya.app (the "Platform"). We are committed to protecting the privacy and personal data of all individuals who interact with our Platform, including registered players, visitors, and prospective users.
This Privacy Policy ("Policy") describes how xtaya collects, uses, stores, discloses, and protects your personal data when you access or use the Platform. It also explains the rights you hold under the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), and how you may exercise those rights.
By registering an account on xtaya or by continuing to use the Platform, you acknowledge that you have read, understood, and agreed to the practices described in this Policy. This Policy should be read together with our Terms & Conditions and Responsible Gaming Policy.
Scope: This Policy applies to all personal data collected through the xtaya Platform, including data collected via the website, mobile-optimised interface, live chat, email correspondence, and any other channel through which you interact with xtaya.
xtaya collects personal data that you provide directly to us, data generated through your use of the Platform, and in certain cases, data received from third-party sources. The categories of personal data we collect include:
xtaya may receive personal data about you from third-party sources, including payment processors (for transaction verification), identity verification service providers (for KYC compliance), and fraud prevention agencies. All third-party data sharing is conducted in accordance with applicable Philippine data protection law.
Note: You are not required to provide all categories of personal data listed above. However, failure to provide certain mandatory data (such as identity and contact information) may prevent xtaya from creating your account or processing your transactions.
xtaya uses the personal data we collect for the following purposes:
| Purpose | Data Used |
|---|---|
| Account registration and management | Identity, contact, and account data |
| Identity verification (KYC) and age verification | Identity data and verification documents |
| Processing deposits and withdrawals | Financial data and identity data |
| Providing customer support | Identity, contact, and communications data |
| Fraud prevention and anti-money laundering compliance | Identity, financial, technical, and usage data |
| Responsible gaming monitoring and intervention | Usage data and account data |
| Platform security and technical maintenance | Technical and usage data |
| Personalising your gaming experience | Usage data and account preferences |
| Sending service-related communications | Contact data |
| Compliance with legal and regulatory obligations | All categories as required by law |
xtaya does not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight, except where required by applicable law or where you have provided explicit consent.
Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, xtaya processes your personal data on the following legal bases:
xtaya does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients only to the extent necessary and in accordance with applicable law:
xtaya engages trusted third-party service providers to assist in operating the Platform, including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification providers, cloud hosting providers, customer support software providers, and analytics platforms. These providers are contractually bound to process your data only on xtaya's instructions and in accordance with applicable data protection law.
xtaya may disclose your personal data to Philippine government agencies, regulatory bodies, law enforcement authorities, or courts where required to do so by applicable law, court order, or regulatory directive. This includes disclosures to the Anti-Money Laundering Council (AMLC) and other relevant Philippine authorities.
In the event of a merger, acquisition, restructuring, or sale of all or part of xtaya's business, your personal data may be transferred to the relevant successor entity. You will be notified of any such transfer and the privacy practices of the successor entity prior to the transfer taking effect.
xtaya may share your personal data with other third parties where you have provided your explicit prior consent to such sharing.
No Cross-Border Transfers Without Safeguards: Where xtaya transfers personal data outside the Philippines, we ensure that appropriate safeguards are in place in accordance with the requirements of the Data Privacy Act of 2012 and the National Privacy Commission's guidelines.
Cookies are small text files placed on your device when you visit the xtaya Platform. They allow the Platform to recognise your device, remember your preferences, and provide a more personalised experience. xtaya also uses similar technologies such as web beacons, pixel tags, and local storage objects.
You may control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the xtaya Platform. Strictly necessary cookies cannot be disabled as they are essential to the operation of the Platform.
xtaya implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:
While xtaya takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are also responsible for maintaining the security of your xtaya account credentials.
xtaya retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with xtaya's data disposal procedures.
Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by xtaya. You may exercise any of these rights by contacting our Data Protection Officer as described in Section 13.
Request a copy of the personal data xtaya holds about you and information about how it is being processed.
Request correction of any inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Object to the processing of your personal data where xtaya relies on legitimate interests as the legal basis for processing.
Request a copy of your personal data in a structured, commonly used, and machine-readable format where technically feasible.
Request that xtaya restricts the processing of your personal data in certain circumstances, such as while a rectification request is being assessed.
How to Exercise Your Rights: Submit your request in writing to our Data Protection Officer at [email protected]. xtaya will respond to all valid requests within fifteen (15) business days. We may request proof of identity before processing your request to protect against unauthorised access to your data.
If you believe that xtaya has not handled your personal data in accordance with the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.
The xtaya Platform is strictly intended for individuals who are at least twenty-one (21) years of age. xtaya does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you are not permitted to register an account or use the Platform in any capacity.
If xtaya becomes aware that personal data has been collected from an individual under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on the xtaya Platform, please contact us immediately at the details provided in Section 13.
The xtaya Platform may contain references to third-party services such as payment providers (GCash, PayMaya, BPI, BDO, Metrobank) and game software providers. When you interact with these third-party services, you are subject to their respective privacy policies, which are separate from and independent of this Policy.
xtaya is not responsible for the privacy practices or content of any third-party services. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the xtaya Platform.
xtaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is displayed at the top of this page.
Where changes to this Policy are material, xtaya will notify registered players by email or by posting a prominent notice on the Platform prior to the changes taking effect. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.
We recommend that you review this Policy periodically to stay informed of how xtaya protects your personal data.
xtaya has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests relating to this Policy or the processing of your personal data, please contact our DPO using the details below.
For complaints that have not been resolved to your satisfaction by xtaya, you may contact the National Privacy Commission of the Philippines:
Response Commitment: xtaya's DPO will acknowledge all privacy-related inquiries within three (3) business days and provide a substantive response within fifteen (15) business days of receiving a valid, complete request.
Your Data, Your Trust
Your privacy and security are at the heart of everything we do at xtaya. Join thousands of Filipino players who trust xtaya for a safe, fair, and exciting online gaming experience — with GCash deposits and fast PHP payouts. 21+ only.