Privacy policy

PRIVACY POLICY

Effec/ve date: 19 January 2026

Operator: X2 Limited Liability Company (LLC “X2”)

Website: x2.kg

1. General Provisions

This Privacy Policy (hereinaJer referred to as the “Policy”) defines the procedure for processing personal

data of users of the X2.KG website and mobile services, operated by the lo>ery operator X2 Limited

Liability Company (LLC “X2”) (hereinaJer referred to as the “Operator”).

The Policy regulates the processes of collec/on, storage, use, and protec/on of personal data in

accordance with:

— the Law of the Kyrgyz Republic “On Personal Data Informa/on” dated 14 April 2008 No. 58;

— the Law of the Kyrgyz Republic “On LoUeries” dated 21 December 2023 No. 214;

— the Law of the Kyrgyz Republic “On Counterac/ng the Legaliza/on (Laundering) of Criminal Proceeds

and the Financing of Terrorist Ac/vi/es” dated 31 July 2018 No. 87;

— the Law of the Kyrgyz Republic “On the Payment System of the Kyrgyz Republic” dated 21 January

2015 No. 21;

— internal regulaTons and informaTon security policies of the Operator.

By using the services of the X2.KG website, you confirm that you have read this Policy and agree to its

terms.

Personal Data Controller

X2 Limited Liability Company (LLC “X2”)

Legal address:

22 Razzakova Street, Bishkek, Kyrgyz Republic

Contact email for privacy requests:

privacy@x2.kg

2. What Data We Collect

We collect personal data strictly to the extent necessary to provide lo>ery parTcipaTon services,

comply with legal requirements, ensure security, and provide reporTng to regulatory authoriTes.

2.1 Data You Provide Directly

When registering, purchasing Tckets, parTcipaTng in draws, or contacTng support, a user may provide:

— full name (surname, name, patronymic);

— date of birth (for verificaTon of the 18+ age requirement);

— phone number;

— email address;

— account informaTon;

— payment details for receiving winnings;

— messages sent to customer support.

This data is used for:

— user idenTficaTon;

— account protecTon;

— compliance with age restricTons (18+);

— ensuring payment of winnings;

— fraud prevenTon.

2.2 Data Collected Automa/cally

When using the website, certain technical data is automaTcally recorded, including:

— IP address;

— approximate geolocaTon based on IP;

— device informaTon;

— browser type;

— operaTng system informaTon;

— connecTon parameters;

— technical logs and error logs;

— visit history;

— behavioral data used for anT-fraud purposes.

2.3 Transac/onal and Gaming Informa/on

The system records operaTonal informaTon related to gaming acTvity, including:

— deposit history;

— withdrawal history;

— transacTon status;

— internal balance movement history;

— parTcipaTon history in lo>ery games;

— draw results;

— winnings credited to the user.

2.4 Data Related to Par/cipa/on in Games and Opera/ons

During use of the service, the system generates informaTon about:

— purchased electronic lo>ery Tckets;

— parTcipaTon in lo>ery games;

— draw results;

— winnings credited to the user;

— movement of funds within the service.

This informaTon is required for transparent accoun/ng and correct payment of winnings.

3. Purposes of Data Processing

We process personal data exclusively for the following purposes.

3.1 Provision of X2.KG Website Services

— registraTon and maintenance of the user account;

— parTcipaTon in lo>ery games;

— accounTng of bets and winnings;

— payment of winnings;

— communicaTon with users regarding services;

— compliance with the legislaTon of the Kyrgyz Republic;

— protecTon of users and services from fraud and abuse;

— improving the funcTonality of the website.

3.2 Ensuring Security

— fraud prevenTon;

— access control;

— monitoring of suspicious acTvity;

— prevenTon of hacking a>empts and technical a>acks;

— logging acTons of users and administrators;

— protecTon of payment transacTons.

3.3 Improving Service Quality

— internal analyTcs;

— operaTon of recommendaTon algorithms;

— proper interface display;

— improvement of website funcTonality.

3.4 Marke/ng Communica/on (with User Consent)

— noTficaTons about lo>ery draws and promoTons;

— informaTonal newsle>ers;

— personalized offers.

Users may opt out of markeTng communicaTons at any Tme.

4. Legal Basis for Data Processing

Personal data processing is carried out based on:

— the consent of the user;

— the necessity to perform a contract to which the user is a party;

— legal obliga/ons imposed by the legislaTon of the Kyrgyz Republic;

— the legi/mate interests of the Operator, provided that the rights of users are not violated.

5. Cookies and Technical Data

The Operator’s website uses cookies, which are small technical files that help to:

— maintain user login sessions;

— remember user secngs;

— ensure service security;

— analyze website performance;

— improve the user interface.

The use of cookies does not allow iden/fica/on of a specific individual without addi/onal informa/on.

Users may restrict cookies through browser secngs; however, some website funcTons may not operate

correctly if cookies are disabled.

6. Transfer of Data to Third Par/es

Personal data may be transferred only in the following cases:

— to payment and technical partners for processing payments and operaTng the service;

— to government authori/es, where required by law;

— to contractors providing technical support and security services.

In all cases, the transfer of data is carried out only to the extent necessary.

7. When Data Is NOT Shared

We do not transfer personal data:

— to adverTsing agencies;

— to third parTes for their own markeTng purposes;

— to external companies without legal grounds.

8. Data Reten/on Periods

Data retenTon periods are determined by the legisla/on of the Kyrgyz Republic and processing

purposes.

Typical retenTon periods include:

— gaming and transacTon data — minimum 5 years;

— security logs — minimum 3 years;

— KYC/AML data — up to 7 years;

— accounTng records — in accordance with tax legislaTon;

— account data — during the enTre period of service use plus mandatory retenTon aJer account

closure.

Data is stored in secure data centers located within the territory of the Kyrgyz Republic.

AJer retenTon periods expire, data is deleted or anonymized.

9. Data Protec/on

We apply a comprehensive set of security measures, including:

— secure data transmission channels;

— system access control;

— role-based employee access rights;

— monitoring of suspicious acTvity;

— regular data backups;

— periodic security audits and updates.

10. User Rights

As a user, you have the right to:

— know which personal data we process;

— correct or update your personal data;

— withdraw consent to markeTng communicaTons;

— submit requests regarding personal data processing;

— file a complaint with the competent government authority.

User requests are processed within the /me limits established by law.

11. Limita/on of Liability

The Operator shall not be liable for:

— loss of access to an account due to the user's fault;

— acTons of third parTes who obtained access to data beyond the Operator’s control;

— failures in communicaTon networks or third-party services;

— force majeure circumstances;

— errors or failures of payment providers.

12. Policy Changes

Any amendments to this Policy shall enter into force from the moment they are published on the

Website.

The current version of the Policy is always available on the X2.KG website.

ConTnued use of the website consTtutes acceptance of the updated Policy.