Privacy Policy

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, including name, date of birth, email address, phone number, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, xco368.
• "Data Processor" means a third party that processes Personal Data on behalf of xco368 under a contractual data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their Personal Data.
• "KYC" means Know Your Customer — the mandatory identity verification process conducted before a player may withdraw funds from their xco368 account.
• "Cookie" means a small data file stored on a user's device by a web browser, used to maintain session state, preferences, and analytics data.

xco368 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, xco368 is responsible for determining the lawful purposes and appropriate means of data processing, and for ensuring that all processing activities comply with applicable data protection legislation.

All data-related enquiries — including access requests, correction requests, deletion requests, and complaints — should be d irected to xco368's data protection contact using the details provided in Section 15 of this Policy.

xco368 collects the following categories of Personal Data in the course of providing its services:

xco368 does not knowingly collect sensitive special-category data (such as racial origin, political opinions, religious beliefs, or health data) beyond what is strictly necessary for responsible gaming assessments or regulatory compliance purposes.

xco368 collects Personal Data through the following means:

• Direct Submission: Data you actively provide during account registration, KYC document uploads, deposit and withdrawal requests, support interactions, and any contact form submissions on the Platform.
• Automated Collection: Technical and usage data collected automatically as you interact with the Platform, including through server logs, session tracking systems, and first-party analytics tools.
• Cookies and Similar Technologies: Data gathered via browser cookies, local storage objects, and similar tracking technologies as detailed in Section 8 of this Policy.
• Third-Party Verification Services: Identity and document verification data returned by KYC service providers engaged to assist with the verification process.
• Payment Processors: Transaction confirmation data returned by payment processors including local Indonesian bank transfer gateways and e-wallet platforms such as OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Fraud Prevention Services: Risk signals and device fingerprint data provided by third-party fraud detection partners to help protect the security of the Platform and its players.

xco368 uses the Personal Data we collect for the following purposes:

• Account Management: Creating, maintaining, and securing your xco368 player account, including authentication and access control.
• Service Delivery: Processing deposits, executing withdrawals, settling bets across all product types — including sports betting, togel (Indonesia's traditional numbers lottery), live casino, and slot gacor (high-payout slot games) — and providing customer support.
• Identity Verification (KYC): Verifying your identity and age (21+) in compliance with our licensing obligations and anti-money laundering requirements.
• Fraud and Security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: Monitoring account activity to identify indicators of problem gambling behaviour, applying self-imposed player limits, and administering self-exclusion requests.
• Legal and Regulatory Compliance: Meeting our obligations under applicable licensing requirements, anti-money laundering (AML) legislation, and any lawful requests from competent authorities.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve Platform performance, fix technical issues, and enhance the player experience.
• Marketing Communications: Sending promotional offers, bonus notifications, and relevant product updates to players who have provided their consent. You may withdraw this consent at any time.
• Dispute Resolution: Maintaining records of transactions and communications necessary to investigate and resolve player disputes fairly and accurately.

xco368 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing that is necessary to perform the agreement between you and xco368 — including account creation, transaction processing, and service delivery — is conducted on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with our licensing conditions, AML/CFT obligations, and any lawful regulatory or governmental requirements is conducted on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, internal analytics, and service improvement is conducted on the basis of xco368's legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications and optional personalisation features is conducted on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

xco368 does not sell your Personal Data. We share data only in the following carefully controlled circumstances:

• Payment Processors: We share financial data with payment gateways and local bank transfer services (including those facilitating transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, and Mastercard) to the extent necessary to process your transactions.
• KYC and Identity Verification Providers: We share identity document data with our third-party KYC verification partners for the sole purpose of completing mandatory identity and age checks.
• Game Content Providers: Aggregated, non-personally identifiable gameplay data may be shared with game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe) for the purposes of game performance analysis and technical support.
• Fraud Prevention and Security Services: We share technical data with fraud detection service providers to protect the integrity of the Platform and the security of all players.
• Regulatory and Legal Authorities: We may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights and safety of xco368, its players, or the public.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of xco368's business assets, player data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

All third-party Data Processors engaged by xco368 are required to sign binding data processing agreements that mandate appropriate security standards and prohibit them from using your data for their own independent commercial purposes.

xco368 uses cookies and similar technologies to ensure the Platform functions correctly, to maintain your session, and to improve your experience. The following categories of cookies are used:

xco368 does not use third-party advertising or behavioural tracking cookies. You can manage cookie preferences through your browser settings; however, disabling essential or security cookies may prevent you from accessing certain parts of the Platform.

xco368 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Transport Encryption: All data transmitted between your device and xco368 servers is encrypted using TLS 1.3 (Transport Layer Security). Our platform is served exclusively over HTTPS.
• Encryption at Rest: Sensitive data fields — including passwords, identity document data, and financial account identifiers — are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within xco368's systems is restricted on a strict need-to-know basis. All staff with access to player data are subject to confidentiality obligations and regular security training.
• Intrusion Detection: xco368's infrastructure is monitored 24/7 by automated intrusion detection and prevention systems designed to identify and respond to anomalous activity in real time.
• Regular Security Audits: xco368 commissions independent security assessments and penetration tests on a periodic basis to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a confirmed personal data breach that poses a risk to player rights, xco368 will notify affected players and relevant authorities without undue delay, consistent with applicable regulatory requirements.

xco368 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your active account relationship with xco368.
• Transaction and Financial Records: Retained for a minimum of 5 years following the date of each transaction, in compliance with anti-money laundering record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of 5 years following account closure or the completion of the KYC process, whichever is later.
• Support Communications: Retained for 2 years following the resolution of a support case, to facilitate ongoing dispute resolution if required.
• Marketing Preferences: Retained until you withdraw consent for marketing communications, after which your opt-out status is retained indefinitely to prevent inadvertent re-marketing.
• Technical Logs: Server and security logs are retained for a maximum of 12 months, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is used, the resulting data is no longer considered Personal Data and may be retained indefinitely for statistical analysis.

Subject to applicable law and any overriding legal obligations on xco368's part, you have the following rights in relation to your Personal Data:

• Right of Access: You may request a copy of the Personal Data xco368 holds about you. We will provide this within 30 days of a verified request.
• Right to Rectification: You may request that inaccurate or incomplete Personal Data be corrected. You can update basic account information directly through your account settings; other corrections should be requested via support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Note that certain data must be retained to comply with our legal and regulatory obligations and cannot be deleted on request.
• Right to Restrict Processing: You may request that xco368 restrict its processing of your data in specific circumstances, such as where you contest the accuracy of the data or where you have objected to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format (e.g., CSV or JSON).
• Right to Object: You may object at any time to the processing of your Personal Data for direct marketing purposes. You may also object to processing based on legitimate interests, though xco368 may continue processing where it can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal.

To exercise any of these rights, please contact xco368's support team using the contact details in Section 15. We will respond to all verified requests within 30 calendar days. In cases of complex or high-volume requests, this period may be extended by a further 30 days, of which you will be notified.

The xco368 Platform is strictly for adults aged 21 and over. xco368 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that a player has registered and is under 21, their account will be immediately suspended, all data will be securely deleted to the extent permitted by law, and any funds will be returned to the depositing payment method.

If you are a parent or guardian and believe your child has registered on the xco368 Platform, please contact us immediately at [email protected] so that we can take appropriate action without delay.

As an internationally operated platform serving Indonesian players, certain Personal Data processed by xco368 may be transferred to, stored in, or processed in countries outside Indonesia. This may occur where our third-party service providers — including KYC verification vendors, payment processors, and cloud infrastructure providers — operate from outside Indonesia.

Where such international transfers occur, xco368 ensures that appropriate safeguards are in place to protect your Personal Data to a standard that is at least equivalent to that provided under this Policy. These safeguards may include:

• Binding contractual clauses requiring recipients to process data in accordance with applicable data protection standards.
• Transfer to jurisdictions recognised as providing an adequate level of data protection.
• Use of certified cloud infrastructure providers that maintain compliance with internationally recognised security frameworks.

xco368 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. When a material change is made, we will notify registered players via email or through a prominent notice on the Platform prior to the change taking effect.

The "Last Updated" date at the top of this Policy will always reflect the most recent revision. We encourage you to review this Policy periodically. Your continued use of the xco368 Platform following the publication of an updated Policy constitutes your acknowledgment of the revised terms.

For all privacy-related enquiries — including data access requests, correction or deletion requests, consent withdrawal, or complaints about how xco368 handles your Personal Data — please reach out using the contact details below. Our support team handles communications in both English and Bahasa Indonesia.