This Privacy Policy explains how xo368 collects, processes, stores, shares, and protects your personal information when you access or use the xo368 Platform. We are committed to handling your data responsibly and transparently, in accordance with internationally recognised privacy principles and the rights of our players across Indonesia.
At xo368, data protection is not a compliance checkbox — it is a core part of how we build trust with every player in Jakarta, Surabaya, Bali, and across Indonesia.
Every byte of data transmitted between your device and the xo368 Platform is protected by industry-standard 256-bit SSL/TLS encryption, the same technology used by major international banks.
xo368 will never sell, rent, or trade your personal information to third-party advertisers or data brokers. Your data is used solely to operate your account and deliver the services you have requested.
Personal data is stored on access-controlled, encrypted servers. Access is restricted to authorised personnel on a strict need-to-know basis, with all access events logged and audited.
We collect only the data that is genuinely necessary to open and manage your account, process payments, and comply with our legal obligations. We do not collect data speculatively or beyond what is required.
You have the right to request a copy of the personal data xo368 holds about you, to request corrections to inaccurate information, and to request deletion of data we are no longer legally required to retain.
Our privacy practices reflect the rights and expectations of players across Indonesia, including residents of Jakarta, Bandung, Medan, Yogyakarta, and Makassar. All support for privacy requests is available in Bahasa Indonesia and English.
In this Privacy Policy, the following terms carry the meanings assigned below unless the context requires otherwise:
This Privacy Policy applies to all Personal Data collected by xo368 through the Platform, including data collected during account registration, KYC verification, deposit and withdrawal processing, gameplay, customer support interactions, marketing communications, and general browsing of the xo368 website.
xo368 acts as the data controller in respect of Personal Data collected directly from Players. Where xo368 engages Third-Party Processors to perform specific services, those processors act under xo368's instructions and are contractually bound to process data only for the purposes specified by xo368.
This Policy applies to all Players regardless of their location within Indonesia — whether you are playing from Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Makassar, or any other city.
This Policy does not apply to third-party websites, applications, or services that may be linked from the Platform. xo368 is not responsible for the privacy practices of any third party outside our direct control.
xo368 collects Personal Data through a number of channels. The categories of data we collect, and the circumstances in which they are collected, are set out below.
When you create an xo368 account, we collect:
To fulfil our legal obligations and to protect our Players from identity fraud, we may collect:
When you make deposits or withdrawals, we collect and retain records of:
As you use the Platform, we automatically record:
Our systems automatically collect the following technical data when you access the Platform:
When you contact our support team or respond to marketing communications, we retain:
xo368 uses the Personal Data we collect for the following specific purposes. We do not use your data in ways that are incompatible with the purposes for which it was collected.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Registration data, contact data | Contract performance |
| Age and identity verification (KYC) | KYC documents, selfie data | Legal obligation |
| Payment processing (deposits and withdrawals) | Financial transaction data, bank/e-wallet details | Contract performance |
| Fraud prevention and anti-money-laundering monitoring | Transaction data, IP data, gameplay data | Legal obligation / Legitimate interest |
| Responsible gaming monitoring and intervention | Gameplay data, deposit history, session data | Legal obligation / Legitimate interest |
| Customer support and complaint resolution | Communications data, account data | Contract performance |
| Platform analytics and performance optimisation | Technical data, session data | Legitimate interest |
| Marketing and promotional communications | Contact data, gameplay preferences | Consent (opt-in) |
| Legal and regulatory compliance | All categories as required | Legal obligation |
Marketing Opt-Out: You may withdraw consent for marketing communications at any time by clicking the "Unsubscribe" link in any promotional email, or by contacting our support team at [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing prior to withdrawal.
xo368 processes your Personal Data on the following legal bases, consistent with internationally recognised data protection frameworks:
xo368 uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are described below.
These cookies are essential for the Platform to function and cannot be disabled. They include session management cookies that keep you logged in during your gaming session, security tokens that protect against cross-site request forgery attacks, and load-balancing cookies that route your requests to the correct server.
These cookies help us understand how Players use the Platform — which games are most popular, where sessions start and end, and how deposits flow through the payment journey. Analytics data is aggregated and anonymised wherever possible. These cookies can be disabled, though doing so may affect Platform performance and personalisation.
These cookies remember your preferences — such as your preferred language (English), your last-visited game lobby, and your display settings — to provide a more consistent experience across sessions.
These cookies and device fingerprinting technologies assist xo368 in detecting suspicious activity, including multiple-account creation from a single device, unusual login patterns, and bot-driven behaviour. They are essential to maintaining Platform integrity and cannot be disabled.
Most modern browsers allow you to manage cookie preferences in their settings. Note that disabling all cookies may prevent certain features of the xo368 Platform from functioning correctly, including login persistence and payment processing.
xo368 does not sell, rent, or trade your Personal Data. We share data only in the following limited and controlled circumstances:
We engage trusted Third-Party Processors to support the operation of the Platform. Each processor is bound by a data-processing agreement that restricts their use of your data to the specific service they provide on our behalf. Categories of processors include:
xo368 may disclose your Personal Data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where we are required to do so by applicable law, valid legal process, or court order. We will notify you of any such disclosure to the extent we are legally permitted to do so.
In the event that xo368 undergoes a merger, acquisition, restructuring, or asset sale, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and given the opportunity to close your account prior to the transaction completing, if you do not wish for your data to be transferred.
xo368 will never disclose your Personal Data to third-party advertisers, data brokers, or unaffiliated commercial entities for their own marketing or profiling purposes.
xo368 retains Personal Data for the minimum period necessary to fulfil the purposes for which it was collected, taking into account our legal obligations, dispute resolution requirements, and business operations. The general retention periods applicable to each data category are set out below.
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years after closure | Legal obligation / Dispute resolution |
| KYC identity documents | 5 years from last transaction date | Anti-money-laundering legal obligation |
| Financial transaction records | 5 years from transaction date | Legal obligation |
| Gameplay and betting records | 3 years from last activity | Dispute resolution / Regulatory audit |
| Customer support communications | 3 years from last interaction | Dispute resolution |
| Marketing preference records | Until consent is withdrawn + 1 year | Consent |
| Technical / device logs | 12 months from collection | Legitimate interest / Security |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our internal data governance procedures. Anonymised and aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and business-planning purposes.
Subject to applicable law and our legal obligations, you have the following rights in respect of your Personal Data held by xo368:
To exercise any of the above rights, contact our support team via live chat (available 24/7 on the Platform) or by email to [email protected]. We may ask you to verify your identity before processing your request. All requests will be acknowledged within 5 business days.
xo368 employs a layered security architecture designed to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security programme includes the following controls:
Your Role in Security: xo368's technical measures protect data on our side, but you also play a critical role. Never share your username, password, or OTP (one-time PIN) with anyone — including people claiming to be xo368 support agents. We will never ask for your password.
The xo368 Platform is strictly intended for adults aged 21 years and over. xo368 does not knowingly collect, process, or retain Personal Data from any person under the age of 21. If we discover or are notified that a minor has registered an account or submitted Personal Data to the Platform, we will:
If you believe that a person under the age of 21 has accessed the xo368 Platform or submitted Personal Data, please contact us immediately at [email protected]. We take underage access extremely seriously and act promptly on all reports.
21+ Only. If you are under 21 years of age, you must not access, register, or use the xo368 Platform under any circumstances.
The xo368 Platform may display references to third-party game studios, payment brands, and sports leagues for informational and contextual purposes. xo368 does not control the privacy practices of third-party organisations, and this Privacy Policy does not apply to any third-party website or service outside the xo368 Platform.
Game content delivered by studios such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, Microgaming, NetEnt, and Spribe is rendered within the xo368 Platform environment. These studios may receive limited session data necessary to operate their game engines. xo368 contractually requires all game studios to use this data solely for game operation and fair-play audit purposes.
xo368 operates infrastructure in multiple jurisdictions and may transfer your Personal Data to countries outside Indonesia in order to operate the Platform and deliver our services. Such transfers may occur when, for example, we process payments through international banking networks, use cloud infrastructure located overseas, or engage KYC verification providers operating in multiple regions.
Where Personal Data is transferred internationally, xo368 ensures that appropriate safeguards are in place, including:
xo368 may update this Privacy Policy from time to time to reflect changes in our data-processing activities, applicable law, or the structure of the Platform. The date of the most recent revision is displayed at the top of this page.
Where changes are material — for example, where we introduce a new category of data collection, a new data-sharing arrangement, or a change to your rights — we will provide at least 14 days' advance notice to registered Players via the email address on file. Non-material corrections and clarifications may be made without advance notice.
Your continued use of the xo368 Platform after any change to this Policy takes effect constitutes your acknowledgement and acceptance of the updated terms. If you do not agree with any material change, you may close your account by contacting our support team before the change takes effect.
For all privacy-related enquiries, data access requests, correction requests, erasure requests, or complaints regarding xo368's handling of your Personal Data, please contact our Data Protection team through the following channels:
Support hours: 00:00 – 23:59 WIB (UTC+7) daily, including Indonesian public holidays such as Idul Fitri, Idul Adha, Indonesian Independence Day (17 August), Nyepi, and Christmas.
xo368 is committed to resolving all privacy concerns promptly and fairly. If you are not satisfied with our response, you retain the right to escalate your complaint to the relevant data protection authority in your jurisdiction.
Now that you understand how xo368 safeguards your personal data, explore our full range of games and betting markets — all secured with 256-bit SSL encryption and full IDR support.