xo638 Privacy Policy

This Privacy Policy ("Policy") is issued by the xo638 online betting platform, accessible at https://xo638.bet ("xo638", "we", "us", "our"). It describes how xo638 collects, uses, stores, shares, and protects the personal data of individuals who visit our website or register as Members on the Platform.

By accessing the xo638 Platform or registering for an Account, you acknowledge that you have read, understood, and agreed to the practices described in this Policy. This Policy forms part of and should be read in conjunction with xo638's Terms & Conditions.

xo638 is committed to handling all personal data responsibly and in accordance with internationally recognized data protection principles, including purpose limitation, data minimization, storage limitation, integrity and confidentiality, and accountability. We apply these principles consistently across all aspects of our Platform operations.

This Policy applies to all Members and visitors regardless of location, though it is primarily directed at individuals accessing xo638 from Indonesia. If you do not agree with this Policy, you must not use the xo638 Platform.

xo638 collects the following categories of personal data from Members and visitors:

Identity Data: Full legal name, date of birth, nationality, and gender — collected during Account registration and KYC verification.

Contact Data: Email address, Indonesian mobile phone number, and residential address in Indonesia — collected during Account registration.

Identity Verification Documents: Copies of government-issued identity documents such as your Indonesian National Identity Card (KTP), Indonesian passport, or Indonesian driver's license — collected as part of our KYC verification process.

Financial Data: Bank account details (account holder name, bank name, account number) for Indonesian bank accounts held with BCA, BRI, BNI, Mandiri, CIMB Niaga, or similar local institutions; and e-wallet account details for OVO, DANA, GoPay, ShopeePay, or LinkAja — collected when you add a withdrawal method to your Account.

Transaction Data: Records of all deposits, withdrawals, bets, game sessions, bonuses claimed, and balance movements on your Account.

Technical Data: Your IP address, browser type, device type, operating system, and session logs — collected automatically when you access the Platform.

Usage Data: Information about how you navigate and interact with the Platform, including pages visited, games played, betting markets accessed, session duration, and click patterns.

Communications Data: Records of your communications with xo638 support, including live chat transcripts, WhatsApp message logs, and email correspondence.

xo638 collects personal data through the following methods:

• Direct submission: Data you provide when registering for an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated technical collection: Data collected automatically by our web servers and analytics systems when you browse the Platform, including IP address, device identifiers, session timestamps, and usage behavior.
• Cookies and similar technologies: Data collected through browser cookies, local storage, and similar tracking mechanisms placed on your device when you visit xo638. See Clause 7 for a detailed explanation of our cookie practices.
• Third-party KYC providers: xo638 may use regulated third-party identity verification services to supplement the KYC process. These providers may independently verify the authenticity of documents you submit against external databases.
• Payment processors: When you initiate a deposit or withdrawal, your payment provider transmits relevant transaction confirmation data to xo638 to enable balance reconciliation.

xo638 uses your personal data for the following purposes:

• Account management: Creating, maintaining, and administering your xo638 Account, including processing login sessions, managing your balance, and recording your transaction history.
• Service delivery: Enabling you to place bets, play casino games, access the sportsbook, and use all other features of the Platform.
• Identity verification (KYC): Confirming that you meet xo638's eligibility requirements, including the minimum age of 21 years and residency in Indonesia, before processing your first withdrawal.
• Payment processing: Facilitating deposits via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and disbursing withdrawals to your verified payment method.
• Fraud prevention and AML compliance: Monitoring Account activity to detect and prevent fraudulent behavior, money laundering, unauthorized access, and other forms of Prohibited Conduct as defined in our Terms & Conditions.
• Customer support: Responding to your enquiries, resolving disputes, and maintaining support records.
• Legal and regulatory compliance: Fulfilling xo638's obligations under applicable laws, including responding to lawful requests from competent authorities.
• Platform improvement: Analyzing aggregated and anonymized usage data to improve the design, functionality, and performance of the Platform.
• Promotional communications: Sending you information about xo638 promotions, bonuses, and new features where you have given your consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Responsible gaming: Using Account activity data to identify potential problem gambling behaviors and, where appropriate, reaching out to offer responsible gaming tools or information.

xo638 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between xo638 and the Member — including Account creation, service delivery, and payment processing.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) regulations, financial record-keeping requirements, and responses to lawful government orders.
• Legitimate interests: Processing carried out in furtherance of xo638's legitimate business interests, including fraud prevention, platform security, customer support, and aggregate analytics — where such interests are not overridden by your privacy rights.
• Consent: Processing for which you have given your explicit consent, including optional marketing communications. Consent may be withdrawn at any time without affecting prior processing.

xo638 does not sell, rent, or otherwise trade your personal data to third parties for their own commercial purposes. We share personal data only in the following limited circumstances:

• Payment processors: Your bank account or e-wallet details are shared with the relevant Indonesian payment institution (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) solely for the purpose of processing your deposit or withdrawal instruction.
• KYC and identity verification providers: Your identity documents and associated personal data are shared with regulated third-party KYC verification service providers to confirm your identity and age.
• Game content providers: When you play a game powered by a third-party studio (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, or Pocket Games Soft), your game session data — including bet amounts and outcomes — is processed by that studio's systems in order to run the game. These studios do not receive your full identity profile.
• Legal and regulatory authorities: xo638 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or lawful regulatory instruction.
• Professional advisors: Lawyers, auditors, and compliance consultants who are bound by confidentiality obligations and who require access to data in the performance of their professional services to xo638.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of xo638's business, your personal data may be transferred to the acquiring entity, subject to appropriate confidentiality obligations.

xo638 uses cookies and similar browser-based technologies to operate and improve the Platform. A cookie is a small data file stored on your device by your browser when you visit a website. Cookies allow xo638 to recognize your browser across sessions, maintain your login state, and analyze how the Platform is used.

Categories of cookies used by xo638:

• Strictly Necessary Cookies: Essential for the Platform to function. These include cookies that maintain your authenticated login session, store your language preference, and enable secure payment flows. These cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Enable the Platform to remember your preferences, such as your most recently accessed game category or preferred betting interface layout.
• Analytics Cookies: Used to collect aggregated, anonymized data about how visitors use the Platform — including page visit counts, session durations, and navigation paths — to improve Platform design and performance.
• Security Cookies: Used to detect and prevent fraudulent activity, including unusual login patterns, rapid multi-session access, and other anomalies.

You may manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging into your xo638 Account and using core Platform features.

xo638 employs a multi-layered approach to protecting the personal data of its Members. Our security measures include, but are not limited to:

• TLS/SSL encryption: All data transmitted between your device and xo638 servers is encrypted using Transport Layer Security (TLS). Look for the padlock icon and "https://" prefix in your browser address bar when accessing the Platform.
• Encryption at rest: Sensitive personal data — including identity documents and financial account details — is encrypted in our databases using industry-standard encryption algorithms.
• Access controls: Access to personal data within xo638's systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data necessary to perform their specific job functions.
• Audit logging: All access to Member personal data is logged for audit purposes. These logs are reviewed regularly for unusual patterns.
• Penetration testing: xo638 conducts regular security assessments and penetration tests to identify and remediate vulnerabilities in the Platform before they can be exploited.
• Incident response: xo638 maintains a documented data breach response procedure. In the event of a confirmed breach affecting Member personal data, affected Members will be notified promptly in accordance with applicable notification requirements.

While xo638 takes every reasonable precaution to protect your data, no digital system is entirely immune to security risks. You are responsible for maintaining the confidentiality of your Account password and for securing your own device. If you suspect unauthorized access to your Account, contact xo638 support immediately.

xo638 retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active Account, plus a minimum of five (5) years following Account closure, to satisfy AML record-keeping obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, to enable financial audits and regulatory reviews.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable law.
• Support communications: Retained for a minimum of two (2) years from the date of the interaction, to enable reference in subsequent support or dispute scenarios.
• Technical and usage data: Retained in anonymized or aggregated form for up to two (2) years for Platform analytics purposes.
• Marketing preferences: Retained until you withdraw consent or opt out, plus a brief period thereafter to process your request and maintain a suppression record.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. xo638 does not retain personal data in identifiable form beyond what is legally or operationally necessary.

As a Member of xo638, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team via live chat, WhatsApp, or email at [email protected].

xo638 will respond to all data rights requests within thirty (30) days of receipt. In complex cases, this period may be extended by an additional thirty (30) days, with written notice to the requesting Member.

The xo638 Platform is strictly intended for adults aged 21 years and over. xo638 does not knowingly collect personal data from individuals under the age of 21.

During the registration process, all applicants are required to confirm that they are at least 21 years old. xo638 further verifies age through our KYC process, which requires submission of a valid government-issued identity document. Any Account discovered to belong to a person under 21 will be immediately closed and all associated data handled in accordance with our data minimization and retention policies.

If you are a parent or guardian and believe that a person under the age of 21 has registered for an xo638 Account, please contact our support team immediately via live chat or WhatsApp at +62 812 0000 6380. xo638 will promptly investigate and close any such Account.

The xo638 Platform integrates game content from certified third-party studios including Evolution Gaming, Pragmatic Play, Pragmatic Play Live, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you access a game powered by one of these studios, your game session data is processed by that studio's infrastructure in accordance with the studio's own data handling practices.

xo638 selects game studio partners that maintain high standards of data security and player confidentiality. However, xo638 is not responsible for the independent data practices of third-party studios beyond the contractual obligations we impose on them as part of our integration agreements.

The xo638 Platform may contain informational references to third-party services such as Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). When you interact directly with these payment institutions to initiate a transfer, your interaction is governed by that institution's own terms and privacy policies. xo638 is not responsible for the data practices of payment providers beyond the specific transaction data they transmit to xo638 for reconciliation purposes.

xo638 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

For material changes — those that significantly affect how we collect, use, or share your personal data — xo638 will notify active Members via a prominent notice on the Platform or by email to the address registered on your Account, at least fourteen (14) days before the change takes effect. Your continued use of the Platform after the effective date of the revised Policy constitutes your acceptance of the updated terms.

We encourage you to review this Policy periodically to stay informed about how xo638 protects your information. If you disagree with any changes to this Policy, you should cease using the Platform and contact support to close your Account.

If you have any questions, concerns, or requests relating to this Privacy Policy or xo638's handling of your personal data, please contact our Data Support team through any of the following channels:

• Live Chat: Available 24/7 directly through the xo638 Platform — the fastest channel for data rights requests.
• WhatsApp: +62 812 0000 6380 (available 24/7, responses within minutes during WIB operating hours).
• Email: [email protected] (plain text — not a clickable link). Responses within 24 hours.

When submitting a data rights request, please include your registered Account username and a clear description of your request. xo638 may ask you to verify your identity before processing the request.