At xo360, your privacy is a core commitment, not an afterthought. This Privacy Policy explains precisely what personal data we collect from players across Indonesia, why we collect it, how it is processed and stored, who it may be shared with, and what rights you hold over your own information. We encourage you to read it in full before using the Platform.
The following highlights summarize the pillars of xo360's approach to data protection. They complement — and do not replace — the full policy text set out in the sections below.
All data transmitted between your device and xo360's servers is protected by 256-bit TLS/SSL encryption — the same standard used by major Indonesian banks such as BCA, BRI, and Mandiri. Your credentials and financial details are never sent in plain text.
xo360 collects only the data strictly necessary to deliver our services, comply with our licensing obligations, and fulfill KYC requirements. We do not harvest data beyond what is needed and do not sell personal information to third-party marketers.
Your personal data is never sold, rented, or traded to advertisers or unrelated third parties. Data sharing is limited to regulated service providers (payment processors, KYC bureaus) who are contractually bound to the same privacy standards we uphold.
Members have the right to access, correct, export, and request deletion of their personal data at any time. All such requests are handled by our dedicated support team within the timelines specified in this policy.
We do not retain personal data indefinitely. Retention periods are tied to regulatory requirements and operational necessity. Once the retention period expires and no legal obligation requires continued storage, data is securely deleted or anonymized.
In the unlikely event of a data security incident that affects your personal information, xo360 will notify affected Members promptly and transparently, including the nature of the incident, data involved, and the remediation steps being taken.
NOTICE TO ALL MEMBERS: This Privacy Policy ("Policy") describes how xo360 ("Company", "We", "Us", "Our") collects, processes, stores, and protects the personal data of individuals ("Members", "You", "Your") who register and use the online betting and gaming services available at xo360.cam ("Platform"). By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. This Policy is to be read in conjunction with xo360's Terms & Conditions and Responsible Gaming Policy.
This Policy applies to all personal data collected by xo360 in connection with the operation of the Platform, including data collected via the xo360 website, any related mobile-browser interface, live chat support interactions, email correspondence, and third-party payment processing integrations.
Data Controller: xo360 acts as the data controller for all personal data collected directly from Members through the Platform. As data controller, xo360 determines the purposes for which and the means by which personal data is processed. Where xo360 engages third-party processors (such as KYC verification bureaus or payment service providers), those parties process data solely on xo360's instructions and may not use it for their own independent purposes.
This Policy applies to Members who are residents of Indonesia and any other jurisdiction in which xo360's services are made available. Where data protection laws in a Member's jurisdiction of residence impose additional obligations or confer additional rights beyond those described in this Policy, xo360 will comply with those obligations and honor those rights to the extent practicable.
xo360 collects personal data from Members through several channels. The categories of data collected, their sources, and their purposes are summarized in the table below:
| Data Category | Examples | Collection Source |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government ID number (KTP / passport) | Registration form, KYC submission |
| Contact Data | Email address, mobile phone number, residential address | Registration form, account updates |
| Financial Data | Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), deposit and withdrawal transaction records | Payment processing, KYC |
| Transactional Data | Betting history, game session records, bonus usage, win/loss records, account balance history | Platform activity logs |
| Technical Data | IP address, device type, browser type and version, operating system, session duration, referring URL | Automatic collection via server logs and cookies |
| Communications Data | Live chat transcripts, email correspondence, support ticket content | Customer support interactions |
| KYC Documentation | Scanned copies of identity documents, proof-of-address documents, selfie or liveness-check images where required | KYC verification process |
| Responsible Gaming Data | Self-exclusion requests, deposit limit settings, cooling-off period activations, problem gambling assessment responses | Responsible gaming tools and support interactions |
xo360 does not collect or process sensitive personal data (as defined under international data protection frameworks) such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for unique identification (beyond liveness-check selfies required for KYC), health data, or data concerning sexual orientation — with the sole exception of problem gambling indicators collected for responsible gaming purposes.
Voluntary Disclosure: Certain data collection activities are voluntary. For example, participation in promotional surveys or feedback forms is optional. However, core identity, contact, and financial data are mandatory for account registration, KYC compliance, and transaction processing. Failure to provide mandatory data may result in an inability to use certain or all services on the Platform.
xo360 processes personal data for the following purposes, each of which is necessary for the operation of the Platform and the fulfillment of our contractual and regulatory obligations:
xo360 relies on the following legal bases to process your personal data, as recognized under international data protection frameworks:
xo360 does not sell, rent, or trade your personal data to unrelated third parties for their own marketing purposes. However, we may share your data with the following categories of recipients, strictly on a need-to-know basis and under contractual confidentiality obligations:
Business Transfers: In the event that xo360 undergoes a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity as part of the transaction. In such circumstances, xo360 will ensure that the acquiring party is bound by obligations equivalent to those set out in this Policy. Members will be notified of any such change in data controller via email and prominent notice on the Platform.
xo360 uses cookies and similar tracking technologies to enhance user experience, maintain session state, analyze Platform usage, and deliver targeted content. A cookie is a small text file stored on your device by your browser. Cookies do not contain executable code and cannot access other files on your device.
Types of Cookies Used:
Managing Cookies: Most browsers allow you to refuse cookies or delete existing cookies. Instructions for managing cookies in common browsers are available at the browser provider's support site. Please note that disabling essential cookies will prevent you from using the Platform. Disabling non-essential cookies may limit certain features but will not affect core functionality.
Do Not Track (DNT): xo360 respects browser-level Do Not Track signals. When DNT is enabled, we do not set marketing or tracking cookies.
xo360 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, and resolve disputes. Retention periods vary by data category:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Identity & Contact Data | 7 years from account closure | Regulatory record-keeping requirements under international gambling and AML laws |
| Transactional Data | 7 years from transaction date | Financial record-keeping, tax compliance, dispute resolution |
| KYC Documentation | 7 years from account closure | AML/CTF regulatory obligations |
| Communications Data | 3 years from final interaction | Support quality assurance, dispute resolution |
| Technical Data (Logs) | 2 years from collection | Security monitoring, fraud investigation |
| Marketing Consent Records | Duration of consent + 2 years | Proof of consent for regulatory compliance |
| Responsible Gaming Data | 10 years from self-exclusion end date | Duty-of-care obligations, re-exclusion enforcement |
Once the applicable retention period expires and no legal obligation requires continued storage, personal data is securely deleted or irreversibly anonymized such that it can no longer be attributed to an individual Member. Anonymized data may be retained indefinitely for statistical and analytical purposes.
xo360 operates from a jurisdiction outside Indonesia but serves Members who are residents of Indonesia. As a result, your personal data may be transferred to, stored in, and processed in countries other than Indonesia, including jurisdictions that may not offer the same level of data protection as Indonesian law.
Where xo360 transfers personal data internationally, we ensure that appropriate safeguards are in place to protect your data in accordance with this Policy and applicable data protection laws. Such safeguards include:
Members consent to international data transfers by registering on the Platform. If you have concerns about international transfers or wish to obtain further information about the safeguards in place, please contact xo360's Data Protection Officer using the details in Section 13.
Members hold the following rights in relation to their personal data, subject to applicable legal limitations and exceptions:
Request a copy of the personal data xo360 holds about you, including details of the purposes of processing, categories of data, and recipients.
Request correction of inaccurate or incomplete personal data. xo360 will update records promptly upon verification.
Request deletion of personal data where it is no longer necessary, consent is withdrawn, or processing is unlawful — subject to legal retention obligations.
Request temporary restriction of processing where accuracy is contested, processing is unlawful, or you object to processing.
Request export of your personal data in a structured, commonly used, machine-readable format for transfer to another service provider.
Object to processing based on legitimate interests, including profiling and direct marketing. xo360 will cease such processing unless compelling legitimate grounds override your rights.
Withdraw consent for marketing communications or optional data processing at any time, without affecting the lawfulness of prior consent-based processing.
Lodge a complaint with xo360 or directly with a relevant data protection authority if you believe your rights have been infringed.
Exercising Your Rights: To exercise any of the above rights, please submit a written request to xo360's support team at the contact details provided in Section 13. All requests must include your full name, registered email address, and account username to verify your identity. xo360 will respond to all valid requests within 30 days of receipt. Complex requests may require up to 60 days; you will be informed of any extension and the reasons for it.
There is no fee for exercising your rights unless your request is manifestly unfounded, excessive, or repetitive, in which case xo360 may charge a reasonable administrative fee or refuse to act on the request.
xo360's services are strictly for adults aged 21 years or older. The Platform is not directed at, nor intended for use by, individuals under the age of 21. xo360 does not knowingly collect personal data from individuals under 21 years of age.
If xo360 becomes aware that personal data has been collected from an individual under 21 — whether through fraudulent registration, parental consent obtained without proper verification, or any other means — that data will be deleted immediately, the associated account will be permanently closed, and any deposits will be returned to the source account.
Parents or guardians who believe that their child has registered on the Platform in violation of this Policy should contact xo360 support immediately at the details provided in Section 13.
Age Verification: xo360 employs mandatory KYC verification for all accounts. Providing false information regarding your age constitutes fraud and will result in immediate account closure, forfeiture of all balances, and referral to relevant authorities where applicable. For more information on age restrictions and responsible gaming, please review our Responsible Gaming Policy.
xo360 employs industry-standard technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or damage. These measures include but are not limited to:
While xo360 takes all reasonable steps to protect personal data, no method of transmission over the internet or electronic storage is 100% secure. Members are responsible for maintaining the confidentiality of their account credentials and for notifying xo360 immediately if they suspect unauthorized account access.
xo360 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.
Material Changes: Where a Policy update results in a material change to how xo360 collects, uses, or shares personal data — particularly where such change would expand data processing beyond the scope to which Members originally consented — xo360 will provide prominent notice via email to all active Members and via a banner notification on the Platform homepage. Members will be given a reasonable opportunity (minimum 14 days) to review the updated Policy before it takes effect.
Continued Use: By continuing to use the Platform following the effective date of an updated Policy, you acknowledge that you have read, understood, and consent to the revised terms. If you do not agree with an updated Policy, you must cease using the Platform and may request account closure and data deletion in accordance with Section 9.
Members are encouraged to review this Policy periodically to stay informed about how xo360 protects their personal data.
If you have any questions, concerns, or complaints regarding this Privacy Policy, or wish to exercise any of the rights described in Section 9, please contact xo360's Data Protection Officer using the details below:
Complaints to Supervisory Authorities: If you are not satisfied with xo360's response to a privacy concern or believe that your data protection rights have been infringed, you have the right to lodge a complaint with a relevant data protection supervisory authority in your jurisdiction of residence. xo360 encourages Members to contact us first so that we may attempt to resolve the issue directly.
Our support team is available 24/7 to answer any questions about this Privacy Policy, help you exercise your data rights, or address privacy concerns. You may also find additional information in our FAQ, Terms & Conditions, and Responsible Gaming Policy.