At xl888, protecting your personal information is a core commitment — not an afterthought. This Privacy Policy explains in plain, precise terms what data we collect from members across Jakarta, Surabaya, Medan, Bandung, Bali, and throughout Indonesia, how we use it, who we share it with, and the controls you have over it. By registering an account or using any xl888 Service, you acknowledge that you have read and accepted this policy in full.
We collect only the personal information that is genuinely necessary to operate your xl888 account, process transactions in IDR, and meet our compliance obligations. We do not request data for its own sake.
xl888 does not sell, rent, or commercially licence your personal data to any third party, advertiser, or data broker. Your information exists to serve your account — nothing else.
All data transmitted between your device and xl888's servers is protected by industry-standard TLS/SSL encryption. Stored data is encrypted at rest using AES-256 protocols to prevent unauthorised access.
You have the right to access, correct, or request deletion of your personal data at any time. Submit a written request to [email protected] and we will respond within five business days.
We retain personal data only for as long as it is necessary for the purpose for which it was collected, or as required by applicable compliance and anti-money-laundering record-keeping obligations.
In the unlikely event of a data security breach that affects your personal information, xl888 will notify impacted members promptly via their registered email address and take immediate remediation steps.
Important: This Privacy Policy applies to all members and visitors of the xl888 platform. You must be at least 21 years of age to create an account. By continuing to use xl888's Services, you confirm your acceptance of this policy. If you do not agree, please discontinue use and contact us to request account closure.
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
2.1 Who This Policy Covers. This Privacy Policy applies to all individuals who access, browse, or use the xl888 platform, whether as registered Members or as unregistered visitors. It covers Personal Data collected via the xl888 website, any associated mobile-optimised interface, and all communication channels including live chat and email support.
2.2 Geographic Scope. xl888's Services are directed at residents of Indonesia. This policy is therefore written with the Indonesian market context in mind, referencing local payment methods (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja), local currency (IDR / Rp), and the Indonesian personal data protection landscape.
2.3 Third-Party Links. The xl888 platform does not contain outbound links to third-party websites. In the event that any third-party content or embedded service is present, this Privacy Policy does not extend to that third party's own data-handling practices. Members should review third-party privacy policies independently where applicable.
3.1 Registration Data. When you create an xl888 account, we collect the information you provide directly, which includes:
3.2 KYC Verification Data. To process your first withdrawal and to comply with our anti-money-laundering obligations, we collect copies of identity documents you voluntarily submit, which may include your KTP (Kartu Tanda Penduduk), Indonesian passport, SIM (Surat Izin Mengemudi), and bank statements from BCA, BRI, BNI, Mandiri, CIMB Niaga, or other supported Indonesian banks.
3.3 Transaction Data. xl888 records all financial transactions associated with your account, including deposit amounts, withdrawal requests, payment method used, transaction timestamps, and game wager and result records. Transaction data is denominated exclusively in IDR (Rp).
3.4 Technical Data. When you access xl888, our servers automatically capture technical information including your IP address, browser type and version, device operating system, screen resolution, referring URL, session duration, and pages visited.
3.5 Communications Data. If you contact xl888 via live chat or email ([email protected]), we retain a record of that conversation including the content of messages exchanged, timestamps, and the support agent who handled your enquiry.
3.6 Gameplay and Behavioural Data. We record gameplay activity including games played, bet amounts, session duration, product categories accessed (sportsbook, slots, live casino, togel (Indonesia's traditional numbers lottery), Domino QQ, Bingo Online), and promotional offers claimed. This data is used for account management, fraud detection, responsible gaming monitoring, and service improvement.
| Data Category | Examples | Collected At |
|---|---|---|
| Registration Data | Name, DOB, phone, email, payment method | Account sign-up |
| KYC Documents | KTP, passport, bank statement | First withdrawal request |
| Transaction Data | Deposits, withdrawals, wager history (IDR) | Continuously during account activity |
| Technical Data | IP address, browser, device OS | Every platform visit |
| Communications Data | Live chat transcripts, support emails | When you contact support |
| Gameplay Data | Games played, session length, bet amounts | Continuously during gameplay |
4.1 Directly From You. The majority of Personal Data we hold is information you provide voluntarily when registering your account, submitting KYC documents, making a deposit, requesting a withdrawal, or contacting our support team.
4.2 Automatically. Technical Data is collected automatically each time your browser or device connects to xl888's servers. This includes data gathered via server logs, session cookies, and analytics tools operating within the xl888 platform.
4.3 From Third-Party Providers. When you initiate a deposit or withdrawal via a payment provider — such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja — that provider may share transaction confirmation data with xl888 to facilitate accurate crediting and reconciliation of your account balance. xl888 does not receive your full bank card number from these providers; we receive only the truncated reference required for transaction matching.
4.4 From KYC Verification Partners. xl888 may use third-party identity verification services to cross-check the documents you submit against Indonesian government identity databases. These services return a verified/not-verified result and a confidence score; they do not provide xl888 with additional data beyond what you have already submitted.
xl888 processes your Personal Data only for specific, legitimate purposes. The table below maps each data category to the purpose for which it is processed and the legal basis on which xl888 relies:
| Processing Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Registration data | Contract performance |
| Age verification (21+ enforcement) | Date of birth, KYC documents | Legal obligation / contract |
| Payment processing (IDR deposits and withdrawals) | Transaction data, payment method details | Contract performance |
| Fraud detection and prevention | Technical data, transaction data, gameplay data | Legitimate interests |
| Anti-money-laundering compliance | KYC documents, transaction data | Legal obligation |
| Customer support | Communications data, registration data | Contract performance |
| Responsible gaming monitoring | Gameplay data, transaction data | Legitimate interests / legal obligation |
| Platform improvement and analytics | Technical data, gameplay data (aggregated/anonymised) | Legitimate interests |
| Promotional communications (where opted in) | Email address, phone number | Consent |
xl888 does not use your Personal Data for any purpose other than those listed above. Where a new processing purpose arises, we will update this Privacy Policy and, where required, seek your consent before commencing that processing.
6.1 No Sale of Personal Data. xl888 does not sell, rent, trade, or otherwise commercially transfer your Personal Data to any third party under any circumstances.
6.2 Service Providers. xl888 shares Personal Data with carefully selected Third-Party Service Providers solely to the extent necessary to deliver the Services. These providers operate under binding data processing agreements that prohibit them from using your data for any purpose beyond the specific service they provide to xl888. Current categories of service providers include:
6.3 Legal Disclosures. xl888 may disclose your Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where we are required to do so by a valid legal order, warrant, or binding regulatory direction. xl888 will notify you of any such disclosure request where legally permitted to do so.
6.4 Business Transfers. In the event of a merger, acquisition, or transfer of all or a substantial part of xl888's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer by email to your registered address before it takes effect.
When xl888 shares data with any service provider, that provider is contractually prohibited from using your information for their own marketing, analytics, or any purpose unrelated to the service they perform for xl888. We audit our service providers' compliance with this obligation on a regular basis.
7.1 Types of Cookies Used. xl888 uses the following categories of cookies on the platform:
7.2 Cookie Lifespan. Session cookies expire when you close your browser. Persistent functional and analytics cookies are set with a maximum lifespan of 12 months, after which they are automatically deleted and, if you return to the platform, re-set with fresh expiry dates.
7.3 Managing Cookies. You can control functional and analytics cookies through your browser settings. Most modern browsers allow you to block or delete cookies on a per-site basis. Please note that disabling strictly necessary or security cookies will impair your ability to log in and use the xl888 platform.
7.4 No Cross-Site Tracking. xl888 does not embed third-party advertising trackers, social media pixels, or cross-site tracking technologies on any page of the platform. Our cookies operate exclusively within the xl888.bio domain.
8.1 Technical Measures. xl888 implements the following technical safeguards to protect your Personal Data:
8.2 Organisational Measures. Access to member Personal Data is restricted to xl888 staff who require it to perform their job functions. All staff with data access are bound by confidentiality obligations and receive regular data-handling training. Access logs are maintained and reviewed periodically.
8.3 Incident Response. In the event of a Personal Data breach that creates a risk to member rights — for example, unauthorised access to account credentials or payment data — xl888 will take immediate containment steps, conduct a root-cause analysis, and notify affected Members by email as promptly as circumstances permit.
8.4 Member Responsibilities. The security of your account also depends on the strength of your password and the confidentiality with which you treat your login credentials. xl888 strongly recommends using a unique, complex password and never sharing your account details with any third party. xl888 support staff will never ask for your password under any circumstances.
9.1 Active Accounts. Personal Data associated with an active xl888 account is retained for the duration of the account's existence. We do not delete data from active accounts as it is necessary for ongoing account management, transaction processing, and dispute resolution.
9.2 Closed Accounts. Following the closure or permanent suspension of an account, xl888 retains Personal Data for a minimum of five years from the date of closure. This retention period reflects our obligations under anti-money-laundering record-keeping requirements and our legitimate interest in maintaining records necessary to defend against legal claims.
9.3 KYC Documents. Identity verification documents are retained for five years from the date they are submitted or from the date the account is closed, whichever is later. After that period, documents are securely deleted or anonymised.
9.4 Analytics Data. Aggregated, anonymised analytics data that cannot reasonably be used to identify any individual may be retained indefinitely for platform improvement purposes.
9.5 Communications Data. Support chat transcripts and email records are retained for three years from the date of the communication. Records relating to formal complaints or legal disputes are retained for five years.
If you request account closure and data deletion, xl888 will delete or anonymise all Personal Data that is not subject to a legal retention obligation within 30 days of confirming your identity and processing the closure request. Data subject to a legal retention period will be deleted as soon as that obligation expires.
As a Member of the xl888 platform, you have the following rights with respect to your Personal Data:
To exercise any of these rights, submit a written request by email to [email protected]. Please include your registered username and the email address associated with your account. xl888 will verify your identity before processing any data rights request.
11.1 Age Restriction. The xl888 platform is strictly for individuals who are 21 years of age or older. We do not knowingly collect Personal Data from anyone under the age of 21. The 21+ age requirement is enforced at registration through date-of-birth collection and confirmed through our KYC identity verification process prior to the processing of any withdrawal.
11.2 Discovery of Minor's Data. If xl888 discovers or is credibly notified that it has collected Personal Data from an individual under 21 years of age, we will immediately suspend the associated account, delete all related Personal Data to the extent not required for legal compliance, and refund any real-money balance to the payment source from which it originated. Any winnings accumulated by an underage account will be forfeited.
11.3 Parental Concerns. If you believe that your child or a minor in your care has created an xl888 account, please contact us immediately at [email protected]. We will investigate promptly and take the remediation steps described in clause 11.2.
12.1 Cross-Border Processing. Some of xl888's Third-Party Service Providers — including cloud infrastructure providers and game studio integration partners — operate servers located outside Indonesia. As a result, your Personal Data may be transferred to and processed in jurisdictions other than Indonesia.
12.2 Safeguards. Where such transfers occur, xl888 ensures that appropriate contractual safeguards are in place to protect your data to a standard equivalent to that described in this Privacy Policy. These safeguards include data processing agreements that impose strict confidentiality, security, and limited-purpose obligations on the receiving party.
12.3 Your Acknowledgement. By using the xl888 platform and submitting Personal Data, you acknowledge and accept that your data may be transferred to and processed in other countries for the purposes described in this Privacy Policy, subject to the safeguards outlined above.
13.1 Right to Amend. xl888 reserves the right to update this Privacy Policy at any time to reflect changes in our data-handling practices, legal obligations, or platform features. The revised policy will be published on this page with an updated "Last Updated" date.
13.2 Notification of Material Changes. Where a change to this Privacy Policy materially affects the way we process your Personal Data or materially reduces your rights, xl888 will notify you by email to your registered address at least seven days before the change takes effect.
13.3 Continued Use. Your continued use of the xl888 platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised terms, you must cease using the platform and request account closure before the amendment's effective date.
For any questions, concerns, or requests relating to this Privacy Policy or the Personal Data xl888 holds about you, please contact us through one of the following channels:
xl888's support team includes Indonesian-speaking agents available across WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones to assist members throughout Indonesia, from Jakarta and Surabaya to Bali, Medan, and beyond.
Security reminder: xl888 will never ask for your password, full bank card number, or OTP (one-time passcode) via email or live chat. If you receive any communication claiming to be from xl888 that requests this information, do not respond — report it immediately to [email protected].
xl888 combines a world-class sportsbook, premium live casino, and the best slots with an unwavering commitment to data security and member privacy. Log in, explore our games, or visit the FAQ if you have further questions. 21+ only. Play responsibly.
SSL Encrypted · Provably Fair · 24/7 Support · IDR Only