xyz88 Privacy Policy

xyz88 operates as an internationally positioned online gambling platform serving players primarily across Indonesia, including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Makassar, and Palembang. In the course of providing our services — which encompass sportsbook betting, live casino, slots, roulette, fish shooting, and associated account and payment services — xyz88 necessarily collects and processes certain personal data about our Members and platform visitors.

We are deeply committed to handling that data with transparency, integrity, and appropriate technical safeguards. This Privacy Policy has been drafted to give you a complete, honest picture of our data practices. It covers every stage of the data lifecycle: collection, storage, use, sharing, and deletion.

This policy should be read alongside the Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference. Where those documents address data-related matters, this Privacy Policy provides the governing detail.

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "Platform" — the xyz88 website at https://xyz88.bio and all associated pages, services, APIs, and digital interfaces.
• "Member" — any individual who has registered a verified Account on the Platform.
• "Visitor" — any individual who accesses the Platform without a registered Account.
• "Personal Data" — any information that identifies or could reasonably identify a natural person, including name, national identity number, contact details, financial data, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, modification, transmission, or deletion.
• "KYC" — Know Your Customer: the identity and age verification process applied to Member Accounts.
• "Third-Party Processor" — any external entity engaged by xyz88 to process Personal Data on our behalf under a data processing agreement, such as payment processors or game providers.
• "Cookies" — small data files placed on a Member's or Visitor's device by the Platform for functional, analytical, or marketing purposes.

xyz88 collects Personal Data across several categories depending on your level of interaction with the Platform:

3.1 Registration & Account Data

• Full legal name (as shown on government-issued ID);
• Date of birth (to verify you are at least 21 years of age);
• Indonesian mobile phone number (+62);
• Email address;
• Username and encrypted password;
• Preferred currency (Indonesian Rupiah, IDR/Rp).

3.2 Identity Verification (KYC) Data

• Copy of Indonesian National Identity Card (KTP), passport, or driver's licence;
• Selfie or liveness-check image taken during the KYC verification process;
• Proof of address (utility bill, bank statement, or equivalent document not older than 3 months);
• Proof of payment method ownership (e.g., bank account screenshot or e-wallet registration confirmation).

3.3 Financial & Transaction Data

• Bank account details (bank name, account number, account holder name) for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, or Bank Danamon;
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja;
• Deposit and withdrawal transaction histories, including amounts in Rupiah (Rp), timestamps, and payment method used;
• Bonus claims, wagering activity, and wallet balance history.

3.4 Gaming & Behavioural Data

• Wager records, game selections, bet amounts, win/loss outcomes, and session durations;
• Sportsbook selections including match choices, odds, and market types such as mix parlay (multi-leg accumulator) and voor bola (Asian handicap);
• Responsible gaming tool usage, including deposit limits, session reminders, and self-exclusion events;
• Live chat and support ticket transcripts.

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser version;
• Session identifiers and authentication tokens;
• Referring URL and on-site navigation path.

3.6 Communications Data

• Emails or messages sent to xyz88 support;
• Promotional preference settings (opt-in/opt-out status for marketing communications);
• Feedback, survey responses, and complaint records.

xyz88 collects Personal Data through the following channels:

• Direct submission: when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, contact support, or update your Account profile;
• Automated technical means: server logs, session cookies, and analytics tools capture device and behavioural data passively as you navigate the Platform;
• Third-party verification services: identity verification providers and payment processors may return data to xyz88 as part of the KYC and transaction flow;
• Game providers: game outcome and session data is transmitted to xyz88 by integrated Game Providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others) for settlement and responsible gaming purposes.

xyz88 does not purchase Personal Data from data brokers, social media platforms, or any other external list providers. All Personal Data held by xyz88 originates from your direct interaction with the Platform or from the limited Third-Party Processors engaged to deliver our services.

xyz88 uses Personal Data for the following purposes:

xyz88 does not use Personal Data for automated profiling or decision-making that produces legal or similarly significant effects on Members without a human review step. Responsible gaming risk flags are assessed by trained support staff before any account restriction is applied.

xyz88 processes Personal Data on the following legal grounds:

• Contractual necessity: the majority of data processing is necessary to perform the contract established by our Terms & Conditions when you register an Account — including identity verification, transaction processing, and game delivery;
• Legal obligation: certain processing activities, particularly KYC verification and AML monitoring, are required to comply with applicable international financial crime and gaming standards;
• Legitimate interests: xyz88 has a legitimate interest in fraud prevention, platform security, and improving the quality of our services, provided these interests do not override your fundamental privacy rights;
• Consent: where processing is based on consent — specifically, opt-in marketing communications — you may withdraw that consent at any time by updating your Account preferences or contacting support, without affecting the lawfulness of processing carried out before the withdrawal.

xyz88 does not sell, rent, or trade your Personal Data to any unaffiliated third party for their own commercial purposes. We share Personal Data only in the following limited and controlled circumstances:

• Payment processors: your bank account details and transaction data are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) strictly to execute the requested deposit or withdrawal transaction;
• Game providers: your account identifier, wallet balance, and game session data are shared with integrated Game Providers (including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to deliver and settle game rounds, and to support responsible gaming monitoring at the provider level;
• Identity verification services: KYC documents are transmitted to our contracted identity verification provider for automated and manual review; that provider is bound by a data processing agreement prohibiting any secondary use of your data;
• Legal authorities: xyz88 will disclose Personal Data to law enforcement, regulatory bodies, or courts when required to do so by a lawful order or where we determine in good faith that disclosure is necessary to prevent or investigate a serious crime, protect public safety, or enforce our Terms & Conditions;
• Business transfers: in the event of a merger, acquisition, or sale of all or substantially all of xyz88's assets, Personal Data held by xyz88 may be transferred to the acquiring entity, subject to equivalent data protection obligations being assumed by that entity. Members will be notified of any such transfer.

xyz88 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention schedule:

At the end of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with any individual. Anonymised aggregate data (e.g., platform-wide wagering statistics with no individual identifiers) may be retained indefinitely for analytical and operational purposes.

xyz88 implements a comprehensive, layered security architecture to protect your Personal Data from unauthorised access, disclosure, alteration, or destruction. Our key technical and organisational security measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and the Platform;
• Encryption at rest for all sensitive Personal Data stored on our servers, including KYC documents and financial records;
• SMS OTP and optional two-factor authentication (2FA) to protect Account login;
• Role-based access controls limiting staff access to Personal Data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Intrusion detection and real-time anomaly monitoring across all Platform infrastructure;
• Secure, geographically redundant data centre hosting with physical access controls and 24/7 monitoring;
• Staff privacy and security training for all personnel who handle Personal Data.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, xyz88 will notify affected Members without undue delay and take all reasonable steps to contain and remediate the breach.

The xyz88 Platform uses cookies and similar tracking technologies to deliver core functionality, improve performance, and — where you have consented — support analytics. The categories of cookies used are as follows:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to or using the Platform. Disabling analytics or marketing cookies will not affect your ability to play or transact on xyz88.

As a Member of the xyz88 Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team via live chat or email at [email protected]. We will respond to all verifiable requests within 30 calendar days.

• Right of Access: you may request a copy of the Personal Data xyz88 holds about you, along with information about the purposes for which it is processed and the categories of recipients with whom it has been shared.
• Right of Rectification: if any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update most Account information directly from your Account dashboard; for KYC-related corrections, contact support.
• Right of Erasure ("Right to Be Forgotten"): you may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there is no overriding legitimate interest. Note that erasure requests may be refused or limited where retention is required for legal compliance or fraud prevention, as described in Clause 8.
• Right to Restrict Processing: you may request that xyz88 restricts the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is being contested or an objection is being assessed.
• Right to Data Portability: where processing is based on consent or contract and carried out by automated means, you may request a machine-readable copy of the Personal Data you have provided to xyz88.
• Right to Object: you have the right to object to processing carried out on the basis of legitimate interests. xyz88 will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for legal claims.
• Right to Withdraw Consent: where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The xyz88 Platform is strictly intended for adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step of the Account registration process, and all Accounts are subject to KYC age confirmation before any withdrawal is processed.

If xyz88 discovers or is notified that an Account belongs to a person under 21 years of age, that Account will be suspended immediately, all associated Wallet balances will be withheld pending investigation, and the matter will be referred to our responsible gaming and compliance teams. Any deposits attributable to the underage individual will be returned to the originating payment method once the investigation is concluded, subject to fraud and AML checks.

If you are a parent or guardian and believe that a person under 21 in your care has registered an xyz88 Account without authorisation, please contact us immediately at [email protected]. We take all such reports seriously and will act promptly.

The xyz88 Platform may contain links to third-party services — for example, integrated game lobby interfaces delivered by external Game Providers. Once you navigate to a third-party environment, that provider's own privacy policy and data practices apply, and xyz88 has no control over how that third party handles your data beyond the contractual protections set out in our agreements with them.

xyz88 encourages you to review the privacy policies of any third-party provider whose services you access through the Platform. The presence of a Game Provider's content on xyz88 does not constitute an endorsement of that provider's privacy practices beyond our contracted data protection obligations.

xyz88 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the scope of our services. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page;
• Post a notice on the Platform for a minimum of 14 days following the change;
• Where required by applicable law or where the change is particularly significant, notify affected Members directly by email.

Your continued use of the xyz88 Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. We recommend bookmarking this page and reviewing it periodically. If you have any questions about a change, our support team is available 24/7.

For all privacy-related queries, data subject access requests, or complaints regarding the handling of your Personal Data by xyz88, please contact our dedicated data support team through the following channels:

• Live Chat: available 24/7 directly from the Platform — typical first response within 45 seconds.
• Email: [email protected] — plain text only, not a clickable link. Formal privacy requests should include the subject line "Privacy Request — [your Account username]". Typical response time: within 4 hours during WIB business hours (09:00–21:00 WIB).

xyz88 will acknowledge all formal privacy requests within 5 business days and endeavour to provide a substantive response within 30 calendar days. For complex requests that require additional time, we will notify you within the initial 30-day period and provide an estimated resolution date.