Privacy Policy

1. Information We Collect

1.1 Personal Information Provided by You

When you register for an xr888 account, we collect personal information that you voluntarily provide, including:

• Identity Information: Full legal name as it appears on your government-issued identification (Indonesian KTP), date of birth, gender, nationality, and place of birth.
• Contact Information: Email address, mobile phone number, residential address in Indonesia including street, city, postal code, and province.
• Account Credentials: Username, password (stored in encrypted form), and security questions/answers for account recovery purposes.
• Financial Information: Bank account details (bank name, account number, account holder name) for Indonesian banks such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata, as well as e-wallet account information for OVO, DANA, GoPay, ShopeePay, and LinkAja used for deposits and withdrawals.
• Verification Documents: Copies of identity documents including Indonesian KTP (Kartu Tanda Penduduk), proof of address (utility bills, bank statements, government correspondence), and selfie photographs holding identification for KYC (Know Your Customer) compliance.
• Communication Records: Correspondence with our customer support team via live chat, email, WhatsApp, or in-app messaging, including inquiry details, complaint information, and resolution records.

1.2 Information Collected Automatically

When you access or use xr888 services, we automatically collect certain technical and usage information:

• Device Information: Device type (smartphone, tablet, desktop), operating system (Android, iOS, Windows, macOS), browser type and version, screen resolution, device identifiers (IMEI, device ID, advertising ID where permitted), and mobile network carrier information.
• Connection and Location Data: IP address, internet service provider (ISP), connection type (Wi-Fi, mobile data), approximate geographic location based on IP address (city, region level only — we do not collect precise GPS coordinates without explicit permission), time zone, and language preferences.
• Website and App Usage Data: Pages visited, features accessed, games played, bet history, deposit and withdrawal transactions, time spent on platform, click patterns, navigation paths, search queries, referring and exit pages, and timestamps for all activities.
• Cookies and Tracking Technologies: We use cookies (small text files stored on your device), web beacons, pixel tags, session IDs, and similar tracking technologies to recognize you, remember your preferences, maintain login sessions, analyze platform performance, prevent fraud, and improve user experience. You can manage cookie preferences through your browser settings, though disabling cookies may limit certain platform functionalities.

1.3 Information from Third-Party Sources

In certain circumstances, xr888 may receive information about you from external sources including:

• Payment Processors: Transaction confirmation, payment status, and identity verification data from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity Verification Services: Age verification, identity authentication, address validation, and fraud detection information from third-party KYC service providers we engage to ensure compliance with legal requirements.
• Game Providers: Game session data, betting patterns, and win/loss records from our partner game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft.
• Marketing and Analytics Partners: Aggregated and anonymized usage statistics, performance metrics, and demographic insights from analytics platforms (Google Analytics, internal analytics systems) to improve our services and marketing effectiveness.

2. How We Use Your Information

xr888 uses the personal information we collect for the following legitimate business purposes:

2.1 Account Management and Service Delivery

• Creating, maintaining, and managing your xr888 gaming account
• Processing deposits, withdrawals, and financial transactions through Indonesian banks and e-wallets
• Providing access to sports betting (football, basketball, tennis, badminton, e-sports including BRI Liga 1, EPL, La Liga, Champions League), live casino games (baccarat, blackjack, roulette, poker), slot machines, and lottery draws (togel markets from Singapore, Hongkong, Sydney, Macau, Taiwan, Japan)
• Processing bets, calculating winnings, updating account balances, and maintaining accurate transaction records
• Communicating important account information, transaction confirmations, withdrawal approvals, and platform updates

2.2 Verification and Compliance

• Verifying your identity, age (21+ requirement), and residency status in Indonesia through KYC procedures
• Preventing underage gambling, identity theft, fraud, money laundering, and other illegal activities
• Complying with legal and regulatory obligations including anti-money laundering (AML) laws, counter-terrorism financing (CTF) regulations, and international gaming standards
• Responding to lawful requests from government authorities, law enforcement agencies, or regulatory bodies when legally required
• Enforcing our Terms & Conditions, detecting and investigating violations, and protecting the integrity of xr888 platform

2.3 Customer Support and Communication

• Providing 24/7 Indonesian-speaking customer support via live chat, email, WhatsApp, and in-app messaging
• Resolving account issues, answering inquiries about deposits/withdrawals, explaining bonus terms, troubleshooting technical problems, and addressing complaints
• Sending transactional emails and notifications including deposit confirmations, withdrawal processing updates, bonus activations, responsible gaming reminders, and security alerts
• Conducting customer satisfaction surveys and gathering feedback to improve service quality

2.4 Platform Improvement and Analytics

• Analyzing usage patterns, game preferences, betting behaviors, and feature engagement to optimize user experience
• Identifying technical issues, monitoring platform performance, and improving website/app stability and speed
• Developing new features, games, payment methods, and services based on user needs and market trends
• Conducting internal research, statistical analysis, and data modeling to enhance xr888 offerings

2.5 Marketing and Promotions (With Your Consent)

• Sending promotional offers, bonus announcements, VIP program updates, tournament invitations, and special deals via email, SMS, push notifications, or in-app messages (only if you have opted in to receive marketing communications)
• Personalizing content, game recommendations, and promotional offers based on your preferences and activity history
• Displaying targeted advertisements on the xr888 platform (we do not sell your personal data to third-party advertisers)
• Running competitions, prize draws, loyalty programs, and seasonal campaigns

You can opt out of marketing communications at any time by adjusting your account settings, clicking "unsubscribe" links in emails, or contacting customer support. Opting out of marketing will not affect transactional or account-related communications, which are necessary for service delivery.

2.6 Security and Fraud Prevention

• Detecting and preventing unauthorized account access, fraudulent transactions, payment disputes, and cybersecurity threats
• Monitoring for suspicious betting patterns, bonus abuse, multi-accounting, collusion, and other prohibited activities
• Implementing advanced security measures including SSL encryption, two-factor authentication (2FA), IP address monitoring, device fingerprinting, and behavior analysis
• Maintaining secure backups and disaster recovery systems to protect against data loss

3. Legal Basis for Processing (Where Applicable)

Under applicable data protection laws, xr888 processes your personal information based on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (Terms & Conditions), including account management, transaction processing, and service delivery.
• Legal Obligation: Processing is required to comply with legal requirements such as age verification (21+ requirement), KYC/AML regulations, tax reporting obligations, and regulatory compliance.
• Legitimate Interests: Processing serves xr888's legitimate business interests in fraud prevention, security maintenance, platform improvement, customer support, and operational efficiency, provided these interests do not override your fundamental privacy rights.
• Consent: For marketing communications, cookies (beyond essential cookies), and other optional data uses, we process information only with your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

4. How We Share Your Information

xr888 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we may share your information with selected third parties in the following limited circumstances:

4.1 Service Providers and Business Partners

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals.
• Game Providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft, and other licensed game studios to deliver casino games, slots, live dealer tables, and lottery draws.
• Identity Verification Services: Third-party KYC/AML compliance providers to verify your age, identity, and address as required by law.
• Technology and Infrastructure Partners: Hosting providers, cloud storage services, cybersecurity firms, and IT maintenance contractors to ensure platform security, performance, and reliability.
• Customer Support Tools: Live chat software providers, help desk platforms, and communication service providers to deliver efficient customer support.
• Analytics and Marketing Services: Analytics platforms (Google Analytics with anonymized IP), email service providers, and SMS gateway operators (only for users who have consented to marketing communications).

All third-party service providers are carefully selected and contractually obligated to protect your data, use it only for specified purposes, and comply with applicable data protection laws. They are prohibited from using your personal information for their own purposes or sharing it with others without authorization.

4.2 Legal and Regulatory Authorities

We may disclose your personal information to government authorities, law enforcement agencies, courts, regulators, or legal counsel when required by law, court order, subpoena, or regulatory request, or when necessary to:

• Comply with legal obligations including AML/CTF reporting requirements
• Respond to lawful requests for information from Indonesian or international authorities
• Protect the rights, property, or safety of xr888, our users, or the public
• Investigate, prevent, or take action regarding illegal activities, fraud, violations of our terms, or security threats
• Enforce our Terms & Conditions and other legal agreements

4.3 Business Transfers

In the event xr888 undergoes a merger, acquisition, corporate restructuring, sale of assets, bankruptcy, or similar business transaction, your personal information may be transferred to the acquiring or successor entity as part of the transaction. In such cases, you will be notified via email or prominent notice on our website, and the new entity will be required to honor the commitments made in this Privacy Policy.

5. Data Security Measures

xr888 implements comprehensive technical, administrative, and physical security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction:

• Encryption: All data transmission between your device and our servers is protected by SSL/TLS encryption (minimum 256-bit encryption standard). Sensitive data including passwords and financial information is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal information is restricted to authorized xr888 employees and contractors who require access to perform their job functions. All staff members are bound by strict confidentiality obligations and undergo security training.
• Authentication: We support two-factor authentication (2FA) for enhanced account security and encourage all users to enable this feature. Passwords are stored using secure one-way hashing algorithms and cannot be retrieved by xr888 staff.
• Network Security: Our infrastructure includes firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), DDoS protection, and continuous security monitoring to detect and respond to threats in real-time.
• Regular Audits: We conduct regular security audits, vulnerability assessments, penetration testing, and compliance reviews to identify and address potential security weaknesses.
• Secure Data Centers: Our servers are hosted in secure, certified data centers with physical access controls, environmental monitoring, redundant power supplies, and disaster recovery capabilities.
• Data Minimization: We collect and retain only the personal information necessary for specified purposes and delete or anonymize data when no longer required.

Despite these measures, no internet-based platform can guarantee absolute security. You acknowledge that data transmission over the internet carries inherent risks, and you use xr888 services at your own risk. You are responsible for maintaining the confidentiality of your account credentials and should immediately notify us if you suspect unauthorized account access.

6. Data Retention

xr888 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law:

• Active Accounts: Personal information for active accounts is retained for the duration of your relationship with xr888 and for a reasonable period thereafter to address post-closure inquiries, comply with legal obligations, or resolve disputes.
• Closed Accounts: After voluntary account closure, we retain essential information (identity details, transaction history, compliance records) for up to seven (7) years to meet legal and regulatory requirements including tax obligations, anti-money laundering laws, and dispute resolution needs. Marketing preferences and non-essential data are deleted within ninety (90) days of account closure.
• Inactive Accounts: Accounts with no login activity for over twelve (12) months may be classified as inactive. We may send reminder emails before implementing data minimization procedures that archive or delete non-essential information while retaining core records for compliance purposes.
• Legal Holds: Information subject to ongoing legal proceedings, regulatory investigations, or unresolved disputes will be retained until such matters are conclusively resolved, regardless of standard retention periods.

7. Your Privacy Rights

Depending on your jurisdiction and applicable data protection laws, you may have the following rights regarding your personal information:

• Right of Access: You can request confirmation of whether xr888 processes your personal data and obtain a copy of the information we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete personal information. You can update most account details directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You can request deletion of your personal information in certain circumstances, subject to legal obligations that may require us to retain certain data (e.g., transaction records for seven years under AML regulations).
• Right to Restrict Processing: You can request that we limit how we use your information in specific situations, such as while verifying the accuracy of disputed data.
• Right to Data Portability: You can request a copy of your personal information in a structured, commonly used, machine-readable format to transfer to another service provider (where technically feasible).
• Right to Object: You can object to processing of your personal information based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you can withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise these rights, please contact our Data Protection Officer via email at [email protected] with the subject line "Privacy Rights Request." We will respond to verified requests within thirty (30) days and may request additional information to confirm your identity before processing the request.

8. International Data Transfers

xr888 primarily serves Indonesian players and stores data within secure data centers. However, some of our service providers (cloud hosting, game studios, payment processors) may be located in jurisdictions outside Indonesia. When personal information is transferred internationally, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities
• Adequacy decisions recognizing recipient countries as providing adequate data protection
• Privacy Shield frameworks (where applicable) or equivalent mechanisms
• Binding corporate rules for transfers within multinational organizations

By using xr888 services, you acknowledge and consent to such international data transfers as necessary for service delivery, subject to the protections described in this Privacy Policy.

9. Children's Privacy

xr888 services are strictly intended for adults aged 21 years or older, in compliance with Indonesian legal requirements for gambling participation. We do not knowingly collect, use, or solicit personal information from individuals under 21 years of age. Our registration process includes age verification through date of birth entry and KYC document checks. If we become aware that we have inadvertently collected information from a person under 21, we will immediately delete such information and close the associated account. Parents or guardians who believe their child has provided personal information to xr888 should contact us immediately at [email protected] so we can take appropriate action.

10. Cookies and Tracking Technologies

xr888 uses cookies and similar tracking technologies to enhance user experience, maintain security, and analyze platform performance. Cookies are small text files stored on your device that help us recognize you across sessions. We use the following types of cookies:

• Essential Cookies: Required for core platform functionality including login authentication, session management, security features, and payment processing. These cannot be disabled without severely impairing platform usability.
• Performance Cookies: Collect anonymous usage statistics to understand how visitors interact with xr888, identify popular features, detect technical errors, and optimize performance.
• Functionality Cookies: Remember your preferences (language selection, display settings, game filters) to provide a personalized experience.
• Targeting/Advertising Cookies: Used to deliver relevant promotional content and measure campaign effectiveness (only with your consent).

You can manage cookie preferences through your browser settings (Chrome, Firefox, Safari, Edge all offer cookie management tools). Disabling essential cookies will prevent you from logging in and using most xr888 features. Third-party cookies (e.g., from analytics providers) can typically be disabled without affecting core functionality.

11. Changes to This Privacy Policy

xr888 reserves the right to update, modify, or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements, business operations, or technological capabilities. Changes will be effective immediately upon posting on our website, with the "Last Updated" date revised accordingly. For material changes that significantly affect your privacy rights or how we process your information, we will provide prominent notice via email, in-app notification, or banner announcement on the xr888 homepage, and may require you to affirmatively accept the updated Privacy Policy before continuing to use our services. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Continued use of xr888 services following any changes constitutes your acceptance of the revised Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, our data practices, or your privacy rights, please contact xr888's Data Protection Officer through the following channels:

• Email: [email protected] (subject line: "Privacy Inquiry" for faster routing)
• Live Chat: Available 24/7 on the xr888 website and mobile app
• WhatsApp: +62 812-3456-7890 (daily 08:00 - 02:00 WIB)
• In-App Messaging: Access through your account dashboard for logged-in members

We are committed to resolving privacy concerns promptly and transparently. You can expect a response to privacy inquiries within seven (7) business days, with full resolution typically provided within thirty (30) days. For complex matters requiring investigation or legal consultation, we will keep you informed of progress and expected resolution timelines.