Your privacy is a fundamental right. This policy explains precisely what personal data xl88 collects, why we collect it, how we use and protect it, and what choices you have as an Indonesian player on our platform.
Last Updated: January 1, 2026 | Effective Date: January 1, 2026 | Version: 3.2
Summary: xl88 collects personal data solely to operate your betting account, process payments, verify your identity, and improve our services. We do not sell your personal data to third parties. We use industry-standard encryption and security controls to protect all data we hold. You have the right to access, correct, delete, or restrict processing of your data at any time by contacting our support team.
In this Privacy Policy, the following terms carry the meanings set out below:
xl88 collects the minimum data necessary to provide our services securely and in accordance with our legal obligations. The categories of personal data we collect are set out in the table below.
| Data Category | Specific Data Points | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government ID number (KTP / Passport) | Account registration, KYC verification, age verification |
| Contact Data | Email address, mobile phone number, WhatsApp/Telegram handle, residential address | Account communications, support, security alerts, promotional messages (with consent) |
| Financial Data | Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Danamon), e-wallet IDs (OVO, DANA, GoPay, ShopeePay, LinkAja), deposit and withdrawal history | Payment processing, fraud prevention, AML compliance, withdrawal verification |
| Account Data | Username, account balance, betting history, game sessions, bonus usage, VIP tier | Service delivery, account management, responsible gaming monitoring |
| Technical Data | IP address, device type and OS, browser type and version, session timestamps, cookies, referral source | Security, fraud detection, platform optimization, analytics |
| KYC Documents | Scanned/photographed copies of KTP (National ID Card), passport, driver's license, utility bills, bank statements | Identity verification, age verification, payment method verification |
| Communications Data | Live chat transcripts, support ticket history, email correspondence, survey responses | Customer support, quality assurance, service improvement |
xl88 collects personal data through the following channels:
You directly provide data to us when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, respond to a survey or promotion, or update your account settings. All forms on the xl88 platform are secured with 256-bit SSL encryption to protect data in transit.
When you access the xl88 website or mobile platform, our servers automatically record technical data including your IP address, device identifiers, browser type, pages visited, session duration, and referring URL. This data is collected using server logs, cookies, and analytics scripts operated by xl88 directly.
In limited circumstances, xl88 may receive personal data from third-party identity verification services engaged for KYC purposes, payment processors engaged to verify the legitimacy of transactions, and fraud prevention services that alert us to suspicious activity patterns associated with a particular account or payment method. In all cases, these third parties are contractually bound to handle data in accordance with applicable privacy standards.
xl88 uses your personal data only for the purposes set out in this Privacy Policy. We do not use your data for any purpose that is incompatible with the original purpose for which it was collected without obtaining your prior consent.
We use your identity and contact data to create and maintain your xl88 account, verify your eligibility, authenticate your login, process deposits and withdrawals, credit winnings to your account, apply bonuses and promotions, and deliver all core betting and gaming services you use on our platform.
Technical data, financial data, and account activity are analyzed continuously to detect and prevent unauthorized account access, payment fraud, identity theft, bonus abuse, money laundering, and other forms of platform misuse. xl88 employs automated risk-scoring systems that flag anomalous activity for manual review by our security team.
We process certain personal data — particularly KYC documents and financial transaction records — to meet our obligations under applicable anti-money-laundering (AML) standards, responsible gaming requirements, and age verification obligations. These records are retained for the minimum period required by our compliance framework.
xl88 uses account activity data (session length, deposit frequency, wagering patterns) to identify players who may be exhibiting signs of problem gambling. Where our responsible gaming systems detect at-risk behavior, we may proactively contact the player with information about available support tools including deposit limits, self-exclusion, and professional counseling resources.
Communications data from live chat, support tickets, and email is used by our customer service team to resolve your queries, track the status of open issues, and improve the quality and efficiency of our support operations. Support conversations involving Indonesian-speaking agents may be recorded and reviewed for quality assurance purposes.
Aggregated, anonymized technical and usage data is used to understand how players navigate and use our platform, identify features that require improvement, test new product features, and optimize page performance. xl88 does not use individually identifiable data for platform analytics beyond what is necessary for security and personalization purposes.
With your explicit consent, xl88 may send you promotional emails, SMS messages, or in-app notifications about bonuses, seasonal promotions (such as offers during Idul Fitri, Ramadhan, or Indonesian Independence Day), new game launches, and VIP program updates. You may withdraw your consent to marketing communications at any time by contacting customer support or updating your account preferences.
xl88 processes personal data only when we have a valid legal basis to do so. The legal bases we rely on are:
xl88 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the following limited circumstances:
We share personal data with carefully vetted third-party service providers who assist us in operating the xl88 platform. These include payment processing partners (Indonesian bank gateways, OVO, DANA, GoPay, ShopeePay, LinkAja), KYC and identity verification providers, cloud hosting and infrastructure providers, game software providers (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, Microgaming, and others), and customer support platform operators. All processors are bound by data processing agreements that prohibit them from using your data for any purpose other than delivering the service xl88 has engaged them to provide.
xl88 may disclose personal data to law enforcement agencies, regulatory bodies, or other government authorities when required to do so by applicable law, court order, or binding legal process. We will only disclose the minimum data necessary to satisfy the specific legal obligation, and we will, where legally permitted, notify affected users of any such disclosure request.
In the event of a merger, acquisition, asset sale, or corporate restructuring involving xl88, your personal data may be transferred to the successor entity as part of the transaction. We will notify you by email or prominent notice on the xl88 website if such a transfer results in a material change to how your data is processed, and we will provide you with the opportunity to delete your account before any transfer takes effect.
xl88 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, plus any additional period requi red by our legal, compliance, and dispute-resolution obligations. Our standard retention periods are as follows:
When retention periods expire, personal data is securely deleted or irreversibly anonymized. Data held in backup systems is subject to the same deletion schedule, applied at the next scheduled backup purge cycle.
xl88 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes the following controls:
All data transmitted between your browser or device and the xl88 platform is encrypted using 256-bit SSL/TLS protocols. Sensitive data fields stored in our databases — including payment details and identity document references — are encrypted at rest using AES-256 encryption. Encryption keys are managed by a dedicated key management system with strict access controls.
Access to systems that process personal data is restricted to xl88 personnel and processors who have a legitimate need to handle that data. We enforce role-based access controls (RBAC), multi-factor authentication (MFA) for all staff accessing production systems, and a principle of least privilege across our entire data infrastructure. All access events are logged and reviewed regularly by our security operations team.
xl88 operates continuous security monitoring across our platform infrastructure to detect and respond to threats in real time. In the event of a confirmed data breach that poses a risk to your rights and freedoms, we will notify affected users without undue delay and will take all reasonable steps to contain the breach, assess its impact, and implement remediation measures.
All xl88 employees and contractors who handle personal data undergo mandatory data privacy and security training upon onboarding and on an annual refresher basis. Our data protection obligations are embedded in our employment contracts and vendor agreements.
The xl88 website uses cookies and similar tracking technologies to deliver a functional and personalized user experience. The categories of cookies we use are described below.
These cookies are essential for the xl88 platform to function. They manage your login session, maintain your account authentication state, and remember your language and currency preferences. Without these cookies, core platform features — including logging in, placing bets, and accessing your account balance — would not function. These cookies cannot be disabled without breaking core platform functionality.
xl88 uses analytics cookies to understand aggregate usage patterns on our platform — for example, which pages are visited most frequently, how long players spend on different sections, and which features generate the most engagement. Analytics data is processed in aggregated, anonymized form and is used exclusively to improve the platform. Individual player behavior is not profiled for commercial targeting purposes using analytics cookies.
Security cookies assist our fraud prevention and bot-detection systems by distinguishing legitimate human users from automated scripts and tracking session anomalies that may indicate account takeover attempts. These cookies are integral to our commitment to protecting your account from unauthorized access.
You can control cookie settings through your browser's privacy settings. Note that disabling strictly necessary cookies will impair your ability to use core xl88 platform features, including logging into your account. Disabling analytics or security cookies may result in a degraded experience or reduced security protection. For detailed browser-specific instructions on managing cookies, refer to your browser's official help documentation.
As a player on the xl88 platform, you have a number of rights with respect to your personal data. xl88 is committed to honoring these rights promptly and without unnecessary barriers. To exercise any of the rights below, contact our support team at [email protected] with the subject line "Data Rights Request" and provide sufficient information to verify your identity.
You have the right to request a copy of all personal data xl88 holds about you, together with information about how it is processed, shared, and retained. We will fulfill access requests within 30 days of receipt.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. You may also update many data fields directly through your account settings panel.
You may request that xl88 delete your personal data. We will honor erasure requests where we are not required to retain the data by applicable law (for example, AML record-keeping obligations may require us to retain certain financial records for up to 5 years after account closure).
You have the right to request that xl88 restrict processing of your personal data in certain circumstances — for example, while we are verifying the accuracy of data you have disputed, or while an objection to processing is being assessed.
Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) for transfer to another service provider.
You have the right to object to processing of your personal data based on our legitimate interests, including direct marketing. Where you object to marketing, we will cease processing your data for that purpose immediately. Where you object to other legitimate-interest processing, we will assess whether our interests override your rights in the specific circumstances.
Where processing is based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent does not affect your ability to continue using your xl88 account.
xl88 will respond to all data rights requests within 30 calendar days. In complex cases, we may extend this period by a further 60 days with notification. There is no fee for submitting a data rights request unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.
The xl88 platform integrates with third-party game providers, payment processors, and technical service partners to deliver our full range of services. While these integrations require limited data sharing as described in Section 6, xl88 does not operate or control the privacy practices of third-party providers. Game studios such as Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, and Microgaming operate under their own privacy policies and data processing agreements with xl88.
The xl88 website does not contain outbound links to third-party websites for browsing or commercial purposes. All links on the xl88 platform direct to pages within the xl88 domain. If you independently navigate to external websites, xl88 accepts no responsibility for the privacy practices of those sites, and we encourage you to review their respective privacy policies.
The xl88 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data of individuals under 21 years of age. Our registration process includes an age declaration requirement, and our KYC verification process is designed to confirm that all account holders meet the minimum age requirement.
If xl88 becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, void all bets placed, and delete all personal data collected from that individual without undue delay. If you are a parent or guardian and believe your child has registered an account on xl88, please contact us immediately at [email protected] so we can take prompt action.
xl88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or service offerings. When we make material changes to this Policy, we will notify registered users by email and by prominent notice on the xl88 website at least 14 days before the changes take effect.
The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of the xl88 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a revised Policy, you may close your account before the changes take effect.
We encourage you to review this Privacy Policy periodically to stay informed about how xl88 protects your personal data. Archived versions of prior Privacy Policy documents are available upon request.
If you have any questions, concerns, or requests relating to this Privacy Policy or xl88's data processing practices, please contact our Data Protection team through any of the following channels:
Our Commitment: xl88 is committed to maintaining the highest standards of data privacy and security. Your personal data is processed transparently, retained only as long as necessary, protected by robust security controls, and never sold to third parties. We stand behind this commitment and encourage you to contact us if you have any concerns about how your data is handled.
Six core commitments that define our approach to handling your personal data responsibly.
Every page of the xl88 platform is protected by 256-bit SSL/TLS encryption. Your personal details, payment data, and account credentials are fully encrypted in transit and at rest — the same standard used by major international banks.
xl88 will never sell, rent, or trade your personal data to advertisers, data brokers, or any commercial third party. Your data exists solely to power your xl88 account and protect you from fraud — nothing else.
You have the right to access, correct, export, or delete your personal data at any time. Our support team processes all data rights requests within 30 days, with no fees for standard requests submitted in good faith.
xl88 collects only the data that is genuinely necessary to run your account, process payments, and meet our legal obligations. We do not collect data speculatively or for purposes we cannot clearly justify to you.
Promotional communications — including bonus offers, seasonal campaigns for events like Idul Fitri and Ramadhan, and new game announcements — are only sent when you have explicitly opted in. You can unsubscribe at any time.
Every category of data we collect, every purpose we use it for, and every party we share it with is documented in this Privacy Policy. There are no hidden data flows, undisclosed processing activities, or opaque third-party relationships at xl88.
Our support team is available 24/7 to address any concerns about how xl88 handles your personal data. You can also explore our related policies below.