Privacy Policy — x0368 Platform

x0368 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every individual who interacts with our online betting platform at https://x0368.app. This Privacy Policy describes how x0368 collects, uses, stores, discloses, and protects personal information in connection with the services we provide to players across Indonesia and other permitted jurisdictions.

This policy applies to all personal data collected through the x0368 website, any associated mobile interfaces, customer support channels, email communications, and any other touchpoints through which you interact with x0368. It should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy.

x0368 acts as the data controller for all personal data processed under this policy. We process personal data in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

x0368 collects several categories of personal data from players, depending on how you interact with the Platform. The table below summarises the primary data categories:

x0368 does not intentionally collect sensitive personal data beyond what is necessary for identity verification and responsible gaming compliance. We do not collect racial or ethnic origin data, political opinions, religious beliefs, or biometric data beyond identity photograph matching required for KYC.

x0368 collects personal data through the following channels and mechanisms:

1. Direct Submission: Data you actively provide when registering an account, completing KYC verification, making deposits or withdrawals, updating your profile, or contacting customer support.
2. Automated Technologies: Data collected automatically as you navigate the Platform, including cookies, server logs, session identifiers, and device fingerprinting technologies used for fraud prevention and session security.
3. Third-Party Verification Partners: Identity verification data returned by our KYC service providers when processing document verification checks. These partners process your submitted documents on our behalf and return a verification outcome and risk score.
4. Payment Processors: Transaction confirmation data returned by Indonesian bank transfer networks and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to confirm successful deposits and withdrawals.
5. Game Providers: Aggregated gameplay data provided by licensed game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe) for game round result verification and responsible gaming monitoring.

x0368 processes your personal data only where a lawful basis for doing so exists. The following table sets out the primary purposes for which we process personal data and the corresponding legal basis for each:

x0368 will not process your personal data for any purpose that is incompatible with the purposes listed above without first providing notice and, where required, obtaining your consent.

x0368 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following limited and controlled circumstances:

• KYC Verification Providers: Your identity documents and photograph are transmitted to our certified KYC verification partner exclusively for the purpose of confirming your identity and age prior to withdrawal processing. These partners are contractually bound to process your data solely on our instructions and may not use it for their own purposes.
• Payment Processors: Bank account and e-wallet details are shared with Indonesian payment networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) to the extent necessary to execute your deposit and withdrawal instructions.
• Game Studio Providers: A pseudonymised player identifier is passed to licensed game studio providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe) to launch game sessions and record game round outcomes. No directly identifying personal data is shared with game studios beyond what is required to authenticate the game session.
• Fraud Prevention and Security Services: Technical data (IP address, device fingerprint, session data) may be shared with fraud prevention service providers to detect bot activity, multi-account abuse, and other prohibited conduct defined in our Terms & Conditions.
• Legal and Regulatory Authorities: x0368 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or regulatory direction. We will notify the affected player where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all assets of x0368, player data may be transferred to the acquiring entity subject to the acquiring entity honouring the privacy commitments set out in this policy.

x0368 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory requirements. The following retention periods apply:

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes, as it can no longer be linked to any individual player.

x0368 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• Transport Layer Security: All data in transit between your browser/app and x0368 servers is encrypted using TLS 1.2 or higher (256-bit SSL certificates). HTTP connections are automatically redirected to HTTPS.
• Data at Rest Encryption: Sensitive personal data — including KYC documents, financial records, and password hashes — is encrypted at rest using AES-256 encryption on our database infrastructure.
• Password Security: Player passwords are never stored in plaintext. We use industry-standard cryptographic hashing with salting. You are responsible for maintaining a strong, unique password for your x0368 account.
• Access Controls: Access to personal data within x0368 is restricted on a strict need-to-know basis. Internal systems enforce role-based access controls (RBAC). All internal data access is logged and auditable.
• Penetration Testing: x0368's Platform infrastructure undergoes regular independent security assessments including penetration testing and vulnerability scanning.
• Incident Response: x0368 maintains a documented data breach incident response plan. In the event of a data breach that poses a risk to player rights, x0368 will notify affected players without undue delay and take immediate remedial action.

x0368 uses cookies and similar technologies on the Platform for the following purposes:

x0368 does not deploy third-party advertising or retargeting cookies. You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies may prevent you from logging in or accessing certain Platform features.

As a player whose personal data is processed by x0368, you have the following rights with respect to your personal data. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 13.

• Right of Access: You have the right to request a copy of the personal data x0368 holds about you, together with information about how that data is being used.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal and regulatory retention obligations described in Section 6.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of the data is being resolved.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to request that we transmit it directly to another data controller where technically feasible.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis, including objecting to the use of your data for Platform analytics and improvement purposes.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

x0368 will respond to all data rights requests within 30 calendar days of receipt. In complex cases or where a large volume of requests are received simultaneously, we may extend this period by a further 30 days, with notice to you. There is no charge for exercising your data rights unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

x0368 employs mandatory date-of-birth entry at registration and KYC age verification prior to processing withdrawal requests to prevent underage access. If x0368 discovers or is notified that personal data has been collected from an individual under the age of 21, we will immediately close the associated account, void any bets placed, return any deposits where practicable, and delete the minor's personal data from our systems as promptly as our legal obligations permit.

If you are a parent or guardian and believe your child has opened an account on the x0368 Platform, please contact our support team immediately at [email protected]. We will treat such reports with the highest priority.

x0368 is operated by an internationally incorporated entity and uses cloud infrastructure and service providers whose servers may be located outside Indonesia. When personal data is transferred outside Indonesia to a third country, x0368 ensures that appropriate safeguards are in place to maintain a level of data protection equivalent to that described in this policy. These safeguards include:

• Entering into standard contractual data processing agreements with all third-party processors that impose binding data protection obligations on the recipient;
• Transferring data only to countries or organisations that provide a demonstrably adequate level of data protection as assessed by x0368's data governance team;
• Applying encryption in transit (TLS) and at rest (AES-256) to all personal data involved in international transfers;
• Conducting periodic reviews of third-party processor compliance with their contractual data protection obligations.

By registering an account and using the x0368 Platform, you acknowledge that your personal data may be processed in a country outside Indonesia. If you require further information about the specific safeguards in place for international transfers affecting your data, please contact our Data Protection Officer.

x0368 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. When we make a material change to this policy, we will:

• Update the "Last Reviewed" date displayed at the top of this page;
• Send a notification to your registered email address summarising the key changes;
• Display a prominent notice on the Platform for a period of at least 14 days following the update.

Your continued use of the x0368 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the changes, you must discontinue use of the Platform and contact support to close your account.

Archived versions of previous Privacy Policy documents are available upon written request to our Data Protection Officer. We recommend reviewing this page at least once every three months to remain informed of how we handle your personal data.

If you have any questions, concerns, or complaints about this Privacy Policy, the way x0368 handles your personal data, or wish to exercise any of your data rights described in Section 9, please contact our Data Protection Officer through the following channel:

When submitting a data rights request, please include your full name, your registered x0368 email address, and a clear description of the right you wish to exercise. x0368 may need to verify your identity before processing your request to ensure we do not disclose personal data to an unauthorised party.

If you are not satisfied with how x0368 has handled your privacy concern, you have the right to escalate your complaint to the relevant data protection authority or regulatory body in your jurisdiction.