Commitment to Your Privacy
xo638 is committed to protecting the privacy and security of your personal data. This Privacy Policy describes our practices concerning the collection, use, disclosure, retention, and protection of information obtained from users of our platform. By accessing or using xo638 services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy. If you do not agree with any aspect of this policy, please discontinue use of our services immediately.
1. Information We Collect
1.1 Personal Information You Provide
When you register for an account with xo638, we collect the following categories of personal information that you voluntarily provide:
- Identity Information: Full legal name as it appears on your government-issued identification, date of birth, place of birth, nationality, and gender.
- Contact Information: Residential address including street, city, province, postal code, primary email address, and mobile telephone number.
- Account Credentials: Username, password (stored in encrypted format), and security questions/answers for account recovery purposes.
- Financial Information: Bank account details (account holder name, bank name such as BCA, BRI, BNI, or Mandiri, account number, branch information), e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja usernames), credit/debit card numbers (with only the last four digits stored for verification), and transaction history including deposits, withdrawals, and wagers.
- Verification Documents: Copies of government-issued photo identification (Indonesian KTP, passport, driver's license), proof of address documents (utility bills, bank statements), proof of payment method ownership, and biometric verification selfie photographs.
1.2 Information Automatically Collected
When you interact with the xo638 platform, we automatically collect certain technical and usage information through cookies, log files, and similar tracking technologies:
- Device Information: Device type, operating system version, browser type and version, screen resolution, mobile carrier network, unique device identifiers (IMEI, UDID), and device settings.
- Connection Information: IP address, ISP (Internet Service Provider), geographic location data (country, city, approximate latitude/longitude), and connection timestamps.
- Usage Data: Pages visited, features used, games played, betting patterns, session duration, click-through rates, search queries, referral sources, and navigation paths through the website.
- Communication Records: Transcripts of live chat conversations with customer support, email correspondence, and telephone call recordings (when you contact our support team).
1.3 Information from Third Parties
xo638 may receive information about you from third-party sources including:
- Payment Processors: Transaction verification data from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP), e-wallet providers (OVO, DANA, GoPay), and international payment gateways.
- Identity Verification Services: Age verification, identity authentication, and anti-fraud screening results from specialized third-party verification providers.
- Marketing Partners: Demographic data, interest categories, and behavioral profiles from affiliate partners and advertising networks (only if you arrived at xo638 through a partner referral link).
2. How We Use Your Information
xo638 processes your personal information for the following legitimate business purposes:
2.1 Account Management and Service Delivery
- Create and maintain your gaming account on the xo638 platform.
- Verify your identity and age to comply with 21+ age restrictions mandated for gambling services in Indonesia.
- Process deposits, withdrawals, and internal fund transfers between gaming wallets.
- Enable you to place bets on sports events (including BRI Liga 1, EPL, La Liga, Champions League), play casino games (slots, live dealer tables, Baccarat, Roulette, Blackjack), participate in togel lottery draws, and access other gaming products.
- Maintain accurate records of your gaming activity, transaction history, and account balance.
- Provide customer support, respond to inquiries, and resolve technical issues or disputes.
2.2 Legal and Regulatory Compliance
- Comply with international gaming regulations, anti-money laundering (AML) laws, counter-terrorism financing (CTF) requirements, and consumer protection legislation.
- Conduct Know Your Customer (KYC) due diligence procedures and ongoing monitoring of suspicious transactions.
- Detect, prevent, and investigate fraud, money laundering, bonus abuse, collusion, underage gambling, and other illegal activities.
- Respond to lawful requests from government authorities, law enforcement agencies, and regulatory bodies.
- Maintain records as required by applicable data retention laws and financial regulations.
2.3 Platform Improvement and Personalization
- Analyze usage patterns and betting behavior to improve user experience, optimize game offerings, and develop new features.
- Personalize content recommendations, game suggestions, and promotional offers based on your preferences and activity history.
- Conduct A/B testing, market research, and statistical analysis to enhance platform performance and conversion rates.
- Generate anonymized and aggregated analytics reports for internal business intelligence purposes.
2.4 Marketing and Communications
- Send you promotional emails, SMS messages, and push notifications about bonuses, tournaments, new game releases, and special offers (only with your explicit consent).
- Display personalized advertisements on the xo638 platform and through third-party advertising networks.
- Communicate important account notifications, security alerts, policy updates, and service announcements.
- Invite you to participate in customer satisfaction surveys and feedback programs.
You may opt out of marketing communications at any time by clicking the unsubscribe link in promotional emails or adjusting your communication preferences in your account settings. Please note that you cannot opt out of essential service communications related to account security, transaction confirmations, or legal notices.
2.5 Responsible Gaming and Player Protection
- Monitor gambling patterns to identify signs of problem gambling behavior or addiction.
- Enforce deposit limits, loss limits, session time restrictions, and self-exclusion settings that you configure.
- Provide reality check reminders and responsible gaming resources when concerning patterns are detected.
- Facilitate access to professional counseling services and problem gambling support organizations.
3. How We Share Your Information
xo638 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we may disclose your information to the following categories of recipients under specific circumstances:
3.1 Service Providers and Business Partners
We engage trusted third-party service providers to perform functions on our behalf, including:
- Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon), e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), and international payment gateways that process deposits and withdrawals.
- Gaming Platform Providers: Software vendors and game studios that power our casino games, live dealer tables, sports betting systems, and togel lottery infrastructure.
- Identity Verification Services: Specialized companies that verify your age, authenticate identity documents, and screen for fraud indicators.
- Cloud Infrastructure Providers: Data center operators that host our servers, databases, and backup systems with enterprise-grade security measures.
- Customer Support Tools: Live chat platforms, email service providers, and ticketing systems that enable our support team to assist you.
- Marketing and Analytics Partners: Email marketing platforms, SMS gateways, advertising networks, and web analytics services (with anonymized or pseudonymized data where possible).
All service providers are contractually obligated to use your personal information only for the specific purposes we authorize and to implement appropriate security safeguards. They are prohibited from selling or disclosing your data to other parties.
3.2 Legal and Regulatory Authorities
We may disclose your information to government agencies, law enforcement, regulatory bodies, and courts when:
- Required by applicable law, regulation, subpoena, court order, or legal process.
- Necessary to comply with gaming license conditions, AML/CTF reporting obligations, or tax regulations.
- Needed to investigate suspected illegal activity, fraud, security threats, or violations of our Terms and Conditions.
- Required to protect the rights, property, or safety of xo638, our users, or the public.
3.3 Business Transfers
In the event of a merger, acquisition, corporate reorganization, sale of assets, or bankruptcy, your personal information may be transferred to the successor entity or acquiring company. You will be notified via email and/or prominent notice on the xo638 website of any change in ownership or control of your personal information, and you will have the opportunity to delete your account before the transfer if you do not consent to the new entity's privacy practices.
3.4 With Your Consent
We may share your information with additional third parties when you provide explicit consent, such as when you authorize us to share your gaming achievements on social media platforms or participate in co-branded promotions with partners.
4. Data Security Measures
xo638 implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction:
- Encryption: All data transmission between your device and our servers is protected by 256-bit SSL/TLS encryption, the same security standard used by major banks and financial institutions worldwide. Sensitive information such as passwords and financial data is encrypted at rest using AES-256 encryption.
- Access Controls: Personal data is stored on secure servers with strict role-based access controls. Only authorized personnel with legitimate business needs can access specific categories of user information, and all access is logged and audited.
- Network Security: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and DDoS mitigation services.
- Security Monitoring: We employ 24/7 security monitoring, automated threat detection algorithms, and regular vulnerability scans to identify and respond to potential security incidents.
- Physical Security: Data centers hosting xo638 infrastructure maintain ISO 27001 certification and implement physical access controls including biometric authentication, surveillance systems, and environmental controls.
- Employee Training: All xo638 staff undergo mandatory data protection and security awareness training and are bound by strict confidentiality agreements.
- Third-Party Audits: We conduct regular independent security audits and penetration testing to verify the effectiveness of our security controls.
Despite our best efforts, no internet-based system can be guaranteed 100% secure against all possible threats. You acknowledge that you provide information at your own risk and agree to immediately notify us if you suspect any unauthorized access to your account by contacting .
5. Data Retention
xo638 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law:
- Active Accounts: Personal information and transaction records are retained for the duration of your active account relationship with xo638.
- Closed Accounts: After you close your account, we retain essential information (name, date of birth, transaction history, communication records) for a minimum of 5 years to comply with financial regulations, AML/CTF requirements, and potential legal claims. After this mandatory retention period, personal data is securely deleted or anonymized.
- Marketing Data: If you opt out of marketing communications, we retain minimal information (email address, opt-out preference) to honor your request and prevent future unwanted contact.
- Legal Obligations: Information subject to ongoing legal proceedings, disputes, investigations, or regulatory inquiries is retained until the matter is fully resolved.
You may request deletion of your personal information at any time by contacting our support team. We will respond to your request within 30 days, subject to our legal obligations to retain certain data for regulatory compliance purposes.
6. Your Privacy Rights
As a user of xo638 services, you have the following rights regarding your personal information:
- Right of Access: You may request a copy of all personal information we hold about you, including account details, transaction history, and communication records. We will provide this information in a commonly used electronic format within 30 days of your request.
- Right to Rectification: If any personal information we hold is inaccurate, incomplete, or outdated, you have the right to request correction. You can update most information directly through your account settings or by contacting customer support.
- Right to Erasure: You may request deletion of your personal information, subject to our legal obligations to retain certain data for regulatory compliance, fraud prevention, and dispute resolution. We will delete or anonymize your data within 30 days where legally permissible.
- Right to Restrict Processing: You may request that we limit how we use your personal information in specific circumstances, such as while we verify the accuracy of disputed data.
- Right to Data Portability: You may request to receive your personal information in a structured, commonly used, machine-readable format and have the right to transmit that data to another service provider.
- Right to Object: You may object to our processing of your personal information for direct marketing purposes at any time. You may also object to processing based on legitimate interests in certain situations.
- Right to Withdraw Consent: Where we process your data based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing conducted before withdrawal.
To exercise any of these rights, please contact us at with your request. We will respond within 30 days and may require identity verification to prevent unauthorized disclosure of your personal information.
7. Cookies and Tracking Technologies
xo638 uses cookies, web beacons, pixel tags, and similar tracking technologies to enhance your user experience, analyze platform performance, and deliver personalized content. Cookies are small text files stored on your device that enable us to recognize your browser and remember your preferences.
7.1 Types of Cookies We Use
- Essential Cookies: Required for core functionality including account login, session management, security features, and transaction processing. These cookies cannot be disabled.
- Performance Cookies: Collect anonymous data about how you use the website (pages visited, navigation paths, error messages) to help us improve platform performance.
- Functionality Cookies: Remember your preferences such as language selection, game filters, display settings, and previously viewed content.
- Advertising Cookies: Track your activity across websites to deliver targeted advertisements and measure campaign effectiveness. These cookies may be set by third-party advertising partners.
7.2 Managing Cookies
Most web browsers automatically accept cookies by default, but you can modify your browser settings to decline cookies or alert you when cookies are being sent. Please note that disabling certain cookies may limit your ability to use some features of the xo638 platform. Consult your browser's help documentation for instructions on managing cookie preferences.
8. International Data Transfers
xo638 operates internationally and may transfer your personal information to countries outside of Indonesia for processing and storage. Some of these countries may have data protection laws that differ from Indonesian regulations. When we transfer your data internationally, we implement appropriate safeguards including:
- Standard contractual clauses approved by data protection authorities that require third parties to protect your data and provide you with enforceable rights.
- Transferring data only to countries recognized as providing adequate levels of data protection.
- Implementing technical measures such as encryption during transit and at rest.
By using xo638 services, you acknowledge and consent to the international transfer of your personal information as described in this section.
9. Children's Privacy
xo638 services are intended exclusively for individuals who are at least 21 years of age. We do not knowingly collect, use, or disclose personal information from anyone under 21 years old. If we become aware that we have inadvertently collected information from a person under the legal age limit, we will immediately delete that information from our systems and permanently close the associated account.
Parents and guardians who believe their child may have provided personal information to xo638 should contact us immediately at so we can take appropriate action to remove such information and prevent future access.
10. Changes to This Privacy Policy
xo638 reserves the right to modify, update, or revise this Privacy Policy at any time to reflect changes in our business practices, legal requirements, or technological developments. Material changes will be communicated through prominent notice on the xo638 homepage or via email to your registered address at least 30 days before the changes take effect.
Continued use of xo638 services after any amendments to this Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how we protect your information. The "Last Updated" date at the bottom indicates when the most recent revisions were implemented.
11. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us through the following channels:
- Email: (Privacy inquiries will be forwarded to our Data Protection Officer)
- Live Chat: Available 24/7 through the chat widget on our website
- WhatsApp: +62 821 3456 7890 (06:00-24:00 WIB daily)
We are committed to resolving privacy concerns promptly and will respond to your inquiry within 30 days. For urgent data protection matters, please clearly indicate "PRIVACY REQUEST" in your email subject line or message opening to ensure priority handling.
Last Updated: January 15, 2026
Bank-Grade Encryption
All data transmission uses 256-bit SSL encryption, the same security standard trusted by major financial institutions worldwide. Your personal and payment information is protected by multiple layers of security controls.
No Data Selling
xo638 never sells, rents, or trades your personal information to third parties for marketing purposes. Your data is used exclusively to provide gaming services and comply with legal obligations.
You Control Your Data
Exercise your privacy rights including access, correction, deletion, and data portability. We respond to all privacy requests within 30 days and provide tools to manage your personal information directly through your account.
Transparent Practices
This Privacy Policy clearly explains what data we collect, why we need it, how we use it, and with whom we share it. No hidden data practices, no ambiguous language, no fine print designed to confuse.