Privacy Policy

xn303 ("xn303", "we", "us", "our") operates the online gaming and sports betting platform accessible at xn303.bet. We are committed to protecting the privacy and security of every individual who visits, browses, registers on, or places wagers through the xn303 platform (collectively "the Platform").

This Privacy Policy ("Policy") sets out the basis on which personal data is collected, used, stored, transferred, and protected by xn303. It applies to all Members and visitors of the Platform, including residents of Indonesia interacting with the Platform in English or through locally preferred payment methods such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.

This Policy should be read alongside the xn303 Terms & Conditions. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with how we handle personal data, please discontinue use of the Platform.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or could reasonably identify a living individual, either on its own or in combination with other data. This includes names, email addresses, Indonesian national ID numbers, phone numbers, and IP addresses.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — xn303, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — A third party that processes Personal Data on behalf of xn303 under contract, such as payment processors, KYC verification providers, or cloud hosting providers.
• "Member" / "User" — Any individual who has registered an account on the xn303 Platform.
• "Sensitive Data" — A subset of Personal Data warranting heightened protection, including financial account details, identity document scans, and transaction histories.
• "Cookie" — A small text file stored on a user's device by a web browser at the instruction of the Platform, used to maintain session state, preferences, and analytics data.

xn303 collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:

xn303 collects Personal Data through the following channels:

• Direct Registration: When you create a Member account on the Platform, you provide Identity Data and Contact Data directly via the registration form.
• Deposits and Withdrawals: When you initiate a financial transaction, Financial Data is collected to facilitate payment processing via local Indonesian banks and e-wallets.
• KYC Verification: When you submit identity documents in response to a verification request, KYC Documentation is collected and passed to our authorised verification partner for processing.
• Platform Use: Technical and Device Data is collected automatically as you browse and interact with the Platform through server logs, session tracking, and browser-based cookies.
• Customer Support: When you contact xn303 via live chat or email at [email protected], Communications Data is recorded for quality assurance and dispute resolution purposes.
• Responsible Gaming Tools: When you set deposit limits, loss limits, or request self-exclusion, the relevant preferences are stored as part of your Account Data.
• Third-Party Sources: In limited circumstances, xn303 may receive Identity Data or Financial Data from authorised third-party fraud prevention or KYC verification providers to cross-reference and validate information you have provided.

xn303 processes your Personal Data for the following specific purposes:

1. Account Management: Creating, maintaining, verifying, and closing Member accounts on the Platform, including password recovery and session management.
2. Transaction Processing: Facilitating deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and maintaining accurate financial records.
3. Identity Verification (KYC): Confirming Member identity and age (21+) in compliance with anti-money-laundering (AML) and responsible gaming obligations.
4. Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, money laundering, and unauthorised platform access.
5. Regulatory Compliance: Meeting obligations under applicable international gaming standards, financial crime prevention requirements, and data protection obligations.
6. Platform Improvement: Analysing aggregated, anonymised usage data to improve game selection, user interface, payment flows, and customer service response times.
7. Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling indicators and, where appropriate, reaching out to Members with responsible gaming guidance or enforcing limits set by the Member.
8. Customer Support: Responding to Member inquiries, resolving disputes, and maintaining records of support interactions for quality assurance.
9. Marketing Communications: Sending promotional offers, deposit bonus notifications, and seasonal promotions (such as Idul Fitri or Ramadhan specials) to Members who have opted in to marketing communications. Members may opt out at any time.

xn303 processes Personal Data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform our obligations under the Member Agreement (Terms & Conditions), including operating your account, processing transactions, and providing gaming services.
• Legal Obligation: Processing is required to comply with applicable AML obligations, KYC requirements, and responsible gaming standards imposed by our operating framework.
• Legitimate Interests: Processing is necessary for xn303's legitimate interests in fraud prevention, platform security, business analytics, and improving service quality — provided these interests are not overridden by your privacy rights.
• Consent: Where processing is based on consent (such as for marketing communications or non-essential cookies), we will obtain your explicit consent before processing and you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

xn303 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share Personal Data only in the following limited and controlled circumstances:

• Payment Processors: Financial Data is shared with Indonesian bank networks and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process deposit and withdrawal transactions initiated by you.
• KYC Verification Providers: Identity Data and KYC Documentation are shared with authorised third-party identity verification specialists under strict data processing agreements for the purpose of verifying Member identity.
• Game Studios and Software Providers: Anonymised session and wagering data may be shared with game providers such as Pragmatic Play, Evolution Gaming, PG Soft, Spribe, and NetEnt for the purpose of game operation, fairness auditing, and technical support.
• Fraud Prevention and AML Partners: Identity and Financial Data may be shared with fraud detection and AML compliance partners where there is a reasonable basis to suspect financial crime or platform abuse.
• Cloud and Hosting Infrastructure: Technical Data is processed by our authorised cloud infrastructure providers under contractual data protection obligations. These providers do not have access to plain-text financial or identity data.
• Legal and Regulatory Authorities: xn303 may disclose Personal Data to law enforcement agencies, regulators, or courts when required to do so by a valid legal order, court order, or equivalent regulatory requirement.

All third parties with whom xn303 shares Personal Data are required, by contract, to process that data only for the specified purpose, to implement appropriate security measures, and not to share it further without xn303's authorisation.

As an internationally operated platform serving Indonesian players, some of your Personal Data may be transferred to and processed in countries outside Indonesia — particularly in relation to cloud hosting infrastructure, KYC verification services, and game provider technical operations.

Where such transfers occur, xn303 takes appropriate contractual and technical safeguards to ensure that the receiving party applies a standard of data protection that is at least equivalent to the protections set out in this Policy. This includes the use of standard contractual clauses and data processing agreements that impose binding privacy and security obligations on data recipients.

By accepting this Privacy Policy and using the xn303 Platform, you consent to the transfer of your Personal Data to third parties located in other jurisdictions for the purposes described in this Policy.

xn303 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or operational obligations. The following general retention periods apply:

• Account Data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in line with standard financial compliance requirements.
• KYC Documentation: Retained for the duration of the account and for five (5) years following account closure. Copies of identity documents are stored in encrypted form and access is restricted to authorised compliance personnel.
• Customer Support Records: Retained for three (3) years from the date of the last support interaction, for dispute resolution and quality assurance purposes.
• Marketing Preferences and Opt-Out Records: Retained indefinitely to honour your marketing preferences and prevent unwanted re-contact after an opt-out.
• Technical and Device Data (Logs): Retained for a rolling period of twelve (12) months for fraud detection, security investigation, and platform performance monitoring.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

xn303 implements a layered approach to data security, combining technical, administrative, and physical controls to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction:

• Transport Encryption: All data transmitted between your device and the xn303 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). The presence of a valid SSL certificate can be confirmed by checking for "https://" and the padlock icon in your browser address bar.
• Data-at-Rest Encryption: Sensitive data stored on xn303 infrastructure, including financial records and KYC documentation, is encrypted at rest using AES-256 encryption.
• Password Security: Member passwords are never stored in plain text. They are salted and hashed using a modern cryptographic hashing algorithm before storage.
• Access Controls: Access to systems holding Personal Data is restricted on a need-to-know basis. All internal access is logged, and privileged access requires multi-factor authentication.
• Penetration Testing: xn303 conducts periodic security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential security weaknesses.
• Incident Response: In the event of a data breach that poses a material risk to Member privacy, xn303 will notify affected Members and relevant authorities within a reasonable timeframe, in accordance with applicable data breach notification standards.

As a Member of the xn303 Platform, you have the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request and sufficient information to verify your identity.

xn303 will respond to all verified privacy rights requests within 30 calendar days. In cases of complex or high-volume requests, we may extend this period by a further 30 days and will notify you of the extension within the initial 30-day window.

The xn303 Platform uses cookies and similar tracking technologies to enable core platform functionality, maintain your logged-in session, and collect anonymised analytics data to improve the Member experience.

Strictly necessary cookies cannot be disabled as they are essential for platform operation. Functional and analytics cookies may be managed through your browser settings. Note that disabling certain cookies may impact the functionality of the Platform, including the ability to maintain a logged-in session.

xn303 does not use third-party advertising cookies or cross-site tracking pixels for retargeting or behavioural advertising purposes.

The xn303 Platform is strictly for individuals aged 21 years and older. xn303 does not knowingly collect Personal Data from individuals under the age of 21. If we discover or are notified that Personal Data has been collected from a Minor, we will immediately suspend the associated account, delete the relevant data, and take appropriate remedial action.

If you believe that a Minor has registered on the xn303 Platform or that your Minor child has accessed the Platform, please contact our support team immediately at [email protected] so that we can take prompt action.

xn303 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. When material changes are made, we will notify active Members via their registered email address and/or through a prominent notice on the Platform prior to the changes taking effect.

The "Effective Date" at the top of this Policy indicates the date of the most recent revision. Your continued use of the xn303 Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with a revised Policy, you may request account closure by contacting our support team.

For any privacy-related inquiries, data subject rights requests, or concerns about how xn303 handles your Personal Data, please contact our Privacy & Compliance team through the following channels:

• Live Chat: Available 24/7 via the xn303 website. The fastest channel for urgent privacy concerns.
• Email: [email protected] — please include "Privacy Request" in your subject line for prioritised routing. (This is a plain text address — not a clickable link.)
• Response Time: Privacy rights requests are acknowledged within 5 business days (WIB, UTC+7) and resolved within 30 calendar days.