xn888 Privacy Policy

This Privacy Policy applies to all personal data processed by xn888 in connection with the operation of the xn888 online gaming platform accessible at xn888.vu, including all associated sub-domains, mobile browser interfaces, and any future application interfaces ("the Platform").

For the purposes of applicable data protection law, xn888 acts as the Data Controller — meaning we determine the purposes and means by which personal data relating to our members is processed. Where xn888 engages third-party service providers to process personal data on our behalf (for example, a KYC verification vendor or a payment processor), those providers act as Data Processors operating under written data-processing agreements that bind them to handle your data only on xn888's documented instructions and to apply appropriate security standards.

This Policy applies to all individuals who access or use the xn888 Platform, including registered members, prospective members who browse the site without registering, and former members whose data is retained under applicable legal obligations.

xn888 collects the following categories of personal data, depending on how you interact with the Platform:

xn888 does not intentionally collect Special Category Data (such as racial or ethnic origin, religious beliefs, health data, or political opinions). If any such data is inadvertently included in a document you submit for KYC purposes, xn888 will not process that data beyond what is strictly necessary to complete the identity verification check.

xn888 collects personal data through the following methods:

• Direct submission: Data you provide when you fill in the registration form, complete KYC verification, set up a withdrawal method, submit a support request, or communicate with xn888 via live chat or email.
• Automated technical collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser attributes, and session behavior, captured via server logs, cookies, and similar tracking technologies.
• Third-party sources: Data received from KYC verification partners (identity confirmation results), payment processors (transaction status confirmations), and fraud screening vendors (risk scoring signals). xn888 does not purchase marketing lists or data from data brokers.
• Inferred data: Behavioral patterns derived from your transaction history and usage data — for example, responsible gaming risk indicators computed from betting frequency and deposit velocity — used solely for player protection and regulatory compliance purposes.

xn888 processes personal data only where a valid legal basis exists. The table below sets out the primary purposes for which xn888 processes your data and the corresponding legal basis:

Where xn888 relies on legitimate interest as a legal basis, we have assessed that our interest in processing the data is not overridden by your fundamental rights and freedoms, particularly given the limited scope of the data used and the safeguards applied.

Where xn888 relies on your consent (for example, for promotional communications), you may withdraw that consent at any time by contacting [email protected] or by updating your communication preferences within the member dashboard. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

xn888 does not sell or rent your personal data to any third party. We share personal data only in the following limited circumstances:

• Payment processors and banks: To execute deposit and withdrawal transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, and e-wallet providers OVO, DANA, GoPay, ShopeePay, and LinkAja. These providers receive only the data necessary to complete the relevant transaction.
• KYC verification partners: To verify your identity, age (21+), and the authenticity of documents submitted during the KYC process. These partners process your identity and biometric data under strict data-processing agreements and are prohibited from using it for any other purpose.
• Fraud and AML screening vendors: To assess transaction risk, detect multi-accounting, and flag patterns consistent with money laundering or other financial crime. Data shared is limited to the transaction and technical data required for risk scoring.
• Game content providers: Game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive a session token and player identifier to facilitate game play. These providers do not receive your full identity or financial data.
• IT infrastructure and hosting providers: Cloud hosting and content delivery providers that store and transmit Platform data on xn888's behalf, operating under data-processing agreements that mandate appropriate security standards.
• Legal and regulatory authorities: Where xn888 is required by applicable law, a court order, or a regulatory authority to disclose personal data, we will comply with such requirements. Where permitted, xn888 will notify you of such a disclosure.

xn888 operates an internationally distributed technology infrastructure. As a result, your personal data may be transferred to and stored on servers located outside Indonesia. Where such transfers occur, xn888 implements appropriate safeguards to ensure your data receives a standard of protection equivalent to that applied within Indonesia, including:

• Contractual clauses with all data processors that require them to apply data protection standards consistent with applicable international best practice;
• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
• Access controls limiting who within our service providers can access your data, restricted to personnel with a documented operational need.

By using the xn888 Platform, you acknowledge that your personal data may be processed in jurisdictions outside Indonesia and consent to such transfers subject to the safeguards described above.

xn888 retains personal data for the periods set out below, or for longer periods where required by applicable law:

Once the applicable retention period has elapsed, xn888 will either securely delete or irreversibly anonymize the relevant data. Anonymized data — where no individual can be re-identified — may be retained for statistical analysis and platform improvement purposes without time limit.

xn888 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Transport security: All communication between your browser and xn888 is protected by TLS 1.2 / 1.3 with 256-bit encryption. xn888 enforces HTTPS sitewide with HSTS headers.
• Storage security: Sensitive personal and financial data is encrypted at rest using AES-256. Database access is restricted by role-based access controls and monitored via audit logs.
• Infrastructure security: xn888's servers are hosted in ISO 27001-certified data centers with physical access controls, redundant power, and environmental monitoring.
• Application security: The xn888 Platform undergoes regular penetration testing by independent security firms. Identified vulnerabilities are remediated on a priority basis. Web Application Firewall (WAF) and DDoS mitigation are deployed at the network perimeter.
• Access controls: Employee access to production systems and member data is governed by the principle of least privilege. Multi-factor authentication is mandatory for all xn888 staff with access to sensitive data systems.
• Incident response: xn888 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights, xn888 will notify affected members within 72 hours of becoming aware of the incident, unless law enforcement requests a delay in notification.

xn888 uses cookies and similar tracking technologies on the Platform to support essential functions, improve user experience, and prevent fraud. The categories of cookies we use are:

• Strictly necessary cookies: Required for the Platform to operate — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language selection, preferred payment method, and game lobby layout to provide a more personalized experience across sessions.
• Analytics cookies: Collect aggregated, anonymized data about how members navigate the Platform — including pages visited, session duration, and feature usage — to help xn888 identify areas for improvement. xn888 uses self-hosted analytics tools; data is not shared with third-party advertising networks.
• Security and fraud-prevention cookies: Track device identifiers and behavioral patterns to detect account takeover attempts, bot activity, and multi-accounting. These are necessary for platform integrity.

xn888 does not use third-party advertising cookies or retargeting pixels. You will not see xn888 advertisements follow you around the web as a result of cookies placed on the xn888 Platform.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. For functional and analytics cookies, declining them may reduce the quality of your experience but will not prevent access to core services.

As an xn888 member, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] from the email address registered to your xn888 account. xn888 will respond to all verified requests within 14 business days.

xn888 will not charge a fee for exercising any of these rights in normal circumstances. Where a request is manifestly unfounded, repetitive, or excessive, xn888 reserves the right to charge a reasonable administrative fee or decline the request, with written explanation.

The xn888 Platform is strictly for adults aged 21 and over. xn888 does not knowingly collect personal data from individuals under the age of 21. Age verification is performed as part of the KYC process for all members.

If xn888 discovers or is notified that a member is under 21 years of age, the account will be immediately suspended, all wagering activity will be voided, and any deposited balance will be returned to the source payment method after deduction of any bonus credits. The member's personal data will be retained only for the minimum period required to process the refund and fulfill any regulatory reporting obligation, after which it will be permanently deleted.

If you believe a person under 21 has registered an xn888 account, please notify us immediately at [email protected].

xn888 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, xn888 will display a prominent notice on the Platform for a minimum of seven days following the update. The "Last Updated" date at the top of this page reflects the effective date of the most recent revision.

Your continued use of the xn888 Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you must stop using the Platform and contact xn888 support to request account closure and data handling instructions.

For historical versions of this Privacy Policy, contact [email protected] and we will provide the version applicable during the period you specify, where such records are available.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by xn888, please contact our support team through the following channels:

• Email: [email protected] (plain text — not a clickable link). Include "Privacy Request" in the subject line for fastest routing to the relevant team.
• Live Chat: Available 24/7 within the xn888 member dashboard after login. Use the keyword "Data Privacy" to be connected directly to a trained privacy support agent.
• Response time: All privacy-related enquiries are acknowledged within 24 hours (WIB) and fully resolved within 14 business days. Complex data access or erasure requests may take up to 30 days; xn888 will inform you if an extension is required.