Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below:

• "Platform" means the xg88 website at https://xg88.cam and any associated mobile-optimised interfaces.
• "We", "Us", "Our" refers to xg88 and its operating entity responsible for data processing.
• "You", "Player", "User" refers to any individual who visits, registers on, or uses the xg88 Platform.
• "Personal Data" means any information that can identify you as an individual, either directly (e.g., your name, email address) or indirectly (e.g., your device ID combined with other data points).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "KYC" (Know Your Customer) means the identity verification process required prior to withdrawal processing.
• "Cookies" means small text files placed on your device by our Platform to facilitate functionality and analytics.

xg88 collects the following categories of Personal Data in the course of operating the Platform:

We do not collect sensitive personal data categories such as biometric data, health data, racial or ethnic origin, religious beliefs, or political opinions.

xg88 collects Personal Data through the following channels:

• Direct Interactions: Information you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting our customer support team.
• Automated Technologies: Technical data collected automatically as you browse and interact with the Platform, including through cookies, web beacons, server logs, and analytics scripts.
• Third-Party Sources: Identity verification and fraud-screening data received from our KYC and anti-money-laundering (AML) service providers, and payment confirmation data received from banks and e-wallet operators such as BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay.
• Publicly Available Sources: In limited circumstances, we may cross-reference information from publicly available databases to verify your identity or assess fraud risk.

xg88 processes your Personal Data for the following defined purposes:

• Account Management: To create, maintain, and administer your xg88 account, including verifying your identity and age eligibility (21+).
• Transaction Processing: To process deposits and withdrawals via Indonesian payment channels including BCA, BRI, BNI, Mandiri, and e-wallets, and to maintain accurate financial records.
• KYC & Fraud Prevention: To conduct identity verification, detect and prevent fraudulent activity, money laundering, and other prohibited conduct in accordance with applicable regulations.
• Platform Delivery: To provide you with access to sports betting markets (including BRI Liga 1, EPL, Champions League, and other leagues), live casino games, and slot titles from our certified game providers.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain a record of communications for quality assurance and compliance purposes.
• Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behaviour and to apply any self-exclusion, deposit limit, or cooling-off measures you request.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have opted in to receive such communications. You may withdraw consent at any time.
• Legal Compliance: To meet our obligations under applicable international gaming regulations, financial crime prevention requirements, and data-protection standards.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, features, and user experience of the xg88 Platform.

xg88 processes your Personal Data on the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between you and xg88, including account registration, payment processing, and gameplay services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations and record-keeping requirements.
• Legitimate Interests: Processing undertaken to pursue our legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — specifically for marketing communications. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

xg88 does not sell, rent, or trade your Personal Data to any third party for commercial gain. We may share your data only in the following circumstances:

• Service Providers: Trusted third-party vendors who assist us in operating the Platform, including KYC verification providers, payment processors, fraud-screening services, cloud infrastructure providers, and customer support tools. All such providers are bound by data-processing agreements that restrict them from using your data for any purpose other than providing services to xg88.
• Game Providers: Certified gaming studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe — may receive session tokens and anonymised identifiers necessary to deliver their games within the Platform. These providers do not receive your full identity or financial data.
• Payment Partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the transaction details necessary to execute deposits and withdrawals.
• Legal Authorities: Where required by law, court order, or a legitimate request from a competent regulatory or law-enforcement authority, xg88 will disclose Personal Data to the extent legally mandated. We will notify you of such requests where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of xg88's business assets, your Personal Data may be transferred to the successor entity, subject to equivalent data-protection obligations.

7.1 All third-party service providers engaged by xg88 are subject to a formal due-diligence process and are required to sign data-processing agreements confirming they will handle your Personal Data securely and only for the purposes specified by xg88.

7.2 xg88 does not embed third-party advertising networks, social media tracking pixels, or affiliate tracking scripts that would share your behavioural data with external marketing platforms without your knowledge.

7.3 The xg88 Platform may contain links to our own internal pages only. We do not link to external websites and accept no responsibility for the privacy practices of any external party you may independently choose to visit.

7.4 In the event that a third-party provider suffers a data breach that may affect your Personal Data held by that provider in connection with xg88 services, we will take reasonable steps to notify you in a timely manner and cooperate fully with any resulting investigation.

8.1 The xg88 Platform uses cookies and similar tracking technologies to ensure proper functionality, enhance your browsing experience, and gather aggregated analytics. The cookies we use fall into the following categories:

• Essential Cookies: Required for the Platform to function correctly — including session management, authentication tokens, and security features. These cannot be disabled without impairing core functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred odds format, and last-visited game category, allowing us to deliver a more personalised experience.
• Analytics Cookies: Collect anonymised data about how users navigate and interact with the Platform, helping us identify usability issues and improve page performance. These cookies do not identify you personally.
• Security Cookies: Support our fraud-detection systems by flagging suspicious session behaviour such as rapid account switching or unusual geographic access patterns.

8.2 Most web browsers allow you to control cookie settings through your browser preferences. Blocking essential cookies may prevent certain features of the Platform from functioning correctly. Analytics and functional cookies can typically be disabled without affecting core access to the Platform.

9.1 xg88 retains your Personal Data for as long as your account remains active and for a defined period thereafter, in line with the following principles:

• Active Accounts: Personal Data is retained for the full duration of your account's active status to support ongoing service delivery, dispute resolution, and regulatory compliance.
• Closed Accounts: Following account closure, identity and transaction data is retained for a minimum of five (5) years to meet anti-money-laundering record-keeping obligations.
• KYC Documents: Identity documents submitted for verification are retained for the same five-year post-closure period and then securely deleted or anonymised.
• Support Communications: Live chat transcripts and email correspondence are retained for up to two (2) years following the close of the relevant support interaction.
• Technical / Log Data: Server logs and IP access records are retained for up to twelve (12) months, after which they are automatically deleted or anonymised.

9.2 Where retention beyond these periods is required by a specific legal obligation, regulatory investigation, or ongoing dispute, xg88 will retain the relevant data until that obligation or proceeding is concluded.

10.1 xg88 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using industry-standard Secure Socket Layer (SSL) technology.
• Access Controls: Access to Personal Data within xg88's internal systems is restricted to authorised personnel on a strict need-to-know basis, with role-based access permissions and multi-factor authentication enforced.
• Server Security: Our servers are hosted in secure, access-controlled data centres with continuous monitoring, intrusion-detection systems, and regular vulnerability assessments.
• Password Protection: Account passwords are stored in hashed form using modern cryptographic algorithms. xg88 staff can never view your plaintext password.
• Penetration Testing: We conduct periodic independent security audits and penetration tests to identify and remediate vulnerabilities proactively.

10.2 While xg88 takes all reasonable precautions, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect any unauthorised access to your account.

As a user of the xg88 Platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact our support team via live chat or email at [email protected].

We will respond to all verified rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

12.1 The xg88 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from individuals under the age of 21.

12.2 Age verification is performed during account registration and as part of the KYC process. Any account found to belong to a person under 21 years of age will be immediately closed, all associated data deleted in accordance with our retention policy, and any balance forfeited in line with our Terms & Conditions.

12.3 If you believe a minor has registered an account or provided personal data to xg88, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

13.1 In the course of providing the xg88 Platform, your Personal Data may be transferred to and processed in countries outside of Indonesia. This may occur when our cloud infrastructure providers, KYC vendors, or game providers operate servers in other jurisdictions.

13.2 Where such transfers occur, xg88 takes steps to ensure that your Personal Data receives an equivalent level of protection to that afforded within Indonesia. These steps may include:

• Entering into data-processing agreements with overseas recipients that incorporate internationally recognised standard contractual clauses for data protection.
• Transferring data only to countries or providers that maintain data-protection standards consistent with applicable international best practices.
• Applying additional encryption and access controls to data transferred across jurisdictional boundaries.

13.3 By registering an account and using the xg88 Platform, you acknowledge that your Personal Data may be processed outside of Indonesia as described above.

14.1 xg88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, operational requirements, or applicable regulations. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

14.2 Where changes are material — meaning they significantly affect how we collect, use, or share your Personal Data — we will notify you in advance via your registered email address or through a prominent notice on the Platform, providing you with a reasonable opportunity to review the changes before they take effect.

14.3 Your continued use of the xg88 Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated policy, you should cease using the Platform and contact our support team to close your account.

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way xg88 handles your Personal Data, please contact our Data Protection team through the following channel:

15.2 Our customer support team is available 24 hours a day, 7 days a week via live chat on the Platform. Indonesian-speaking agents are available at all times to assist you in your preferred language.

15.3 For formal data-subject rights requests, please include your account username and a clear description of the right you wish to exercise, along with any supporting information that will help us locate your records efficiently. We will acknowledge receipt of your request within 5 business days and provide a full response within 30 calendar days.

15.4 Where you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data-protection authority or to seek resolution through independent arbitration as described in our Terms & Conditions.