Privacy Policy

1. Introduction

xltoto is committed to protecting the privacy and security of your personal information. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, how we protect it, and your rights regarding your data. This policy applies to all users of the xltoto platform, including visitors, registered members, and anyone who interacts with our services.

xltoto operates as an online betting and gaming platform serving the Indonesia market. As part of our operations, we are required to collect and process certain personal information to provide our services, comply with legal obligations, prevent fraud, and ensure the security and integrity of the platform. We handle all personal data in accordance with international data protection standards and best practices.

This Privacy Policy should be read in conjunction with our Terms and Conditions and Responsible Gaming Policy. Together, these documents form the complete legal framework governing your use of xltoto.

2. Information We Collect

xltoto collects several categories of personal information to operate the platform, provide our services, comply with legal requirements, and enhance your user experience. The types of information we collect include:

2.1 Information You Provide Directly

When you register an account with xltoto, you provide us with the following information:

• Identity information: Full legal name, date of birth, gender, and nationality as they appear on your government-issued identification document (KTP, passport, or equivalent).
• Contact information: Email address, mobile phone number, and residential address (including city, province, and postal code).
• Account credentials: Username, password (stored in encrypted form), and security questions for account recovery.
• Financial information: Bank account details, e-wallet account numbers, and transaction history for deposits and withdrawals. Supported payment methods include BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Identification documents: Scanned or photographed copies of your government-issued ID, which we collect as part of our Know Your Customer (KYC) verification process to comply with anti-money laundering regulations and to verify your age (21+ requirement).
• Communication records: Records of your interactions with our customer support team via live chat, email, WhatsApp, or phone, including transcripts, email correspondence, and support tickets.

2.2 Information Collected Automatically

When you access and use the xltoto platform, we automatically collect certain technical and usage information:

• Device information: Device type (desktop, mobile, tablet), operating system (Windows, Android, iOS, macOS), browser type and version, screen resolution, and device identifiers.
• Connection information: IP address, internet service provider, connection type, and approximate geographic location (city and region level, derived from IP address).
• Usage data: Pages visited, features used, time spent on the platform, clickstream data, referral sources, and navigation patterns. This helps us understand how members interact with the platform and identify opportunities for improvement.
• Betting activity: Complete records of all bets placed, including bet type (sports betting, togel lottery, live casino, slots), stake amounts, odds, outcomes, winnings, and timestamps. This data is essential for settlement, dispute resolution, and responsible gaming monitoring.
• Session data: Login and logout times, session duration, concurrent sessions, and authentication events for security monitoring.

2.3 Information from Third Parties

In certain circumstances, xltoto may receive information about you from third-party sources:

• Payment processors: When you deposit or withdraw funds, our payment partners (banks and e-wallet providers) confirm transaction details and account ownership to prevent fraud.
• Identity verification services: We may use third-party identity verification services to validate the authenticity of submitted documents and prevent identity theft.
• Fraud prevention partners: We work with specialized fraud detection services that provide risk assessments and alerts about suspicious activity patterns across multiple platforms.

3. How We Use Your Information

xltoto uses your personal information for the following purposes:

3.1 Service Provision and Account Management

• Creating and maintaining your member account
• Processing deposits, withdrawals, and all financial transactions
• Accepting, processing, and settling bets and wagers across all product categories (sports betting, togel, live casino, slots)
• Crediting winnings and bonuses to your account balance
• Providing customer support and responding to inquiries
• Sending transactional communications (deposit confirmations, withdrawal notifications, bet settlements, account alerts)

3.2 Legal Compliance and Security

• Verifying your identity and age to ensure compliance with our 21+ policy
• Conducting Know Your Customer (KYC) checks as required by anti-money laundering regulations
• Preventing, detecting, and investigating fraud, collusion, bonus abuse, and other prohibited activities
• Monitoring betting patterns for unusual or suspicious activity
• Maintaining transaction records for audit and regulatory purposes
• Responding to legal requests, court orders, and regulatory inquiries
• Enforcing our Terms and Conditions and protecting platform integrity

3.3 Platform Improvement and Personalization

• Analyzing usage patterns to improve platform functionality and user experience
• Personalizing content and recommendations based on your betting preferences
• Testing new features and conducting A/B testing
• Optimizing website performance, load times, and mobile responsiveness
• Identifying and fixing technical issues and bugs

3.4 Marketing and Promotions

• Sending promotional offers, bonus announcements, and exclusive deals (only with your consent, and you may opt out at any time)
• Informing you about new games, features, and platform updates
• Running competitions, tournaments, and loyalty programs
• Conducting market research and member satisfaction surveys

3.5 Responsible Gaming Support

• Monitoring betting behavior for signs of problem gambling
• Implementing and enforcing deposit limits, session timers, and self-exclusion requests
• Providing access to responsible gaming tools and resources
• Contacting members who may benefit from responsible gaming interventions

4. How We Share Your Information

xltoto does not sell, rent, or trade your personal information to third parties for marketing purposes. However, we may share your data with the following categories of recipients in limited circumstances:

4.1 Service Providers and Business Partners

We work with trusted third-party service providers who assist us in operating the platform. These providers have access to your personal information only to the extent necessary to perform their services and are contractually obligated to protect your data and use it only for the purposes we specify. Service providers include:

• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP, and e-wallet providers OVO, DANA, GoPay, ShopeePay, LinkAja)
• Identity verification and KYC service providers
• Fraud detection and prevention specialists
• Cloud hosting and data storage providers
• Customer support software vendors (live chat, ticketing systems, email platforms)
• Analytics and business intelligence tools
• Security monitoring and penetration testing firms

4.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement agencies, regulators, courts, or other governmental authorities when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with legal obligations, court orders, or regulatory requests
• Enforce our Terms and Conditions or other policies
• Protect the rights, property, or safety of xltoto, our members, or the public
• Prevent or investigate suspected illegal activity, fraud, or security threats

4.3 Corporate Transactions

In the event of a merger, acquisition, sale of assets, or other corporate restructuring involving xltoto, your personal information may be transferred to the acquiring or successor entity. We will notify you of any such transaction and the choices you have regarding your data.

5. Data Security

xltoto employs industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. Our security practices include:

• 256-bit SSL encryption: All data transmitted between your device and our servers is encrypted using Secure Socket Layer (SSL) technology, the same encryption standard used by banks and financial institutions.
• Secure data storage: Personal information is stored on secure servers located in access-controlled data centers with 24/7 monitoring, fire suppression systems, and redundant power supplies.
• Password protection: User passwords are hashed using strong cryptographic algorithms and are never stored in plain text. We cannot retrieve your original password, which is why password resets require creating a new password.
• Two-factor authentication (2FA): Members can enable 2FA on their accounts for an additional layer of security, requiring both a password and a time-based one-time code to log in.
• Access controls: Access to personal data is restricted to authorized personnel only, based on the principle of least privilege. Employees and contractors sign confidentiality agreements and undergo security training.
• Regular security audits: We conduct periodic security assessments, vulnerability scans, and penetration testing to identify and address potential weaknesses.
• Incident response: We maintain an incident response plan to quickly detect, contain, and remediate security breaches. In the unlikely event of a data breach that affects your personal information, we will notify you promptly in accordance with applicable laws.

While we implement robust security measures, no system is entirely immune to security risks. You play a critical role in protecting your account by using a strong, unique password, enabling 2FA, and never sharing your login credentials with anyone.

6. Data Retention

xltoto retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by data category:

Data Category	Retention Period
Account information (name, email, address)	Duration of account + 7 years after closure
Transaction records (deposits, withdrawals)	7 years from transaction date (regulatory requirement)
Betting history and game logs	7 years from bet settlement date
KYC documents (ID scans, proof of address)	7 years after account closure (AML compliance)
Customer support communications	3 years from last interaction
Marketing consent records	Duration of consent + 2 years after withdrawal
Website usage analytics	26 months from collection

After the applicable retention period expires, we securely delete or anonymize your personal information so that it can no longer be associated with you. Anonymized data may be retained indefinitely for statistical analysis and platform improvement.

7. Your Privacy Rights

As a member of xltoto, you have the following rights regarding your personal information:

7.1 Right to Access

You have the right to request a copy of the personal information we hold about you. You can access most of your account information directly through your account dashboard. For a comprehensive data export, contact our support team via email at [email protected] with the subject line "Data Access Request." We will provide your data in a structured, commonly used, and machine-readable format within 30 days.

7.2 Right to Rectification

If any of your personal information is inaccurate or incomplete, you have the right to request correction. You can update your email address, phone number, and residential address directly in your account settings. For changes to your name or date of birth, please contact support with supporting documentation (updated government ID).

7.3 Right to Erasure

You have the right to request deletion of your personal information in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or when you withdraw consent. However, we may be required to retain certain data to comply with legal obligations (e.g., transaction records for 7 years under anti-money laundering laws). To request account deletion, contact support with the subject line "Account Deletion Request."

7.4 Right to Restrict Processing

You can request that we limit how we use your personal information in certain situations, such as when you contest the accuracy of the data or object to processing. During the restriction period, we will store your data but not actively use it except with your consent or for legal claims.

7.5 Right to Data Portability

You have the right to receive your personal information in a portable format and transmit it to another service provider. This right applies to data you provided to us with your consent or under a contract, and which we process by automated means.

7.6 Right to Object

You have the right to object to processing of your personal information for direct marketing purposes. You can opt out of marketing communications at any time by clicking the "unsubscribe" link in any promotional email or by adjusting your communication preferences in your account settings.

7.7 Right to Withdraw Consent

Where we rely on your consent to process personal information (such as marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact our data protection team via email at [email protected] or through our 24/7 live chat. We will respond to your request within 30 days. In some cases, we may need to verify your identity before processing your request to ensure data security.

8. Cookies and Tracking Technologies

xltoto uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device that allow us to recognize you, remember your preferences, and analyze how you use the site.

8.1 Types of Cookies We Use

• Essential cookies: Required for basic platform functionality, such as maintaining your login session, processing transactions, and enabling security features. These cookies cannot be disabled.
• Performance cookies: Collect anonymous information about how visitors use the platform, such as which pages are most popular and error messages. This helps us improve site performance.
• Functionality cookies: Remember your preferences (language, currency display, game favorites) to provide a more personalized experience.
• Analytics cookies: Used to understand user behavior, measure traffic, and generate statistical reports. We use analytics data to optimize the platform and identify areas for improvement.

8.2 Managing Cookies

You can control cookie settings through your web browser. Most browsers allow you to block or delete cookies, though doing so may impact your ability to use certain features of the platform. To learn more about managing cookies, visit your browser's help section.

9. Third-Party Links

The xltoto platform may contain links to third-party websites (such as game providers, payment processors, or social media platforms) for your convenience. This Privacy Policy applies only to information collected by xltoto. We are not responsible for the privacy practices of third-party sites, and we encourage you to review their privacy policies before providing any personal information.

10. Children's Privacy

xltoto is an adult-only platform. We do not knowingly collect personal information from anyone under the age of 21. All members must verify that they are at least 21 years old during registration, and we conduct age verification checks as part of our KYC process. If we become aware that we have collected personal information from a minor, we will delete that information immediately and close the associated account without refund.

Parents or guardians who believe their child has provided personal information to xltoto should contact us immediately at [email protected].

11. International Data Transfers

xltoto primarily serves members in Indonesia, and your personal information is stored on secure servers within the region. However, some of our service providers and business partners may be located outside Indonesia, which may result in your data being transferred internationally. When we transfer data across borders, we ensure that appropriate safeguards are in place to protect your information in accordance with international data protection standards.

12. Changes to This Privacy Policy

xltoto reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will notify you by posting a prominent notice on the platform or sending an email to your registered email address. The "Effective Date" at the top of this policy indicates when it was last revised.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the platform after changes are posted constitutes acceptance of the updated Privacy Policy.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or how xltoto handles your personal information, please contact us:

• Email: [email protected]
• 24/7 Live Chat: Available on every page of the platform
• WhatsApp: +62 811 9876 5432

Our support team operates 24 hours a day, 7 days a week (WIB / UTC+7) and can assist you in both English and Bahasa Indonesia.