Privacy Policy — xtcbet

Definitions

In this Privacy Policy, the following terms carry the meanings assigned below unless the context expressly requires otherwise.

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, information that can be used, directly or indirectly, to identify a specific individual. Examples include a name, national ID number, email address, IP address, or location data.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means — including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means xtcbet, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third-party entity that processes Personal Data on behalf of xtcbet under a written data processing agreement.
• "Member" / "User" means any individual who holds or has applied for a registered account on the xtcbet platform.
• "KYC" (Know Your Customer) means the identity verification process we conduct to confirm each Member's identity, age, and residential address.
• "Cookies" means small text files placed on your device by our platform to facilitate certain features and collect Usage Data. Full details are set out in Section 8 of this policy.
• "Third Party" means any entity — whether an individual, company, or organization — that is not xtcbet or a Member of the platform.

Scope & Application

This Privacy Policy applies to all Personal Data collected by xtcbet through the xtcbet.cam website and any associated mobile applications, APIs, or communication channels operated by xtcbet.

This policy does not apply to:

• Third-party websites or services that you may access through links on the xtcbet platform. Those websites have their own independent privacy policies, and xtcbet accepts no responsibility for their data practices.
• Payment processors and e-wallet providers (such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja) — those entities process your financial data under their own privacy policies and terms of service.
• Game providers whose games are embedded on the xtcbet platform — data collected directly by those providers is subject to their own privacy policies.

Where xtcbet engages third-party processors to handle Personal Data on our behalf, those processors are contractually required to comply with equivalent data-protection standards.

Personal Data We Collect

xtcbet collects and processes the following categories of Personal Data:

3.1 Identity Data

Full legal name, date of birth, gender, nationality, national identity card number (NIK for Indonesian citizens), passport number (for foreign nationals), and copies of identity documents submitted for KYC purposes.

3.2 Contact Data

Email address, mobile phone number, residential address (including street, city, province, and postal code).

3.3 Financial Data

Bank account number and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, or others), e-wallet identifiers and registered phone numbers (OVO, DANA, GoPay, ShopeePay, LinkAja), deposit and withdrawal transaction history, and payment-method verification documents (e.g., screenshots or photos of payment accounts showing the registered name).

3.4 Technical Data

IP address, device ID, browser type and version, operating system, screen resolution, language preferences, time zone, session timestamps, and unique device fingerprint identifiers used for fraud detection.

3.5 Usage Data

Pages viewed, games played, bets placed (type, stake, odds, outcome), features accessed, session duration, click-through patterns, referral source, and responsible-gaming tool usage (deposit limits, time-outs, self-exclusion).

3.6 Marketing & Communication Preferences

Whether you have opted in or out of receiving promotional emails, SMS messages, or push notifications; your preferred communication channel; and your language preference (English or Indonesian).

3.7 Support & Correspondence Data

Transcripts of live chat conversations, copies of email correspondence with our support team, complaint records, and any other communications you have with xtcbet.

How We Collect Personal Data

xtcbet collects Personal Data through the following methods:

• Directly from you during account registration: When you create an xtcbet account, you provide Identity Data and Contact Data through the registration form.
• During KYC verification: When you submit identity documents (KTP, passport, proof of address, payment-method verification screenshots) for the purpose of verifying your identity before your first withdrawal.
• Through deposit and withdrawal transactions: When you make a deposit or request a withdrawal, we collect Financial Data including account numbers, transaction amounts, timestamps, and payment-method identifiers.
• Automatically through platform usage: When you navigate the xtcbet website, we automatically collect Technical Data and Usage Data through cookies, server logs, and analytics tools.
• When you contact customer support: When you send an email, initiate a live chat, or otherwise communicate with our support team, we collect and store the content of that communication.
• Through third-party sources: In limited cases, we may receive data from payment processors, fraud-detection services, identity-verification providers, or affiliates through whom you accessed the platform.

How We Use Your Personal Data

xtcbet processes your Personal Data for the following purposes:

5.1 Account Management & Service Delivery

• To create and maintain your Member account.
• To authenticate your identity when you log in.
• To process deposits, withdrawals, and internal transfers.
• To settle bets and credit winnings to your account balance.
• To apply bonuses, process promotions, and enforce bonus terms.

5.2 Compliance & Legal Obligations

• To verify that you are at least 21 years of age and legally eligible to gamble in Indonesia.
• To conduct KYC and anti-money laundering (AML) checks as required by our international operating license.
• To comply with applicable regulations, court orders, and law enforcement requests.
• To maintain transaction records for the statutory retention period.

5.3 Fraud Prevention & Security

• To detect and prevent fraud, money laundering, bonus abuse, match-fixing, collusion, and other prohibited conduct.
• To monitor for duplicate accounts and enforce our one-account-per-person rule.
• To identify unusual betting patterns and potential security threats.
• To protect the integrity of games and prevent cheating or exploitation.

5.4 Customer Support & Dispute Resolution

• To respond to your inquiries, complaints, and support requests.
• To investigate and resolve disputes related to bets, payouts, or account access.
• To improve the quality of our customer service operations.

5.5 Platform Improvement & Analytics

• To understand how Members use the platform and which features are most popular.
• To identify technical issues, bugs, and performance bottlenecks.
• To test new features and optimize the user experience.
• To generate aggregated, anonymized statistics for internal business analysis.

5.6 Marketing & Communication (Consent-Based)

• To send you promotional emails and SMS messages about new bonuses, tournaments, and platform updates — only if you have opted in to receive such communications.
• To personalize promotional offers based on your gaming preferences and activity history.
• To inform you of changes to our Terms & Conditions or Privacy Policy.

5.7 Responsible Gaming

• To monitor betting behavior for signs of problem gambling.
• To enforce deposit limits, session time-outs, and self-exclusion requests.
• To provide information and resources on responsible gaming support services.

Legal Bases for Processing

xtcbet processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and xtcbet (i.e., the Terms & Conditions), including account creation, deposit/withdrawal processing, bet settlement, and customer support.
• Legal Obligation: Processing is necessary to comply with a legal obligation to which xtcbet is subject, such as KYC, AML, age verification, record-keeping, and cooperation with law enforcement.
• Legitimate Interests: Processing is necessary for the legitimate interests pursued by xtcbet — such as fraud prevention, security monitoring, platform improvement, and business analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is based on your explicit consent (e.g., marketing communications, non-essential cookies), you have the right to withdraw that consent at any time.

Data Sharing & Third-Party Disclosure

xtcbet does not sell, lease, or trade your Personal Data to third parties for their independent marketing purposes. We share your data only in the following limited circumstances:

7.1 Service Providers & Data Processors

We engage third-party service providers to perform certain functions on our behalf, including:

• Payment processors: To facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Identity verification partners: To verify your identity documents and perform KYC checks.
• Cloud infrastructure providers: To host the platform and store data securely.
• Fraud detection & security services: To monitor for suspicious activity and prevent fraud.
• Customer support platforms: To manage live chat, email ticketing, and support request tracking.
• Analytics providers: To analyze platform usage and generate performance reports.

All third-party processors are contractually bound to process your data only for the specified purpose, to maintain equivalent data-protection standards, and to delete or return data when the service engagement ends.

7.2 Legal & Regulatory Disclosure

xtcbet may disclose your Personal Data if required to do so by law, court order, regulatory directive, or in response to a valid request from law enforcement or government authorities. We may also disclose data where necessary to protect the rights, property, or safety of xtcbet, our Members, or the public.

7.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy involving xtcbet, your Personal Data may be transferred to the successor entity. We will notify you via email or prominent notice on the platform before your data is transferred and becomes subject to a different privacy policy.

7.4 Aggregated & Anonymized Data

xtcbet may share aggregated, anonymized statistical data — which cannot be used to identify individual Members — with business partners, affiliates, or for public reporting purposes. Such data is not considered Personal Data.

Cookies & Tracking Technologies

xtcbet uses cookies and similar tracking technologies to enhance your experience on the platform. A cookie is a small text file stored on your device that helps us recognize you when you return, remember your preferences, and analyze platform usage.

8.1 Types of Cookies We Use

• Essential Cookies: Required for the platform to function — used for login authentication, session management, and security. You cannot opt out of these cookies.
• Functional Cookies: Remember your preferences (language, timezone, display settings) and provide enhanced features. You can disable these in your browser settings.
• Analytics Cookies: Collect data on how you use the platform (pages visited, time spent, click paths) to help us improve our services. You can opt out via browser settings or privacy controls.
• Advertising Cookies: Track your activity to deliver personalized promotions. These cookies require your explicit consent and can be controlled through the cookie consent banner displayed on your first visit.

8.2 Managing Cookies

Most browsers allow you to refuse or delete cookies through their settings. However, disabling essential cookies may prevent you from using certain features of the platform. Consult your browser's help documentation for instructions on managing cookies.

Data Security

xtcbet takes data security seriously and implements industry-standard technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction.

9.1 Technical Safeguards

• Encryption in transit: All data transmitted between your device and the xtcbet platform is encrypted using TLS 1.3 (Transport Layer Security).
• Encryption at rest: Sensitive data stored on our servers — including KYC documents, payment details, and passwords — is encrypted using AES-256 encryption.
• Password hashing: Member passwords are hashed using bcrypt with per-user salts and never stored in plaintext.
• Access controls: Personal Data is accessible only to authorized personnel on a need-to-know basis. All access is logged and audited.
• Firewalls & intrusion detection: Network-level security measures are deployed to detect and prevent unauthorized access attempts.

9.2 Organizational Safeguards

• All xtcbet staff and contractors who handle Personal Data are bound by confidentiality agreements.
• Regular security training is provided to all personnel with access to Personal Data.
• Data-processing agreements are in place with all third-party processors.
• Incident response procedures are documented and tested to respond rapidly to any data breach.

9.3 Data Breach Notification

In the unlikely event of a data breach that is likely to result in a high risk to your rights and freedoms, xtcbet will notify you via email within 72 hours of becoming aware of the breach, together with a description of the breach, the data affected, and the steps we are taking to mitigate the impact.

Data Retention

xtcbet retains your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods are as follows:

• Active account data: Retained for the duration of your active membership and for 5 years following account closure, as required by AML and financial record-keeping regulations.
• Transaction records: Retained for 7 years from the date of transaction, as required by financial services regulations.
• KYC documents: Retained for 5 years following account closure or the last transaction, whichever is later.
• Support correspondence: Retained for 3 years from the date of the last communication, to support dispute resolution and quality assurance.
• Marketing consent records: Retained for the duration of your consent plus 2 years, to evidence compliance with consent requirements.
• Technical logs & analytics data: Retained for 12 months, then aggregated and anonymized for long-term statistical analysis.

At the end of the applicable retention period, Personal Data is either securely deleted (overwritten and unrecoverable) or anonymized (stripped of all identifiable information and converted to aggregated statistical data).

Your Rights

Under applicable data-protection law, you have the following rights with respect to your Personal Data held by xtcbet:

• Right of Access: You have the right to request a copy of the Personal Data we hold about you. We will provide this in a structured, commonly used, and machine-readable format within 30 calendar days of your request.
• Right of Rectification: You have the right to request correction of inaccurate or incomplete Personal Data. You can update most information directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your Personal Data, subject to certain exceptions (e.g., where retention is required by law or for the establishment, exercise, or defense of legal claims).
• Right to Restriction of Processing: You have the right to request that we temporarily suspend processing of your Personal Data in certain circumstances (e.g., while we verify the accuracy of contested data).
• Right to Data Portability: You have the right to receive your Personal Data in a portable format and to transmit that data to another controller, where technically feasible.
• Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing conducted prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory data-protection authority if you believe that xtcbet has violated your data-protection rights.

To exercise any of these rights, please contact us at the email address provided in Section 15 of this policy. We will respond to all requests within 30 calendar days, or notify you if additional time is required.

International Data Transfers

xtcbet operates internationally and may transfer your Personal Data to countries outside Indonesia for the purposes of hosting, processing, and storage. Where we transfer data to jurisdictions that do not provide an equivalent level of data protection, we implement appropriate safeguards such as:

• Standard contractual clauses approved by relevant data-protection authorities.
• Data processing agreements requiring the recipient to apply equivalent data-protection standards.
• Technical measures such as encryption and access controls to protect data in transit and at rest.

By using the xtcbet platform, you acknowledge and consent to the transfer of your Personal Data outside Indonesia in accordance with this Privacy Policy.

Children & Minors

The xtcbet platform is intended exclusively for individuals who are at least 21 years of age. We do not knowingly collect Personal Data from anyone under the age of 21.

If we become aware that we have collected Personal Data from a person under 21 years of age, we will take immediate steps to delete that data and permanently close the associated account. Any deposits made by an underage person will be returned, minus any winnings, in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that your child has provided Personal Data to xtcbet, please contact us immediately at the email address provided in Section 15.

Amendments to This Privacy Policy

xtcbet reserves the right to amend, update, or replace this Privacy Policy at any time. Where a material change is made that affects how we use or disclose your Personal Data, we will notify you by email or by displaying a prominent notice on the platform at least 30 days before the change takes effect.

The "Last Updated" date displayed at the top of this document indicates when the most recent revision was published. Your continued use of the platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

We recommend that you review this Privacy Policy periodically to stay informed of how we are protecting your data.

Contact & Data Protection Officer

If you have any questions, concerns, or complaints about this Privacy Policy or how xtcbet handles your Personal Data, or if you wish to exercise any of your data rights, please contact us at: