oxl88 Privacy Policy

In this Privacy Policy, the following terms carry the meanings defined below unless the context clearly requires otherwise:

This Privacy Policy applies to all Personal Data collected by oxl88 through the following channels:

• The oxl88 website at https://oxl88.bio and all associated subdomains.
• The oxl88 mobile-optimized web application accessible via mobile browsers.
• Any downloadable oxl88 application made available to Members.
• Communications between Members and the oxl88 support team, whether via live chat, email, or telephone.
• Participation in oxl88 promotions, surveys, or market research programs.

This Policy applies to Members who are residents of Indonesia and to any individual who accesses or uses the oxl88 platform from Indonesian territory. It governs all Personal Data Processing activities carried out by oxl88 as the data controller, as well as the Processing activities carried out by authorized Data Processors on oxl88's behalf.

This Policy does not apply to third-party websites or services that may be linked to or referenced from the oxl88 platform. oxl88 has no control over the privacy practices of third-party sites and accepts no responsibility for their content or data handling.

oxl88 collects Personal Data through three primary channels: data you provide directly, data generated automatically through your use of the platform, and data obtained from authorized third-party sources. The following table provides a comprehensive breakdown:

Certain data fields marked as optional during registration (such as a secondary phone number or referral code) are not mandatory for account creation. You may skip optional fields without affecting your access to the core Services. However, KYC data is mandatory for withdrawal privileges and cannot be waived.

You are responsible for ensuring that all Personal Data provided to oxl88 is accurate, complete, and current. Providing false, misleading, or someone else's identity data constitutes a material breach of the Terms & Conditions and may result in permanent account closure and forfeiture of balance.

oxl88 uses your Personal Data exclusively for the following legitimate purposes:

• Account Management: Creating, maintaining, securing, and closing your oxl88 Account; sending account-related notifications (e.g., deposit confirmations, withdrawal approvals, security alerts).
• Identity Verification (KYC): Verifying your age (21+ requirement), identity, and Indonesian residency in compliance with AML obligations and our platform eligibility rules.
• Payment Processing: Facilitating deposits and withdrawals via your registered bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and crypto addresses (USDT, BTC).
• Service Delivery: Providing access to sports betting markets (including BRI Liga 1, EPL, Champions League, and Timnas Indonesia fixtures), slot games, live casino tables, and all other oxl88 Services.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, bonus abuse, and unauthorized account access; maintaining the integrity of sports markets and casino games.
• Regulatory Compliance (AML): Monitoring transaction patterns for potential money laundering activity; retaining records as required by applicable AML and financial crime prevention regulations; reporting suspicious activity to relevant authorities where legally required.
• Responsible Gaming: Monitoring betting patterns for indicators of problem gambling behavior; honoring self-exclusion, deposit limit, and cool-off requests; facilitating referrals to professional support organizations where appropriate. Full details on our Responsible Gaming program are available at Responsible Gaming.
• Personalization: Tailoring the platform experience — including game recommendations, promotional offers, and market suggestions — based on your betting history and stated preferences, subject to your marketing preferences settings.
• Analytics & Platform Improvement: Analyzing aggregated, anonymized usage data to improve platform performance, identify technical issues, and develop new features and product offerings.
• Marketing Communications: Sending promotional emails, SMS notifications, and in-platform messages about bonuses, seasonal promotions (e.g., Idul Fitri, Ramadhan, and major football events), and new product launches — only where you have provided explicit consent or where we have a legitimate interest based on your existing Member relationship. You may opt out at any time as described in Section 9.
• Legal & Dispute Resolution: Preserving evidence, enforcing our Terms & Conditions, responding to legal process, and resolving disputes between Members and oxl88.

oxl88 processes your Personal Data under the following legal bases, consistent with internationally recognized data protection principles and Indonesia's Personal Data Protection Law (UU PDP):

oxl88 does not sell your Personal Data. We share your data only in the following limited and controlled circumstances:

oxl88 engages third-party Data Processors to perform specific functions on our behalf. These processors are contractually bound to process your data only according to our documented instructions and to maintain appropriate technical and organizational security measures. Current categories of Data Processor include:

• KYC & Identity Verification Vendors: Third-party providers that receive copies of your identity documents and selfie photos to perform automated and manual identity verification. These providers are required to delete raw document images after verification is complete, retaining only the verification result and timestamp.
• Payment Processors: Licensed payment processing partners that handle deposit and withdrawal transactions via Indonesian bank channels (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet networks (OVO, DANA, GoPay, ShopeePay, LinkAja), and crypto networks (USDT TRC-20, BTC).
• Fraud Prevention & Security Services: Providers of fraud detection algorithms and device fingerprinting tools used to identify suspicious login patterns and multi-account activity.
• Platform Analytics: Providers of anonymized web analytics tools used to measure platform performance, page load times, and user journey data. No individually identifiable data is shared with analytics providers.
• Customer Support Infrastructure: Providers of live chat and ticketing software that host support conversation data. All such providers are bound by data processing agreements.

oxl88 may disclose your Personal Data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where required by law, court order, or regulatory investigation — including AML reporting obligations. In such cases, oxl88 will disclose only the minimum data necessary to satisfy the legal requirement and will notify the affected Member where legally permitted to do so.

In the event of a merger, acquisition, or sale of all or substantially all of oxl88's business assets, Member Personal Data may be transferred to the acquiring entity as part of the transaction. oxl88 will provide affected Members with at least 30 days' advance notice of any such transfer, and the acquiring entity will be required to honor this Privacy Policy or provide Members with an equivalent or higher level of data protection.

oxl88 may share your Personal Data with additional third parties where you have given specific, informed, and freely given consent for that sharing. You may withdraw such consent at any time by contacting support at the details provided in Section 14.

oxl88 retains Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply by default:

Upon expiry of the applicable retention period, Personal Data is either securely and permanently deleted from oxl88 systems or anonymized such that the data can no longer be linked to an identifiable individual. Anonymized data may be retained indefinitely for aggregated statistical and analytical purposes.

Members who request account closure may submit a formal data deletion request. oxl88 will complete deletion of all non-legally-mandated data within 30 days of receiving the request, and will confirm completion in writing via the registered email address.

The oxl88 platform uses cookies and similar tracking technologies (including local storage and session tokens) to deliver a secure, reliable, and personalized betting experience. The following cookie categories are in use:

oxl88 does not permit third-party advertising networks to place cookies on the platform. Analytics tools used by oxl88 are configured in anonymization mode, meaning no individually identifiable data is transmitted to third-party analytics providers.

You can manage or disable non-essential cookies via your browser settings. Most modern browsers (Chrome, Firefox, Safari, Edge) provide granular cookie controls under the Privacy or Security section of their Settings menu. Please note that disabling Strictly Necessary cookies will prevent you from logging in or using core platform features. oxl88 does not currently operate a cookie consent management panel; functional and analytics cookies are active by default upon first use of the platform, consistent with the session-based consent model applicable to platforms in this category.

As an Indonesian resident and oxl88 Member, you have the following rights with respect to your Personal Data, consistent with Indonesia's UU PDP and internationally recognized data protection principles. To exercise any of these rights, contact the oxl88 privacy team using the details in Section 14. oxl88 will respond to all rights requests within 14 business days.

• Right of Access: You have the right to request a copy of all Personal Data oxl88 holds about you, along with information on how it is processed, the legal basis for processing, and with whom it has been shared. Requests will be fulfilled within 14 business days free of charge for up to two requests per calendar year.
• Right to Correction: You have the right to request correction of inaccurate or incomplete Personal Data. Where a correction affects KYC-verified information (e.g., a legal name change), additional documentary evidence will be required.
• Right to Deletion ("Right to be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where it has been processed unlawfully. Deletion requests are subject to mandatory retention obligations — data that must be retained for AML compliance or legal proceedings cannot be deleted until the applicable retention period expires.
• Right to Restrict Processing: You have the right to request that oxl88 restrict the processing of your Personal Data — for example, while a correction request is under review, or while you contest the legal basis for processing.
• Right to Data Portability: You have the right to receive a copy of your Personal Data in a commonly used, machine-readable format (e.g., CSV or JSON) to transfer to another service, where this is technically feasible and where the processing is based on consent or contract performance.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. To opt out of marketing communications, use the unsubscribe link in any promotional email or contact support directly.
• Right to Object: You have the right to object to processing based on legitimate interest, including profiling for personalization purposes. oxl88 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Lodge a Complaint: If you believe oxl88 has processed your Personal Data in violation of applicable data protection law, you have the right to lodge a complaint with the relevant data protection authority. In Indonesia, the supervisory authority responsible for UU PDP enforcement is the Ministry of Communication and Digital Affairs (Kemenkomdigital).

oxl88 implements comprehensive technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security framework includes:

• Transport Encryption: All data in transit between your device and oxl88 servers is protected using TLS 1.3 (256-bit) encryption. HSTS (HTTP Strict Transport Security) is enforced to prevent protocol downgrade attacks.
• Data Encryption at Rest: Sensitive Personal Data stored on oxl88 servers — including KYC documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data within oxl88 is restricted on a strict need-to-know basis. Staff access is role-based and subject to multi-factor authentication. All internal data access events are logged and audited regularly.
• Two-Factor Authentication (2FA): oxl88 strongly recommends — and for high-value accounts, requires — the activation of 2FA via Google Authenticator or SMS OTP to protect Member accounts from unauthorized login.
• Penetration Testing: The oxl88 platform undergoes regular third-party penetration testing and vulnerability assessments. Critical vulnerabilities are remediated within 24 hours of identification; high-severity issues are addressed within 7 days.
• Incident Response: In the event of a data security incident that may affect your Personal Data, oxl88 will notify affected Members via their registered email address within 72 hours of becoming aware of the incident, in accordance with applicable data breach notification obligations.
• Data Minimization: oxl88 collects only the Personal Data that is strictly necessary for the stated purpose. Data fields that are not required for account creation or KYC are treated as optional.

oxl88 operates a strict 21+ age policy. The platform is intended exclusively for adults aged 21 years and above. oxl88 does not knowingly collect, store, or process Personal Data of any person under the age of 21.

During the account registration process, oxl88 requests date of birth to filter underage applicants. The KYC verification process provides an additional layer of age verification through government-issued identity document checks. Any account for which KYC verification reveals the holder to be under 21 years of age will be immediately suspended, all associated funds will be returned to the depositing payment method, and the account will be permanently closed.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account with oxl88, please contact us immediately at [email protected] with the subject line "Underage Account Report". oxl88 will investigate within 24 hours, suspend the account pending review, and permanently close it upon confirmation. All Personal Data associated with the underage account will be deleted within 30 days of confirmed closure, except where retention is required by AML or legal obligations.

oxl88 also supports the use of third-party parental control software to restrict minors' access to online gambling sites. Tools such as GamBlock, Betfilter, and Gamban are compatible with oxl88.bio and can be installed at the device or network level to prevent access by underage individuals in your household.

oxl88 may transfer your Personal Data to servers and service providers located outside of Indonesia, including in jurisdictions where data protection laws may differ from those applicable in Indonesia. Such transfers occur primarily in connection with the Data Processors described in Section 6 — specifically KYC verification vendors, payment processors, and platform analytics providers.

Where Personal Data is transferred internationally, oxl88 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under Indonesia's UU PDP. These safeguards include:

• Data Processing Agreements (DPAs) with all third-party Data Processors that include binding data protection obligations and confidentiality undertakings.
• Selection of Data Processors operating in jurisdictions with adequacy decisions or recognized data protection frameworks.
• Contractual clauses in vendor agreements that require processors to notify oxl88 of any data breach affecting oxl88 Member data within 24 hours of discovery.
• Regular due-diligence reviews of Data Processor security postures, certifications (e.g., ISO 27001, SOC 2), and compliance track records.

By using the oxl88 platform and providing your Personal Data, you acknowledge and consent to the international transfer of your data as described in this Section, subject to the safeguards outlined above.

oxl88 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform functionality, or data processing practices. The following amendment process applies:

• Material Changes: Where a proposed amendment materially affects your rights or the way oxl88 processes your Personal Data, oxl88 will provide at least 30 days' advance notice by email to your registered address before the change takes effect. The updated Policy will also be published on this page with a revised "Last Updated" date.
• Minor Changes: Non-material amendments — such as clarifications of existing language, corrections of typographical errors, or updates to contact details — may be made without prior individual notice. The updated Policy will be published on this page with a revised "Last Updated" date.
• Continued Use: Your continued use of the oxl88 platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the amended terms, you must cease using the platform and contact support to request account closure.
• Version History: oxl88 maintains an internal archive of all previous versions of this Privacy Policy. Members may request a copy of a previous version by contacting the privacy team at the details in Section 14.

For all privacy-related inquiries, data subject rights requests, or concerns regarding oxl88's handling of your Personal Data, please contact the oxl88 Privacy and Compliance team using the following details:

oxl88 has appointed an internal Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy, reviewing data processing activities, and serving as the primary point of contact for data subject rights requests and regulatory inquiries. The DPO operates under the same contact details as the Privacy team above.