Privacy Policy — xyz333

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "xyz333", "we", "us", "our" — the xyz333 platform and its operating entity, accessible at https://xyz333.app.
• "Platform" — the xyz333 website, mobile web application, and all associated gaming and betting services.
• "Player", "you", "your" — any individual who accesses, registers on, or interacts with the Platform.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. Examples include full name, date of birth, email address, IP address, device identifiers, and financial account details.
• "Sensitive Personal Data" — a subset of personal data that warrants heightened protection, including government-issued identification numbers, financial data, and biometric data where collected.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion.
• "Third Party" — any entity other than xyz333 and the Player, including payment processors, KYC verification providers, game content studios, and analytics partners.
• "KYC" — Know Your Customer, the identity and age verification process that xyz333 is obligated to conduct under its licensing obligations.
• "Cookie" — a small text file placed on a Player's device by the Platform for the purposes of session management, analytics, or preference storage.

xyz333 acts as the data controller in respect of the personal data it collects from Players through the Platform. As data controller, xyz333 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection principles.

If you have any questions, concerns, or requests relating to the processing of your personal data, please contact us directly using the details set out in Section 15 of this Policy. We aim to respond to all data-related enquiries within five business days.

xyz333 collects the following categories of personal data from Players:

3.1 Registration Data

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Email address
• Username and hashed password
• Mobile phone number (where provided for two-factor authentication)
• Preferred currency (IDR)

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (Indonesian KTP, SIM, or passport scan)
• Proof of address documentation (where required)
• Proof of payment method ownership (bank statement, e-wallet screenshot, or similar)
• Selfie photograph for liveness verification (where required by enhanced KYC)

3.3 Financial Data

• Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) used for deposits or withdrawals
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction history (deposit amounts, withdrawal amounts, dates, and reference numbers)
• Account balance history

3.4 Technical and Usage Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session timestamps and duration
• Pages visited and features interacted with on the Platform
• Game history (titles played, stakes placed, outcomes, bonus usage)
• Cookie identifiers and similar tracking technology data (see Section 11)

3.5 Communications Data

• Records of live chat conversations with xyz333 customer support
• Email correspondence with the xyz333 support team
• Responses to surveys, feedback forms, or promotional opt-in records

xyz333 collects personal data through the following means:

• Directly from you — when you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or respond to a promotion.
• Automatically — through cookies, server logs, and similar technologies as you browse and interact with the Platform. This includes IP address logging, session tracking, and game-event data recorded by our game servers.
• From third-party payment providers — transaction confirmation data shared by BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja when you initiate a deposit or withdrawal.
• From KYC and fraud-prevention partners — identity verification outcomes, watchlist screening results, and risk scores generated by our licensed third-party KYC service providers.
• From analytics partners — aggregated, anonymised traffic and engagement data that helps us understand how Players use the Platform. This data is processed in a form that does not identify individual Players.

xyz333 processes your personal data for the following purposes:

xyz333 does not process your personal data for any purpose incompatible with those listed above without first obtaining your express consent or establishing an alternative lawful basis for processing.

xyz333 relies on the following legal bases to process your personal data:

• Contractual necessity. Processing required to perform the contract between xyz333 and you — including account creation, deposit and withdrawal processing, game participation, and customer support — is carried out on the basis that it is necessary for the execution of that contract.
• Legal obligation. Certain processing activities — including KYC identity verification, age verification, AML screening, and transaction record-keeping — are required by the licensing conditions and applicable law under which xyz333 operates. xyz333 has no discretion to omit this processing.
• Legitimate interests. xyz333 processes certain data categories (such as technical and usage data for fraud prevention, platform security, and responsible gaming monitoring) on the basis of its legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent. Where xyz333 processes your data for optional purposes — such as sending promotional emails, push notifications, or personalised offers — it does so only on the basis of your freely given, informed, and specific consent. You may withdraw this consent at any time by updating your communication preferences in your Account settings or by contacting support.

xyz333 does not sell your personal data to third parties. We share data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors. When you initiate a deposit or withdrawal, the relevant transaction data is shared with the applicable payment provider — BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, or LinkAja — solely to execute the transaction. These providers process your data under their own privacy policies and are independent data controllers for that transaction.
• KYC and identity verification providers. Your KYC documents and registration data are shared with licensed third-party verification services to confirm your identity, age, and eligibility to use the Platform. These providers are contractually bound to process your data only for the purposes of verification and to maintain equivalent data protection standards.
• Game content providers. Studios such as Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, Spribe, and NetEnt receive limited technical identifiers (such as an anonymised session token) to enable game functionality. They do not receive your name, financial data, or contact details via this mechanism.
• Analytics and platform infrastructure providers. Aggregated or pseudonymised usage data may be processed by cloud infrastructure and analytics partners to support Platform performance, security monitoring, and product improvement. All such providers are subject to data processing agreements that restrict their use of the data.
• Regulatory and law enforcement authorities. xyz333 will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts when required to do so by applicable law, court order, or regulatory instruction. xyz333 will, where legally permissible, notify you of such disclosure.
• Business transfers. In the event of a merger, acquisition, or sale of all or part of xyz333's business, your personal data may be transferred to the successor entity as part of that transaction, subject to equivalent privacy protections.

xyz333 operates in an international environment and some of the third-party service providers described in Section 7 are located outside Indonesia. When your personal data is transferred to a jurisdiction that may not offer the same level of data protection as your home country, xyz333 takes the following protective measures:

• Entering into contractual arrangements with recipient entities that impose data protection obligations equivalent to those applied by xyz333.
• Ensuring that cloud and infrastructure providers operate data centres with industry-standard physical and logical security certifications (such as ISO 27001).
• Applying technical safeguards — including end-to-end encryption in transit (TLS 1.2 or higher) and encryption at rest — to all personal data transferred across borders.

By registering an Account and using the Platform, you acknowledge that your personal data may be processed in jurisdictions outside Indonesia as described in this section.

xyz333 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical analysis.

xyz333 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the xyz333 Platform.
• Encryption at rest for all sensitive data stored on xyz333 servers, including KYC documents and financial records.
• Password hashing using industry-standard one-way cryptographic algorithms. xyz333 never stores passwords in plaintext and cannot retrieve your password — only reset it.
• Two-factor authentication (2FA) available to all Players and mandatory for certain high-value withdrawal thresholds.
• Access controls limiting internal employee access to personal data on a strict need-to-know basis, enforced through role-based permission systems.
• Regular security audits and vulnerability assessments conducted by independent third-party security firms.
• Incident response procedures that include Player notification in the event of a data breach that poses a risk to your rights and freedoms, within the timeframe required by applicable law.

The xyz333 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure experience. The following categories of cookies are deployed:

• Strictly necessary cookies. These cookies are essential for the Platform to function. They manage your login session, maintain your Account state across page requests, and enable security features. These cookies cannot be disabled without impairing Platform functionality.
• Functional cookies. These cookies remember your preferences — such as language settings, preferred deposit method display, and notification settings — so you do not need to re-enter them on each visit.
• Analytics cookies. Aggregated, anonymised data about how Players navigate the Platform helps xyz333 identify technical issues, improve page performance, and prioritise new features. Where third-party analytics tools are used, they are configured to anonymise IP addresses and are prohibited from using the data for their own commercial purposes.
• Security and fraud-prevention cookies. These cookies assign a device fingerprint token that helps xyz333 detect unusual login patterns, identify bot activity, and flag potentially fraudulent sessions for manual review.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to the Platform. Disabling analytics or functional cookies will not affect your ability to place bets or access games, but may result in a less personalised experience.

Subject to applicable law and the limitations set out below, you have the following rights in relation to your personal data held by xyz333:

• Right of access. You may request a copy of the personal data xyz333 holds about you, together with information about how it is processed.
• Right to rectification. If any personal data xyz333 holds about you is inaccurate or incomplete, you may request that it be corrected. For data such as your registered name or date of birth, an updated KYC document may be required.
• Right to erasure. You may request that xyz333 delete your personal data. This right is subject to xyz333's obligation to retain certain records for regulatory compliance purposes (see Section 9). Where deletion is not possible, xyz333 will explain the basis for retention.
• Right to restriction of processing. In certain circumstances — for example, while a dispute regarding data accuracy is being resolved — you may request that xyz333 restrict (but not delete) the processing of your personal data.
• Right to data portability. You may request that xyz333 provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object. You may object to processing carried out on the basis of legitimate interests. xyz333 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent. Where processing is based on consent (for example, marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to the withdrawal.

To exercise any of the above rights, please contact xyz333 at [email protected] with the subject line "Data Rights Request — [Your Username]". We will respond within five business days. We may request additional information to verify your identity before processing your request.

The xyz333 Platform is strictly intended for adults aged 21 and over. xyz333 does not knowingly collect or process personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all registered Players.

If xyz333 discovers that personal data has been collected from an individual who is under 21 years of age, it will immediately suspend the associated Account, delete the relevant personal data to the extent not required by law, and — where funds have been deposited — return those funds to the verified payment source used for the deposit.

If you are a parent or guardian and believe that your child has registered on the xyz333 Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

xyz333 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform features. When material changes are made, we will notify registered Players via email and display a prominent notice on the Platform at least 7 days before the revised Policy takes effect.

The "Last Updated" date at the top of this Policy will always reflect the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with any changes, you should cease using the Platform and request Account closure in accordance with the Terms & Conditions.

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by xyz333, please reach out through the following channel:

• Email: [email protected] (subject line: "Privacy Request" or "Data Rights Request")
• Live Chat: Available 24/7 via the in-Platform chat feature, staffed by Indonesian-speaking agents across WIB, WITA, and WIT time zones.
• Response Time: Privacy-related email enquiries are prioritised and typically receive a substantive response within five business days.

xyz333 is committed to resolving all privacy concerns fairly and transparently. If you are not satisfied with our response, you have the right to escalate your concern to the relevant data protection authority or regulatory body applicable in your jurisdiction.