Privacy Policy

1 Introduction

ox368 is an internationally regulated online sports betting and casino platform serving players principally located in Indonesia. We operate the website at https://ox368.cam and all associated mobile-optimized interfaces. In the course of providing our services — including sports betting on competitions such as BRI Liga 1, the English Premier League, and the AFF Cup; casino and live dealer games; togel (Indonesia's traditional numbers lottery) products; and IDR payment processing — we necessarily collect and process certain categories of personal data belonging to our Members and visitors.

ox368 is firmly committed to handling personal data responsibly, transparently, and in accordance with internationally recognized data protection principles. We collect only what is necessary, retain it only for as long as required, and implement robust technical and organizational safeguards to protect it against unauthorized access, disclosure, or loss.

This Policy applies to all personal data processed by ox368 in connection with the Platform, regardless of the device or network through which you access it. It covers data collected during account registration, identity verification (KYC), financial transactions processed in Indonesian Rupiah (IDR) via methods such as BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja, as well as data generated through your ordinary use of betting and gaming products on the Platform.

2 Data Controller

2.1 For the purposes of this Privacy Policy, ox368 acts as the data controller in respect of all personal data collected through the Platform. As data controller, ox368 determines the purposes for which your personal data is processed and the means by which that processing is carried out.

2.2 Where ox368 engages third-party service providers — such as KYC verification vendors, payment processors, fraud-detection services, or cloud hosting providers — those parties act as data processors under instruction from ox368. They are bound by contractual obligations to process your data only as directed and to maintain appropriate security standards.

2.3 If you have questions or concerns about how ox368 processes your personal data, or if you wish to exercise any of your data rights described in Section 10, please contact our Data Protection contact using the details in Section 14 of this Policy.

3 Data We Collect

ox368 collects personal data across several categories, depending on the nature of your interaction with the Platform. The table below summarizes the primary categories of data we collect and provides representative examples of each.

3.1 Special Category Data. ox368 does not intentionally collect special category personal data (sometimes referred to as sensitive personal data), such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, unless this is strictly required for regulatory compliance. For example, certain KYC processes may involve facial recognition matching against identity documents; in such cases, biometric data is processed solely for identity verification purposes and is not retained beyond the verification event.

3.2 Voluntarily Provided Data. Some data is provided voluntarily by you — for example, when you contact customer support or participate in a promotional survey. Where provision of certain data is optional, we will make this clear at the point of collection.

4 How We Collect Your Data

ox368 collects personal data through the following methods:

• Direct collection: Information you provide when completing the account registration form, submitting KYC documents, making a deposit or withdrawal request, or communicating with our support team via email or WhatsApp.
• Automated technical collection: Data generated automatically when you access the Platform, including your IP address, device identifiers, session logs, and browser characteristics, collected via server logs and first-party analytics tools.
• Cookies and similar technologies: First-party cookies and local storage objects used to maintain your login session, store your language and display preferences, and generate aggregate, anonymized usage analytics. See Section 9 for full details.
• Third-party identity verification services: During the KYC process, ox368 may engage accredited identity verification providers who cross-reference the documents you submit against official identity databases to confirm authenticity.
• Payment processors: When you initiate a deposit or withdrawal via a bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or an e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the payment processor may share transaction-confirmation data with ox368 for reconciliation and fraud-prevention purposes.
• Fraud detection and AML screening services: ox368 may receive risk-scoring data from third-party fraud detection or anti-money-laundering screening services to assist in assessing the risk profile of individual transactions or accounts.

5 Purpose & Legal Basis for Processing

ox368 processes your personal data only where there is a valid legal basis for doing so. The following table maps each primary processing purpose to its corresponding legal basis.

5.1 Withdrawing Consent. Where processing is based on your consent (for example, receiving promotional communications about seasonal offers around Ramadhan, Idul Fitri, or major sporting events), you may withdraw that consent at any time by contacting our support team. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

5.2 Consequences of Not Providing Data. Certain data is required for us to perform our contractual obligations — in particular, Identity Data, Contact Data, and Financial Data are necessary to register an Account and process transactions. If you decline to provide this data, ox368 will not be able to provide you with Platform access or process your financial transactions.

6 Data Sharing & Disclosure

6.1 No Sale of Personal Data. ox368 does not sell, rent, or lease your personal data to any third party for commercial or marketing purposes. Your data is shared externally only in the limited circumstances described below.

6.2 Service Providers. ox368 engages carefully selected third-party service providers who process data on our behalf and under our instruction. These include:

• KYC and identity verification providers — to verify the authenticity of identity documents (KTP, passport) submitted by Members during the verification process.
• Payment processors and banking partners — including Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — to execute deposit and withdrawal transactions in IDR.
• Cloud infrastructure providers — for secure hosting of Platform data on servers protected by industry-standard physical and logical access controls.
• Fraud detection and AML screening vendors — to screen transactions and account activity against risk databases and sanctions lists.
• Customer communication platforms — to facilitate email and WhatsApp-based customer support interactions.

6.3 Legal and Regulatory Disclosure. ox368 may disclose personal data to competent regulatory authorities, law enforcement agencies, courts, or other governmental bodies where required to do so by applicable law or by a valid legal order. In such cases, ox368 will disclose only the minimum data necessary to comply with the legal requirement.

6.4 Business Transfers. In the event that ox368 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its business assets, personal data held about Members may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it, with reasonable advance notice.

6.5 Aggregate and Anonymized Data. ox368 may share aggregated, anonymized, and de-identified statistical data — for example, aggregate betting volumes on BRI Liga 1 matches or overall platform performance metrics — with industry partners or in published reports. Such data cannot be used to identify any individual Member.

7 Data Retention

7.1 Retention Principle. ox368 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. When personal data is no longer required, it is securely deleted or anonymized.

7.2 Account Data. Personal data associated with an active Account is retained for the duration of the Account's existence and for a minimum period of five (5) years following Account closure. This retention period reflects standard AML and financial-records-keeping obligations applicable to internationally licensed gambling operators.

7.3 KYC Documents. Identity verification documents — including copies of KTP, passports, and supporting financial documents — are retained for a minimum of five (5) years from the date of verification or Account closure (whichever is later), in compliance with AML regulatory requirements.

7.4 Transaction Records. Financial transaction records (deposits, withdrawals, bonus credits, and wager history) are retained for a minimum of seven (7) years from the date of the transaction, in line with internationally accepted financial record-keeping standards.

7.5 Marketing Consent Data. Records of your marketing consent preferences are retained for the duration of your Account plus three (3) years, to demonstrate compliance with consent obligations. Consent withdrawal records are retained indefinitely.

7.6 Technical and Log Data. Server access logs and technical session data are retained for a maximum of twelve (12) months from the date of collection, after which they are automatically purged or anonymized.

8 Security Measures

8.1 Technical Safeguards. ox368 implements a comprehensive set of technical security controls to protect your personal data, including:

• 256-bit SSL/TLS encryption on all data in transit between your browser or app and our servers.
• AES-256 encryption for sensitive data fields stored at rest in our databases, including financial account numbers and identity document records.
• Multi-factor authentication (MFA) available to Members for Account login, and mandatorily enforced for all ox368 internal administrative access.
• Web Application Firewall (WAF) and DDoS mitigation infrastructure to prevent unauthorized access and service disruption.
• Intrusion Detection Systems (IDS) monitoring platform traffic in real time for anomalous patterns indicative of unauthorized access attempts.
• Regular third-party penetration testing of the Platform's infrastructure and application layer, conducted at minimum annually.

8.2 Organizational Safeguards. Internal access to personal data is governed by a strict role-based access control (RBAC) policy. Only personnel with a documented business need may access Member personal data, and all such access is logged and subject to periodic audit. ox368 conducts regular staff training on data protection obligations.

8.3 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Members, ox368 will notify affected individuals without undue delay and will take all reasonable steps to contain and remediate the breach.

8.4 Your Responsibility. While ox368 maintains robust platform-side security, you are responsible for maintaining the security of your Account credentials. You should use a strong, unique password, enable MFA if available, and never share your login details with any third party. ox368 bears no liability for unauthorized Account access resulting from your failure to secure your credentials.

9 Cookies & Tracking Technologies

9.1 What Are Cookies. Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites function correctly, to improve user experience, and to provide basic analytics information to website operators.

9.2 Cookies Used by ox368. The ox368 Platform uses the following categories of first-party cookies:

9.3 No Third-Party Advertising Cookies. ox368 does not place, or permit third parties to place, advertising tracking cookies or cross-site behavioral profiling cookies on the Platform. We do not participate in retargeting advertising networks.

9.4 Managing Cookies. You may control cookie settings through your browser's privacy settings. Blocking strictly necessary cookies may impair the function of the Platform — in particular, you will not be able to maintain a logged-in session without session cookies. Blocking analytics cookies will have no functional impact on your Platform experience.

10 Your Data Rights

As a data subject whose personal data is processed by ox368, you hold the following rights. To exercise any of these rights, please contact us using the details in Section 14. We will respond to valid requests within thirty (30) calendar days. We may need to verify your identity before processing a rights request to protect against unauthorized access to your data.

• Right of Access: You may request a copy of all personal data ox368 holds about you, together with information about how that data is used. This is sometimes called a Subject Access Request (SAR).
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing has been unlawful. Note that this right is subject to overriding legal obligations — for example, AML regulations require us to retain certain financial and identity records for a minimum period.
• Right to Restriction of Processing: You may request that ox368 restrict the processing of your data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format so you can transfer it to another service provider.
• Right to Object: You have the right to object to processing based on legitimate interests, including direct marketing. Where you object to marketing communications, ox368 will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

11 Minors & Under-21 Policy

11.1 The ox368 Platform is strictly for adults aged 21 years and over. ox368 does not knowingly collect, store, or process personal data belonging to individuals under the age of 21. Age verification is a mandatory component of the Account registration and KYC process.

11.2 If ox368 becomes aware that personal data has been collected from an individual who is under 21 years of age, we will take immediate steps to delete that data and close the associated Account. Any funds deposited by an underage Account holder will be handled in accordance with our Terms & Conditions.

11.3 ox368 supports the use of parental control software and internet filtering tools to prevent minors from accessing online gambling platforms. We recommend that guardians of minors in Indonesian households install appropriate filtering software on shared devices.

12 International Data Transfers

12.1 ox368 operates infrastructure across multiple geographic regions to ensure platform reliability and performance for Indonesian users. As a result, your personal data may be transferred to and processed in countries outside of Indonesia, including jurisdictions that host our cloud infrastructure, KYC processing services, or customer support operations.

12.2 Where personal data is transferred internationally, ox368 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. These safeguards may include contractual data processing agreements with receiving entities, compliance with the data protection requirements of the receiving jurisdiction's applicable laws, and technical safeguards such as encryption.

12.3 By registering an Account with ox368, you acknowledge and consent to the transfer of your personal data outside Indonesia as described in this section, subject to the safeguards outlined above.

13 Amendments to This Policy

13.1 ox368 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

13.2 Where changes to this Policy are material — meaning they significantly affect how your data is collected, used, or shared — ox368 will provide advance notice by displaying a prominent notice on the Platform homepage and, where reasonably practicable, by sending a notification to your registered email address.

13.3 Your continued use of the ox368 Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you should cease using the Platform and request Account closure in accordance with Section 3.4 of the Terms & Conditions.

14 Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a suspected data security incident, please contact the ox368 Data Protection team through the following channels. All contact information is provided as plain text only and is not clickable.

When contacting us regarding a data rights request, please include your registered Account username, your full name as registered on the Account, and a clear description of the right you wish to exercise or the matter you wish to raise. This will allow us to locate your records promptly and respond without unnecessary delay.