Privacy Policy

1. Introduction and Scope

1.1 About This Policy

This Privacy Policy governs the collection, processing, storage, and disclosure of personal information by ox138 (referred to as "we," "us," or "our"). It applies to all users (referred to as "you" or "your") who access our website at https://ox138.cam, create an account, or use any of our gaming services.

1.2 Data Controller

ox138 acts as the data controller for all personal information collected through our platform. We determine the purposes and means of processing your personal data in accordance with applicable data protection laws and our international gaming licenses.

1.3 Indonesian Context

As an international gaming platform serving Indonesian users, we recognize the importance of complying with Indonesian data protection principles while operating under our offshore regulatory framework. We handle Indonesian users' data with particular attention to local banking privacy requirements and cultural expectations around confidentiality.

2. Information We Collect

ox138 collects several categories of personal information necessary to provide our gaming services, ensure platform security, comply with regulatory obligations, and improve user experience.

2.1 Information You Provide Directly

When you register for an ox138 account and use our services, you provide the following information:

• Account Registration Data: Full name, date of birth, email address, phone number, residential address, username, and password.
• Identity Verification (KYC) Data: Government-issued identification documents (Indonesian KTP or other national ID), selfie photographs for facial verification, proof of address documents (utility bills or bank statements), and copies of payment method documentation.
• Financial Information: Bank account numbers (BCA, BRI, BNI, Mandiri, etc.), e-wallet account details (OVO, DANA, GoPay), transaction history, deposit amounts, withdrawal requests, and payment method verification documents.
• Communication Data: Messages sent to customer support, live chat transcripts, feedback and complaints, survey responses, and any other communications with ox138 staff.

2.2 Information Collected Automatically

When you access or use the ox138 platform, we automatically collect certain technical and usage information:

• Device Information: IP address, device type and model, operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, features accessed, games played, bets placed, time spent on platform, click patterns, navigation paths, and session duration.
• Gaming Activity: Bet history, win/loss records, game preferences, betting patterns, deposit and withdrawal activity, bonus claims and usage, and account balance changes.
• Location Data: Approximate geographic location based on IP address (we do not collect precise GPS coordinates unless explicitly permitted by you).
• Cookies and Tracking Technologies: Session cookies, preference cookies, analytics cookies, and similar tracking technologies (see Section 10 for details).

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Payment processors and banks for transaction verification and fraud prevention
• Identity verification services for KYC compliance
• Credit reference agencies for financial suitability checks (where legally permitted)
• Game providers for gameplay data and fairness monitoring
• Marketing partners (only with your explicit consent)

3. How We Use Your Information

ox138 processes your personal information for the following specific purposes:

3.1 Account Management and Service Delivery

• Creating and maintaining your user account
• Processing deposits, withdrawals, and other financial transactions
• Providing access to casino games, sports betting, live dealer tables, and other gaming products
• Managing bonuses, promotions, and loyalty program benefits
• Processing customer support requests and resolving disputes
• Communicating important account notifications and service updates

3.2 Legal and Regulatory Compliance

• Verifying your identity, age (21+ requirement), and residency status
• Complying with anti-money laundering (AML) and counter-terrorist financing (CTF) regulations
• Meeting Know Your Customer (KYC) requirements under our gaming licenses
• Detecting and preventing fraud, cheating, or other prohibited activities
• Maintaining transaction records as required by law
• Responding to legal requests from authorities or regulators

3.3 Security and Risk Management

• Detecting and preventing unauthorized account access
• Monitoring for suspicious betting patterns or fraudulent activity
• Protecting against technical vulnerabilities and cyberattacks
• Enforcing our Terms and Conditions
• Investigating potential violations or security incidents

3.4 Platform Improvement and Analytics

• Analyzing user behavior to improve platform usability
• Understanding game preferences and betting trends
• Optimizing website performance and mobile responsiveness
• Developing new features and gaming products
• Conducting statistical analysis and market research (using anonymized data)

3.5 Responsible Gaming

• Monitoring gaming behavior to identify potential problem gambling
• Implementing deposit limits, loss limits, and self-exclusion requests
• Providing responsible gaming tools and resources
• Preventing underage gambling through age verification

3.6 Marketing and Promotions (With Consent)

• Sending promotional offers, bonus notifications, and VIP rewards (only if you opt in)
• Personalizing marketing communications based on your preferences
• Conducting customer satisfaction surveys

4. Legal Basis for Processing

Under applicable data protection laws, ox138 processes your personal information based on one or more of the following legal grounds:

4.1 Contractual Necessity

Processing is necessary to fulfill our contractual obligations under the Terms and Conditions, including account creation, transaction processing, game provision, and customer support.

4.2 Legal Compliance

Processing is required to comply with legal obligations under our gaming licenses, including KYC verification, AML/CTF compliance, age verification, and regulatory reporting.

4.3 Legitimate Interests

Processing is necessary for our legitimate business interests, including fraud prevention, security monitoring, platform improvement, and business analytics, provided these interests do not override your fundamental rights.

4.4 Consent

For certain activities such as marketing communications and non-essential cookies, we rely on your explicit consent, which you may withdraw at any time.

5. Data Sharing and Third Parties

ox138 does not sell your personal information to third parties. However, we may share your data with carefully selected partners and service providers as described below:

5.1 Essential Service Providers

• Payment Processors: To process deposits and withdrawals through Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay). These providers handle transaction data under strict confidentiality agreements.
• Identity Verification Services: Third-party KYC providers verify your identity documents and conduct anti-fraud checks on our behalf.
• Game Providers: Software providers hosting casino games and live dealer tables receive limited gameplay data necessary to deliver services and ensure fairness.
• Cloud Hosting Services: Secure data centers store and process your information with industry-standard encryption and access controls.
• Customer Support Tools: Live chat platforms and ticketing systems used by our Indonesian-speaking support team to assist you.

5.2 Legal and Regulatory Disclosure

We may disclose your information to:

• Gaming regulatory authorities under our licensing jurisdiction
• Law enforcement agencies in response to valid legal requests
• Courts and legal advisors in connection with legal proceedings
• Government bodies for tax, AML, or national security purposes

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity, subject to equivalent data protection commitments.

5.4 Data Protection Standards for Third Parties

All third parties with access to your data are contractually obligated to:

• Process data only for specified purposes
• Implement appropriate security measures
• Not disclose data to unauthorized parties
• Delete or return data upon contract termination

6. International Data Transfers

As an international gaming platform, ox138 may transfer your personal information outside of Indonesia to our offshore data centers and service providers located in various jurisdictions. These transfers are conducted under appropriate safeguards:

• Adequacy Decisions: Transfers to countries recognized as providing adequate data protection
• Standard Contractual Clauses: Legally binding data protection agreements with recipients in other jurisdictions
• Security Measures: Encryption, access controls, and contractual obligations ensuring equivalent protection regardless of location

Your personal information is always protected by robust security measures regardless of where it is processed.

7. Data Security Measures

ox138 implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, loss, misuse, or alteration:

7.1 Technical Security

• Encryption: All data transmission uses 256-bit SSL/TLS encryption (the same standard as banks)
• Secure Storage: Personal data is encrypted at rest using industry-standard algorithms
• Firewall Protection: Multi-layer firewalls protect against unauthorized network access
• Intrusion Detection: 24/7 automated monitoring detects and responds to security threats
• Regular Security Audits: Independent third-party penetration testing and vulnerability assessments

7.2 Access Controls

• Role-based access restrictions ensure employees only access data necessary for their job functions
• Multi-factor authentication required for staff accessing sensitive systems
• Comprehensive audit logs track all data access and modifications
• Immediate account suspension upon detecting suspicious activity

7.3 Employee Training and Policies

• All staff receive mandatory data protection training
• Strict confidentiality agreements and non-disclosure obligations
• Clear procedures for handling personal information securely
• Disciplinary action for privacy violations

7.4 Your Security Responsibilities

While we implement robust security measures, you also play a crucial role in protecting your account:

• Use a strong, unique password and change it regularly
• Enable two-factor authentication where available
• Never share your login credentials with anyone
• Log out after each session, especially on shared devices
• Report suspected unauthorized access immediately

8. Data Retention

8.1 Retention Periods

ox138 retains your personal information only as long as necessary to fulfill the purposes for which it was collected or as required by law:

• Active Accounts: Data retained for the duration of your account plus regulatory retention periods
• Closed Accounts: Most data deleted within 90 days of voluntary account closure
• Transaction Records: Financial transaction data retained for 7 years to comply with AML regulations and tax laws
• KYC Documents: Identity verification documents retained for 7 years after account closure per regulatory requirements
• Marketing Data: Deleted or anonymized immediately upon withdrawal of consent
• Legal Hold: Data may be retained longer if subject to legal proceedings, investigations, or disputes

8.2 Anonymization

Where possible, we anonymize personal data so it can no longer identify you, allowing us to retain statistical and analytical insights without privacy implications.

9. Your Privacy Rights

Subject to applicable laws and regulatory requirements, you have the following rights regarding your personal information:

9.1 Right of Access

You may request a copy of the personal information we hold about you. We will provide this information in a commonly used electronic format within 30 days of your request.

9.2 Right to Rectification

If your personal information is inaccurate or incomplete, you may request corrections. You can update most information directly through your account settings.

9.3 Right to Erasure (Right to Be Forgotten)

You may request deletion of your personal information when:

• It is no longer necessary for the purposes for which it was collected
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds

Note: This right is subject to our legal obligations to retain certain data (e.g., transaction records for 7 years under AML laws).

9.4 Right to Restriction of Processing

You may request that we limit how we use your data in certain circumstances, such as while we verify data accuracy following your rectification request.

9.5 Right to Data Portability

You may request that we transfer your data to another service provider in a structured, machine-readable format where technically feasible.

9.6 Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we have compelling legitimate grounds.

9.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw it at any time. This will not affect the lawfulness of processing before withdrawal.

9.8 Exercising Your Rights

To exercise any of these rights, contact our Data Protection Officer at [email protected] with your request. We will respond within 30 days and may require identity verification to prevent unauthorized disclosure.

10. Cookies and Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website. They help us recognize you, remember your preferences, and improve your experience.

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for website functionality, security, and account authentication. These cannot be disabled without affecting core services.
• Performance Cookies: Collect anonymous usage statistics to help us improve platform performance and identify technical issues.
• Functionality Cookies: Remember your preferences such as language settings, timezone, and display options.
• Analytics Cookies: Help us understand how users interact with the platform, which pages are most popular, and where improvements are needed.

10.3 Managing Cookies

You can control cookies through your browser settings. However, disabling cookies may limit functionality and prevent you from using certain features. Most browsers accept cookies by default, but you can modify settings to reject or delete them.

10.4 Third-Party Tracking

We do not allow third-party advertising networks to place tracking cookies on our platform. Any third-party cookies are limited to essential service providers (e.g., payment processors, analytics tools) operating under strict data protection agreements.

11. Marketing Communications

11.1 Consent-Based Marketing

ox138 will only send you promotional emails, SMS messages, or push notifications if you explicitly opt in during registration or through your account settings. Marketing communications may include:

• Bonus offers and promotional campaigns
• VIP rewards and loyalty program updates
• New game launches and feature announcements
• Tournament invitations and special events

11.2 Unsubscribing

You may unsubscribe from marketing communications at any time by:

• Clicking the "unsubscribe" link in any promotional email
• Adjusting notification preferences in your account settings
• Contacting customer support to opt out

Even after unsubscribing from marketing, you will still receive essential account notifications (transaction confirmations, security alerts, terms updates).

12. Children's Privacy

ox138 services are strictly intended for individuals aged 21 years or older. We do not knowingly collect personal information from anyone under 21 years of age.

If we discover that we have inadvertently collected information from a person under 21:

• We will immediately delete all associated data
• The account will be permanently closed
• Any deposits will be refunded to the source payment method
• Winnings will be forfeited per our Terms and Conditions

If you believe someone under 21 has created an account, please report it immediately to [email protected].

13. Changes to This Privacy Policy

ox138 may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We may notify you via email or prominent notice on the website
• Continued use of our services after changes constitutes acceptance
• You can review the current policy at any time at https://ox138.cam/privacy-policy

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

Our Indonesian-speaking support team is available around the clock to assist with privacy-related questions and requests. All communications are handled confidentially and professionally.