Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") is issued by XO368 (hereinafter referred to as "XO368", "we", "us", or "our") and governs the collection, processing, storage, and disclosure of personal data relating to individuals (hereinafter referred to as "Members", "Users", or "you") who access or use the XO368 online gaming platform at xo368.lat and any associated subdomains or mobile applications (collectively, the "Platform").

XO368 is committed to protecting the privacy and personal data of all Members in accordance with internationally recognised data protection principles. We process personal data only where we have a lawful basis to do so, and we take all reasonable technical and organisational measures to ensure that such data is kept secure and used only for the purposes described in this Policy.

This Policy should be read alongside our Terms & Conditions, which are incorporated by reference. By registering for an Account on the Platform or by continuing to use the Platform, you acknowledge that you have read, understood, and agree to the terms of this Policy. If you do not agree, please discontinue your use of the Platform immediately.

For the purposes of this Policy, the following terms shall carry the meanings set out below. Undefined terms carry their ordinary meaning in the context of data protection and online services.

XO368 collects the following categories of Personal Data from Members and prospective Members. We collect only the minimum data necessary for each specified purpose, in accordance with the principle of data minimisation.

XO368 does not intentionally collect Sensitive Data beyond what is required for KYC compliance and payment processing. Members based in Malaysia submitting their MyKad (National Registration Identity Card) during KYC should note that the identification number on this document is treated as Sensitive Data and is stored with elevated security controls.

XO368 collects Personal Data through the following channels and mechanisms:

• Direct Collection — Registration: When you create an Account on the Platform, you provide your name, contact details, date of birth, and preferred payment method.
• Direct Collection — KYC Verification: When you submit identity documents to complete the Know Your Customer process prior to initiating withdrawals.
• Direct Collection — Customer Support: When you contact our support team via live chat or email, the content of those communications is recorded and retained.
• Direct Collection — Transactions: When you make a deposit or withdrawal via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or any other supported payment channel, transaction data is logged.
• Automated Collection — Platform Usage: Technical and usage data is collected automatically when you access the Platform, including IP address, device information, and session behaviour.
• Automated Collection — Cookies: The Platform uses cookies and similar tracking technologies to maintain session state, remember preferences, and collect analytics data. See Section 10 for full details.
• Third-Party Sources: XO368 may receive limited data from third-party identity verification services, payment processors, and fraud prevention providers engaged to support the operation of the Platform.

XO368 processes Personal Data for the following specific, documented purposes. We do not process Personal Data for any purpose that is incompatible with the purposes described below without first obtaining your consent or establishing a separate lawful basis.

• Account Administration: Creating, managing, verifying, and maintaining your Member Account on the Platform.
• KYC and Age Verification: Confirming that you are aged 21 or above and verifying your identity in accordance with our legal and regulatory obligations.
• Payment Processing: Processing deposits and withdrawals via supported Malaysian and international payment channels, including reconciliation and dispute resolution.
• Game and Betting Operations: Facilitating your participation in casino games, sports betting, live football markets, and other Platform activities.
• Fraud Prevention and AML: Monitoring transactions and account activity to detect, prevent, and report fraud, money laundering, and other financial crimes in accordance with applicable anti-money-laundering laws.
• Responsible Gambling Compliance: Monitoring betting patterns and account activity to identify potential signs of problem gambling and to enforce self-exclusion, deposit limit, and cooling-off arrangements.
• Customer Support: Responding to enquiries, resolving disputes, and providing technical assistance to Members.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve the design, functionality, and performance of the Platform.
• Marketing Communications: Where you have provided your explicit consent, sending promotional offers, bonus notifications, and news about the Platform. You may withdraw consent at any time.
• Legal Compliance: Fulfilling obligations under applicable laws, responding to lawful requests from regulatory authorities, and exercising or defending legal claims.

Each processing activity carried out by XO368 is grounded in at least one of the following recognised legal bases:

• Contractual Necessity: Processing required to perform the contract between XO368 and you — including Account creation, payment processing, and the provision of gaming services.
• Legal Obligation: Processing required to comply with applicable laws, including KYC obligations, anti-money-laundering regulations, and responsible gambling requirements.
• Legitimate Interests: Processing carried out in the legitimate interests of XO368 — including fraud prevention, platform security, analytics, and business continuity — where such interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily in the context of optional marketing communications.

XO368 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. We share Personal Data only in the following circumstances:

• Payment Processors: We share necessary financial and identity data with payment processors and gateway providers — including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, and Public Bank transactions — to complete deposits and withdrawals.
• Identity Verification Providers: We engage third-party KYC verification services to validate identity documents submitted during account verification. These providers process data strictly on our behalf under contractual data protection obligations.
• Fraud Prevention and AML Services: We share relevant transaction and identity data with fraud screening and anti-money-laundering service providers to meet our regulatory obligations.
• Game and Software Providers: Game outcomes, betting data, and limited technical information may be shared with our game software providers for the purposes of game operation, dispute resolution, and technical support.
• Regulatory and Law Enforcement Authorities: We disclose Personal Data to competent authorities where required to do so by applicable law, court order, regulatory directive, or in connection with the investigation of illegal activity.
• Corporate Transactions: In the event of a merger, acquisition, or sale of business assets, Member data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third-party Data Processors engaged by XO368 are bound by contractual obligations to process data only on our documented instructions, to maintain appropriate security standards, and to prohibit any further disclosure without our written authorisation.

XO368 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. Our general data retention principles are as follows:

• Active Account Data: Retained for the duration of your Account's active status on the Platform.
• KYC Documents: Retained for a minimum of five (5) years following Account closure, in compliance with applicable anti-money-laundering and financial record-keeping regulations.
• Transaction Records: Financial transaction records are retained for a minimum of five (5) years following the date of the relevant transaction.
• Gaming History: Bet and gaming session records are retained for a minimum of three (3) years following Account closure.
• Customer Support Records: Communications with our support team are retained for a minimum of two (2) years.
• Marketing Consent Records: Records of consent and opt-out actions are retained for the duration of the relationship and for a reasonable period thereafter as evidence of compliance.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our internal data disposal procedures.

XO368 implements a comprehensive suite of technical and organisational security measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at Rest: Personal Data and KYC documents stored on our servers are encrypted at rest using industry-standard algorithms.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Internal staff access is governed by role-based permissions and multi-factor authentication.
• Infrastructure Security: Our platform infrastructure is hosted in data centres that maintain industry-standard physical and cyber security controls, including intrusion detection and prevention systems.
• Regular Security Audits: We conduct periodic security assessments and vulnerability testing to identify and remediate potential weaknesses.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected Members and relevant authorities in a timely manner.

XO368 uses cookies and similar tracking technologies on the Platform to deliver core functionality, improve the user experience, and gather aggregated analytics. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential to the operation of the Platform — including session management, authentication, and security. They cannot be disabled without impairing core Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as language settings, game preferences, and display options — to provide a personalised experience across sessions.
• Analytics Cookies: These cookies collect aggregated, anonymised data about how Members use the Platform — including pages visited, time spent, and navigation paths — to help us improve the Platform.
• Performance Cookies: These cookies help us monitor and optimise Platform performance, including load times and error detection.

You may manage your cookie preferences through your browser settings. Most modern browsers allow you to refuse non-essential cookies, delete existing cookies, or receive notifications when cookies are set. Please note that disabling strictly necessary cookies will impair your ability to use core Platform features including login and payment processing.

XO368 does not use cookies to serve third-party advertising or to track Members across websites other than xo368.lat.

As a Member of XO368, you hold the following rights with respect to your Personal Data. XO368 is committed to facilitating the exercise of these rights in a timely and transparent manner. To submit a rights request, please contact us at [email protected] with the subject line "Data Rights Request" along with your registered Account details.

We will respond to all verified rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further two months, in which case we will notify you of the extension and the reasons for it. We may request proof of identity before processing any rights request.

Please note that certain rights are subject to limitations. For example, the right to erasure does not apply where data must be retained to comply with a legal obligation — such as KYC and AML record-keeping requirements — or where data is required for the establishment, exercise, or defence of legal claims.

The XO368 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21. Age verification is a mandatory step in the Account registration and KYC process.

If XO368 becomes aware that Personal Data has been collected from a person under the age of 21, we will take immediate steps to delete such data, close the associated Account, and forfeit any associated funds in accordance with our Terms & Conditions. If you are a parent or guardian and have reason to believe that a person under 21 has registered on the Platform, please contact us immediately at [email protected].

The Platform may contain references to third-party services, payment providers, or game software vendors. Where such third parties operate their own websites or platforms, their respective privacy policies — not this Policy — govern the collection and use of your data on those platforms. XO368 has no control over and accepts no responsibility for the privacy practices of third-party operators.

We encourage Members to review the privacy policies of any third-party service providers they interact with in connection with their use of the Platform, including payment providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, Maybank, CIMB, and Public Bank.

XO368 reserves the right to revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we provide. When we make material changes to this Policy, we will update the "Last Updated" date at the top of this page and, where appropriate, notify active Members via their registered email address.

It is your responsibility to review this Policy periodically. Your continued use of the Platform following publication of a revised Policy constitutes your acceptance of the updated terms. If you do not accept a revised Policy, you must cease using the Platform and contact us to request Account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which XO368 processes your Personal Data, please contact our data support team using the details below. We are committed to addressing all privacy enquiries promptly and transparently.

We aim to respond to all privacy-related enquiries within 30 calendar days. For verified data rights requests, we will acknowledge receipt within 5 business days and provide a substantive response within the 30-day statutory period.