Privacy Policy

1 Introduction

xera88 ("we", "us", "our", "the Company") operates the online gaming platform accessible at https://xera88.cam and serves players primarily located in Indonesia. We are committed to protecting the privacy and personal data of every individual who interacts with our platform, whether as a registered player, a prospective player browsing our public pages, or a former player whose account has been closed.

This Privacy Policy is published in accordance with internationally recognized data protection standards, including principles drawn from the General Data Protection Regulation (GDPR) and the Asia-Pacific Economic Cooperation (APEC) Privacy Framework, both of which inform our data governance practices even where they are not directly legally applicable to offshore operations serving Indonesian residents.

The Indonesian data protection landscape is evolving. Indonesia's Personal Data Protection Law (Undang-Undang Perlindungan Data Pribadi, or UU PDP), enacted in 2022, establishes national-level principles for the lawful collection and processing of personal data of Indonesian individuals. xera88 designs its data practices to align with the core principles of UU PDP — including lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability — to the extent applicable to an internationally licensed offshore operator.

If you have any questions about how xera88 handles your personal data, please contact our Data Protection contact via the details provided in Clause 15.

2 Definitions

The following terms have the meanings set out below throughout this Privacy Policy:

Data We Collect

xera88 collects the following categories of Personal Data in the course of operating the platform and providing services to players:

4 How We Collect Data

xera88 collects Personal Data through the following channels and mechanisms:

• Direct submission: Data you provide when creating an account, completing KYC, making a deposit or withdrawal request, contacting our support team, or updating your account profile.
• Automated collection: Technical Data collected automatically when you access the platform, including via cookies, web beacons, pixel tags, and server logs. See Clause 10 for full details of our cookie practices.
• Third-party verification partners: Identity and address verification data returned by our KYC verification service providers following document checks against public and commercial databases.
• Payment processors: Transaction confirmation data returned by our payment processing partners — including local bank transfer gateways and e-wallet providers such as OVO, DANA, GoPay, and ShopeePay — to confirm deposit and withdrawal status.
• Fraud detection services: Device fingerprinting and behavioral analytics data provided by our fraud prevention partners, used to identify and prevent prohibited activities as defined in our Terms & Conditions.
• Customer support transcripts: Records of your communications with our support agents via live chat, WhatsApp, and Telegram, retained for quality assurance, training, and dispute resolution purposes.

5 Purposes of Processing

xera88 processes your Personal Data only for the purposes listed below. We do not use your data for any purpose that is incompatible with those stated here without first obtaining your consent or updating this Policy.

1. Account management: Creating, maintaining, and securing your xera88 player account, including authentication and session management.
2. KYC and regulatory compliance: Verifying your identity and age (21+) in accordance with our international licence obligations and anti-money-laundering (AML) compliance requirements.
3. Payment processing: Processing deposits and withdrawals via Indonesian bank transfers and e-wallets, reconciling transactions, and resolving payment disputes.
4. Service delivery: Providing access to casino games, live dealer tables, togel (Indonesia's traditional numbers lottery) products, sports betting markets, and all other platform features.
5. Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behaviours, applying self-imposed limits, and fulfilling our duty of care obligations to players.
6. Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, collusion, and other Prohibited Activities.
7. Customer support: Responding to enquiries, resolving disputes, and improving the quality of our support services.
8. Marketing communications: Sending promotional offers, bonus notifications, and seasonal campaign messages to players who have opted in. You may opt out at any time by contacting our support team.
9. Platform improvement: Analysing aggregated, anonymized usage data to improve platform performance, game selection, and user experience.
10. Legal and regulatory obligations: Complying with applicable law, court orders, regulatory directions, and law enforcement requests.

6 Legal Basis for Processing

xera88 processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform our contractual obligations to you under the xera88 Terms & Conditions — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and our international gaming licence obligations — including KYC, AML checks, and record retention requirements.
• Legitimate interests: Processing carried out for xera88's legitimate business interests where those interests are not overridden by your rights — including fraud prevention, platform security, and anonymized analytics.
• Consent: Processing for marketing communications, non-essential cookies, and any other purpose where consent is the most appropriate basis. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

7 Data Sharing

7.1  xera88 does not sell or rent your Personal Data to third parties. We share data only in the following limited and controlled circumstances:

• Game providers: Aggregated, session-level data is shared with licensed game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) solely for the purpose of delivering game content and resolving game-round disputes.
• Payment processors: Financial Data necessary to execute deposit and withdrawal instructions is shared with our certified payment processing partners, including local Indonesian bank transfer gateways and e-wallet providers.
• KYC verification providers: Identity and address documents are shared with our contracted KYC verification partners for the sole purpose of performing identity checks.
• Fraud prevention services: Technical Data and behavioral signals are shared with our fraud detection partners to identify and prevent Prohibited Activities.
• Customer support platforms: Communication Data is processed on our contracted support platform infrastructure under binding data-processing agreements.
• Legal and regulatory authorities: Personal Data may be disclosed to law enforcement agencies, regulatory bodies, financial intelligence units, or courts where we are legally required or permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. Players will be notified of any such transfer in advance.

7.2  All third-party Data Processors engaged by xera88 are subject to written data-processing agreements that require them to process Personal Data only on documented instructions from xera88, to maintain appropriate technical and organizational security measures, and to delete or return data upon termination of the engagement.

8 International Data Transfers

8.1  xera88 operates on an internationally hosted infrastructure. As a result, your Personal Data may be transferred to and processed in countries outside Indonesia. These countries may not have data protection laws equivalent to those in Indonesia.

8.2  Where Personal Data is transferred internationally, xera88 ensures that appropriate safeguards are in place, which may include:

• Contractual clauses requiring the recipient to apply data protection standards equivalent to those described in this Policy.
• Transfers only to jurisdictions or recipients that maintain certified security and compliance programs recognised by international standards bodies.
• Anonymisation or pseudonymisation of data prior to transfer where full Personal Data is not required for the processing purpose.

8.3  By using the xera88 platform, you acknowledge and consent to the international transfer of your Personal Data as described in this clause, subject always to the protections outlined herein.

9 Data Retention

9.1  xera88 retains Personal Data for no longer than is necessary for the purposes for which it was collected, taking into account our legal, regulatory, and contractual obligations. The following default retention periods apply:

• Active account data: Retained for the duration of the account relationship plus 5 years following account closure, to meet AML record-keeping and licence compliance obligations.
• KYC documents: Retained for a minimum of 5 years following the completion of the KYC process or account closure, whichever is later, in accordance with standard AML compliance frameworks.
• Financial transaction records: Retained for 7 years following the date of the transaction.
• Customer support communications: Retained for 3 years following the date of the interaction, or longer where a dispute or investigation remains unresolved.
• Marketing opt-in records: Retained for the duration of the opt-in period plus 3 years to demonstrate compliance with consent requirements.
• Technical / log data: Retained for 12 months in rolling logs, unless retained longer in connection with a specific security investigation.

9.2  Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting data may be retained indefinitely for aggregated analytical purposes without constituting processing of Personal Data.

10 Cookies & Tracking Technologies

10.1  xera88 uses cookies and similar tracking technologies (including web beacons, local storage, and session tokens) on the platform. Cookies help us deliver a secure, personalized, and efficient experience for every player.

10.2  Types of cookies we use:

• Strictly Necessary Cookies: Essential for the operation of the platform — including authentication tokens that keep you logged in, session management cookies, and security cookies that protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language setting, preferred games, and display options, to provide a more personalized experience on return visits.
• Analytical Cookies: Collect aggregated, anonymized data about how players navigate and interact with the platform, helping us identify areas for improvement. We use privacy-respecting analytics tools that do not share raw player data with third parties.
• Marketing Cookies: Used only where you have consented, to track the effectiveness of our promotional campaigns and to present relevant bonus offers. You may opt out of marketing cookies at any time via your account settings or by contacting support.

10.3  Most web browsers are configured to accept cookies by default. You may configure your browser to refuse all cookies or to alert you when cookies are being set. However, disabling strictly necessary cookies will prevent you from logging in and using the xera88 platform.

11 Your Data Rights

As a Data Subject, you hold the following rights in relation to the Personal Data that xera88 holds about you. To exercise any of these rights, contact our support team using the details in Clause 15. We will respond to all verified requests within 30 days.

12 Security Measures

12.1  xera88 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive Personal Data stored at rest in our databases.
• PCI DSS Level 1 certified payment gateway integration — full card numbers are never stored on xera88 systems.
• Multi-factor authentication (MFA) options for player accounts, strongly recommended for all users.
• Role-based access controls limiting internal employee access to player data on a strict need-to-know basis.
• Regular third-party penetration testing and vulnerability assessments of our platform infrastructure.
• 24/7 automated intrusion detection and security event monitoring.
• Formal data breach response procedures with defined escalation paths and notification timelines.

12.2  In the event of a data breach that is likely to result in a high risk to the rights and freedoms of affected players, xera88 will notify impacted individuals without undue delay via the email address registered to their account, and will take all reasonable steps to contain and remediate the breach.

12.3  While xera88 takes data security extremely seriously, no internet-based system can guarantee absolute security. You are responsible for keeping your own login credentials confidential and for notifying us immediately if you suspect unauthorized access to your account.

13 Minors & Age Restriction

13.1  The xera88 platform is strictly for adults aged 21 years or older. We do not knowingly collect or process the Personal Data of individuals under the age of 21. Age verification is a mandatory component of our KYC process, and any account found to belong to an underage individual will be closed immediately, with all funds returned to the originating payment method.

13.2  If you are a parent or guardian and believe that a minor in your care has registered an account on xera88, please contact our support team immediately at [email protected]. We will investigate and, if confirmed, close the account and delete all associated Personal Data within 72 hours of verification.

13.3  xera88 does not direct any marketing communications toward individuals who have identified themselves as under 21, and we do not knowingly display advertising on platforms or channels whose primary audience is minors.

14 Changes to This Policy

14.1  xera88 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform services. The "Last Updated" date at the top of this page will be revised whenever a change is made.

14.2  Where changes are material — meaning they significantly affect how we collect, use, or share your Personal Data — we will provide at least 14 days' advance notice to registered players via email before the revised Policy takes effect. For minor, non-material changes (such as clarifications of existing practices), we may update the Policy immediately without prior notice.

14.3  Your continued use of the xera88 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any change, you must stop using the platform and close your account before the revised Policy takes effect.

14.4  We recommend that you review this Privacy Policy periodically to stay informed of any updates. Previous versions of the Policy are available upon request from our support team.

15 Contact & Complaints

15.1  If you have any questions, concerns, or requests relating to this Privacy Policy or the way xera88 processes your Personal Data, please contact our support team through any of the following channels. Our team is available 24 hours a day, 7 days a week, in both English and Bahasa Indonesia.

• Live Chat: Available directly on the xera88 platform — average first response under 60 seconds.
• WhatsApp: Contact details provided upon account registration.
• Telegram: Contact details provided upon account registration.
• Email: [email protected] (plain text only — not a clickable link; please copy and paste into your email client). Responses within 4 hours during operational hours.

15.2  Formal privacy complaints: If you are not satisfied with our response to a privacy concern, you may escalate your complaint to our Customer Relations team by requesting a formal escalation through any of the channels above. All formal privacy complaints are acknowledged within 24 hours and fully investigated within 14 business days.

15.3  Indonesian players who remain dissatisfied following our internal complaints process may have the right to lodge a complaint with the relevant national data protection authority in Indonesia in accordance with the provisions of UU PDP (Indonesia's Personal Data Protection Law). xera88 will cooperate fully with any such authority in the course of a legitimate investigation.