Privacy Policy

1. Introduction

This Privacy Policy applies to all personal data collected by oxloto through our website (https://oxloto.cam), mobile applications, customer support channels, and any other services we provide (collectively, "Services"). oxloto operates as an international online betting platform serving customers across Southeast Asia, with a particular focus on the Indonesian market.

We understand that privacy is a fundamental right, especially when dealing with financial transactions and personal information. This policy outlines our commitment to safeguarding your data in accordance with international best practices and applicable data protection regulations, including principles derived from the General Data Protection Regulation (GDPR) and other relevant frameworks.

By creating an account with oxloto, making deposits, placing bets, or otherwise using our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein.

2. Information We Collect

2.1 Information You Provide Directly

When you register for an oxloto account or use our Services, we collect the following categories of personal information that you provide directly:

• Identity Information: Full legal name, date of birth, gender, nationality, and government-issued identification number (e.g., KTP Indonesia / National ID card number).
• Contact Information: Email address, mobile phone number, and residential address (street, city, postal code, province).
• Account Credentials: Username, password (stored in encrypted form), and security questions/answers.
• Financial Information: Payment method details including bank account names and numbers (for BCA, BRI, BNI, Mandiri, and other Indonesian banks), e-wallet account information (OVO, DANA, GoPay), and transaction history.
• Verification Documents: Copies of government-issued ID, proof of address documents (utility bills, bank statements), and selfie photographs (for KYC verification purposes).
• Communication Records: Content of your communications with oxloto customer support, including live chat transcripts, emails, and WhatsApp messages.
• Marketing Preferences: Your consent choices regarding promotional communications and marketing materials.

2.2 Information Collected Automatically

When you access or use oxloto Services, we automatically collect certain technical and usage information:

• Device Information: Device type, operating system, browser type and version, screen resolution, device identifiers (IMEI, device ID), and mobile network information.
• Connection Information: IP address, internet service provider, connection type, time zone setting, and geographic location (country, city level).
• Usage Data: Pages visited, features used, bets placed, games played, session duration, navigation paths, timestamps, referral sources, and interaction patterns.
• Transaction Data: Deposit amounts, withdrawal requests, bet history, win/loss records, bonus claims, and payment processing statuses.
• Cookies and Similar Technologies: Data collected through cookies, web beacons, pixel tags, and similar tracking technologies (see Section 5 for details).

2.3 Information from Third Parties

In limited circumstances, we may receive information about you from third-party sources, including:

• Payment Processors: Transaction verification data from banks and payment service providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) to confirm deposits and process withdrawals.
• Identity Verification Services: Age verification and identity authentication results from third-party KYC service providers (no raw identity documents are shared, only verification status).
• Game Providers: Gameplay data, bet outcomes, and technical performance metrics from our partnered game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, etc.).
• Fraud Prevention Services: Risk assessment scores and fraud indicators from specialized security vendors to protect against fraudulent accounts and transactions.

3. How We Use Your Information

oxloto uses your personal information for the following legitimate business purposes:

3.1 Account Management and Service Delivery

• Creating and maintaining your oxloto account
• Processing your deposits, withdrawals, and bet transactions
• Verifying your identity and age (21+ requirement) through KYC procedures
• Providing access to sports betting, live casino, slots, togel lottery draws, and other gambling products
• Managing your bonus balances, loyalty rewards, and promotional offers
• Communicating with you about your account, transactions, and service updates

3.2 Legal and Regulatory Compliance

• Complying with international gaming regulations and licensing requirements
• Conducting anti-money laundering (AML) checks and Know Your Customer (KYC) verification
• Preventing underage gambling and enforcing 21+ age restrictions
• Responding to legal requests, court orders, and regulatory inquiries
• Maintaining records required by applicable gambling laws

3.3 Security and Fraud Prevention

• Detecting and preventing fraudulent transactions, bonus abuse, and multi-accounting
• Monitoring for suspicious activity and unusual betting patterns
• Protecting against security threats, unauthorized access, and data breaches
• Enforcing our Terms and Conditions and investigating policy violations

3.4 Service Improvement and Analytics

• Analyzing usage patterns to improve platform performance and user experience
• Conducting A/B testing and feature optimization
• Understanding player preferences to enhance game selection and betting markets
• Generating aggregated, anonymized statistics for business intelligence (no personally identifiable information in reports)

3.5 Marketing and Communications (With Your Consent)

• Sending promotional emails about bonuses, new games, and special offers (only if you opted in)
• Displaying personalized content and recommendations based on your betting preferences
• Notifying you about relevant sports events, togel draw schedules, and jackpot updates
• Conducting surveys and requesting feedback to improve our services

You can opt out of marketing communications at any time by clicking "unsubscribe" in our emails or adjusting your preferences in your account settings.

3.6 Customer Support

• Responding to your inquiries via live chat, email, WhatsApp, and in-app messaging
• Troubleshooting technical issues and resolving disputes
• Providing assistance with deposits, withdrawals, and account verification
• Training our support team to improve service quality

4. How We Share Your Information

oxloto does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your data with the following categories of recipients in limited circumstances:

4.1 Service Providers and Business Partners

We share necessary information with trusted third-party service providers who assist us in operating oxloto, including:

• Payment Processors: Banks and payment service providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) to process deposits and withdrawals. We share only the minimum information required to complete transactions (account holder name, account number, transaction amount).
• Game Providers: Licensed casino and slot game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming) to deliver gaming content. They may collect gameplay data but do not receive your full personal profile.
• KYC Verification Services: Third-party identity verification platforms to confirm your age and identity. We share identification documents and personal details only for verification purposes.
• Hosting and Infrastructure: Cloud hosting providers and server management companies to maintain our platform infrastructure (data is encrypted at rest and in transit).
• Customer Support Tools: Live chat software and support ticketing systems to manage customer communications.
• Analytics Providers: Web analytics services to understand user behavior (data is anonymized wherever possible).

All service providers are contractually obligated to protect your data and use it only for the purposes we specify. They are not permitted to use your information for their own purposes or share it with others without our authorization.

4.2 Legal and Regulatory Authorities

We may disclose your information to government authorities, law enforcement, regulators, or courts when required by law or when we believe disclosure is necessary to:

• Comply with legal obligations, court orders, subpoenas, or regulatory requests
• Enforce our Terms and Conditions or investigate violations
• Protect the rights, property, or safety of oxloto, our users, or the public
• Detect, prevent, or address fraud, security issues, or illegal activity
• Cooperate with anti-money laundering investigations

4.3 Business Transfers

In the event that oxloto undergoes a business transition such as a merger, acquisition, sale of assets, or bankruptcy, your personal information may be transferred to the successor organization as part of the transaction. We will notify you via email and/or prominent notice on our website before your information becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information with third parties for purposes not described in this Privacy Policy if we obtain your explicit consent to do so.

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files stored on your device by websites you visit. oxloto uses cookies and similar tracking technologies (web beacons, pixel tags, local storage) to enhance your experience, analyze usage, and deliver personalized content.

5.2 Types of Cookies We Use

• Essential Cookies: Required for basic platform functionality such as logging in, maintaining your session, and processing transactions. These cannot be disabled without affecting core features.
• Performance Cookies: Collect anonymous data about how visitors use oxloto (pages visited, time spent, error messages) to help us improve performance and user experience.
• Functionality Cookies: Remember your preferences (language, currency, display settings) to provide a more personalized experience.
• Targeting/Advertising Cookies: Track your browsing behavior to deliver relevant promotional content and measure marketing campaign effectiveness. These are only used if you consent.

5.3 Managing Cookies

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies if you prefer. However, disabling cookies may limit your ability to use certain oxloto features. To manage cookies:

• Browser Settings: Adjust your browser's privacy settings to block or delete cookies. Instructions vary by browser (Chrome, Firefox, Safari, Edge).
• Opt-Out Tools: Use industry opt-out tools such as the Network Advertising Initiative (NAI) or Digital Advertising Alliance (DAA) to opt out of targeted advertising cookies.
• oxloto Cookie Preferences: Manage your cookie preferences through your account settings (available after login).

5.4 Third-Party Cookies

Some cookies on oxloto are placed by third-party service providers (game studios, analytics providers, payment processors). These third parties have their own privacy policies governing how they use cookies and collected data. We recommend reviewing their policies if you have concerns about third-party tracking.

6. Data Security Measures

oxloto takes data security seriously and employs multiple layers of protection to safeguard your personal information:

6.1 Encryption

• SSL/TLS Encryption: All data transmitted between your device and oxloto servers is encrypted using 256-bit SSL (Secure Sockets Layer) / TLS (Transport Layer Security) protocols. This prevents interception during transmission.
• Database Encryption: Sensitive data stored in our databases (passwords, financial information, identification documents) is encrypted at rest using industry-standard encryption algorithms.

6.2 Access Controls

• Role-Based Access: Access to personal data is restricted to authorized oxloto personnel who require it to perform their job duties. Access levels are assigned based on the principle of least privilege.
• Authentication: Employees accessing sensitive systems must authenticate using strong passwords and, where applicable, multi-factor authentication (MFA).
• Audit Logs: All access to personal data is logged and monitored for unauthorized or suspicious activity.

6.3 Infrastructure Security

• Secure Servers: Your data is stored on secure servers located in data centers with 24/7 physical security, fire suppression systems, and redundant power supplies.
• Firewalls: Network firewalls protect our servers from unauthorized access and cyberattacks.
• Regular Backups: Data is backed up regularly to prevent loss due to hardware failure or disasters. Backups are also encrypted and stored securely.

6.4 Security Monitoring and Incident Response

• Intrusion Detection: Automated systems monitor for signs of security breaches, malware, and suspicious activity.
• Vulnerability Scanning: Our platform undergoes regular security assessments and penetration testing by independent cybersecurity experts.
• Incident Response Plan: In the event of a data breach, we have a documented incident response plan to contain the breach, assess the impact, notify affected users, and implement corrective measures.

7. Data Retention

oxloto retains your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal, regulatory, and business requirements.

7.1 Active Accounts

While your oxloto account is active, we retain all personal information, transaction history, and account records to provide ongoing services, process bets and withdrawals, and maintain compliance with gaming regulations.

7.2 Closed Accounts

If you close your account (either voluntarily or due to account termination by oxloto), we will continue to retain certain information for the following periods:

• Identity and KYC Documents: Retained for 7 years after account closure to comply with anti-money laundering regulations and licensing requirements.
• Transaction Records: Retained for 7 years to satisfy financial record-keeping obligations and enable dispute resolution.
• Communication Logs: Retained for 3 years to support customer service quality assurance and resolve complaints.
• Marketing Preferences: Retained indefinitely (or until you request deletion) to honor your opt-out preferences and prevent unwanted communications.

7.3 Legal Obligations

In some cases, we may be required to retain data for longer periods to comply with legal obligations, respond to lawsuits, enforce agreements, or defend legal claims. Data subject to legal holds will be retained until the matter is resolved.

7.4 Anonymization

After the required retention period expires, we will either delete your personal information or anonymize it so that it can no longer be linked to you. Anonymized data may be retained indefinitely for statistical analysis and business intelligence purposes.

8. Your Privacy Rights

oxloto respects your rights regarding your personal information. Depending on your location, you may have the following rights under applicable data protection laws:

8.1 Right to Access

You have the right to request a copy of the personal information we hold about you. We will provide this information in a commonly used electronic format within 30 days of your request. You can request access by contacting customer support.

8.2 Right to Rectification

If any of your personal information is inaccurate or incomplete, you have the right to request that we correct or update it. You can update most information directly through your account settings, or contact support for assistance.

8.3 Right to Erasure (Right to Be Forgotten)

You may request that we delete your personal information under certain circumstances, such as when the data is no longer necessary for the purposes it was collected, you withdraw consent, or the data was processed unlawfully. However, we may be required to retain some information to comply with legal obligations (e.g., 7-year retention for financial records).

8.4 Right to Restriction of Processing

You have the right to request that we limit how we use your personal information in certain situations, such as when you contest the accuracy of the data or object to processing while we investigate your concerns.

8.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format and transmit it to another service provider without hindrance from oxloto.

8.6 Right to Object

You have the right to object to certain types of processing, including direct marketing (you can opt out at any time) and processing based on legitimate interests (we will cease unless we demonstrate compelling legitimate grounds).

8.7 Right to Withdraw Consent

Where we process your data based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

8.8 How to Exercise Your Rights

To exercise any of the above rights, please contact us using the contact information in Section 12. We will respond to your request within 30 days. To protect your privacy, we may ask you to verify your identity before processing requests related to your personal information.

9. Indonesia-Specific Context

oxloto serves customers in Indonesia and recognizes the unique privacy considerations for Indonesian users:

9.1 Local Payment Data

We process payment information from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja). This data is transmitted securely to the respective financial institutions and is not stored in full by oxloto (we retain only anonymized transaction records and last-four-digits for reference).

9.2 Indonesian Rupiah Transactions

All financial transactions are processed in Indonesian Rupiah (IDR). Currency exchange is not required, and we do not share your financial information with international currency conversion services.

9.3 Indonesian Language Support

While oxloto's public-facing content is presented in English to serve an international audience, our customer support team speaks Bahasa Indonesia fluently and can assist with privacy-related inquiries in Indonesian. Communication records may be maintained in both English and Indonesian.

9.4 Age Verification for Indonesian Users

Indonesian law requires that online gambling participants be at least 21 years of age. oxloto verifies age using Indonesian government-issued identification (KTP Indonesia / National ID card) through our KYC process. We do not knowingly collect or process data from individuals under 21.

10. Children's Privacy

oxloto services are intended exclusively for adults aged 21 years and older. We do not knowingly collect personal information from individuals under the age of 21, and we do not target our marketing or services to minors.

If we become aware that we have inadvertently collected personal information from a person under 21 years of age, we will take immediate steps to delete that information from our systems and terminate the associated account. Parents or guardians who believe we may have collected information from a minor should contact us immediately at the address provided in Section 12.

Our age verification process during account registration and KYC review is designed to prevent underage users from accessing oxloto services. Providing false information about your age is a serious violation of our Terms and Conditions and may result in legal consequences.

11. Changes to This Privacy Policy

oxloto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will notify you by:

• Updating the "Last Updated" date at the top of this policy
• Sending an email notification to the address associated with your account (for significant changes)
• Displaying a prominent notice on our website or in your account dashboard

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of oxloto services after any changes become effective constitutes your acceptance of the revised Privacy Policy.

If you do not agree with any changes to this Privacy Policy, you should discontinue using our services and close your account by contacting customer support.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or how oxloto handles your personal information, please contact us through the following channels:

• Email: [email protected] (mark your email subject as "Privacy Inquiry" for faster routing)
• Live Chat: Available 24/7 via the chat widget on our website
• WhatsApp: +62 812 3456 7890 (8 AM - 12 AM WIB)
• In-App Messaging: Send a message through your account dashboard

For data protection-specific requests (access, deletion, portability), please include "Data Subject Request" in your message subject line and provide sufficient information to verify your identity. We will respond to your request within 30 days.

Our customer support agents are trained to handle privacy inquiries and can escalate your request to our data protection team if necessary. All communications regarding privacy matters are handled confidentially.