Privacy Policy — xlbola Platform

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

xlbola collects the following categories of personal data from players. We collect only the data that is necessary for the legitimate purposes described in this Privacy Policy.

xlbola does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is contained in identity documents submitted for KYC purposes.

xlbola collects personal data through the following mechanisms:

• Direct Collection: Information you provide when completing the account registration form, submitting KYC documents, making deposits or withdrawals, contacting customer support, or responding to surveys and promotional communications.
• Automated Collection: Technical data collected automatically when you access the xlbola platform, including through cookies, web beacons, log files, and session tracking tools. This data is used for security monitoring, fraud prevention, and platform performance optimisation.
• Third-Party Sources: xlbola may receive data about you from payment processors (such as local Indonesian bank networks), fraud detection and identity verification services, and, where applicable, publicly available sources for enhanced due diligence purposes.
• Platform Interactions: Data generated through your betting and gaming activity, including bet placement records, game session logs, bonus opt-in events, and navigation patterns within the xlbola platform.

xlbola processes your personal data for the following specific, explicit, and legitimate purposes:

• Account Management: Creating, maintaining, and managing your xlbola account, including authentication and password recovery;
• Identity Verification (KYC): Confirming your identity, age (21+), and eligibility to use the platform, as required by our licensing obligations and responsible gaming commitments;
• Payment Processing: Processing deposits and withdrawals in IDR through your nominated Indonesian bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Service Delivery: Providing access to sportsbook markets, casino games, togel (Indonesia's traditional numbers lottery) markets, and all other platform features;
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions;
• Responsible Gaming: Monitoring betting patterns to identify potential problem gambling behaviour and administering player-requested protection tools such as deposit limits, cooling-off periods, and self-exclusion;
• Customer Support: Responding to your enquiries, resolving disputes, and providing assistance with account issues;
• Legal Compliance: Meeting our obligations under applicable anti-money laundering, data protection, and licensing regulations;
• Marketing Communications: Sending you promotional offers, bonus announcements, and platform updates — only where you have provided explicit consent or where we have a legitimate interest in keeping you informed of relevant offers. You may opt out of marketing communications at any time by contacting support;
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, user experience, and game content selection.

xlbola will not use your personal data for any purpose that is incompatible with those listed above without first obtaining your explicit consent or establishing a new lawful basis for processing.

xlbola processes your personal data on the following legal grounds, depending on the specific processing activity involved:

xlbola may share your personal data with the following categories of third parties:

• Payment Processors and Banking Partners: Indonesian bank networks and e-wallet providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) require your name and account details to facilitate deposits and withdrawals in IDR;
• Identity Verification Services: Third-party KYC and anti-money laundering service providers used to verify the authenticity of identity documents and confirm player eligibility;
• Game Content Providers: Licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised session data for game integrity and certification purposes;
• Fraud Prevention and Security Services: Specialist providers who assist xlbola in detecting suspicious activity, preventing account takeover, and monitoring for bonus abuse patterns;
• Customer Support Tools: Third-party live chat and ticketing platforms used to manage support communications — these providers process data on xlbola's behalf under strict data processing agreements;
• Regulatory and Law Enforcement Authorities: xlbola may disclose personal data to competent authorities where required by law, court order, or regulatory request. We will notify you of such disclosures where legally permitted to do so;
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of xlbola's business assets, player data may be transferred to the acquiring entity, provided that the acquiring entity agrees to uphold the protections described in this Privacy Policy.

All third parties with whom xlbola shares personal data are required to process that data in accordance with applicable data protection laws and solely for the purposes for which it was shared.

xlbola uses cookies and similar tracking technologies to operate the platform, enhance your experience, and gather analytical data. A cookie is a small text file placed on your device when you visit the xlbola platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for core platform functionality — including session authentication, account login state, bet slip management, and security features. These cookies cannot be disabled without impairing the platform's basic operation;
• Performance and Analytics Cookies: Used to collect anonymised information about how players navigate the platform — including pages visited, time on site, and error events. This data helps xlbola identify and resolve technical issues and optimise the user experience;
• Functionality Cookies: Store your preferences such as language display, preferred deposit method, and odds format (e.g., decimal, Malay, or Hong Kong odds). These cookies are not essential but significantly improve usability;
• Targeting and Marketing Cookies: Used to deliver relevant promotional content and to measure the effectiveness of xlbola's marketing activities. These cookies are only placed where you have provided consent.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the xlbola platform. For all other cookie categories, you may opt out without materially affecting core platform functionality. Note that some third-party game providers and payment processors embedded within the platform may set their own cookies, which are governed by their respective privacy policies.

xlbola retains your personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal, regulatory, and contractual obligations. The following retention periods apply as a general guide:

When personal data is no longer required for any of the above purposes and no legal obligation requires its further retention, xlbola will securely delete or anonymise it using industry-standard data destruction methods.

Our security infrastructure includes the following measures:

• Encryption: All data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest — including financial details and identity documents — is encrypted using AES-256 encryption;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. xlbola staff are granted the minimum level of data access required to perform their job function. All access is logged and audited;
• Two-Factor Authentication: xlbola recommends and supports two-factor authentication (2FA) for player accounts to provide an additional layer of login security;
• Penetration Testing: xlbola's platform undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited;
• Incident Response: xlbola maintains a formal data breach response procedure. In the event of a data breach that poses a risk to your rights, xlbola will notify affected players and relevant authorities in accordance with applicable law and within the required notification timeframes;
• Staff Training: All xlbola personnel who handle personal data receive mandatory data protection training and are bound by confidentiality obligations.

While xlbola takes all reasonable steps to protect your personal data, no security system is completely impenetrable. Players are responsible for maintaining the confidentiality of their own account credentials and for notifying xlbola immediately of any suspected unauthorised account access.

As a player on the xlbola platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request". xlbola will respond to all valid requests within 30 calendar days.

Please note that some rights are subject to limitations under applicable law. For example, xlbola cannot erase financial transaction records that we are legally obliged to retain. Where a right cannot be fully exercised, xlbola will explain the reason in its response to your request.

xlbola operates as an internationally licensed platform and may store or process your personal data on servers located outside Indonesia. Where personal data is transferred to a country that does not provide a level of data protection equivalent to that afforded under applicable Indonesian law, xlbola will implement appropriate safeguards to ensure your data remains protected. These safeguards may include:

• Standard contractual clauses approved by a competent data protection authority;
• Binding corporate rules where the transfer is within a corporate group;
• Certification schemes or approved codes of conduct recognised by the relevant data protection authority;
• Your explicit consent to the transfer, where other safeguards are not available or practical.

By registering an account on xlbola, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Indonesia as described in this section. xlbola will always ensure that such transfers comply with applicable data protection requirements and that your data is afforded a consistent level of protection regardless of where it is processed.

If you have reason to believe that a minor has registered an account on xlbola or has submitted personal data to the platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action. Parents and guardians are encouraged to make use of parental control software and to monitor their children's internet activity to prevent access to online gambling platforms.

xlbola reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. When material changes are made — meaning changes that significantly affect how we collect, use, or share your personal data — we will notify you by publishing the revised policy on this page and, where practicable, by sending a notification to your registered email address at least 7 calendar days before the changes take effect.

The "Last Updated" date at the top of this page indicates when this Privacy Policy was most recently revised. Your continued use of the xlbola platform after any amendment takes effect constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically to stay informed of any changes. If you have concerns about an amendment, please contact our support team before the effective date.

If you have any questions, concerns, or complaints regarding this Privacy Policy or xlbola's data processing practices, or if you wish to exercise any of your data rights, please contact our dedicated Data Protection team using the details below:

Where you are not satisfied with xlbola's response to a privacy complaint, you may have the right to lodge a complaint with the competent data protection authority in the jurisdiction applicable to your situation. xlbola encourages players to contact us directly in the first instance, as we are committed to resolving all privacy concerns promptly and in good faith.