Privacy Policy — oxl100

Throughout this Privacy Policy, the following terms carry the meanings assigned to them below:

• "oxl100" / "the Company" / "we" / "us" / "our" — the operator of the oxl100 online gaming platform accessible at https://oxl100.bet, including its parent company, subsidiaries, and affiliated entities.
• "Platform" — the oxl100 website at https://oxl100.bet, any mobile-optimised version thereof, and all services, products, and features accessible through it.
• "Member" / "you" / "your" — any individual who has registered an account on the Platform or who interacts with the Platform as a visitor without a registered account.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, email address, phone number, device identifiers, IP address, payment details, and KYC documentation.
• "Sensitive Personal Data" — a subset of Personal Data that warrants heightened protection, including government-issued identity document numbers (KTP), financial account details, and data relating to health or gambling behaviour patterns.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, or destruction, whether by automated means or otherwise.
• "Third-Party Processor" — any external organisation engaged by oxl100 to process Personal Data on its behalf under a contractual data processing agreement, including payment processors, KYC providers, cloud hosting providers, and game studios.
• "KYC" — Know Your Customer; the identity and age verification process applied to members before withdrawal processing or at any other stage deemed necessary by the Company.
• "Cookie" — a small data file placed on your device by the Platform for the purposes of session management, analytics, personalisation, or fraud prevention.

oxl100 acts as the data controller in respect of all Personal Data collected through the Platform. As data controller, oxl100 determines the purposes and means by which your Personal Data is processed, and is responsible for ensuring that such processing is carried out in accordance with this Privacy Policy and applicable data protection law.

All data protection inquiries, subject access requests, and complaints should be directed to the oxl100 data protection contact at:

oxl100 collects Personal Data across several categories depending on how you interact with the Platform. The table below summarises each category, the specific data points within it, and the primary reason for collection:

oxl100 does not collect biometric data, precise geolocation beyond city-level inference from IP address, or any special-category data beyond what is strictly required for age and identity verification.

Your Personal Data reaches oxl100 through three primary channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, participate in a promotion, or update your account preferences, you provide data directly to oxl100.
• Automatically through your use of the Platform: Technical and device data, session logs, cookie data, and gaming activity data are collected automatically as you navigate and interact with the Platform. This collection occurs whether or not you are logged into an account.
• From third-party sources: Where permitted, oxl100 may receive supplementary identity or fraud-risk data from KYC and AML screening providers. Payment processors such as BCA, BRI, and the e-wallet networks may also share transaction confirmation data with oxl100 to reconcile deposits and withdrawals. We do not purchase data lists from brokers.

oxl100 processes your Personal Data only where a valid legal basis exists. The following bases apply to our primary processing activities:

• Performance of a contract: Processing your registration data, financial data, and gaming activity data is necessary to create and operate your account, process your deposits and withdrawals in Indonesian Rupiah, and deliver the gaming services you have contracted for.
• Legal obligation: KYC documentation processing, AML screening, and the retention of financial transaction records are required by the regulatory and licensing obligations under which oxl100 operates.
• Legitimate interests: Technical and device data is processed on the basis of oxl100's legitimate interest in detecting fraud, preventing unauthorised account access, maintaining platform security, and resolving disputes. These interests are balanced against your privacy rights, and oxl100 implements the principle of data minimisation in all such processing.
• Consent: Marketing communications — including promotional emails and SMS notifications about bonuses and events — are sent only where you have given explicit opt-in consent. You may withdraw this consent at any time through your account preferences or by emailing support@oxl100.bet.

oxl100 uses the Personal Data it collects for the following specific purposes. We do not process your data for any purpose that is incompatible with those listed here without first obtaining your consent or establishing a fresh legal basis:

• Account management: Creating, maintaining, securing, and closing your oxl100 account; verifying your identity and age (21+ requirement); managing your login credentials and session security.
• Payment processing: Executing deposits via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); processing withdrawal requests within the stated one-hour window during operating hours (08:00–24:00 WIB); maintaining transaction records in IDR.
• Service delivery: Providing access to all gaming products on the Platform, including sportsbook markets (BRI Liga 1, EPL, La Liga, Champions League, and others), live casino tables, video slots, and crash game titles; recording game results and settling wagers.
• Fraud prevention and security: Detecting unusual login activity, flagging potentially fraudulent transactions, identifying multi-account registrations, and protecting both Members and the Company against financial crime.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling indicators and, where appropriate, proactively offering or activating Responsible Gaming tools such as deposit limits, loss limits, cool-off periods, or self-exclusion.
• Legal and regulatory compliance: Satisfying AML reporting obligations, responding to court orders or regulatory requests, and maintaining records as required by the Company's licensing authority.
• Customer support: Responding to your inquiries, resolving complaints, investigating disputes, and maintaining support interaction records for quality assurance.
• Marketing (with consent only): Sending personalised promotional communications about bonuses, seasonal offers (e.g., Idul Fitri promotions, Ramadhan specials), new game launches, and VIP program updates — exclusively to Members who have opted in.
• Platform analytics and improvement: Using aggregated, anonymised usage data to understand how Members navigate the Platform, identify performance bottlenecks, and prioritise development improvements. No individual-level profiling is conducted for this purpose.

oxl100 shares your Personal Data only in the circumstances described below. In all cases, we limit the data shared to what is strictly necessary for the specific purpose:

• Payment processors: Financial data (bank account number, e-wallet account details, transaction amounts in IDR) is shared with the relevant payment gateway or bank necessary to execute your specific deposit or withdrawal instruction. Each provider operates under its own privacy framework.
• KYC and AML screening providers: Identity documents and verification data are shared with third-party KYC providers for the sole purpose of completing identity and age verification. These providers are contractually prohibited from using your data for any purpose beyond verification.
• Game studios and software providers: Certain gaming activity data (session tokens, bet events) is shared with game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft solely to facilitate gameplay and settle game results. These providers do not receive your personal registration data.
• Regulatory and legal authorities: Where required by applicable law, a valid court order, or a direction from a competent regulatory authority, oxl100 may disclose Personal Data to government bodies or law enforcement agencies. We will notify you of such disclosures where legally permitted to do so.
• Cloud hosting and infrastructure providers: oxl100 uses third-party cloud infrastructure to host the Platform and store data securely. These providers act as data processors under contractual obligations equivalent to the standards set out in this Policy.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of the Company's assets, Member Personal Data may be transferred to the acquiring entity. In such cases, we will notify affected Members at least 30 days in advance and ensure the receiving entity commits to maintaining the protections set out in this Policy.

oxl100 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and the Company's regulatory obligations. The following retention periods apply as a general guide:

• Account and registration data: Retained for the lifetime of your active account plus a minimum of five years following account closure, to satisfy AML record-keeping requirements.
• KYC documentation: Retained for a minimum of five years from the date of verification completion, in line with standard anti-money-laundering retention standards.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction, in IDR amounts, including all deposits and withdrawals.
• Gaming activity logs: Retained for a minimum of three years to support dispute resolution and responsible gaming monitoring.
• Support correspondence: Retained for two years from the date of the final interaction in a support thread, unless the matter remains subject to active dispute or regulatory inquiry.
• Marketing consent records: Retained for the lifetime of your account plus two years following account closure, as evidence of consent or withdrawal of consent.
• Technical and device logs: Retained for 12 months on a rolling basis for fraud detection and security purposes, after which they are anonymised or deleted.

When Personal Data is no longer required, oxl100 securely deletes or anonymises it so that it can no longer be associated with an identifiable individual.

oxl100 implements a layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon visible in your browser address bar confirms this protection is active.
• Encryption at rest: Sensitive Personal Data stored in our databases — including KYC documents and financial account references — is encrypted at rest using AES-256 encryption.
• Access controls: Access to Personal Data within oxl100 is restricted on a strict need-to-know basis. Staff with legitimate access undergo background screening and operate under confidentiality obligations. All internal access is logged and auditable.
• Password security: Account passwords are stored as salted cryptographic hashes; oxl100 staff cannot view your password in plain text. We strongly recommend Members enable two-factor authentication (2FA) where available and use a unique, strong password for their oxl100 account.
• Fraud monitoring: Automated systems monitor login attempts, transaction patterns, and device fingerprints in real time to detect and flag suspicious activity. Unusual activity triggers additional verification steps before account access is granted.
• Incident response: In the event of a confirmed data breach that affects your rights and freedoms, oxl100 will notify affected Members by email within 72 hours of becoming aware of the breach, and will take immediate steps to contain and remediate the incident.

oxl100 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, prevent fraud, and — where you have consented — to improve your experience through personalisation. The categories of cookies we use are as follows:

• Strictly necessary cookies: These are essential for the Platform to function. They manage your login session, maintain your account state between pages, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without impairing core Platform functionality.
• Functional cookies: These remember your preferences — such as your selected language, last-visited game category, and notification settings — so that you do not need to reconfigure them on each visit. They are activated only for logged-in Members.
• Analytics cookies: Anonymised analytics data helps oxl100 understand which Platform features are most used, where navigation drop-offs occur, and how page performance can be improved. Analytics processing uses aggregated data only and does not identify individual Members.
• Security and fraud detection cookies: These support oxl100's fraud monitoring systems by associating your session with a consistent device fingerprint, allowing us to identify anomalous login patterns that may indicate account compromise.

oxl100 does not use third-party advertising cookies or behavioural tracking cookies that profile your browsing activity across external websites. You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging into your account.

As an oxl100 Member, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact us at support@oxl100.bet with the subject line "Privacy Request — [Right Type]". We will respond within 30 calendar days:

• Right of access: You may request a copy of all Personal Data that oxl100 holds about you, including the categories of data, the purposes for which it is processed, and any Third-Party Processors with whom it has been shared.
• Right to rectification: If any Personal Data oxl100 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Basic account details (name spelling, contact number, email address) may also be updated directly through your account settings.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where: it is no longer necessary for the purpose it was collected; you withdraw consent and no other legal basis applies; or it has been processed unlawfully. This right is subject to override where retention is required by law (e.g., AML record-keeping obligations).
• Right to restrict processing: You may request that oxl100 pause processing of your data in certain circumstances — for example, while an accuracy dispute is being resolved.
• Right to data portability: Where processing is based on contract or consent and carried out by automated means, you may request a structured, machine-readable copy of the Personal Data you provided directly to oxl100 (e.g., registration data, transaction history).
• Right to object: You may object to processing carried out on the basis of legitimate interests, and to all processing for direct marketing purposes. An objection to marketing will be acted upon immediately; other objections will be assessed against the specific circumstances.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

oxl100 will not discriminate against any Member for exercising their privacy rights. Your account will not be closed, your service degraded, or your promotional access restricted as a result of a legitimate privacy request.

The oxl100 Platform is strictly restricted to individuals aged 21 years or older. oxl100 does not knowingly collect Personal Data from individuals under the age of 21. The KYC verification process is specifically designed to detect and prevent underage registration by requiring government-issued identity documentation (KTP) that includes a verified date of birth.

If oxl100 discovers or is made aware that Personal Data has been collected from a person under the age of 21, we will immediately suspend the relevant account, void all associated transactions, arrange the return of any real-money deposits in accordance with our Terms & Conditions, and permanently delete all Personal Data associated with that account from our systems as quickly as operationally possible.

Parents or guardians who believe a minor may have created an account on oxl100 are encouraged to contact us immediately at support@oxl100.bet. We will treat such reports as high-priority and respond within 24 hours.

oxl100 operates as an internationally licensed gaming platform. As a result, some of your Personal Data may be transferred to and processed in countries outside of Indonesia, including the jurisdiction in which the Company holds its gaming license and the locations of our cloud infrastructure and Third-Party Processor partners.

Where Personal Data is transferred internationally, oxl100 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding the protections described in this Privacy Policy. These safeguards include:

• Contractual data processing agreements with all Third-Party Processors that include data protection clauses aligned with internationally recognised standards.
• Transfer only to jurisdictions that maintain adequate data protection frameworks, or to processors that have implemented recognised supplementary safeguards.
• Regular review of the data protection standards maintained by our Third-Party Processors to ensure ongoing compliance.

oxl100 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or changes in the services we offer. When material changes are made, oxl100 will notify Members by email to the address registered on their account and by displaying a prominent notice on the Platform, with a minimum of 14 days' advance notice before the revised Policy takes effect.

Non-material changes — such as clarifications to existing language, corrections of typographical errors, or additions of new data retention periods consistent with existing obligations — may be made without advance notice, though the "Last Revised" date at the top of this Policy will always be updated to reflect the most recent modification.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. The current version of this Privacy Policy is always available at https://oxl100.bet/privacy-policy.

For all privacy-related inquiries, subject access requests, data correction requests, deletion requests, or complaints regarding oxl100's data practices, please contact our data protection team through the following channel:

If you are not satisfied with oxl100's response to your privacy inquiry or complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction applicable to the Company's gaming license.