Privacy Policy
xl999 Data Protection

Introduction

xl999 ("we", "us", "the Platform") is committed to protecting and respecting the privacy of every individual who interacts with our platform at xl999.vu. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by xl999.

This policy applies to all users of the xl999 platform, including registered members, prospective members who browse the site without registering, and anyone who contacts xl999 support. It covers all personal data collected through the xl999 website, mobile-optimized interface, live chat system, and any associated communication channels.

By accessing the xl999 platform or registering an account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy.

Definitions

For the purposes of this Privacy Policy, the following definitions apply:

Data We Collect

xl999 collects personal data across several categories depending on how you interact with the platform. The table below summarizes the categories of data we collect and provides examples of the specific data points within each category.

How We Collect Data

xl999 collects personal data through the following channels:

4.1 Direct Collection

You provide data directly to xl999 when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, respond to a promotion, or update your account settings. This is the primary source of identity, contact, and financial data held by xl999.

4.2 Automated Collection

When you visit or use the xl999 platform, our systems automatically collect Technical Data including your IP address, browser type, device identifiers, and session behavior. This data is collected through server logs, cookies, and similar tracking technologies described in Section 10.

4.3 Third-Party Sources

xl999 may receive data about you from third parties in limited circumstances, including:

• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and others) confirming the status and ownership of deposit or withdrawal transactions.
• Identity verification service providers used to support the KYC process, which may cross-reference the documents you submit against public or commercially licensed identity databases.
• Fraud prevention and anti-money-laundering screening services that flag accounts or transactions associated with known risk indicators.

Purpose & Legal Basis for Processing

xl999 processes your personal data only for specific, legitimate purposes and only where a valid legal basis exists for doing so. The table below maps our processing activities to their purposes and legal bases.

Data Sharing

xl999 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following limited and necessary circumstances:

6.1 Third-Party Service Providers

xl999 engages trusted third-party service providers who process data on our behalf under binding data processing agreements. These include payment processing partners handling transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, Visa, and Mastercard; KYC and identity verification providers; fraud detection and AML screening services; cloud infrastructure and hosting providers; live chat and customer support platform operators; and game studio providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, and Spribe. Each of these providers is authorized to use your data only for the specific service they provide to xl999 and is prohibited from using it for any other purpose.

6.2 Regulatory and Legal Disclosure

xl999 may disclose your personal data to regulators, law enforcement agencies, courts, or other public authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of xl999, its members, or the general public. xl999 will, where legally permitted, notify you of any such disclosure request.

6.3 Business Transfers

In the event that xl999 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. You will be notified of any such transfer and of any material changes to the privacy practices applicable to your data as a result.

6.4 Aggregate and Anonymized Data

xl999 may share aggregated, anonymized statistical data — from which no individual can be identified — with business partners, analytics providers, or for publication in industry reports. This anonymized data is not personal data and is not subject to the protections of this Privacy Policy.

International Data Transfers

xl999 is headquartered in Vanuatu and operates infrastructure across multiple jurisdictions. Your personal data may be transferred to and processed in countries outside Indonesia, including Vanuatu and other jurisdictions where our service providers maintain data centers. These countries may have data protection laws that differ from those applicable in your location.

When xl999 transfers personal data internationally, we implement appropriate safeguards to ensure that your data receives a standard of protection consistent with this Privacy Policy. These safeguards include contractual clauses in agreements with third-party processors, technical security controls, and access restriction policies ensuring that data is accessed only by personnel who require it to perform their authorized functions.

Data Retention

xl999 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory retention obligations, and to resolve any disputes or enforce our agreements. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• Financial transaction data: Retained for a minimum of 5 years from the date of the transaction to meet financial reporting and AML obligations.
• KYC documentation: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Support communications: Retained for up to 3 years from the date of the interaction, or longer if the communication relates to an unresolved dispute or legal matter.
• Technical and analytics data: Retained in identifiable form for up to 24 months, after which it is anonymized or deleted.
• Marketing consent records: Retained for the duration of your consent and for 1 year after consent is withdrawn, as evidence of compliance.

When personal data is no longer required, xl999 will securely delete or anonymize it in accordance with industry-standard data destruction procedures.

Your Rights

You have the following rights in relation to the personal data xl999 holds about you. To exercise any of these rights, contact our support team via live chat or at [email protected]. xl999 will respond to all valid rights requests within 30 days.

9.1 Right to Access

You have the right to request a copy of the personal data xl999 holds about you, along with information about how it is being processed. xl999 will provide this information in a structured, commonly used format within 30 days of a verified request.

9.2 Right to Rectification

If any personal data held by xl999 is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating your contact email or phone number) can typically be made directly within your account settings.

9.3 Right to Erasure

You may request that xl999 delete your personal data in certain circumstances — for example, if the data is no longer necessary for the purpose for which it was collected, or if you withdraw consent and there is no other legal basis for processing. Note that xl999 may be unable to fully erase data that is subject to mandatory legal retention requirements such as AML record-keeping obligations.

9.4 Right to Object to Marketing

You have an absolute right to object to the processing of your personal data for direct marketing purposes at any time. Upon receipt of a valid objection, xl999 will cease marketing communications immediately and will not use your data for this purpose again unless you re-consent.

Cookies & Tracking Technologies

xl999 uses cookies and similar tracking technologies on its platform. Cookies are small data files stored on your device that allow the platform to recognize your browser, remember your preferences, maintain your session, and analyze how the platform is used.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the platform to function correctly. These include session authentication cookies that keep you logged in during an active session. These cookies cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences such as language display settings, last-visited game categories, and responsible gaming limit configurations. These enhance your experience but are not essential.
• Analytics Cookies: Collect aggregated information about how visitors use the xl999 platform — including pages visited, time spent on each page, and navigation paths — to help us improve platform performance and user experience.
• Security Cookies: Used to detect and prevent fraudulent activity, including session hijacking and account takeover attempts. These are strictly necessary and cannot be disabled.

10.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Note that disabling functional cookies may affect the quality of your xl999 experience. Disabling analytics cookies will not impair any platform functionality. Strictly necessary and security cookies cannot be disabled through browser settings without making the platform unusable.

Children's Privacy

The xl999 platform is strictly intended for adults aged 21 years and over. xl999 does not knowingly collect, store, or process personal data belonging to any person under the age of 21. If xl999 discovers or is notified that personal data has been collected from a person under 21, the account will be closed immediately, all data will be deleted as promptly as possible subject to any legal retention requirements, and any deposited funds will be returned to the original payment source following a mandatory review period.

If you believe that a minor has registered an account on xl999, please contact us immediately at [email protected] so that we can take prompt action.

Security Measures

xl999 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the xl999 platform, ensuring that your credentials, financial data, and session activity cannot be intercepted in transit.
• Data-at-rest encryption for all sensitive data stored in xl999's databases, including identity documents, financial records, and account credentials.
• Access controls and role-based permissions ensuring that xl999 staff can only access the data necessary to perform their specific function. No employee has unrestricted access to the full member database.
• Two-factor authentication (2FA) available to all members as an additional layer of account security, and mandatory for all xl999 administrative staff accounts.
• Regular security audits and penetration testing conducted by independent third-party security firms to identify and remediate vulnerabilities before they can be exploited.
• Incident response procedures that ensure any confirmed or suspected data breach is assessed, contained, and — where legally required — notified to affected individuals and relevant authorities without undue delay.

Third-Party Services

The xl999 platform integrates with a number of third-party services to deliver its full range of features. While xl999 carefully selects and vets its service providers, each third-party service operates under its own privacy policy and data practices. xl999 is not responsible for the privacy practices of any third-party provider beyond the data processing agreements we hold with them.

Third-party services integrated with xl999 include game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, Spribe), payment processing networks (Visa, Mastercard, and local Indonesian payment infrastructure), identity verification providers, and customer support software. When you interact with a live dealer game streamed from an Evolution Gaming or Pragmatic Play Live studio, your session data — including your seat position and betting activity within that game — is also processed by that studio in accordance with their own privacy policies and certification requirements.

Changes to This Privacy Policy

xl999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes to this policy, we will notify you by posting a prominent notice on the xl999 platform and, where your contact details are verified, by sending an email to the address registered on your account. The updated policy will be effective from the date indicated at the top of the document.

We encourage you to review this Privacy Policy periodically. Continued use of the xl999 platform after the effective date of any amendment constitutes your acknowledgment of and agreement to the revised policy. If you do not agree to the revised policy, you must cease using the platform and request account closure.

Contact & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or the way xl999 handles your personal data, please contact our dedicated privacy support team through the following channels:

• Live Chat: Available 24/7 directly on the xl999 platform — average response time under 3 minutes.
• Email: [email protected] — privacy-related requests will be acknowledged within 24 hours and resolved within 30 days wherever possible.

xl999's support team is fully bilingual in English and Bahasa Indonesia. You may submit privacy requests in either language and we will respond accordingly.

If you are not satisfied with xl999's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection or licensing authority. Details of the applicable authority are available on request from the xl999 support team.