xl99 is committed to safeguarding your personal data. This policy explains what information we collect, how we use it, and the choices you have as a registered player.
Last Updated: January 2026This Privacy Policy ("Policy") describes how xl99 ("we", "us", "our") collects, processes, stores, and protects personal data provided by users ("you", "your") of the online betting platform accessible at https://xl99.cam (the "Platform").
xl99 takes its data protection obligations seriously. We collect only the personal information necessary to deliver a safe, secure, and fully functional betting experience to players across Indonesia, including those located in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and Makassar. We do not sell your personal data to third parties for marketing purposes.
By registering an Account and using the Platform, you acknowledge that you have read, understood, and agreed to the terms of this Policy. This Policy forms an integral part of our Terms & Conditions. If you disagree with any part of this Policy, please discontinue use of the Platform and contact us to arrange Account closure.
This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, all of which govern your use of the xl99 Platform.
xl99 acts as the data controller for personal data collected through the Platform. As data controller, xl99 determines the purposes for which and the means by which personal data is processed. All enquiries relating to this Policy or your data rights should be directed to our dedicated data protection contact:
Data Protection Contact (plain text):
Our support team is staffed by native Indonesian-speaking agents available 24 hours a day, 7 days a week, and can assist with all data-related requests.
xl99 collects the following categories of personal data, depending on how you interact with the Platform:
Sensitive Data: xl99 does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, health information, or criminal records, except where required by applicable anti-money laundering (AML) regulations or as strictly necessary to comply with legal obligations.
xl99 collects personal data through the following channels:
The following table sets out the purposes for which xl99 processes your personal data and the legal basis relied upon for each:
| Purpose | Data Categories Used | Legal Basis |
|---|---|---|
| Account registration and management | Identity, Contact | Performance of contract |
| KYC identity verification | Identity, Financial | Legal obligation; legitimate interests |
| Processing deposits and withdrawals | Financial, Identity | Performance of contract |
| Fraud detection and AML compliance | Identity, Financial, Technical | Legal obligation; legitimate interests |
| Customer support and dispute resolution | Identity, Contact, Communications | Performance of contract; legitimate interests |
| Responsible gaming monitoring | Usage, Financial | Legal obligation; legitimate interests |
| Platform improvement and analytics | Technical, Usage | Legitimate interests |
| Promotional communications (opted-in) | Contact, Usage | Consent |
| Legal and regulatory compliance | All categories as required | Legal obligation |
xl99 will not use your personal data for any purpose that is materially different from those listed above without first providing you with notice and, where required, obtaining your consent.
xl99 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data only in the following limited circumstances:
We engage carefully selected third-party service providers who process data on our behalf under strict contractual obligations. These include:
xl99 may disclose personal data to law enforcement agencies, regulatory bodies, or other public authorities where required by applicable law, court order, or where we have a good-faith belief that disclosure is necessary to prevent fraud, protect our legal rights, or ensure the safety of our users.
In the event of a merger, acquisition, restructuring, or sale of all or part of xl99's business, personal data held by xl99 may be transferred to the acquiring entity as part of that transaction. We will notify registered users via email in advance of any such transfer that materially affects the processing of their personal data.
All third-party service providers engaged by xl99 are contractually required to process personal data only for the specific purposes for which it was shared, to maintain appropriate security standards, and to delete or return data upon termination of their engagement.
The xl99 Platform serves users primarily located in Indonesia (Western Indonesia Time, WIB, UTC+7). Some of our third-party service providers and data processors operate outside Indonesia. Where personal data is transferred internationally, xl99 ensures that appropriate safeguards are in place, which may include:
You may request further information about the safeguards applied to international transfers of your personal data by contacting [email protected].
xl99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for satisfying any legal, accounting, or reporting requirements. The general retention periods applied by xl99 are as follows:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account and identity records | 5 years after Account closure | AML/KYC regulatory compliance |
| Financial transaction records | 5 years after transaction date | Financial reporting and audit obligations |
| Betting and game history | 3 years after Account closure | Dispute resolution; responsible gaming monitoring |
| Customer support communications | 2 years after resolution | Quality assurance; dispute evidence |
| Technical and log data | 12 months from collection | Security monitoring and fraud prevention |
| Marketing consent records | Until consent is withdrawn + 12 months | Demonstrating lawful basis for communications |
Once a retention period expires, xl99 will securely delete or anonymise the relevant personal data so that it can no longer be associated with you as an individual.
Subject to applicable law, you have the following rights in respect of your personal data held by xl99. To exercise any of these rights, please contact us at [email protected] with your registered Account username and a clear description of your request. We will respond within 30 days of receipt.
Right of AccessRequest a copy of the personal data xl99 holds about you.
Right to RectificationRequest correction of inaccurate or incomplete personal data.
Right to ErasureRequest deletion of your data where we no longer have a legal basis to retain it.
Right to Restrict ProcessingRequest that we limit how we use your data in certain circumstances.
Right to PortabilityReceive your data in a structured, machine-readable format.
Right to ObjectObject to processing based on legitimate interests or for direct marketing.
Right to Withdraw ConsentWithdraw consent for processing at any time where consent is the legal basis.
Right to Lodge a ComplaintFile a complaint with the relevant data protection authority in your jurisdiction.
Please note: Some rights are subject to limitations. For example, xl99 may be unable to delete data that is required to be retained under AML or financial regulation. We will always explain the reason if we are unable to fulfil a request in full.
xl99 uses cookies and similar tracking technologies to improve your experience on the Platform, maintain session security, and gather analytics data that helps us understand how the Platform is used.
You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies; however, disabling strictly necessary cookies will prevent you from logging in and using core Platform features. Detailed instructions for managing cookies in popular browsers are available in your browser's help documentation.
xl99 does not use third-party advertising cookies or permit advertising networks to place tracking cookies on the Platform for the purpose of serving targeted advertisements to you on other websites.
xl99 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:
While xl99 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for notifying us immediately if you suspect unauthorized use of your Account.
21+ Only. The xl99 Platform is strictly intended for adults aged 21 and over. xl99 does not knowingly collect personal data from individuals under the age of 21. If we become aware that a user under 21 has registered an Account or submitted personal data, we will immediately suspend the Account, delete the data, and void any associated transactions.
If you believe that a minor has registered on the Platform using false information, please notify us immediately at [email protected]. Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms.
The xl99 Platform does not contain links to external third-party websites as a matter of policy. In the event that any third-party content, embedded game provider interface, or payment gateway is presented within the Platform environment, please be aware that those third parties operate under their own privacy policies. xl99 is not responsible for the privacy practices of third-party game studios, payment processors, or any other external service whose interface may appear within the Platform. We encourage you to review the privacy policies of any third-party service you interact with.
xl99 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Material changes to this Policy will be communicated to registered users via the email address associated with their Account, and a revised "Last Updated" date will be displayed prominently at the top of this page.
Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not agree with the revised Policy, you should stop using the Platform and may request Account closure by contacting us at [email protected].
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by xl99, please contact our support team. Native Indonesian-speaking agents are available 24 hours a day, 7 days a week to assist you.
Contact Email (plain text):
Please include your registered Account username, a clear subject line referencing your data rights request, and any relevant details. We aim to acknowledge all data-related requests within 5 business days and to provide a full response within 30 calendar days. Business hours for written correspondence are 08:00–22:00 WIB (Western Indonesia Time, UTC+7).
If you are dissatisfied with our handling of your personal data or our response to a data rights request, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.
Six core commitments that underpin our approach to your personal data
All personal and financial data transmitted through xl99 is protected by 256-bit SSL/TLS encryption — the same standard used by Indonesia's leading banks including BCA and BRI.
xl99 never sells, rents, or trades your personal data to third-party marketers. Your information is used solely to deliver and improve the services you signed up for.
You retain comprehensive rights over your personal data — access, correction, portability, deletion, and objection. Submit any data request to our team at [email protected] and we will respond within 30 days.
xl99 collects only the personal data that is strictly necessary to provide our services and meet our regulatory obligations. We do not gather data speculatively or beyond what is required.
Our identity verification process is designed to protect both players and the platform. KYC data is handled with strict access controls and retained only for the periods mandated by applicable AML regulations.
Our native Indonesian-speaking support team is available around the clock to assist with any privacy concern, data rights request, or security question. Reach us anytime at [email protected].
Review our full Terms & Conditions, explore our FAQ, or return to the homepage to get started.