Privacy Policy

Definitions

The following definitions apply throughout this Privacy Policy:

• "exo368", "Platform", "We", "Us", "Our" — the online betting and gaming service operated at https://exo368.bet and all associated subdomains and applications.
• "You", "User", "Player", "Data Subject" — any individual who visits, registers on, or uses the exo368 platform in any capacity.
• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, including name, date of birth, national identification number, email address, phone number, residential address, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on personal data, including collection, storage, retrieval, use, disclosure, transfer, and deletion.
• "KYC" (Know Your Customer) — the identity and age verification process applied by exo368 to confirm the identity, age, and payment method ownership of registered players, particularly prior to withdrawal processing.
• "Third Party" — any natural or legal person, public authority, agency, or body other than exo368 and the Data Subject.
• "Cookies" — small text files placed on the User's device by the exo368 platform for the purposes of session management, analytics, and personalisation.

Data We Collect

exo368 collects personal data across several categories, depending on your interaction with the platform. The table below summarises the categories of personal data we collect and the contexts in which they arise:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (beyond selfie-based identity verification), health data, or data concerning sex life or sexual orientation unless specifically required by applicable regulation and disclosed to you at the point of collection.

How Data Is Collected

exo368 collects your personal data through the following channels:

• Direct submission: Information you provide when creating an account, completing KYC verification, submitting a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated technical collection: Technical and usage data collected automatically when you access the platform, including through cookies, web beacons, server logs, and similar tracking technologies. This collection occurs regardless of whether you are logged in to your account.
• Third-party payment processors: Transaction confirmation data received from payment partners including BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja when you initiate a deposit or withdrawal.
• Identity verification providers: Confirmation responses from third-party KYC and identity verification service providers used to authenticate government-issued identity documents submitted during the verification process.
• Fraud detection and security partners: Risk signals and device fingerprint data received from third-party fraud prevention services that help exo368 identify suspicious login attempts, account takeovers, and unusual transaction patterns.

Legal Basis for Processing

exo368 processes your personal data only where a valid legal basis exists. The primary legal bases on which we rely are:

• Contractual necessity: Processing required to perform the contract between you and exo368 — including operating your account, processing deposits and withdrawals, settling bets, and providing customer support.
• Legal obligation: Processing required to comply with applicable anti-money-laundering (AML), counter-terrorist-financing (CTF), and international sanctions screening obligations. This includes the collection and retention of KYC documentation and transaction records.
• Legitimate interests: Processing carried out for exo368's legitimate business interests where those interests are not overridden by your fundamental rights. This includes fraud prevention, platform security, product analytics, and responsible gaming monitoring. Where we rely on legitimate interests, we conduct and document a balancing assessment.
• Consent: Where we rely on your consent — for example, to send you promotional communications about new games, seasonal offers, or bonus programmes — you may withdraw that consent at any time by updating your communication preferences in the account settings panel or by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

How We Use Your Data

exo368 uses the personal data we collect for the following specific purposes:

• Account management: Creating, maintaining, and securing your registered account, processing login requests, and managing account settings and communication preferences.
• Transaction processing: Processing IDR deposits and withdrawals via supported Indonesian banking channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OCBC NISP, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), reconciling transaction records, and resolving payment disputes.
• Identity and age verification: Confirming that all registered players are at least 21 years of age and are who they claim to be, in accordance with our KYC policy and international best practices for responsible gaming.
• Regulatory compliance: Meeting our obligations under applicable anti-money-laundering, counter-terrorist-financing, and international sanctions frameworks, including screening player data against relevant watchlists and maintaining mandated transaction records.
• Fraud prevention and platform integrity: Detecting, investigating, and preventing fraudulent transactions, bonus abuse, multi-accounting, money laundering, match-fixing, and other prohibited conduct as defined in the exo368 Terms & Conditions.
• Responsible gaming: Monitoring account activity for behavioural indicators of problem gambling and proactively offering responsible gaming tools — including deposit limits, session timers, cooling-off periods, and self-exclusion — where appropriate.
• Product improvement and analytics: Analysing aggregated usage data to improve platform performance, identify popular game categories, optimise the user interface, and develop new features that better serve Indonesian players.
• Customer support: Responding to account queries, technical issues, payment disputes, bonus queries, and responsible gaming requests submitted via live chat or email.
• Marketing communications (consent-based only): Sending you information about new games, seasonal promotions (such as Idul Fitri or Ramadhan campaigns), bonus offers, and platform updates — exclusively where you have opted in to receive such communications.

Data Sharing & Disclosure

exo368 does not sell, rent, or trade your personal data to any third party for marketing purposes. We share personal data only in the following limited circumstances and only to the extent strictly necessary for the stated purpose:

• Payment processors and banking partners: Your financial account details and transaction amounts are shared with the relevant payment provider (e.g., BCA, BRI, OVO, GoPay) solely to execute the specific deposit or withdrawal you have initiated.
• KYC and identity verification providers: Identity documents and biometric selfie data are shared with our contracted third-party verification service for the sole purpose of confirming your identity and age. These providers operate under strict data processing agreements and are prohibited from using your data for any purpose beyond the verification service.
• Fraud prevention and security services: Technical data including IP addresses, device fingerprints, and behavioural risk signals are shared with contracted fraud prevention partners to protect the integrity of the platform and safeguard all registered players.
• Game content providers: Where necessary to load and render game sessions, pseudonymised session identifiers may be transmitted to licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe). No directly identifying personal data such as your full name or financial details is shared with game studios.
• Law enforcement and regulatory authorities: exo368 will disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required to do so by applicable law, court order, or legally enforceable regulatory request. We will, where legally permissible, notify the affected User prior to such disclosure.
• Business restructuring: In the event of a merger, acquisition, or sale of all or part of the exo368 business, personal data held by exo368 may be transferred to the acquiring entity as part of the transaction. Users will be notified of any such transfer and of any material change to privacy practices that results from it.

All third-party service providers who process personal data on behalf of exo368 are required to enter into data processing agreements that bind them to confidentiality obligations and restrict their use of personal data to the specific contracted purpose.

Data Retention

exo368 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle management procedures. Anonymised or aggregated data that can no longer be used to identify any individual may be retained indefinitely for statistical and product development purposes.

Data Security

exo368 implements a layered security architecture designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• TLS 1.3 encryption with 256-bit SSL certificates applied to all data in transit across every page of the platform, including the login flow, deposit and withdrawal screens, and the customer support interface.
• Encryption at rest for all stored personal data and financial records, using AES-256 or equivalent encryption standards on our database infrastructure.
• Two-factor authentication (2FA) available to all registered players and enforced for all internal exo368 staff who access production systems containing personal data.
• Role-based access controls (RBAC) ensuring that exo368 staff can only access personal data to the extent required for their specific job function. Access logs are maintained and reviewed regularly.
• Regular security audits and penetration testing conducted by independent third-party security professionals to identify and remediate vulnerabilities before they can be exploited.
• Intrusion detection and anomaly monitoring operating continuously across the platform infrastructure, with automated alerts for unusual access patterns or data exfiltration attempts.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, exo368 will notify affected Users without undue delay and will take all reasonable steps to contain and remediate the breach. You will be informed of the nature of the breach, the categories of data affected, and the steps you should take to protect yourself.

Cookies & Tracking Technologies

exo368 uses cookies and similar tracking technologies to operate essential platform functions, improve performance, and understand how players use the site. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that keep you logged in during your visit, security tokens, and load-balancing cookies. These cookies cannot be disabled without breaking the platform.
• Performance and analytics cookies: Used to collect aggregated, anonymised data about how visitors interact with the platform — including which pages are most visited, average session duration, and game category popularity. This data informs product development decisions and does not identify individual players.
• Functionality cookies: Allow the platform to remember your preferences — such as your last-selected deposit method (e.g., BCA vs. OVO) and your language and display settings — to provide a more personalised experience on return visits.
• Marketing and targeting cookies: Used only where you have provided explicit consent. These cookies track your browsing behaviour across sessions to serve you relevant promotional content about games, bonuses, and platform features that match your interests. You may withdraw consent for marketing cookies at any time through your account privacy settings.

Most web browsers allow you to control cookie behaviour through the browser settings menu. Blocking strictly necessary cookies will impair your ability to log in and use the platform. Blocking performance or marketing cookies will not affect your ability to place bets or process transactions, but may reduce the personalisation of your experience.

Your Rights

As a Data Subject, you have the following rights with respect to your personal data held by exo368. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Subject Request". We will respond within 30 days of receiving a verifiable request.

• Right of access: You have the right to request a copy of all personal data that exo368 holds about you, along with information about how it is being used and with whom it has been shared.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. For minor corrections (such as a mis-typed email address), you may update your details directly in the account settings panel without contacting support.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data. This right is subject to our legal retention obligations — we cannot delete data that we are required by law to retain (such as KYC records and transaction data required under AML regulations). Where erasure is not possible in full, we will inform you of what data must be retained and why.
• Right to restriction of processing: You may request that we restrict processing of your personal data in certain circumstances — for example, while the accuracy of data is under dispute, or while you await the outcome of an objection to processing.
• Right to data portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) so that you can transfer it to another service provider.
• Right to object: You have the right to object to processing based on legitimate interests. Upon receiving an objection, exo368 will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Minors & Age Restriction

exo368 is strictly an adults-only platform. The minimum age to register an account and use any service on exo368 is 21 years. We do not knowingly collect personal data from individuals under the age of 21.

If exo368 discovers or reasonably suspects that a registered account belongs to a person under 21 years of age, the account will be suspended immediately and all personal data associated with that account will be deleted as soon as practicable, subject to any mandatory retention obligations arising from transactions already processed on the account.

If you are a parent or guardian and believe that your child under 21 has registered an account on exo368, please contact us immediately at [email protected]. We will investigate the matter promptly and take all necessary steps to close the account and delete the minor's data.

Third-Party Links

The exo368 platform does not contain links to external third-party websites in its main navigation or content areas. However, game loading interfaces provided by licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe) may operate within embedded iframes that are technically hosted on the studios' own infrastructure.

exo368 is not responsible for the privacy practices of third-party game studios operating within embedded game frames. The personal data transmitted to these studios is limited to pseudonymised session identifiers as described in Section 6 of this Policy. exo368 does not share directly identifying personal data (such as your full name, email address, or financial details) with any game studio.

International Data Transfers

exo368 operates as an internationally licensed platform. Your personal data may be processed and stored on servers located outside of Indonesia. Where personal data is transferred internationally, exo368 ensures that appropriate safeguards are in place to protect your data to the same standard as described in this Privacy Policy, including:

• Contractual data protection clauses in agreements with all international service providers and sub-processors.
• Selection of service providers that maintain internationally recognised security certifications (such as ISO 27001 or equivalent).
• Where required, the implementation of additional technical safeguards such as end-to-end encryption for cross-border data transfers.

By registering an account on exo368, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Indonesia. exo368 will always apply the protections described in this Privacy Policy regardless of the jurisdiction in which processing occurs.

Policy Amendments

exo368 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the products and services we offer. Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — we will notify you by email to your registered address at least seven (7) days before the changes take effect.

The effective date at the top of this document will be updated each time the Policy is revised. Your continued use of the exo368 platform after the effective date of any amendment constitutes your acknowledgment of the revised Privacy Policy. If you do not accept the revised terms, you should cease using the platform and request account closure in accordance with the Terms & Conditions. The current version of this Privacy Policy is always accessible at https://exo368.bet/privacy-policy.

Contact & Complaints

If you have any questions, concerns, or formal complaints regarding this Privacy Policy or the way exo368 handles your personal data, please contact our data protection team through the following channel:

• Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Subject Request" as appropriate.
• Live Chat: Available 24/7 via the in-platform chat widget after logging in at exo368 Login. Our Indonesian-speaking support agents are available on every shift.
• Response commitment: exo368 commits to acknowledging all privacy-related inquiries within 24 hours and providing a substantive response within 30 calendar days.

If you are not satisfied with our response to your privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in the jurisdiction governing exo368's international licence. Details of the relevant supervisory authority are available upon request from our data protection team.

For general platform support, account issues, or responsible gaming assistance, please also visit our FAQ page or our dedicated Responsible Gaming page.