At ox138, protecting the personal data of our players is a core operational priority — not an afterthought. This Privacy Policy sets out precisely what information we collect, why we collect it, how we use and protect it, and the rights you hold as a registered player based in Indonesia. We encourage you to read this document in full before creating your Account.
Throughout this Privacy Policy, the following terms carry the meanings assigned below:
| Term | Meaning |
|---|---|
| "ox138" / "we" / "us" | The online gaming platform accessible at ox138.app and all associated sub-domains, mobile interfaces, and services. |
| "Player" / "you" | Any individual who registers an Account on ox138 or otherwise provides personal data to ox138 through the Platform. |
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, date of birth, contact details, financial data, device identifiers, and behavioural data. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, and deletion. |
| "Account" | A registered user profile on the ox138 Platform, created upon successful completion of the registration process. |
| "KYC" | Know Your Customer — the identity and age verification process required to confirm that a Player meets ox138's eligibility requirements, including the 21+ age restriction. |
| "Platform" | The ox138 website, mobile-optimised site, and any associated application or interface through which gaming services are delivered. |
| "Third Party" | Any entity other than ox138 and the Player, including payment processors, identity verification providers, fraud-prevention services, and analytics vendors. |
ox138 acts as the data controller in respect of all Personal Data collected through the Platform. As data controller, ox138 is responsible for determining the purposes and means by which your Personal Data is processed.
ox138 operates as an internationally licensed gaming platform. While our primary player base is located in Indonesia — including major cities such as Jakarta, Surabaya, Bandung, Medan, Bali, and Yogyakarta — our data infrastructure is maintained in accordance with internationally recognised data protection standards. We apply these standards consistently to all players regardless of geography.
Your data stays controlled. ox138 does not sell, rent, or auction your Personal Data to third-party advertisers, marketing aggregators, or data brokers under any circumstances. Any sharing of data with third parties is strictly limited to the operational purposes described in this Policy.
ox138 collects and processes the following categories of Personal Data:
ox138 collects your Personal Data through the following channels:
| Collection Channel | Examples |
|---|---|
| Direct submission | Registration form, KYC document upload, deposit/withdrawal requests, support contact forms, promotional opt-in fields. |
| Automated technical collection | Server logs, cookies, pixel tags, browser fingerprinting (limited), session analytics tools running on the Platform. |
| Third-party identity verification | KYC and age-verification providers who cross-reference submitted documents against national databases where permitted. |
| Payment processors | Confirmation data from BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja confirming successful transaction status and account name match. |
| Fraud & risk platforms | Device reputation data, IP classification (VPN/proxy detection), and behavioural risk scores from third-party fraud-prevention vendors. |
ox138 processes your Personal Data for the following specific and legitimate purposes:
Marketing opt-out: You may withdraw your consent to receive marketing communications at any time by contacting ox138 support or using the unsubscribe link in any promotional email. Withdrawing marketing consent does not affect the lawfulness of processing that occurred prior to withdrawal.
Each processing activity carried out by ox138 rests on one or more of the following legal bases:
| Legal Basis | Processing Activities Covered |
|---|---|
| Contractual necessity | Account registration, KYC verification, payment processing, game access, customer support — all are necessary to deliver the service you signed up for. |
| Legal obligation | Anti-money-laundering checks, age verification, record retention, and cooperation with lawful regulatory or law enforcement requests. |
| Legitimate interests | Fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where these interests are not overridden by your rights and freedoms. |
| Consent | Marketing communications and any optional data collection activities where we have expressly asked for and obtained your consent. |
ox138 does not sell your Personal Data. We may share specific categories of data with the following categories of recipients strictly on a need-to-know basis:
We share your name, account number, and transaction amount with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute deposits and withdrawals. These providers are bound by their own privacy obligations under applicable Indonesian financial regulations.
KYC document data (KTP image, name, date of birth) may be shared with accredited third-party identity verification providers who compare submitted documents against authoritative sources to confirm authenticity. These partners are contractually prohibited from using your data for any purpose other than verification.
Technical identifiers such as IP address, device fingerprint, and behavioural risk signals are processed by third-party fraud-prevention platforms to protect the integrity of the Platform and safeguard all players' accounts and funds.
ox138 will disclose Personal Data to regulatory bodies, law enforcement agencies, or courts when legally compelled to do so by a valid legal instrument. Where permitted by law, we will notify affected players of such disclosures.
In the event of a merger, acquisition, or sale of all or substantially all of ox138's assets, your Personal Data may be transferred to the acquiring entity. You will be notified via email prior to any such transfer, and the receiving entity will be required to honour the protections set out in this Privacy Policy.
No cross-border data sales. ox138 does not transfer Personal Data to overseas data brokers or advertising networks. Where data is processed outside of Indonesia by any of the third parties listed above, those transfers are governed by contractual data processing agreements incorporating internationally recognised standard clauses.
ox138 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account identity & KYC documents | 5 years after Account closure | Anti-money-laundering legal obligation |
| Financial transaction records (IDR deposits/withdrawals) | 5 years after transaction date | Legal obligation / audit trail |
| Gaming session & wagering history | 3 years after session date | Responsible gaming compliance / dispute resolution |
| Customer support correspondence | 3 years after ticket closure | Legitimate interest (dispute resolution) |
| Marketing consent records | Until consent is withdrawn + 1 year | Demonstrating consent compliance |
| Technical / server logs | 12 months | Security monitoring / fraud prevention |
| Cookie and analytics data (anonymised) | 13 months | Platform improvement (legitimate interest) |
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and product development purposes.
ox138 implements a layered security architecture designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our current security framework includes:
Security is a shared responsibility. ox138's technical safeguards are most effective when complemented by good personal security hygiene on your part — including using a unique, strong password for your ox138 Account, never sharing your login credentials, and notifying support immediately if you suspect any unauthorised activity on your Account.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, ox138 will notify affected players without undue delay and take all reasonable steps to contain and remediate the incident.
ox138 uses cookies and similar tracking technologies to operate the Platform efficiently and deliver a personalised experience. The following categories of cookies are in use:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly necessary | Maintain your login session, remember your Account state during a game session, and enforce security policies. Cannot be disabled without breaking core Platform functionality. | Session |
| Functional | Remember your language preference, preferred deposit method, and game display settings so you do not need to re-configure them on each visit. | Up to 12 months |
| Analytics | Collect anonymised, aggregated data on page performance, navigation paths, and feature adoption to help ox138 improve the Platform experience. | Up to 13 months |
| Fraud prevention | Store device and session identifiers used by our fraud-detection systems to identify suspicious activity and protect all players' accounts. | Up to 12 months |
ox138 does not use third-party advertising cookies or retargeting pixels that track your activity across other websites. You may manage cookie preferences through your browser's settings. Note that disabling strictly necessary cookies will impair or prevent your ability to log in and use the Platform.
As a player whose Personal Data is processed by ox138, you hold the following rights. To exercise any of these rights, contact our support team at the details provided in Clause 14.
Right of Access Request a copy of all Personal Data ox138 holds about you, including the purposes for which it is being processed.
Right to Rectification Request correction of any inaccurate or incomplete Personal Data held in your Account profile.
Right to Erasure Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Right to Restrict Processing Request that ox138 temporarily halt processing of your data while a rectification or objection request is being assessed.
Right to Data Portability Receive a copy of Personal Data you have provided to ox138 in a structured, machine-readable format (where technically feasible).
Right to Object Object to processing of your Personal Data where ox138 relies on legitimate interests as the legal basis, including profiling for fraud detection.
Right to Withdraw Consent Withdraw any consent you have given for marketing communications or optional data processing activities at any time, without affecting prior lawful processing.
Right to Lodge a Complaint File a complaint with the relevant data protection supervisory authority in your jurisdiction if you believe ox138 has processed your Personal Data in violation of applicable law.
ox138 will respond to all data rights requests within 30 calendar days of receipt. Where a request is complex or voluminous, we may extend this period by a further 60 days with prior notification. We will never charge a fee for processing a data rights request unless the request is manifestly unfounded or excessive.
ox138 operates a strict 21+ age policy. The Platform is not intended for, and must not be used by, any person under 21 years of age. ox138 does not knowingly collect or process Personal Data from individuals under 21.
During the registration process, you are required to declare that you are 21 years of age or older. ox138 may subsequently request documentary proof of age (KTP, passport, or driver's licence) at any time. Where an Account is found to have been registered by or on behalf of a person under 21:
Parents and guardians: If you believe a minor in your household has accessed the ox138 Platform, contact our support team immediately at [email protected]. We will investigate and act promptly. We strongly recommend the use of parental control software to restrict access to gambling websites on shared devices.
ox138 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will:
Your continued use of the ox138 Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the revised Policy, you must stop using the Platform and may request Account closure in accordance with the Terms & Conditions.
We encourage you to review this Privacy Policy periodically. The most current version will always be accessible at ox138.app/privacy-policy.
For any questions relating to this Privacy Policy, to exercise your data rights, or to report a suspected data security incident, please contact the ox138 Data Protection team through the following channels:
When submitting a data rights request by email, please include your full name, the email address associated with your ox138 Account, and a clear description of the right you wish to exercise. ox138 may ask you to verify your identity before processing the request.
ox138 aims to acknowledge all Privacy Policy queries and data rights requests within 72 hours of receipt and to provide a substantive response within 30 calendar days, extendable to 90 days for complex requests with prior notice.
For concerns about your gambling behaviour or use of the Platform's responsible gaming tools, please visit our Responsible Gaming page, or review our FAQ for answers to common privacy and account questions.
Six pillars underpin ox138's approach to data privacy — from collection through retention and beyond.
Every byte of data transmitted between your device and ox138 is protected by TLS 1.2+ encryption. KYC documents and financial records are stored under AES-256 encryption at rest — your sensitive information is never held in plain text.
ox138 requires every player to complete a full identity verification process before withdrawals are processed. This protects the entire player community by ensuring accounts are held only by verified adults aged 21 or older with legitimate payment methods.
ox138 has never sold, rented, or brokered player Personal Data to third-party advertisers or data aggregators. Your information is used exclusively to operate your Account, process payments, and keep the Platform secure.
Data is held only as long as legally required or operationally necessary. KYC and financial records are retained for five years post-Account closure to meet anti-money-laundering obligations; all other data is deleted or anonymised on a published schedule.
You can access, correct, port, restrict, or request deletion of your Personal Data at any time. ox138 responds to all data rights requests within 30 calendar days — no fees, no bureaucratic runaround, just a direct answer to your request.
Behavioural and gaming session data is analysed in real time to detect patterns that may indicate problem gambling. This data is used strictly to enforce player-protection tools — deposit limits, cooling-off periods, and self-exclusion — never for marketing profiling.
Now that you understand exactly how ox138 handles your personal information, join thousands of players across Jakarta, Surabaya, Bandung, and Bali who trust ox138 as their platform of choice. Explore our full game library, check the FAQ for quick answers, or log in to your Account right now.
21+ only. Please gamble responsibly. If you have concerns about your gambling behaviour, visit our Responsible Gaming page.