Your privacy matters to us. This Privacy Policy explains exactly what personal data 33xl collects, how we use it, who we share it with, and how we keep it secure — so you can make informed decisions about your information.
Last Updated: 1 January 2026Six principles that guide how 33xl handles your personal data every day.
All personal data transmitted to and stored by 33xl is protected with industry-standard 256-bit SSL encryption. Your KTP details, banking information, and account credentials are never stored in plain text.
We collect only the personal data that is strictly necessary to operate your account, process payments, verify your identity under KYC rules, and comply with our licensing obligations. Nothing more.
33xl does not sell, rent, or trade your personal data to advertisers, data brokers, or unaffiliated marketing companies. Your information stays within the 33xl ecosystem and its regulated service partners.
We are transparent about every category of data we collect and every purpose for which we use it. If our processing practices change materially, we will notify you before the change takes effect.
You retain meaningful rights over your personal data, including the right to access it, correct inaccuracies, and request deletion subject to legal retention requirements. Contact our support team to exercise these rights.
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Account data is deleted within 90 days of a verified closure request.
1.1 This Privacy Policy ("Policy") is published by the company operating the online betting platform accessible at https://33xl.cam ("33xl", "we", "us", "our"). It describes how we collect, use, disclose, store, and protect the personal data of individuals ("you", "your") who access our Platform, register a player account, or otherwise interact with our services.
1.2 33xl serves Indonesian players from an offshore international jurisdiction. We are committed to handling personal data responsibly and in accordance with applicable international data protection standards. While Indonesia's Personal Data Protection Law (UU PDP) and its implementing regulations continue to develop, we voluntarily align our practices with internationally recognised principles including those reflected in the EU General Data Protection Regulation (GDPR) as a benchmark for best practice.
1.3 This Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, all of which form part of the overall agreement governing your relationship with 33xl.
1.4 By registering a player account or continuing to use the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, please discontinue your use of the Platform and contact us to close your account.
The following terms carry the meanings set out below throughout this Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or can reasonably identify a living individual, whether directly (e.g., full name, KTP number) or indirectly (e.g., IP address, device ID, account number). |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, transfer, or deletion. |
| "Data Controller" | 33xl, as the entity that determines the purposes and means of processing personal data on the Platform. |
| "Data Processor" | A third-party service provider that processes personal data on behalf of 33xl under a contractual data processing agreement. |
| "KYC" | Know Your Customer — the identity and age-verification process required of all Players before withdrawals are processed. |
| "Cookie" | A small text file placed on your device by the Platform to store session information, preferences, and analytics data. |
| "Platform" | The 33xl website at https://33xl.cam and any associated mobile web interface or software application. |
3.1 Registration Data: When you create a player account, we collect your full legal name (as it appears on your KTP), date of birth, residential address in Indonesia, email address, and mobile phone number. This data is necessary to establish and manage your account.
3.2 Identity Verification (KYC) Data: To comply with our licensing obligations and prevent underage gambling and fraud, we collect images of your Indonesian National Identity Card (KTP), selfie photographs, and bank account confirmation documents. These documents are processed solely for verification purposes.
3.3 Financial Data: We record details of deposits and withdrawals, including the bank name (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga), account holder name, partial account number (masked), transaction amounts in IDR, and transaction timestamps. We do not store complete bank account numbers or e-wallet PINs.
3.4 Gameplay Data: We record your betting history, casino game sessions, wagering amounts, game outcomes, bonus usage, and account balance movements. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory reporting.
3.5 Technical Data: We automatically collect IP address, browser type and version, device type and operating system, screen resolution, session duration, pages visited, clickstream data, and referring URLs. This data is used for Platform security, fraud prevention, and performance optimisation.
3.6 Communications Data: If you contact our support team via live chat or email, we retain records of those communica tions for quality assurance, training, and dispute resolution purposes.
3.7 Responsible Gaming Data: We record any deposit limits, time-outs, or self-exclusion periods you set on your account. This data is necessary to enforce the responsible gaming controls you have chosen.
4.1 Direct Collection: Most personal data is provided directly by you when you complete the registration form, submit KYC documents, deposit or withdraw funds, place bets, adjust account settings, or contact our support team.
4.2 Automated Collection: Technical data such as IP address, device type, browser version, and clickstream behaviour is collected automatically via cookies, server logs, and analytics tools each time you access the Platform.
4.3 Third-Party Sources: In limited cases, we may obtain verification data from third-party identity validation services or financial fraud prevention databases to confirm your identity or assess transaction risk. Any such data is collected in accordance with applicable law and industry standards.
5.1 We process your personal data for the following purposes, each of which is supported by a lawful basis under international data protection principles:
| Purpose | Legal Basis |
|---|---|
| Account registration and management | Performance of our contract with you (Terms & Conditions) |
| Identity and age verification (KYC) | Legal obligation under our gaming licence and responsible gaming duties |
| Processing deposits and withdrawals | Performance of contract; legitimate interest in secure payment processing |
| Recording gameplay and bet settlement | Performance of contract; legitimate interest in accurate account management |
| Fraud prevention and security monitoring | Legal obligation; legitimate interest in protecting the Platform and other users |
| Responsible gaming monitoring (identifying problem behaviour) | Legal obligation under licensing conditions; legitimate interest in player welfare |
| Customer support and dispute resolution | Performance of contract; legitimate interest in service quality |
| Sending promotional emails (where consented) | Consent (you may withdraw consent at any time via account settings) |
| Platform analytics and improvement | Legitimate interest in optimising user experience and technical performance |
| Regulatory reporting (e.g., suspicious transaction reports) | Legal obligation under AML/CTF regulations |
5.2 Where we process personal data based on legitimate interest, we have conducted a balancing assessment confirming that the processing is necessary, proportionate, and does not override your fundamental rights.
6.1 33xl does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the limited circumstances described below, and only with parties bound by confidentiality obligations:
6.2 All third-party service providers engaged by 33xl are contractually bound to process personal data only in accordance with our instructions and to implement appropriate technical and organisational security measures.
7.1 The 33xl Platform uses cookies and similar tracking technologies (local storage, session tokens, device fingerprints) to provide core functionality, enhance user experience, and gather analytics.
7.2 Cookie Categories:
7.3 You can manage or delete cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Most modern browsers also offer "Do Not Track" signals, though industry response to these signals remains inconsistent.
7.4 33xl does not use third-party advertising cookies or participate in behavioural ad networks that track you across unrelated websites.
8.1 33xl implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:
8.2 While we employ industry-standard security, no method of transmission or storage over the internet is completely secure. You are responsible for maintaining the confidentiality of your password and for any activity under your account.
8.3 If you become aware of any unauthorised access to your account, change your password immediately and contact our support team without delay.
9.1 33xl retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods are as follows:
| Data Category | Retention Period |
|---|---|
| Account registration data (name, email, phone, address) | Duration of active account + 90 days after verified closure request |
| KYC documents (KTP images, selfies) | 5 years after account closure (regulatory requirement for AML compliance) |
| Transaction history (deposits, withdrawals, bets) | 7 years after transaction date (tax and financial reporting requirements) |
| Gameplay records and bet settlements | 7 years after bet settlement (dispute resolution and regulatory audit requirements) |
| Support chat transcripts and email correspondence | 3 years after final message (quality assurance and training) |
| Marketing consent records | Duration of active account + 2 years after closure (proof of consent) |
| Server logs and IP address records | 90 days (security and fraud detection) |
| Self-exclusion records | Permanent (to prevent re-registration during exclusion period) |
9.2 Upon expiry of the relevant retention period, personal data is securely deleted or anonymised such that it can no longer identify you. Anonymised data may be retained indefinitely for statistical and research purposes.
9.3 If you request account closure, we will delete your registration data within 90 days. However, data subject to longer legal retention periods (KYC documents, transaction history) will be archived in a secure environment with restricted access until the retention period expires.
10.1 You have the following rights with respect to your personal data. To exercise any of these rights, please contact our Data Protection Officer via the details provided in Clause 15.
Request a copy of the personal data we hold about you. We will respond within 30 days with a data export in portable format.
Correct inaccurate or incomplete personal data. Most account details can be updated directly via your account settings page.
Request deletion of your personal data. Subject to legal retention obligations (KYC, transaction records), we will erase data within 90 days of a verified request.
Ask us to suspend processing of your data while a dispute or accuracy concern is resolved. Your account may be temporarily limited during this period.
Receive your personal data in a structured, commonly used format for transfer to another service provider where technically feasible.
Object to processing based on legitimate interest (e.g., direct marketing). We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.
10.2 To protect your privacy, we will verify your identity before processing any data subject request. We may ask you to provide a copy of your KTP and answer security questions to confirm you are the account holder.
10.3 If your request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or refuse to act on the request. We will explain our decision if this occurs.
11.1 33xl operates from an offshore jurisdiction and serves Indonesian players internationally. Your personal data is stored on secure servers located outside Indonesia, in data centres that meet international security and privacy standards.
11.2 Some of our service providers (payment processors, KYC verification services, cloud hosting providers) are also located in jurisdictions outside Indonesia. When we transfer personal data internationally, we ensure that:
11.3 You acknowledge and consent to the international transfer of your personal data as described in this Clause by continuing to use the Platform.
12.1 The 33xl Platform is intended solely for individuals aged 21 years or older. We do not knowingly collect personal data from individuals under 21.
12.2 If we become aware that a person under 21 has registered an account, we will immediately close that account, return any deposited funds (less the value of bets already placed), and delete all associated personal data except as required for regulatory reporting.
12.3 Parents or guardians who believe their child has provided personal data to 33xl should contact our support team immediately using the details in Clause 15.
13.1 The Platform may contain links to third-party websites or services (such as game studios' own sites, payment provider portals, or responsible gaming resources). This Privacy Policy applies only to 33xl's own processing activities.
13.2 We are not responsible for the privacy practices or content of any third-party site. We encourage you to read the privacy policy of any site you visit via a link from our Platform before providing personal data to that site.
14.1 33xl reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technological developments.
14.2 Where amendments are material (e.g., expanding the purposes for which we process data, or sharing data with new categories of third parties), we will notify you by displaying a prominent notice on the Platform and, where practicable, by sending an email to your registered address at least 14 days before the amended Policy takes effect.
14.3 Your continued use of the Platform after the effective date of an amended Policy constitutes your acceptance of the changes. If you do not agree to the amendments, please close your account before the effective date.
14.4 The "Last Updated" date at the top of this page reflects the most recent revision. We recommend reviewing this Policy periodically to stay informed of our data handling practices.
15.1 If you have any questions, concerns, or complaints about this Privacy Policy or about how 33xl handles your personal data, please contact our Data Protection Officer:
15.2 We will acknowledge your enquiry within 2 business days and provide a substantive response within 30 days. If your matter is complex, we may extend this period by a further 30 days and will explain the reason for the delay.
15.3 If you are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in the jurisdiction where 33xl holds its gaming licence, or in your country of residence if applicable data protection law permits.
Our support team is available 24/7 to answer any data protection enquiries. You can also explore our Terms, FAQ, and Responsible Gaming resources.