Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or could reasonably identify a living individual, including names, email addresses, phone numbers, financial details, device identifiers, and IP addresses.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, alteration, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" means win108, the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means a third party that Processes Personal Data on behalf of win108 under a written data-processing agreement.
• "KYC" (Know Your Customer) means the identity and age verification procedures win108 carries out to comply with anti-money laundering obligations and confirm that Users are at least 21 years of age.
• "Cookies" means small text files placed on your device by the Platform to recognize your browser, maintain session state, and analyze usage patterns.
• "Account" means the personal betting account registered by a User on the win108 Platform.

2. Information We Collect

2.1 Information You Provide Directly

When you register for an Account, use Platform features, or contact our support team, we collect information you voluntarily provide, which may include:

• Identity Data: full legal name, date of birth, gender, nationality, and Indonesian national identity number (KTP number) as required for KYC verification.
• Contact Data: email address, mobile phone number, and residential address in Indonesia (including city, province, and postal code).
• Financial Data: bank account details (e.g., BCA, BRI, BNI, or Mandiri account number and account holder name), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction histories for deposits and withdrawals processed through the Platform.
• Identity Documents: scanned or photographed copies of government-issued identification (KTP), proof of address, and source-of-funds documentation when requested for enhanced KYC or large withdrawal verification.
• Communications Data: messages sent to our live chat, email support, or WhatsApp channel, including the content of those communications.
• Responsible Gaming Data: any deposit limits, time-out preferences, or self-exclusion requests you submit through your Account settings.

2.2 Information Collected Automatically

When you access the Platform, our servers and analytics systems automatically record:

• Technical Data: IP address, browser type and version, operating system, device type (desktop, smartphone, tablet), screen resolution, and device identifiers.
• Usage Data: pages visited, features used, search queries entered within the Platform, game sessions initiated, bet history, session duration, and click-path data.
• Location Data: approximate geographic location derived from your IP address (typically accurate to city level). We do not collect precise GPS location without explicit permission.
• Cookie and Tracking Data: data collected through cookies, web beacons, and similar technologies as described in Section 8 of this Policy.

2.3 Information Received from Third Parties

We may receive Personal Data about you from the following third-party sources:

• Payment Processors: transaction confirmation data from BCA, BRI, BNI, Mandiri, and e-wallet providers to reconcile deposits and withdrawals.
• Identity Verification Providers: results of KYC checks conducted by third-party verification services used to confirm identity and age.
• Fraud Prevention Services: risk signals and fraud scores from fraud detection partners to protect the integrity of the Platform and the security of User funds.
• Referral Partners: basic identifying information (name and email) where you have been referred to win108 by a legitimate referral partner and have consented to the referral.

3. How We Use Your Personal Data

win108 uses collected Personal Data only for the purposes listed below. We do not engage in automated decision-making that produces legal or similarly significant effects without human review.

4. Disclosure and Data Sharing

4.1 Service Providers and Data Processors

win108 engages trusted third-party service providers that Process Personal Data on our behalf under written data-processing agreements that impose confidentiality and security obligations equivalent to those in this Policy. Categories include:

• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) for transaction processing.
• Identity verification (KYC) service providers for age and document verification.
• Cloud hosting and infrastructure providers that store Platform data on secure servers.
• Fraud detection and cyber-security vendors.
• Customer support software providers for live chat and ticket management.
• Analytics providers (using anonymized or pseudonymized data) for Platform performance measurement.

4.2 Legal and Regulatory Disclosure

We may disclose your Personal Data to governmental authorities, law enforcement agencies, or regulatory bodies where we are required or legally permitted to do so, including in response to a valid court order, subpoena, or regulatory investigation. We will notify you of any such disclosure to the extent permitted by law.

4.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or part of the Company's assets, your Personal Data may be transferred to the acquiring entity as part of the transaction. We will notify affected Users by email or prominent notice on the Platform before Personal Data is transferred and becomes subject to a materially different privacy policy.

5. Data Retention

win108 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable law. Our standard retention periods are:

• Active Account Data: retained throughout the period your Account remains open and active.
• Transaction and Financial Records: retained for a minimum of 5 years from the date of the transaction to comply with anti-money laundering record-keeping requirements.
• KYC and Identity Documents: retained for a minimum of 5 years from Account closure or the date the document was submitted, whichever is later.
• Customer Support Communications: retained for 3 years from the date of the last correspondence.
• Technical and Usage Logs: retained for 12 months in identifiable form, then anonymized for analytical purposes.
• Marketing Preferences: retained until you withdraw consent or close your Account, after which your opt-out record is retained for 5 years to prevent accidental re-contact.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized using industry-standard methods so that it can no longer be attributed to any individual.

6. Your Data Rights

As a User of the win108 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our Data Protection team at the details provided in Section 10 of this Policy.

• Right of Access: You may request a copy of the Personal Data win108 holds about you, along with information about how it is used and shared.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that override this right.
• Right to Restriction: You may request that we restrict Processing of your Personal Data in certain circumstances, for example while the accuracy of data is being contested.
• Right to Data Portability: Where Processing is based on your consent or contractual necessity and carried out by automated means, you may request that we provide your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to Processing based on legitimate interests, including direct marketing. Where you object to direct marketing, we will cease Processing immediately.
• Right to Withdraw Consent: Where Processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of Processing that occurred before withdrawal.

7. Data Security

win108 implements a comprehensive, layered security framework to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption in Transit: All communications between your device and our servers are encrypted using TLS 1.2 or higher (256-bit SSL certificates), ensuring that data cannot be intercepted in transmission.
• Encryption at Rest: Sensitive Personal Data, including financial details and identity documents, is encrypted at rest using AES-256 encryption on our database servers.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Internal staff are granted role-based permissions, and all access is logged and audited regularly.
• Two-Factor Authentication: Administrative access to systems holding Personal Data requires multi-factor authentication (MFA). We also strongly recommend that Users enable two-factor authentication on their own Accounts.
• Penetration Testing: We engage independent cybersecurity firms to conduct regular penetration tests and vulnerability assessments of our Platform infrastructure.
• Incident Response: win108 maintains a documented data breach response plan. In the event of a confirmed breach affecting your Personal Data, we will notify you within 72 hours of becoming aware of the incident and provide guidance on protective steps you can take.
• Staff Training: All win108 employees who handle Personal Data undergo mandatory privacy and security training upon onboarding and at regular intervals thereafter.

While we apply rigorous security standards, no method of electronic storage or internet transmission is completely immune to risk. You also play a role in keeping your Account secure: use a strong, unique password, do not share your login credentials, and contact us immediately if you suspect unauthorized access to your Account.

8. Cookies and Tracking Technologies

win108 uses cookies and similar technologies (web beacons, pixel tags, local storage) on the Platform. The table below describes the categories of cookies we deploy and their purposes:

Most web browsers allow you to control cookie settings through their preferences or settings menu. Disabling strictly necessary cookies may impair Platform functionality and prevent you from accessing your Account. To manage cookies, consult the help documentation for your specific browser (Chrome, Firefox, Safari, Edge, or your mobile browser of choice).

9. Minors and Age Restrictions

The win108 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals under 21 years of age. Our registration process includes mandatory age declaration, and we conduct KYC verification to confirm the age and identity of all Users.

If we discover or are notified that we have inadvertently collected Personal Data from a person under 21, we will immediately suspend the associated Account, delete all related Personal Data, and refund any deposited funds to the originating payment source. If you are a parent or guardian and believe your child has registered on win108 without authorization, please contact our support team immediately at [email protected].

10. International Data Transfers

win108 operates globally, and your Personal Data may be transferred to and stored on servers located outside of Indonesia. In particular, our cloud infrastructure, KYC verification partners, and fraud detection systems may involve data Processing in jurisdictions such as Singapore, Hong Kong, or the European Union.

Whenever we transfer Personal Data outside Indonesia, we implement appropriate safeguards to ensure that your data receives an equivalent level of protection, including:

• Standard contractual clauses (SCCs) incorporated into agreements with Data Processors in third countries.
• Transfers only to jurisdictions or recipients that provide adequate data protection standards.
• Technical measures such as encryption to protect data during international transmission.

11. Changes to This Privacy Policy

win108 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or business operations. When we make material changes, we will notify you by posting a prominent notice on the Platform and, where your email address is on file, by sending a direct notification to your registered email address at least 14 days before the changes take effect.

We encourage you to review this Privacy Policy periodically. The "Effective Date" and "Last Reviewed" dates at the top of this page indicate when the Policy was most recently revised. Your continued use of the win108 Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

12. Contact and Data Protection Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please contact the win108 Data Protection team through any of the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 through the win108 Platform
• WhatsApp: +62 812 3456 7890 (available daily 08:00–02:00 WIB)

We are committed to resolving all privacy-related inquiries promptly, professionally, and in accordance with applicable data protection standards. If you are not satisfied with our response, you retain the right to escalate your concern to the relevant data protection authority in your jurisdiction.