idr108 Privacy Policy

This Privacy Policy applies to all personal data collected, processed, stored, and transmitted by idr108 in connection with the operation of the online betting and casino platform available at https://idr108.net and all associated subdomains, mobile web interfaces, and API integrations (collectively, the "Platform").

This policy applies to:

• All registered Members of the idr108 Platform, regardless of the device or method through which they access the service.
• Prospective Members who have initiated but not completed the registration process.
• Visitors to the idr108 website who have not registered an Account but whose technical data (e.g., IP address, browser type, cookie identifiers) is collected via standard web server and analytics tools.

This Privacy Policy should be read alongside the idr108 Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between idr108 and its Members. By registering an Account or continuing to use the Platform, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

idr108 collects personal data across the following categories:

idr108 does not knowingly collect sensitive categories of personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) beyond what is strictly required for age and identity verification under KYC obligations.

idr108 collects personal data through the following channels:

• Directly from you: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or participating in promotions and surveys.
• Automatically via the Platform: Technical and usage data collected through web server logs, session tracking, and first-party analytics tools when you access and interact with the idr108 website or any integrated game interface.
• From payment processors and banking partners: Transaction confirmation data and, where required, identity confirmation data from BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja when processing your deposits and withdrawals.
• From third-party KYC and fraud-prevention providers: Identity verification results, fraud risk scores, and device fingerprinting data from specialist compliance service providers engaged by idr108.
• From game studios: Aggregated game session data, RNG certification references, and jackpot event data from studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. This data is used to resolve disputes and maintain game integrity records.

idr108 processes your personal data for the following specific, documented purposes:

• Account creation and management: To register, authenticate, and maintain your idr108 Account, including password reset, session management, and account security notifications.
• Identity and age verification (KYC): To confirm that you are a real individual, that you are at least 21 years of age, and that you are a resident of Indonesia, as required by our operating standards and responsible gaming obligations.
• Payment processing: To execute deposits and withdrawal requests via your registered local bank account or e-wallet, and to maintain accurate IDR-denominated financial records.
• Fraud detection and prevention: To identify, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and any other prohibited conduct described in the idr108 Terms & Conditions.
• Responsible gaming monitoring: To detect patterns of play that may indicate problem gambling behaviour, and to enforce self-exclusion, deposit limit, and time-out settings applied by Members through their Account or via the support team.
• Customer support: To respond to your inquiries, resolve disputes, process complaints, and provide 24/7 Indonesian-speaking assistance through live chat and email.
• Marketing communications: To send you promotional offers, bonus notifications, and information about new games and features — exclusively where you have provided explicit consent. Campaigns may include events tied to the Indonesian cultural calendar, such as Idul Fitri, Ramadhan, and Indonesian Independence Day (17 August).
• Platform improvement and analytics: To understand how Members use the Platform, identify technical issues, optimise game performance, and inform product development decisions.
• Legal and regulatory compliance: To fulfil any legal obligations applicable to idr108's operations, respond to lawful requests from courts or regulatory authorities, and enforce idr108's contractual rights.

idr108 processes your personal data on one or more of the following legal grounds, depending on the specific purpose of processing:

• Contractual necessity: Processing that is required to perform the contract between idr108 and you as a registered Member — including account management, payment processing, and the delivery of betting and casino services.
• Legitimate interests: Processing carried out in pursuit of idr108's legitimate business interests — such as fraud detection, security monitoring, and internal analytics — where those interests are not overridden by your fundamental rights and freedoms.
• Legal obligation: Processing that is necessary to comply with applicable legal or regulatory requirements, including anti-money laundering (AML) obligations, KYC/CDD requirements, and responses to lawful orders from courts or government authorities.
• Consent: Processing carried out on the basis of your explicit, freely given, specific, and informed consent — primarily for optional marketing communications. You may withdraw consent at any time without penalty to your Account access.

idr108 does not sell your personal data. We share personal data with third parties only in the following circumstances and only to the extent strictly necessary:

• Payment processors and banking partners: Your name, account number, and transaction amount are shared with your nominated payment method provider (e.g., BCA, BRI, OVO, GoPay) to execute deposit and withdrawal transactions.
• KYC and identity verification providers: Your identity documents and personal details may be shared with specialist third-party KYC providers for the purpose of document authentication and fraud risk scoring.
• Game studios and content providers: Aggregated session identifiers and game-play data are shared with studios such as Pragmatic Play, Evolution Gaming, and Spribe as required to deliver their games and resolve any game-outcome disputes.
• Cloud infrastructure and hosting providers: idr108 uses cloud-based server infrastructure. Personal data stored on these systems is subject to the same security standards and contractual protections as data on idr108-managed hardware.
• Legal and regulatory authorities: idr108 will disclose personal data to courts, law enforcement agencies, or regulatory bodies where required to do so by a lawful order, or where idr108 reasonably believes disclosure is necessary to prevent crime, protect the safety of any person, or enforce its legal rights.
• Corporate transactions: In the event of a merger, acquisition, or restructuring involving idr108's operating entity, Member personal data may be transferred to the acquiring or successor entity as part of the transaction, subject to equivalent privacy protections.

All third-party data processors engaged by idr108 are subject to written data processing agreements that require them to process Member data solely on idr108's instructions, to maintain appropriate security measures, and to prohibit further disclosure or onward transfer without idr108's authorisation.

idr108 uses first-party cookies and similar client-side tracking technologies to provide a functional, secure, and personalised experience on the Platform. The following categories of cookies are in use:

idr108 does not load third-party advertising cookies, social media tracking pixels, or cross-site behavioural tracking technologies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from logging in and using core Platform features.

idr108 retains personal data for the minimum period necessary to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required by law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active Account relationship with idr108, plus a minimum of 5 years following Account closure, to satisfy AML record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, consistent with standard financial record-keeping requirements.
• KYC verification documents: Retained for the duration of the Account relationship plus 5 years from Account closure, or longer if required by a specific regulatory obligation or legal proceeding.
• Customer support communications: Retained for 2 years from the date of the last communication in a given support thread, unless the communication relates to an open or ongoing dispute.
• Marketing preference records: Retained for the duration of the Account relationship and for 1 year following Account closure, as evidence of consent status.
• Technical and usage logs: Retained for up to 12 months in active log storage, after which they are either deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted from idr108 systems using industry-standard data destruction procedures, or anonymised in such a way that it can no longer be attributed to any identifiable individual.

idr108 implements a layered approach to information security designed to protect Member data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:

• Encryption in transit: All data exchanged between your browser or device and idr108 servers is encrypted using TLS 1.2 or higher. HTTPS is enforced across all Platform endpoints; plain HTTP connections are not permitted.
• Encryption at rest: Sensitive personal and financial data stored in idr108 databases is encrypted at rest using AES-256 or equivalent industry-standard encryption.
• Access control: Internal systems containing Member data are protected by role-based access controls, multi-factor authentication for administrative users, and comprehensive audit logging of all data access events.
• Penetration testing and vulnerability management: idr108 conducts regular vulnerability assessments and periodic penetration tests to identify and remediate security weaknesses in the Platform and supporting infrastructure.
• Incident response: idr108 maintains a documented data breach response procedure. In the event of a confirmed personal data breach that poses a risk to affected Members, we will notify impacted Members and relevant authorities within the timeframes required by applicable law.
• Staff training: All idr108 staff with access to Member personal data undergo mandatory privacy and security training upon onboarding and at regular intervals thereafter.

As a Member of idr108, you have the following rights in respect of your personal data. To exercise any of these rights, contact the idr108 privacy team at [email protected] with the subject line "Privacy Rights Request":

• Right of Access: You may request a copy of the personal data idr108 holds about you, together with information about the purposes for which it is processed and the categories of recipients with whom it has been shared.
• Right to Rectification: You may request that inaccurate or incomplete personal data held by idr108 be corrected or updated. You may update basic profile information directly through your Account settings at any time.
• Right to Erasure: You may request that idr108 delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn your consent and no other legal basis applies. Note that erasure may not be possible where idr108 is required to retain data for legal or regulatory compliance purposes.
• Right to Restriction: You may request that idr108 restrict the processing of your personal data in certain circumstances, such as while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that idr108 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to idr108's processing of your personal data where that processing is based on legitimate interests. idr108 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Marketing Consent: You may opt out of marketing communications at any time through your Account settings or by contacting support. Withdrawal of marketing consent does not affect your Account access or any other processing activities.

idr108 will respond to all privacy rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

idr108 does not permit any individual under the age of 21 to register an Account, access the Platform, or engage in any betting or gaming activity. The idr108 Platform is strictly for adults aged 21 and over.

idr108 applies a mandatory age verification step during the registration process and reserves the right to request identity documentation — including a copy of your KTP (Kartu Tanda Penduduk) — at any stage to confirm that you meet the minimum age requirement. Accounts where age verification cannot be satisfactorily completed will be suspended pending resolution.

If idr108 discovers that personal data has been collected from or in connection with an individual who is under 21 years of age, we will take immediate steps to close the associated Account, refund any net deposits made, and delete the minor's personal data from our systems, except to the extent that retention is required for fraud investigation or legal compliance purposes.

idr108's primary target audience is Indonesian players and, where operationally practicable, Member data is stored on servers located within or proximate to the Southeast Asian region. However, some of idr108's third-party service providers — including cloud infrastructure partners, game studios (e.g., Evolution Gaming, Pragmatic Play, Spribe), and KYC verification providers — operate globally and may process Member data in jurisdictions outside Indonesia.

Where personal data is transferred outside Indonesia, idr108 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Indonesia. These safeguards may include:

• Standard contractual data protection clauses incorporated into agreements with third-party data processors.
• Binding corporate rules or equivalent intra-group transfer agreements where the recipient is part of a corporate group.
• Transfers to jurisdictions assessed as providing an adequate level of data protection.

If you would like further information about the specific safeguards in place for any particular international transfer, please contact our privacy team at [email protected].

idr108 may update this Privacy Policy from time to time to reflect changes in our data processing practices, the services we offer, or applicable legal and regulatory requirements. Material changes to this policy will be communicated to registered Members via email notification to the address on record and/or via a prominent notice displayed on the Platform, no less than 7 days prior to the effective date of the change.

The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision. We encourage you to review this Privacy Policy periodically. Your continued use of the idr108 Platform after a revised policy has come into effect constitutes your acceptance of the updated terms.

If the proposed changes are material and you do not agree with them, you have the right to close your Account prior to the effective date of the revised policy. Pending balance will be returned to your registered payment method subject to standard verification checks.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way idr108 processes your personal data, please contact our privacy team using the details below. We are committed to resolving all privacy-related inquiries promptly and transparently.

• Email: [email protected] (subject line: "Privacy Rights Request")
• Support Hours: 24/7 · WIB (UTC+7)
• Response Time: We aim to acknowledge all privacy inquiries within 2 business days and provide a substantive response within 30 days of receipt.

For general customer support inquiries unrelated to privacy — such as account access, deposits, withdrawals, or game queries — please use the live chat feature available on the Platform or email the same address with a descriptive subject line.