pol88 Privacy Policy

This Privacy Policy ("Policy") is published by pol88 ("pol88", "we", "us", or "our") and applies to all personal data processed in connection with the pol88 platform located at https://pol88.bio ("Platform") and all associated gaming, betting, and customer support services. By registering an account or continuing to use the Platform, you acknowledge that you have read this Policy and understand how your personal data is processed. This Policy should be read together with pol88's Terms & Conditions.

1. Definitions

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, including name, email address, date of birth, financial account details, device identifiers, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, pol88.
• "Data Processor" means a third party that Processes Personal Data on behalf of pol88 under a contractual arrangement.
• "KYC Data" means identity and address verification documents submitted by Users in accordance with pol88's Know Your Customer obligations.
• "Transaction Data" means records of deposits, withdrawals, wagers, bonus credits, and any other financial activity conducted on the Platform.
• "Device Data" means technical information automatically collected from a User's device when they access the Platform, including IP address, browser type, operating system, device model, and session timestamps.

2. Scope & Data Controller

This Policy covers all Personal Data Processing activities carried out by pol88 in connection with the Platform. It applies to:

• Registered account holders, including users who have initiated but not completed the registration process.
• Visitors to the Platform who have not registered an account but whose Device Data is passively collected during their visit.
• Former account holders whose data is retained for the minimum statutory period following account closure.

pol88 acts as the Data Controller for all Personal Data processed under this Policy. Where pol88 engages Data Processors to perform specific functions (such as payment processing, identity verification, or customer support software), those processors act under written contracts that impose data protection obligations consistent with this Policy.

3. Personal Data We Collect

pol88 collects Personal Data in three ways: data you provide directly, data generated automatically during your use of the Platform, and data received from authorised third-party sources such as identity verification providers.

3.1 Data You Provide Directly

Category	Examples	When Collected
Registration Data	Email address, username, date of birth, password (hashed)	Account registration
KYC Data	Full legal name, national ID number (KTP), passport scan, driver's license, proof of address (bank statement, utility bill)	Identity verification request
Payment Data	Bank account name, bank account number (partial), e-wallet identifier (OVO, GoPay, DANA, ShopeePay, LinkAja), transaction reference numbers	Deposit and withdrawal transactions
Support Data	Content of live chat messages, email correspondence, support ticket details	Customer support interactions
Responsible Gaming Data	Deposit limit settings, self-exclusion requests, cooling-off period activations	Use of responsible gaming tools

3.2 Data Collected Automatically

Category	Examples
Device Data	IP address, device type and model, operating system, browser type and version, screen resolution
Session Data	Login timestamps, session duration, pages visited, game titles accessed, betting market interactions
Transaction Data	Deposit amounts and timestamps, withdrawal requests, wager amounts, game outcomes, bonus activations
Cookie & Tracking Data	Session cookies, preference cookies, first-party analytics data (see Section 8 for full cookie disclosure)

3.3 Data from Third-Party Sources

pol88 may receive Personal Data from the following authorised third-party sources:

• Identity Verification Providers: Results of automated KYC checks (document authenticity, facial match, sanctions screening).
• Payment Processors: Transaction status confirmations from Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, GoPay, DANA, ShopeePay, LinkAja).
• Fraud Prevention Services: Risk scores and flagged identifiers from industry-standard fraud detection networks.

4. Legal Basis for Processing

pol88 processes Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing that is required to deliver the services set out in our Terms & Conditions — including account creation, deposit processing, game delivery, and withdrawal execution.
• Legal Obligation: Processing required to comply with anti-money-laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) obligations imposed by our licensing jurisdiction.
• Legitimate Interests: Processing for fraud prevention, platform security, product improvement, and responsible gaming monitoring — where these interests are not overridden by your privacy interests.
• Consent: Processing for optional communications such as promotional emails and push notifications, where you have provided explicit opt-in consent. Consent may be withdrawn at any time by contacting support or updating notification preferences in your account settings.

5. How We Use Your Personal Data

pol88 uses the Personal Data collected for the following purposes:

• Account Management: Creating and maintaining your pol88 account, authenticating your identity at login, enforcing account security, and processing account closure requests.
• Service Delivery: Processing deposits and withdrawals in IDR via Indonesian bank and e-wallet channels; providing access to casino games, sportsbook markets, live dealer tables, and other Platform products.
• Compliance & Regulatory Obligations: Conducting KYC verification, ongoing transaction monitoring for AML and CTF compliance, responding to lawful requests from regulatory authorities, and maintaining the records required by our licensing obligations.
• Fraud Prevention & Platform Security: Detecting multi-account registrations, identifying automated betting activity, investigating suspected bonus abuse, and protecting the Platform from unauthorised access.
• Customer Support: Responding to live chat queries, processing dispute submissions, and improving support quality through interaction analysis.
• Responsible Gaming: Monitoring behavioral indicators associated with problem gambling, applying account-level protections, and delivering responsible gaming communications where appropriate.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve game catalogue curation, interface design, and promotional relevance. This analysis does not identify individual users.
• Marketing Communications (with consent only): Sending promotional offers, deposit bonus notifications, and relevant product updates to users who have opted in to marketing communications. You may opt out at any time.

6. Third-Party Disclosure

pol88 does not sell, rent, or trade your Personal Data. We disclose data to third parties only in the following circumstances:

• Service Providers (Data Processors): pol88 engages vetted third-party providers for functions including identity verification, payment processing, customer support software, and cloud infrastructure hosting. These providers act solely on pol88's instructions under written data processing agreements and are prohibited from using your data for their own independent purposes.
• Game Studio Partners: Certain game studios (such as Evolution Gaming, Pragmatic Play, and Spribe) receive session tokens and game-round identifiers to deliver their content to your session. These partners do not receive your name, financial account details, or KYC documents.
• Payment Partners: Indonesian bank transfer partners and e-wallet providers (OVO, GoPay, DANA, ShopeePay, LinkAja) receive the minimum transaction data required to execute deposits and withdrawals. They process this data under their own privacy policies and applicable Indonesian financial regulation.
• Regulatory & Law Enforcement Authorities: pol88 will disclose Personal Data where required by a lawful order from a competent regulatory or law enforcement authority. We will notify you of any such disclosure to the extent permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of pol88's assets, Personal Data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

7. International Data Transfers

pol88's servers and some of its service providers are located outside of Indonesia. Where Personal Data is transferred to a country that does not provide a level of data protection equivalent to that applicable in Indonesia, pol88 implements appropriate safeguards, which may include:

• Standard contractual clauses approved by relevant data protection authorities.
• Binding corporate rules where the recipient is part of the same corporate group as pol88.
• Transfers to countries that have been assessed as providing an adequate level of protection by the applicable regulatory authority.

You may request details of the specific safeguards applied to any international transfer of your Personal Data by contacting pol88 support.

8. Cookies & Tracking Technologies

pol88 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

Cookie Type	Purpose	Duration
Strictly Necessary	Maintain your authenticated session, remember your language preference, and enable core Platform functionality. These cannot be disabled without breaking Platform features.	Session / up to 24 hours
Functional	Remember display preferences, game lobby filter settings, and responsible gaming tool configurations.	Up to 90 days
Analytics	First-party analytics to understand page performance, feature usage patterns, and session flow — used exclusively to improve the Platform. Data is aggregated and anonymised before analysis.	Up to 12 months
Security	Device fingerprinting tokens used to detect multi-account registrations, fraudulent login attempts, and automated bot activity.	Up to 12 months

pol88 does not use third-party advertising cookies or cross-site tracking technologies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent certain Platform features from functioning correctly.

9. Data Retention

pol88 retains Personal Data for the following minimum periods:

• Account and KYC Data: Retained for a minimum of 5 years following account closure, as required by anti-money-laundering record-keeping obligations applicable under our licensing framework.
• Transaction Data: Retained for a minimum of 5 years from the date of each transaction.
• Support Interaction Data: Retained for 3 years from the date of each interaction, to enable accurate dispute resolution.
• Marketing Consent Records: Retained for the duration of the account relationship and for 1 year following opt-out, to demonstrate compliance with consent requirements.
• Device and Session Data: Retained for 13 months in identifiable form, after which it is aggregated and anonymised.

Where retention is required beyond these minimum periods by a specific legal obligation, court order, or ongoing regulatory investigation, pol88 will retain the relevant data until that obligation is fulfilled.

10. Security Measures

pol88 implements the following technical and organisational security measures to protect your Personal Data:

• Encryption in Transit: All data exchanged between your device and the Platform is encrypted using TLS 1.2 or higher with 256-bit AES encryption.
• Encryption at Rest: Personal Data and financial records stored on pol88 infrastructure are encrypted at rest using AES-256.
• Access Controls: Internal access to Personal Data is restricted to authorised personnel on a need-to-know basis. Access is logged and audited quarterly.
• Two-Factor Authentication: pol88 offers optional 2FA for all account holders and requires it for internal administrative access to customer data systems.
• Independent Security Audits: pol88 engages an independent security firm to conduct penetration testing and infrastructure review on a quarterly basis.
• Incident Response Plan: pol88 maintains a documented data breach incident response plan that defines escalation paths, containment procedures, and notification obligations.

11. Your Privacy Rights

Subject to applicable law and our legitimate operational and compliance requirements, you have the following rights regarding your Personal Data:

• Right of Access: You may request a copy of the Personal Data pol88 holds about you. Requests are fulfilled within 30 days. pol88 reserves the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.
• Right to Rectification: If Personal Data held by pol88 is inaccurate or incomplete, you may request that it be corrected. Some corrections may require re-submission of KYC documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and there is no other legal basis for processing), or where processing is unlawful. This right is subject to pol88's legal retention obligations — data required for AML compliance cannot be deleted during the mandatory retention period.
• Right to Restriction of Processing: You may request that processing of your Personal Data be restricted in certain circumstances, such as where accuracy is contested or where processing is unlawful but you prefer restriction to erasure.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request that your data be provided in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming monitoring. pol88 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact pol88 support via live chat or email at [email protected]. We will respond within 30 days and may require identity verification before processing a data rights request.

12. Minors

The pol88 Platform is strictly for users aged 21 and above. pol88 does not knowingly collect Personal Data from individuals under 21 years of age. If pol88 discovers that Personal Data has been collected from a user who is under 21, the relevant account will be immediately closed, the data will be deleted (subject to any overriding legal retention obligation), and any balance held in the account will be dealt with in accordance with our minor account closure procedure.

If you are a parent or guardian and believe that your minor child has registered an account with pol88, please contact us immediately via live chat so we can investigate and take appropriate action without delay.

13. Changes to This Policy

pol88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our services. Material changes will be communicated to registered account holders via email to the registered address, with a minimum of 14 days' notice before the amended Policy takes effect. The "Last Updated" date at the top of this document reflects the most recent revision. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy.

We encourage you to review this Policy periodically. Archived versions of previous Policy iterations are available on request from our support team.

14. Contact & Complaints

For questions, data rights requests, or concerns regarding this Privacy Policy or pol88's data processing practices, please contact us via:

• Live Chat: Available 24/7 directly from your Account dashboard on the pol88 Platform. This is the fastest channel for urgent privacy or security concerns.
• Email: [email protected] — plain text only, not a clickable link.

pol88 aims to acknowledge all formal privacy enquiries within 2 business days (WIB / UTC+7) and to provide a substantive response within 30 calendar days.

If you are dissatisfied with pol88's response to a privacy complaint, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction under which pol88's licence is issued. Details of the relevant supervisory authority are available on request.