idr138 Privacy Policy

1. Introduction

This Privacy Policy applies to idr138, the online gaming platform accessible at https://idr138.cam (the "Platform," "Website," "Service," "we," "us," or "our"). This Policy governs all personal information collected from users ("you," "your," or "Player") through our website, mobile applications, customer support channels, and any other services we provide.

idr138 operates in accordance with internationally recognized data protection principles and complies with applicable privacy laws in the jurisdictions where we are licensed to operate. As a platform serving Indonesian players, we acknowledge the evolving data protection landscape in Indonesia and respect your fundamental right to privacy.

We are the data controller responsible for your personal information. This means we determine the purposes and means of processing your data. Questions about how we handle your information should be directed to our Data Protection Officer using the contact details provided at the end of this Policy.

2. Information We Collect

To provide our gaming services, process transactions, comply with legal obligations, and enhance your experience, idr138 collects several categories of personal information:

2.1 Registration Information

When you create an idr138 account, we collect:

• Personal Identifiers: Full legal name, date of birth, gender, nationality
• Contact Details: Email address, phone number, residential address (street, city, province, postal code)
• Account Credentials: Username, password (stored in encrypted format)
• Preferred Settings: Language preference, currency (Indonesian Rupiah), communication preferences

2.2 Verification Documents (KYC)

To verify your identity and comply with Know Your Customer (KYC) and anti-money laundering regulations, we collect:

• Government-Issued ID: Scanned copies or photos of your Indonesian national identity card (KTP), driver's license (SIM), or passport showing your name, photo, date of birth, ID number, and expiration date
• Proof of Address: Utility bills, bank statements, or official correspondence dated within the last three months confirming your registered residential address
• Selfie Verification: Photograph of you holding your ID document next to your face to confirm physical possession and prevent identity theft

2.3 Financial Information

For deposits, withdrawals, and payment processing, we collect:

• Payment Method Details: Bank account number, bank name (BCA, BRI, BNI, Mandiri, etc.), account holder name, e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay)
• Transaction History: Deposit amounts, withdrawal amounts, timestamps, payment method used, transaction status, reference numbers
• Financial Verification: In some cases, bank statements or proof of funds to verify the source of deposits exceeding certain thresholds

Note: We do not store complete credit card numbers or CVV security codes. Payment card transactions are processed through PCI-DSS compliant third-party payment gateways that handle sensitive card data according to strict security standards.

2.4 Gaming Activity Data

To provide gaming services and ensure fair play, we track:

• Bet History: Games played, bet amounts, outcomes (wins/losses), timestamps, stake selections (sports betting markets, slot spins, casino hands)
• Bonus Usage: Bonuses claimed, wagering progress toward bonus requirements, bonus expiration dates, bonus terms accepted
• Account Balance: Real money balance, bonus balance, pending withdrawals, transaction logs
• Gaming Patterns: Favorite games, session duration, betting patterns (used for responsible gaming monitoring and fraud detection)

2.5 Technical and Device Information

When you access idr138, we automatically collect technical data including:

• Device Information: Device type (smartphone, tablet, desktop), operating system (Android, iOS, Windows, macOS), browser type and version, screen resolution, device language settings
• Network Data: IP address, internet service provider, approximate geographic location (city-level based on IP), connection type
• Usage Data: Pages visited, features used, clicks, navigation paths, time spent on pages, referral source (how you found idr138)
• Performance Data: Page load times, error messages, crash reports (used to improve platform stability)

2.6 Communications

We retain records of your communications with us including:

• Customer Support Interactions: Live chat transcripts, email correspondence, WhatsApp messages, support ticket history, phone call recordings (where legally permitted and with notice)
• Marketing Communications: Your responses to promotional emails, SMS messages, or push notifications, including whether you opened emails or clicked links
• Feedback and Surveys: Any feedback, reviews, survey responses, or testimonials you voluntarily provide

3. How We Use Your Information

idr138 processes your personal information for the following specific purposes:

3.1 Service Provision

• Creating and managing your user account
• Authenticating your identity when you log in
• Processing deposits and withdrawals
• Enabling gameplay on slots, live casino, sports betting, and other gaming products
• Calculating and crediting winnings to your account
• Applying bonuses and tracking wagering requirements
• Providing customer support and responding to inquiries

3.2 Legal Compliance

• Verifying your identity and age (21+ requirement) through KYC procedures
• Complying with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations
• Detecting and preventing fraud, money laundering, bonus abuse, and other illegal activities
• Responding to legal requests from law enforcement or regulatory authorities
• Maintaining records as required by our gaming licenses and applicable laws

3.3 Security and Fraud Prevention

• Monitoring for unusual account activity or suspicious betting patterns
• Detecting multiple accounts (multi-accounting) through IP address matching, device fingerprinting, and behavioral analysis
• Preventing unauthorized access to your account
• Blocking access from prohibited jurisdictions
• Investigating disputes, chargebacks, and payment fraud

3.4 Platform Improvement

• Analyzing usage patterns to improve website design and user experience
• Testing new features and gaming products
• Optimizing platform performance and loading speeds
• Identifying and fixing technical bugs or errors
• Conducting market research to understand player preferences

3.5 Marketing and Communications

• Sending promotional offers, bonus announcements, and personalized recommendations (only with your consent)
• Notifying you of new games, features, or platform updates
• Conducting customer satisfaction surveys
• Delivering targeted advertising based on your interests and gaming activity

You can opt out of marketing communications at any time by clicking the unsubscribe link in promotional emails, adjusting your communication preferences in account settings, or contacting customer support.

3.6 Responsible Gaming

• Monitoring gaming behavior for signs of problem gambling
• Enforcing deposit limits, loss limits, and self-exclusion requests
• Providing responsible gaming tools and resources
• Intervening when we detect potentially harmful gambling patterns

4. Data Sharing and Disclosure

idr138 does not sell your personal information to third parties. However, we may share your data with the following categories of recipients for legitimate business purposes:

4.1 Service Providers

We engage trusted third-party companies to perform services on our behalf, including:

• Payment Processors: Banks and payment gateways that process deposits and withdrawals (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay providers)
• Game Providers: Software developers who supply casino games and live dealer tables (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft)
• Verification Services: Identity verification platforms that authenticate your KYC documents
• Cloud Hosting: Server and infrastructure providers that host our platform and databases
• Customer Support Tools: Live chat, email, and ticketing systems
• Analytics Providers: Services that help us understand website usage and user behavior
• Marketing Platforms: Email delivery services and advertising partners (only if you've consented to marketing)

All service providers are bound by strict confidentiality agreements and are prohibited from using your data for any purpose other than providing services to idr138.

4.2 Legal Obligations

We may disclose your information to law enforcement, regulatory authorities, or courts when:

• Required by law, court order, subpoena, or legal process
• Necessary to comply with our gaming license conditions
• Needed to investigate suspected illegal activity, fraud, or violations of our Terms and Conditions
• Required to protect the rights, property, or safety of idr138, our users, or the public

4.3 Business Transfers

In the event idr138 undergoes a merger, acquisition, sale of assets, or bankruptcy, your personal information may be transferred to the successor entity. You will be notified via email and prominent website notice before such transfer occurs, and the new entity will be bound to honor this Privacy Policy.

4.4 With Your Consent

We may share your information with other parties when you provide explicit consent, such as when you opt in to receive offers from our partners or participate in co-branded promotions.

5. Data Security Measures

Protecting your personal information is a top priority for idr138. We implement multiple layers of security controls:

5.1 Encryption

• SSL/TLS Encryption: All data transmitted between your device and our servers is protected by 256-bit Secure Socket Layer (SSL) encryption, the same technology banks use
• Database Encryption: Personal information stored in our databases is encrypted at rest using industry-standard AES-256 encryption
• Password Hashing: Your password is never stored in plain text. We use bcrypt hashing with salt, making it computationally infeasible to reverse-engineer your password

5.2 Access Controls

• Access to personal data is restricted to authorized personnel only, based on role-based access control (RBAC)
• Employees accessing sensitive data must use multi-factor authentication (MFA)
• All data access is logged and audited for unusual activity
• Staff receive regular training on data protection and confidentiality obligations

5.3 Infrastructure Security

• Firewalls and intrusion detection systems protect our servers from unauthorized access
• Regular security audits and penetration testing identify vulnerabilities
• Automated daily backups ensure data can be restored in case of system failure
• DDoS protection mitigates distributed denial-of-service attacks

5.4 Ongoing Monitoring

• 24/7 security monitoring detects and responds to potential threats
• Fraud detection algorithms flag suspicious account activity
• Incident response protocols ensure rapid containment of any security breaches

6. Cookies and Tracking Technologies

idr138 uses cookies and similar tracking technologies to enhance your experience, analyze platform usage, and deliver personalized content. Cookies are small text files stored on your device that help our website remember your preferences and recognize you on return visits.

6.1 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Required for basic platform functionality: logging in, maintaining your session, processing transactions, and remembering your account settings.	Session or up to 30 days
Functional Cookies	Remember your preferences such as language, currency, display settings, and favorite games for convenience.	Up to 1 year
Analytics Cookies	Collect aggregated data on how users navigate the website, which pages are most popular, and where users encounter errors. Helps us improve platform design.	Up to 2 years
Marketing Cookies	Track your activity across idr138 to deliver personalized advertisements and measure ad campaign effectiveness. Only used with your consent.	Up to 1 year

6.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse all cookies, accept only certain cookies, or delete existing cookies. However, disabling essential cookies will prevent you from using key features of idr138, including logging in and placing bets. Instructions for managing cookies in popular browsers:

• Google Chrome: Settings > Privacy and Security > Cookies and other site data
• Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies

6.3 Third-Party Cookies

Some cookies are placed by third-party services we use, such as Google Analytics for website traffic analysis. These third parties have their own privacy policies governing how they use data. We recommend reviewing their policies if you have concerns about third-party tracking.

7. Data Retention

idr138 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law or our gaming licenses.

7.1 Retention Periods

• Active Accounts: Data is retained indefinitely while your account remains active and in good standing
• Inactive Accounts: If you do not log in for 24 consecutive months, your account may be classified as dormant, and we will retain only essential data required for legal compliance
• Closed Accounts: After account closure, we retain your data for a minimum of 5 years to comply with anti-money laundering regulations and to resolve any disputes, claims, or investigations that may arise
• Transaction Records: Financial transaction history is retained for at least 7 years as required by gaming regulations and tax laws
• Marketing Data: If you opt out of marketing, we retain a record of your opt-out preference indefinitely to ensure we never contact you again

7.2 Deletion After Retention Period

Once the retention period expires and there is no legal or business reason to keep your data, we securely delete or anonymize it. Anonymized data (data that cannot be linked back to you as an individual) may be retained indefinitely for statistical analysis and research purposes.

8. Your Privacy Rights

You have several rights regarding your personal information. idr138 respects these rights and provides mechanisms to exercise them:

8.1 Right to Access

You can request a copy of all personal information we hold about you. This includes your registration details, verification documents, transaction history, gaming activity, and communications records. We will provide this information in a commonly used electronic format (typically PDF or CSV). To request access, contact our Data Protection Officer at [email protected] (display only).

8.2 Right to Rectification

If any of your personal information is inaccurate or incomplete, you have the right to request correction. You can update most information directly through your account settings, including your email address, phone number, and residential address. For changes to your legal name or date of birth, contact customer support with supporting documentation.

8.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes it was collected or if you withdraw consent for marketing. However, we may be legally required to retain certain information (e.g., transaction records for AML compliance) even after you request deletion. We will explain which data can be deleted and which must be retained.

8.4 Right to Object

You can object to processing of your personal data for direct marketing purposes at any time. Simply click "unsubscribe" in any promotional email or adjust your communication preferences in account settings. You may also object to automated decision-making or profiling, though this may limit our ability to provide personalized services.

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format and transmit it to another service provider. We will provide your data in CSV or JSON format upon request.

8.6 Right to Restrict Processing

You can request that we temporarily restrict processing of your personal data while we investigate a dispute about accuracy or lawfulness of processing. During this period, we will store your data but not actively use it.

8.7 Exercising Your Rights

To exercise any of these rights, contact us at [email protected] (display only) or through live chat. We will respond within 30 days of receiving your request. We may require additional information to verify your identity before fulfilling requests to protect against unauthorized access to your data.

9. International Data Transfers

idr138 operates internationally and may transfer your personal information to servers located outside Indonesia. When we transfer data across borders, we ensure appropriate safeguards are in place:

• Transfers to countries recognized as providing adequate data protection under international standards
• Use of standard contractual clauses approved by data protection authorities
• Binding corporate rules for transfers within our corporate group
• Explicit consent from you for specific transfers when required by law

Our servers and data processing facilities are located in secure jurisdictions with strong data protection laws. All transferred data is encrypted during transmission and protected by the same security measures described in Section 5 of this Policy.

10. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a data security concern, please contact our Data Protection Team:

Changes to This Privacy Policy

idr138 reserves the right to update this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated via email to your registered address and through prominent notices on our website at least 30 days before taking effect. Your continued use of idr138 after the effective date of changes constitutes acceptance of the updated Policy. We encourage you to review this page regularly to stay informed about how we protect your privacy.