Privacy Policy

This Policy applies to all personal data processed by apk88 in connection with the operation of the Platform, including data collected when you visit the website, create or manage an Account, deposit or withdraw funds, participate in games or sports betting, contact customer support, or engage with any promotional activity offered by the Platform.

The Platform serves Indonesian players who access our services online. While Indonesia's primary personal data protection framework is governed by Law No. 27 of 2022 on Personal Data Protection (UU PDP), the Platform adopts internationally recognised data protection principles — transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability — to ensure a standard of protection that meets or exceeds applicable requirements.

This Policy does not apply to third-party websites or services linked from or integrated with the Platform. Each third-party provider is governed by its own privacy terms, and we encourage you to review those separately.

The Platform collects the following categories of personal data:

apk88 collects personal data through the following channels:

• Direct Submission: Data you provide when completing the registration form, submitting KYC documents, filling in payment details, or contacting the support team via live chat or email.
• Automated Technologies: Data collected automatically as you navigate the Platform, including cookies, web beacons, server logs, and similar tracking technologies that record your interactions with the website.
• Payment Processors: Transaction confirmation data received from banking partners (BCA, BRI, BNI, Mandiri, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate deposits or withdrawals.
• Game Providers: Session and outcome data transmitted by third-party game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) during your gaming activity on the Platform.
• Identity Verification Services: Where the Platform uses third-party KYC providers to verify the authenticity of submitted documents, those providers may return enriched data (e.g., name-match scores, document validity status) to the Platform.
• Analytics Partners: Aggregated and anonymised behavioural analytics collected by performance-monitoring tools embedded in the Platform's infrastructure, used solely for service improvement purposes.

The Platform processes your personal data under one or more of the following legal bases, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to register your Account, operate the gaming and sportsbook services, process deposits and withdrawals, and fulfil the obligations set out in the Terms & Conditions.
• Legitimate Interests: Processing necessary for fraud prevention, platform security, abuse detection, service improvement, and internal analytics, provided those interests do not override your fundamental rights and freedoms.
• Legal Obligation: Processing required to comply with anti-money laundering (AML) obligations, KYC requirements, and any applicable regulatory requirements imposed on the Platform.
• Consent: Where the Platform relies on your freely given, specific, and informed consent — for example, for certain marketing communications or optional analytics features — you retain the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Vital Interests: In exceptional circumstances where processing is necessary to protect your safety or the safety of another person, including responsible gaming interventions.

The Platform uses collected personal data for the following purposes, each of which is tied to a specific legal basis described in Clause 4:

• Account Management: Creating, maintaining, and securing your Account; verifying your identity; resetting credentials; and enforcing the one-account-per-player rule.
• Service Delivery: Enabling access to casino games, live dealer tables, sportsbook markets including BRI Liga 1, EPL, La Liga, Champions League, and MotoGP betting, and processing all associated financial transactions in IDR.
• KYC & Fraud Prevention: Verifying documents submitted during the identity verification process; detecting and preventing fraudulent transactions, money laundering, and multi-accounting; and conducting transaction monitoring.
• Customer Support: Responding to queries, resolving disputes, and processing responsible gaming requests submitted through live chat or email.
• Responsible Gaming: Monitoring gaming patterns to identify signs of problem gambling behaviour; administering deposit limits, cooling-off periods, and self-exclusion requests; and maintaining self-exclusion records for the full duration of any exclusion period.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to Players who have opted in to receive such communications. You may opt out at any time by contacting support or adjusting your Account communication preferences.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the Platform's features, performance, and user experience.
• Legal Compliance: Meeting obligations under applicable anti-money laundering regulations, responding to lawful requests from competent authorities, and enforcing the Platform's Terms & Conditions.

apk88 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. Data is shared only in the circumstances described below, and always subject to appropriate safeguards:

• Payment Service Providers: Financial data is shared with banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process the transactions you initiate. These providers process data under their own privacy policies and in accordance with applicable banking regulations.
• Game Studios: Session identifiers and wager data are transmitted to third-party game providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and others) as technically necessary to deliver the gaming experience and to resolve any disputes arising from game sessions.
• KYC & Verification Partners: Identity documents may be shared with accredited third-party identity verification services for document authenticity checks. These partners are contractually bound to process data only for verification purposes and to delete documents upon completion.
• IT & Infrastructure Providers: Technical service providers who host, maintain, and secure the Platform's infrastructure may have access to personal data as part of their service delivery, subject to strict data processing agreements.
• Legal & Regulatory Authorities: The Platform may disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by a lawful order, or when disclosure is necessary to protect the rights, property, or safety of the Platform, its Players, or third parties.
• Business Transfers: In the event of a merger, acquisition, or transfer of the Platform's business assets, personal data held by the Platform may be transferred to the successor entity, subject to the same or equivalent privacy protections.

The Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure browsing experience. The following categories of cookies are in use:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair or prevent your ability to log in and use core Platform features. Disabling other categories will not affect access to the Platform but may reduce the quality of your experience.

The Platform retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of your Account being open and active on the Platform.
• Closed Account Data: Following Account closure, core identity, financial, and transaction records are retained for a minimum of 5 years to meet anti-money laundering compliance obligations and to handle any retrospective disputes or regulatory enquiries.
• KYC Documents: Retained for a minimum of 5 years from the date of submission or the date of Account closure, whichever is later.
• Support Communications: Live chat transcripts and email records are retained for 2 years from the date of the last interaction in each support case.
• Marketing Data: If you withdraw consent to marketing communications, your contact details will be removed from active marketing lists within 30 days. A suppression record may be retained indefinitely to honour your opt-out preference.
• Self-Exclusion Records: Maintained for the full duration of the exclusion period plus 5 years thereafter, to prevent re-registration in breach of the exclusion.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard data destruction methods.

The Platform implements a multi-layered security architecture designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key technical and organisational measures include:

• TLS Encryption: All data transmitted between your device and the Platform's servers is encrypted using 256-bit TLS (Transport Layer Security) protocols. The Platform does not accept unencrypted HTTP connections.
• Password Hashing: Account passwords are never stored in plain text. The Platform uses industry-standard adaptive hashing algorithms (bcrypt or equivalent) with per-user salts.
• Access Controls: Personal data is accessible only to authorised Platform personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) systems with multi-factor authentication for administrative access.
• Penetration Testing: The Platform's infrastructure undergoes regular third-party security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Data Segregation: Financial data, KYC documentation, and gaming activity logs are stored in logically segregated systems with independent access controls to reduce the impact of any single point of compromise.
• Incident Response: The Platform maintains a documented data breach incident response procedure. In the event of a breach that poses a material risk to affected Players, the Platform will notify impacted users without undue delay in accordance with applicable notification obligations.

Subject to applicable law and the Platform's legal obligations, you have the following rights in relation to your personal data held by apk88:

• Right of Access: You may request a copy of the personal data the Platform holds about you, along with information about how it is used.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. For Account details such as your name or date of birth, corrections may require supporting documentation.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to the Platform's legal retention obligations — data that must be retained for AML compliance cannot be erased on request during the mandatory retention period.
• Right to Restrict Processing: You may request that the Platform restricts active processing of your data in certain circumstances, such as while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that data you have provided be supplied in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, and to direct marketing processing at any time. Upon receipt of a marketing opt-out, the Platform will cease marketing communications within 30 days.
• Right to Withdraw Consent: Where processing relies on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact the Platform's support team via live chat or email (see Clause 14). The Platform will respond to verified requests within 30 days. In complex cases, this period may be extended by a further 60 days, with prior notice to you.

The Platform is strictly restricted to individuals aged 21 years or older. The Platform does not knowingly collect personal data from any person under the age of 21. Age verification is conducted during the registration process and reinforced through KYC document checks prior to the first withdrawal.

If the Platform becomes aware that personal data has been collected from a person under 21 years of age, that Account will be immediately suspended, all associated personal data will be deleted in accordance with the Platform's data deletion procedures, and any funds held in that Account will be handled in accordance with the Platform's minor-account policy.

The Platform integrates with a number of third-party services to deliver its full range of features. While apk88 carefully selects partners who maintain high standards of data protection, the Platform does not control and is not responsible for the privacy practices of these third parties. The following categories of third-party services are used:

• Game Studios: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft each operate under their own data processing arrangements with the Platform, governed by contractual data processing agreements that limit their use of Player data to service delivery purposes only.
• Payment Networks: Visa and Mastercard card network rules may apply where card-based payment methods are made available. Indonesian bank partners (BCA, BRI, BNI, Mandiri, and others) and e-wallet providers are each subject to Bank Indonesia regulations and their own published privacy notices.
• Analytics & Performance Tools: The Platform may use server-side analytics tools to collect aggregated, anonymised performance metrics. No personally identifiable data is shared with analytics providers in a form that would allow individual identification.

This Policy governs only the personal data that apk88 itself collects and controls. Players are encouraged to review the privacy notices of each third-party service provider whose products they interact with on the Platform.

The Platform reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, applicable law, or Platform functionality. When a material change is made, the Platform will notify registered Players by email to their registered address and/or by a prominent notice on the Platform's website, with a minimum of 14 days' advance notice before the revised Policy takes effect.

The "Effective Date" at the top of this Policy will be updated each time a new version is published. Continuing to use the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you should contact support to discuss your options, which may include requesting Account closure and the withdrawal of your available Balance.

For any questions, concerns, or requests relating to this Privacy Policy or to your personal data held by apk88, please contact the Platform's Data Protection team through the following channels:

• Live Chat: Available 24/7 via the live chat widget on the Platform. For privacy-specific enquiries, please identify your request as a "Data Protection Request" at the start of your chat session so it can be routed to the appropriate team.
• Email: support at apk88.lat — include your registered username, a description of your request or concern, and your preferred contact method for the response.
• Response Times: The Platform aims to acknowledge all privacy-related requests within 48 hours and to provide a substantive response within 30 days. Complex requests, such as full data access requests, may take up to 30 days from identity verification.