Privacy Policy — pt988

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "Platform" — the pt988 website at https://pt988.app, its sub-pages, mobile-optimised interfaces, and any associated applications or tools.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including name, email address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — pt988, the entity that determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" — a third-party service provider that Processes Personal Data on pt988's behalf and under its documented instructions.
• "Member" — any individual who has registered an account on the Platform.
• "KYC" — Know Your Customer; the identity and age verification process required for account operation and withdrawal processing.
• "Cookies" — small text files placed on your device by the Platform to store session information, preferences, and analytics data.
• "Sensitive Data" — a subset of Personal Data requiring heightened protection, including government-issued identification numbers (e.g., Indonesian KTP number), financial account details, and biometric data where collected.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the Processing of your Personal Data for a stated purpose.

This Privacy Policy applies to all Personal Data collected by pt988 in the course of operating the Platform and providing its services to Members located in Indonesia and other jurisdictions where the Platform is accessible.

pt988 acts as the Data Controller for all Personal Data collected directly from Members. Where pt988 engages third-party game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), payment processors, or identity verification providers to deliver aspects of its service, those parties act as Data Processors operating under binding data processing agreements.

This Policy does not apply to third-party websites linked from the Platform. pt988 is not responsible for the privacy practices of external sites. You should review the privacy notice of any third-party site you visit.

pt988 collects Personal Data through several channels. The categories of data collected, together with the collection method and typical examples, are set out in the table below:

pt988 does not intentionally collect Sensitive Data beyond what is strictly required for KYC identity verification. If you voluntarily provide additional sensitive information (for example, in a support message), we will handle it with the highest level of care but recommend you limit such disclosures to what is necessary.

pt988 uses the Personal Data it collects for the following purposes:

• Account creation and management: to register your account, verify your identity, maintain your profile, and manage your session on the Platform.
• Service delivery: to process deposits and withdrawals via local Indonesian banks and e-wallets, settle sportsbook bets (including BRI Liga 1, EPL, and other football markets), and provide access to casino games including live baccarat, blackjack, and slots.
• KYC and fraud prevention: to verify that you are at least 21 years of age, a resident of Indonesia, and the legitimate owner of the payment methods linked to your account; to detect and prevent money laundering, bonus abuse, and other fraudulent activity.
• Compliance obligations: to meet our obligations under the anti-money laundering (AML) framework of our licensing jurisdiction, including transaction monitoring and suspicious activity reporting.
• Responsible gaming: to monitor player behaviour for signs of problem gambling, enforce deposit limits and self-exclusion requests, and provide intervention where required under our Responsible Gaming obligations.
• Communications: to send you transactional notifications (deposit confirmations, withdrawal status updates, security alerts), respond to support queries, and — where you have opted in — send promotional emails about bonuses and seasonal offers (e.g., Ramadhan promotions, Idul Fitri specials).
• Platform improvement: to analyse usage patterns and technical performance data in order to fix bugs, optimise page load times, and improve the overall user experience.
• Legal proceedings: to establish, exercise, or defend legal claims in the event of a dispute.

pt988 relies on one or more of the following legal bases when Processing your Personal Data:

• Contractual necessity: Processing is necessary to perform the contract between you and pt988 — specifically, to operate your account, process transactions, and deliver the gaming services you have requested.
• Legal obligation: Processing is necessary to comply with applicable law, including AML regulations, KYC requirements mandated by our gaming licence, and tax reporting obligations.
• Legitimate interests: Processing is necessary for the legitimate interests of pt988 (such as fraud prevention, network security, and Platform analytics), provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where no other legal basis applies — most commonly for optional marketing communications and non-essential analytics cookies — we rely on your freely given, informed consent. You may withdraw consent at any time without affecting the lawfulness of Processing carried out prior to withdrawal.

The pt988 Platform uses cookies and similar tracking technologies to ensure its proper operation, analyse usage, and — where you have consented — personalise content. The cookie categories we deploy are:

You can manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may impair the functionality of the Platform, including the ability to log in or maintain your session.

pt988 shares Personal Data with third parties only in the circumstances described below. In all cases, data sharing is governed by binding data processing agreements that require recipients to apply equivalent data protection standards.

• Payment processors: To facilitate deposits and withdrawals, pt988 shares transaction-level data (name, account number, amount in IDR) with local Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These partners act as independent data controllers in respect of their own services.
• Identity verification providers: Third-party KYC and AML screening services receive Identity Data and KYC documents to authenticate Members and screen against sanctions and politically exposed person (PEP) lists.
• Game studio providers: Licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive Technical Data and session identifiers necessary to deliver their games through the Platform. These studios do not receive your financial account details.
• IT and hosting providers: Cloud infrastructure and content delivery network (CDN) providers process Technical Data and Usage Data on pt988's behalf solely to maintain Platform availability and performance.
• Regulatory and law enforcement authorities: pt988 will disclose Personal Data to competent authorities where required by law, court order, or the enforceable demand of a regulator with jurisdiction over pt988's operations.
• Professional advisors: Lawyers, auditors, and compliance consultants may access Personal Data to the extent necessary to provide their professional services to pt988, subject to strict confidentiality obligations.

pt988 does not sell, rent, or otherwise commercially exploit your Personal Data. No data is transferred to advertising networks for the purpose of targeting you with third-party advertisements.

As an internationally operated platform serving players in Indonesia, pt988 may transfer your Personal Data to servers or service providers located outside Indonesia. Such transfers occur only where adequate safeguards are in place, including:

• Standard contractual clauses (SCCs) approved by the relevant data protection authority, incorporated into data processing agreements with all international Data Processors.
• Transfer to jurisdictions that have been assessed as providing an adequate level of data protection equivalent to the standards of pt988's licensing jurisdiction.
• Where neither of the above applies, transfer only with your explicit consent or where the transfer is strictly necessary for the performance of your contract (e.g., to settle a live baccarat or blackjack game hosted on a studio server outside Indonesia).

pt988 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The standard retention periods are as follows:

After the applicable retention period expires, Personal Data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

As a Member, you hold the following rights in relation to your Personal Data held by pt988. To exercise any of these rights, contact our Data Protection Officer at support at pt988.app. We will acknowledge your request within 5 business days (WIB) and provide a substantive response within 30 days.

Note that certain rights may be limited where pt988 is required to retain or Process data to comply with a legal obligation (such as AML record-keeping) or to establish, exercise, or defend legal claims. Where we cannot fulfil a request in full, we will explain the reason in our response.

The pt988 Platform is strictly restricted to individuals who are 21 years of age or older. pt988 does not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If pt988 discovers or is credibly informed that a Member is under the age of 21, it will:

• Immediately suspend the Account and freeze all pending transactions.
• Delete the underage Member's Personal Data from its active systems as soon as the investigation is complete, retaining only the minimum data required by AML law to document the incident.
• Not refund any deposits made by an underage player, as such deposits represent a breach of the registration terms.
• Report the incident to the relevant compliance authority where required by law.

pt988 implements a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our technical and organisational security measures include:

• Transport encryption: All data in transit between your browser and pt988 servers is protected by 256-bit TLS (Transport Layer Security). Our SSL certificate is maintained and renewed to ensure continuous validity.
• Data at rest encryption: Stored Personal Data — including KYC documents, financial account details, and password hashes — is encrypted using AES-256 before being written to disk.
• Password security: Member passwords are stored exclusively as salted cryptographic hashes using a bcrypt algorithm. pt988 staff cannot view your plaintext password at any time.
• Access controls: Internal access to Personal Data is restricted on a strict need-to-know basis. All staff with access to Member data undergo background screening and are bound by confidentiality obligations.
• Intrusion detection: pt988 operates 24/7 automated intrusion detection and monitoring systems. Anomalous access patterns trigger immediate alerts and investigation.
• Regular security audits: The Platform and its data infrastructure undergo regular penetration testing and security audits by independent third-party security firms.
• Incident response: In the event of a confirmed data breach that poses a risk to your rights and freedoms, pt988 will notify the affected Members and the relevant supervisory authority within 72 hours of becoming aware of the incident.

While pt988 implements industry-leading security measures, no method of transmission over the internet or electronic storage is 100% secure. You are responsible for keeping your account credentials confidential and for notifying pt988 immediately if you suspect unauthorised access to your account.

The Platform may contain links to third-party websites or services — for example, links to game studio documentation or payment provider help pages. These links are provided for your convenience only. pt988 has no control over the content, privacy practices, or security of third-party sites and accepts no responsibility for them.

We strongly recommend that you review the privacy notice of any third-party site you visit before providing any Personal Data. The presence of a link on the pt988 Platform does not constitute an endorsement of that site or its privacy practices.

pt988 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data Processing activities, or the features of the Platform. When material changes are made, pt988 will:

• Publish the updated Privacy Policy on this page with a revised "Last Updated" date at the top of the document.
• Send an email notification to all active Members at their registered email address at least 14 days before the amended Policy takes effect, except where an immediate change is required for legal, regulatory, or security reasons.
• Display a prominent notice on the Platform homepage during the 14-day notice period summarising the nature of the material changes.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree to the amended Policy, you must cease using the Platform and request closure of your Account before the amendment takes effect. Outstanding balance withdrawals will be processed in accordance with the withdrawal terms in force at the time of account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way pt988 handles your Personal Data, please contact our Data Protection Officer (DPO) using the details below:

• Email: support at pt988.app — please include "Privacy Request" in the subject line so your message is routed directly to the DPO team.
• Response Time: We will acknowledge all privacy-related correspondence within 5 business days (WIB) and provide a full substantive response within 30 calendar days.
• Languages: Requests may be submitted in English or Indonesian (Bahasa Indonesia). Native Indonesian-speaking staff are available to handle your query.
• Support Hours: The pt988 support team is available 24 hours a day, 7 days a week, including Indonesian national public holidays such as Idul Fitri and Indonesian Independence Day (17 August).