Privacy Policy

1. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, address, email address, phone number, financial account details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
• "Controller" refers to ids338 as the entity that determines the purposes and means of processing Personal Data.
• "Processor" refers to any third-party entity that processes Personal Data on behalf of ids338 pursuant to written instructions.
• "User" or "Data Subject" refers to any individual who registers, accesses, or uses the ids338 platform and whose Personal Data is processed under this policy.
• "KYC" (Know Your Customer) refers to the identity verification process required of all registered Users prior to withdrawal privileges being activated.
• "Cookies" refers to small text files placed on your device by the Platform to enable session management, analytics, and personalization functions.

2. Personal Data We Collect

ids338 collects only the personal data that is necessary to operate our platform safely, comply with applicable regulations, and deliver a high-quality service to Indonesian players. We do not engage in unnecessary or speculative data collection.

2.1 Registration Data

When you create an account on ids338, we collect the following information:

• Full legal name as it appears on your official identity document
• Date of birth (to verify that you are at least 21 years of age)
• Email address
• Mobile phone number (used for two-factor authentication and account notifications)
• Residential address, including city (Jakarta, Surabaya, Bandung, Medan, Bali, or elsewhere in Indonesia) and postal code
• Chosen username and securely hashed password

2.2 Identity Verification (KYC) Data

To comply with anti-money-laundering requirements and responsible gaming obligations, we require identity verification documents before processing withdrawals. This data includes:

• Photograph or scan of your Indonesian National Identity Card (KTP / Kartu Tanda Penduduk)
• Selfie photograph holding your identity document
• Proof of address: utility bill, bank statement (from BCA, BRI, BNI, Mandiri, or other supported banks), or government correspondence dated within the last three months
• Supplementary documents requested by our compliance team in specific circumstances

2.3 Financial and Transaction Data

When you conduct financial transactions on the Platform, we record:

• Deposit and withdrawal amounts in Indonesian Rupiah (IDR / Rp)
• Bank account details associated with your transactions (bank name, account number suffix — we do not store full account numbers)
• Transaction timestamps and reference numbers
• Payment method used (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, or BSI)

2.4 Gaming Activity Data

We maintain records of your activity on the Platform, including:

• Games played, bets placed, and wager amounts
• Wins and losses, jackpot records
• Session duration, login timestamps, and IP addresses
• Bonuses claimed and wagering progress
• Game preferences and settings

2.5 Technical and Device Data

• Device type, operating system, and browser version
• IP address and approximate geographic location
• Referring URLs and navigation patterns within the Platform
• Error logs and performance diagnostics

2.6 Communications Data

If you contact us via live chat, email ([email protected]), WhatsApp, or in-app messaging, we retain records of these communications, including timestamps, agent notes, and any attachments you provide.

3. How We Collect Your Data

ids338 collects Personal Data through the following channels:

• Directly from you: Information you voluntarily provide during account registration, KYC submission, payment processing, and customer support interactions.
• Automatically: Technical data collected via cookies, server logs, and similar tracking technologies when you interact with our platform.
• From third parties: Identity verification results from KYC service providers; fraud-detection signals from payment processors; geolocation data from IP-resolution services.

4. Purposes and Legal Bases for Processing

We process your Personal Data only when a valid legal basis exists. The table below maps our processing activities to their purposes and legal grounds:

5. Data Sharing and Third-Party Disclosure

ids338 does not sell, rent, or barter your personal data. We may share limited data with third parties only in the circumstances described below:

5.1 Service Providers (Processors)

We engage vetted third-party service providers to perform functions on our behalf. These processors are contractually prohibited from using your data for their own purposes and must implement security standards consistent with our own. Categories of processors include:

• Payment processors and banking partners — BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, and BSI, to facilitate deposit and withdrawal transactions
• KYC and identity verification providers — to authenticate the documents you submit during account verification
• Cloud infrastructure providers — to host the Platform on secure, redundant servers
• Customer support tools — to manage live chat and messaging services
• Fraud detection services — to identify and block suspicious account activity

5.2 Legal and Regulatory Disclosure

We may disclose your Personal Data when required to do so by applicable law, court order, regulatory authority, or law enforcement agency. In such cases, we disclose only the minimum information necessary to satisfy the legal requirement and, where legally permissible, we will notify you of the disclosure.

5.3 Business Transfers

In the event that ids338 is involved in a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the acquiring entity. We will notify you of any such transfer and the privacy practices that will apply to your data under the new ownership.

5.4 Consent-Based Sharing

We will not share your data with any party not described above without first obtaining your explicit, informed consent.

6. Cookies and Tracking Technologies

The ids338 platform uses cookies and similar technologies to deliver core functionality, maintain session security, and improve the user experience. The categories of cookies we use are:

• Essential Cookies: Required for basic platform functionality, including session authentication and security tokens. These cannot be disabled without breaking core features.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and display options to personalize your experience.
• Analytics Cookies: Collect aggregated, anonymized data about how Users navigate the Platform, which pages are visited most frequently, and where technical errors occur. This data is used solely to improve the Platform.
• Security Cookies: Detect and prevent fraudulent sessions, bot activity, and unauthorized access attempts.

You can configure your browser to refuse some or all cookies; however, disabling essential cookies will prevent you from accessing your account and using the Platform. We do not use third-party advertising cookies or tracking pixels for cross-site behavioral advertising.

7. Data Retention

ids338 retains your Personal Data only for as long as is necessary to fulfill the purposes described in this policy, comply with legal obligations, and resolve disputes. Our standard retention periods are as follows:

• Account and registration data: Retained for the duration of your account and for 5 years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• KYC and identity documents: Retained for 5 years from the date of submission or from the date of account closure, whichever is later.
• Financial transaction records: Retained for 5 years from the date of each transaction.
• Gaming activity logs: Retained for 3 years from the date of each session, then anonymized for aggregate analytics purposes.
• Customer support communications: Retained for 2 years from the date of the last interaction.
• Technical and device logs: Retained for 12 months on a rolling basis, then automatically purged.
• Marketing consent records: Retained for as long as you remain opted in, plus 2 years following any opt-out, to demonstrate compliance.

When retention periods expire, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with you as an individual.

8. Security Measures

ids338 employs a layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our technical and organizational safeguards include:

8.1 Encryption

All data transmitted between your device and our servers is protected using 256-bit SSL/TLS encryption — the same standard used by major Indonesian banking institutions such as BCA and Mandiri. Data stored on our servers is encrypted at rest using AES-256 encryption.

8.2 Access Controls

Access to Personal Data within ids338 is governed by the principle of least privilege. Only staff members who require access to specific data categories to perform their job functions are granted that access. All internal access is logged, audited, and reviewed regularly.

8.3 Two-Factor Authentication

We strongly encourage all Users to enable two-factor authentication (2FA) on their accounts. Our 2FA implementation uses one-time passcodes delivered via SMS to the mobile number registered on your account.

8.4 Penetration Testing and Audits

Our platform undergoes regular independent security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited. We also maintain an internal incident response plan to ensure rapid containment and notification in the event of a data breach.

8.5 Data Breach Notification

In the unlikely event of a data breach that poses a material risk to your rights and freedoms, ids338 will notify affected Users promptly — typically within 72 hours of becoming aware of the breach. Notification will be delivered via the email address registered on your account and will include a description of the breach, the categories of data affected, and the steps we are taking to address it.

9. Your Rights Over Your Personal Data

As a User of the ids338 platform, you hold meaningful rights over your Personal Data. We are committed to honoring these rights promptly and without undue friction. Your rights include:

• Right of Access: You may request a copy of all Personal Data we hold about you, along with information about how it is used and with whom it is shared. We will respond within 30 days.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you have the right to request correction. You may update most account information directly through your account settings; for KYC document corrections, please contact support.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where processing is unlawful. Note that we may be required to retain certain data for legal compliance purposes even after an erasure request.
• Right to Restriction of Processing: You may request that we restrict processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: You may request a copy of the Personal Data you provided to us in a structured, machine-readable format, which you may then transfer to another service provider.
• Right to Object: You may object to processing based on our legitimate interests at any time. You may also object to receiving marketing communications, even if you previously consented.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, contact our Data Protection team at [email protected]. We may request proof of identity before processing your request to prevent unauthorized access to another person's data. We will respond to all valid requests within 30 calendar days. If we are unable to fulfill a request — for example, because a legal obligation requires us to retain the data — we will explain the reason in writing.

10. Protection of Minors

The ids338 platform is strictly intended for adults aged 21 and over. We do not knowingly collect, store, or process the Personal Data of individuals under the age of 21. Age verification is conducted as part of our KYC process, and accounts found to belong to underage individuals are immediately closed, with any deposited funds returned to the originating payment method.

If you believe that a minor has created an account on ids338, please contact us immediately at [email protected]. We treat such reports as urgent and will investigate and act within 24 hours of notification.

11. Changes to This Policy

ids338 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Display a prominent notification within the platform for a period of at least 14 days following the update
• Send an email notification to your registered email address for significant changes that affect your rights

Your continued use of the ids338 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with any revised terms, you must discontinue use of the platform and may request account closure.

12. Contact and Data Inquiries

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please reach out to our Data Protection team through the following channels:

• Email: [email protected] (please include "Privacy Inquiry" in the subject line)
• Live Chat: Available 24/7 via the Platform — ask to be connected to our Data Protection team
• WhatsApp: +62 812-3456-7890 (available 08:00–23:00 WIB)

We aim to acknowledge all privacy-related inquiries within 24 hours and to provide a full response within 30 calendar days. For complex requests involving large volumes of data or legal analysis, we may require additional time and will inform you accordingly.