pp888 Privacy Policy

In this Privacy Policy, the following terms have the meanings set out below unless the context clearly indicates otherwise:

• "pp888" / "we" / "us" / "our" refers to pp888, the operator of the online casino and sportsbook platform accessible at pp888.lol and all associated subdomains.
• "Member" / "you" / "your" refers to any individual who has registered an account with pp888 or who visits and interacts with the pp888 platform without registering.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, national identity number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, pp888.
• "Data Processor" means any third party that processes Personal Data on behalf of pp888 and under pp888's documented instructions.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including financial account details, government-issued identity documents, and data relating to health or gambling behaviour patterns.
• "Platform" means the pp888 website, mobile-optimised site, and all related services made available to Members at pp888.lol.
• "IDR" means Indonesian Rupiah, the transaction currency of the pp888 platform.
• "KYC" (Know Your Customer) refers to the identity and age verification process applied to pp888 Members in accordance with responsible gaming and anti-money-laundering standards.

This Privacy Policy applies to all Personal Data collected and processed by pp888 in connection with the operation of the pp888 platform, including data collected from Members resident in Indonesia and from visitors who access the platform from Indonesia without creating an account.

pp888 acts as the Data Controller in respect of all Personal Data collected directly from Members through the registration process, the account dashboard, customer support interactions, and the platform's gaming and sportsbook products.

Where pp888 engages third-party service providers to process data on its behalf — such as payment processors handling IDR transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, or game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, and Spribe — those third parties act as Data Processors under binding data processing agreements that require them to handle Personal Data only in accordance with pp888's instructions and to maintain appropriate technical and organisational security measures.

pp888 collects the following categories of Personal Data, gathered only to the extent necessary for the purposes described in Clause 5:

pp888 collects Personal Data through the following channels and methods:

• Direct collection at registration: When you create a pp888 account, you voluntarily submit identity, contact, and account data through the registration form.
• KYC document uploads: When your account reaches verification thresholds, we request scanned copies of government-issued identity documents (KTP, passport, driving licence) and proof-of-address documents. These are submitted securely through our platform's document upload portal.
• Payment transactions: Financial data is captured each time you initiate a deposit or withdrawal, including the originating bank account or e-wallet identifier and the transaction amount in IDR.
• Platform interaction: Technical and usage data is collected automatically as you navigate the pp888 platform, including session logs, IP addresses, and device fingerprint information used for fraud and account security purposes.
• Cookies and similar technologies: As described in Clause 10, pp888 uses session cookies, persistent cookies, and analytics tracking technologies to understand platform usage patterns and improve the Member experience.
• Customer support interactions: When you contact pp888 via live chat or email, we record the content of those communications together with your account details for quality assurance, dispute resolution, and training purposes.
• Third-party verification providers: In some cases, pp888 may use third-party identity verification services to cross-check the accuracy of the documents and information you submit during KYC. These providers process only the specific data elements needed for verification.

pp888 processes your Personal Data only for specific, documented purposes. The table below sets out each processing purpose together with the legal basis on which pp888 relies:

Where pp888 relies on legitimate interests as the legal basis for processing, we have carried out a balancing assessment to confirm that our interests do not override your fundamental privacy rights. You have the right to object to processing based on legitimate interests — see Clause 11.

Where processing is based on consent (primarily marketing communications), you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent can be effected through your account settings or by contacting [email protected].

pp888 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share Personal Data only in the limited circumstances described below, and in each case only to the minimum extent necessary:

• Payment processors and banking partners: We share relevant financial and identity data with payment service providers — including Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — to process deposits and withdrawals in IDR. These providers are contractually bound to use your data solely for the purpose of executing the transaction.
• Licensed game providers: When you launch a game powered by a third-party studio (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PGSoft, Spribe, or others), your Member ID and session token are passed to that provider to initialise and authenticate the game session. Game providers do not receive your full identity or financial data.
• Identity verification services: During KYC, document data may be shared with a trusted third-party verification provider to authenticate the legitimacy of the submitted documents. That provider processes the data solely for verification and retains no copies beyond the verification period.
• IT and hosting infrastructure providers: pp888's platform is hosted on secure cloud infrastructure. The hosting provider has access to server-level data in encrypted form but is contractually prohibited from accessing or processing the content of that data for any other purpose.
• Analytics service providers: Aggregated, anonymised or pseudonymised usage data may be shared with analytics providers to support platform optimisation. No directly identifiable Personal Data is included in these analytics datasets.
• Regulatory and law enforcement authorities: pp888 will disclose Personal Data to competent governmental or regulatory authorities where required to do so by applicable law, court order, or lawful governmental request. Where permitted, pp888 will notify the affected Member before making such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of pp888's assets, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change to this Privacy Policy that results from it.

Some of pp888's Data Processors — particularly cloud hosting infrastructure providers and certain game studios — may be based in jurisdictions outside Indonesia. Where Personal Data is transferred to a jurisdiction that does not provide a level of data protection equivalent to international best practice, pp888 ensures that appropriate safeguards are in place before the transfer occurs.

Appropriate safeguards may include:

• Standard contractual clauses (SCCs) incorporated into the data processing agreement with the relevant Data Processor.
• The receiving organisation's certification under an internationally recognised data security framework (such as ISO/IEC 27001 or SOC 2 Type II).
• An adequacy determination by a relevant data protection authority confirming that the destination country provides adequate protection for personal data.

If you would like further information about the specific safeguards applied to any cross-border data transfer, please contact us at [email protected] referencing "Data Transfer Inquiry" in your message subject.

pp888 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or regulation. The key retention periods applied by pp888 are set out below:

Upon expiry of the applicable retention period, Personal Data is either permanently deleted from pp888's systems or rendered irreversibly anonymous such that it can no longer be linked to any identified individual.

pp888 applies a layered, defence-in-depth approach to the security of Personal Data. The following technical and organisational measures are in place across the pp888 platform and internal systems:

• Encryption in transit: All data transmitted between your browser or device and the pp888 platform is encrypted using TLS 1.3. Connections over older, insecure TLS versions are rejected.
• Encryption at rest: Sensitive data stored in pp888's databases — including identity documents, financial records, and hashed credentials — is encrypted at rest using AES-256.
• Password hashing: Member passwords are never stored in plaintext. They are hashed using a cryptographically strong adaptive algorithm (bcrypt or equivalent) with per-user salt.
• Access controls: Access to Personal Data within pp888's internal systems is governed by strict role-based access controls. Employees are granted access only to the data categories necessary for their specific job function, on a least-privilege basis.
• Two-factor authentication: Internal administrative access to systems holding Personal Data requires multi-factor authentication. Members are strongly encouraged to enable 2FA on their own accounts through the account security settings.
• Regular security audits: pp888 engages independent third-party security firms to conduct periodic penetration testing and vulnerability assessments of the platform infrastructure.
• Intrusion detection and monitoring: Automated monitoring systems scan for anomalous access patterns, brute-force attempts, and other indicators of compromise around the clock (24/7, WIB/WITA/WIT).
• Data breach response: In the event of a confirmed Personal Data breach, pp888 will notify affected Members and relevant authorities within the timeframe required by applicable law, together with a description of the nature of the breach, the categories of data affected, and the remedial steps taken.

pp888 uses cookies and similar tracking technologies on its platform. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used:

pp888 does not use third-party advertising cookies, retargeting pixels, or any tracking technology that shares your browsing behaviour across external websites.

You can manage or delete cookies through your browser settings. Disabling functional or analytics cookies will not prevent you from accessing the pp888 platform, but may affect the personalisation of your experience. Disabling strictly necessary or security cookies will impair platform functionality and may prevent you from logging in.

As a Member whose data is processed by pp888, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact [email protected] with the subject line "Privacy Rights Request" and your Member ID:

• Right of Access: You may request a copy of all Personal Data that pp888 holds about you. pp888 will provide this in a structured, commonly used format within 30 days of receiving a valid request.
• Right to Rectification: If any Personal Data held by pp888 is inaccurate or incomplete, you may request that it be corrected. For basic account data (email, address, phone number), you may make corrections directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data. pp888 will action erasure requests subject to any overriding legal retention obligations (see Clause 8). Data that must be retained by law will not be deleted until the mandatory retention period has elapsed.
• Right to Restrict Processing: You may request that pp888 restrict its processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.
• Right to Data Portability: You may request that pp888 provide your Personal Data in a machine-readable format so that it can be transferred to another service provider, where technically feasible.
• Right to Object: You may object at any time to the processing of your Personal Data where that processing is based on legitimate interests. pp888 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (primarily marketing communications), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right Not to Be Subject to Automated Decision-Making: pp888 uses automated systems for fraud detection and responsible gaming monitoring. Where such automated processing produces a significant decision affecting your account (for example, account suspension), you have the right to request a manual review of that decision by a pp888 compliance team member.

The pp888 platform is strictly intended for adults aged 21 and over. pp888 does not knowingly collect Personal Data from any individual under the age of 21. Age verification is applied at the point of registration and reinforced through the KYC process.

If pp888 becomes aware that it has inadvertently collected Personal Data from a person under the age of 21, it will immediately:

• Suspend the relevant account and block all gambling access.
• Void any wagers placed and return any deposited funds (net of any amounts already withdrawn) to the originating payment account.
• Delete all Personal Data associated with the underage individual from its systems as promptly as practicable, subject to any mandatory retention obligations relating to the investigation of the underage registration.

If you have reason to believe that a person under 21 has registered on the pp888 platform, please contact us immediately at [email protected] with the subject line "Under-Age Report". pp888 takes these reports seriously and will investigate all credible notifications on a priority basis.

The pp888 platform does not contain links to external third-party websites as a general rule. However, in certain promotional or informational contexts, references to third-party sports organisations (such as BRI Liga 1, FIFA, or the AFC) or game studios may appear. If you navigate to any external website independently of the pp888 platform, please note that:

• pp888 has no control over the content or privacy practices of any external website.
• This Privacy Policy applies exclusively to data processing carried out by or on behalf of pp888 in connection with the pp888 platform.
• pp888 is not responsible for, and expressly disclaims all liability in relation to, the data collection, storage, or use practices of any third-party website.
• Before submitting Personal Data to any third-party website, you should review that website's own privacy policy carefully.

pp888 reviews this Privacy Policy periodically and reserves the right to amend it at any time to reflect changes in law, technology, platform operations, or data processing practices. Where a material change is made to this Privacy Policy — for example, a change to the categories of data collected, the addition of a new processing purpose, or a change to the retention periods — pp888 will notify Members by:

• Displaying a prominent notice on the pp888 platform for a minimum of 14 days before the amended Policy takes effect.
• Sending an email notification to the address registered on your account, where the change is material enough to require re-consent or significantly affects your rights.

Minor amendments — such as corrections of typographical errors, updates to contact details, or clarifications that do not change the substantive meaning of any clause — may be made without advance notice and take effect immediately upon publication. The "Last updated" date at the top of this page reflects the most recent revision. We encourage Members to review this page periodically.

Your continued use of the pp888 platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. If you do not agree to the amended Privacy Policy, you must cease using the platform and request account closure by contacting [email protected].

For all privacy-related inquiries, data subject rights requests, or concerns about how pp888 handles your Personal Data, please contact our support team through the following channels. All communications regarding privacy matters should include your Member ID and a clear description of your request or concern:

• Email (privacy matters): [email protected] — use subject line "Privacy Rights Request", "Data Deletion Request", "Data Breach Report", or "Privacy Complaint" as appropriate to ensure priority routing.
• Live Chat: Available 24/7 via the pp888 platform after logging in to your account. For complex privacy requests, email is recommended to create a written record.
• Response language: Our support team includes native Indonesian-speaking agents available at all hours for Members who prefer to discuss their privacy concerns in Indonesian , while all formal written privacy responses are issued in English as the platform's official language of record.

pp888 takes all privacy complaints seriously and maintains a formal internal complaints log. Every complaint is reviewed by a senior team member and used to inform ongoing improvements to our data protection practices. We are committed to resolving all legitimate privacy concerns fairly, transparently, and promptly.