idr508 Privacy Policy

1. Introduction

idr508 is committed to protecting the privacy and security of all personal information entrusted to us by our users. This Privacy Policy outlines our data handling practices in compliance with international data protection standards, including principles derived from the General Data Protection Regulation (GDPR) and other applicable privacy frameworks.

This policy applies to all personal data collected through the idr508 platform (https://idr508.cam), including data provided during account registration, payment processing, gameplay activity, customer support interactions, and any other touchpoint with our services.

We recognize that trust is earned through transparent communication and responsible data stewardship. This document is designed to give you full visibility into what happens to your personal information when you choose to use idr508.

2. Data Controller

idr508 is the data controller responsible for the personal data you provide through the platform. As the data controller, we determine the purposes for which, and the manner in which, your personal data is processed.

Our registered business details are available upon request through our customer support team. If you have any questions regarding how your data is handled, or wish to exercise your privacy rights, please contact us using the details provided in Section 14 of this policy.

3. Information We Collect

idr508 collects several categories of personal information to provide our gaming services, ensure platform security, and comply with regulatory obligations. The information we collect includes:

3.1 Account Registration Data

When you create an account, we collect:

• Personal identifiers: Full legal name, date of birth, Indonesian National Identity Card number (NIK/KTP), gender
• Contact information: Email address, mobile phone number, residential address (city and province)
• Account credentials: Username, encrypted password, security questions and answers

3.2 Identity Verification (KYC) Documents

To comply with anti-money-laundering regulations and verify your age, we collect:

• Scanned copies or photographs of government-issued identification documents (KTP, passport, driver's license)
• Proof of address documentation (utility bills, bank statements)
• Selfie photographs for facial verification matching
• Payment method verification documents (bank account screenshots, e-wallet screenshots)

3.3 Financial Transaction Data

For deposit and withdrawal processing, we collect:

• Bank account details (bank name, account holder name, account number) for BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata
• E-wallet identifiers (registered phone numbers) for OVO, DANA, GoPay, ShopeePay, LinkAja
• Transaction history including deposit amounts, withdrawal requests, timestamps, and transaction references
• Payment provider transaction IDs and status confirmations

3.4 Gaming Activity Data

To deliver our gaming services and detect fraud, we collect:

• Gameplay history including bets placed, games played, win/loss records, session durations
• Account balance movements and bonus fund usage
• Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status)
• Promotional offer participation and wagering requirement progress

3.5 Technical & Device Information

When you access idr508, we automatically collect:

• IP address and geolocation data (country, region, city-level)
• Device identifiers (device type, operating system, browser type and version)
• Session data (login timestamps, page views, click patterns, time spent on platform)
• Referral sources and marketing campaign identifiers
• Error logs and diagnostic information for technical troubleshooting

3.6 Communication Records

When you contact customer support, we collect:

• Content of email correspondence, live chat transcripts, and uploaded attachments
• Customer support ticket histories and resolution outcomes
• Feedback survey responses and satisfaction ratings

4. How We Use Your Data

idr508 processes your personal data for the following specific purposes:

4.1 Service Delivery

• Creating and managing your player account
• Processing deposits and withdrawals to and from your account
• Enabling you to place bets on sports events and play casino games
• Calculating and crediting winnings, bonuses, and promotional offers
• Maintaining your transaction history and account statements

4.2 Regulatory Compliance

• Verifying your identity and age to enforce the 21+ restriction
• Conducting KYC (Know Your Customer) and AML (Anti-Money Laundering) checks
• Detecting and preventing fraudulent activity, money laundering, and terrorist financing
• Responding to legal requests from law enforcement or regulatory authorities
• Maintaining records as required by gaming license conditions

4.3 Platform Security & Fraud Prevention

• Monitoring for unauthorized account access and suspicious activity patterns
• Identifying duplicate accounts and bonus abuse behavior
• Preventing underage gambling and self-excluded user circumvention
• Securing payment transactions against chargebacks and payment fraud

4.4 Customer Support

• Responding to your questions, complaints, and service requests
• Resolving disputes regarding bets, withdrawals, or account issues
• Providing technical assistance and troubleshooting guidance
• Investigating reported problems and implementing solutions

4.5 Responsible Gaming

• Implementing and enforcing deposit limits, loss limits, and session time limits you set
• Processing self-exclusion requests and preventing access during exclusion periods
• Identifying patterns of potentially problematic gambling behavior
• Providing information about responsible gaming resources

4.6 Communications & Marketing

• Sending transactional notifications (deposit confirmations, withdrawal approvals, bonus credits)
• Delivering promotional offers, bonus announcements, and new game notifications (only with your consent)
• Conducting customer satisfaction surveys and requesting feedback
• Providing important service updates and policy changes

5. Legal Basis for Processing

Under data protection law, idr508 must have a lawful basis for processing your personal data. We rely on the following legal grounds:

• Contractual Necessity: Processing is necessary to fulfill our contract with you (the Terms & Conditions) and deliver the gaming services you requested. This covers account management, payment processing, and gameplay features.
• Legal Obligation: Processing is required to comply with laws and regulations governing online gambling, including age verification, KYC/AML requirements, and reporting obligations to licensing authorities.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, platform security, network integrity, and improving user experience. We balance these interests against your privacy rights.
• Consent: For marketing communications and non-essential cookies, we rely on your explicit consent, which you may withdraw at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. Data Sharing & Disclosure

idr508 does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we do share your data with carefully selected service providers and in specific circumstances described below:

6.1 Essential Service Providers

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay) receive the minimum data necessary to process your deposits and withdrawals.
• Game Providers: Studios like Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive anonymized or pseudonymized gameplay data necessary to deliver their games through our platform.
• Identity Verification Services: Third-party KYC/AML verification providers process your identity documents to confirm your age and identity against government databases and watchlists.
• Cloud Hosting Providers: Secure data centers that host our platform infrastructure receive encrypted data for storage and processing.

6.2 Legal & Regulatory Disclosures

We may disclose your personal data when required by law or in response to valid legal requests:

• Court orders, subpoenas, or other legal processes
• Requests from law enforcement investigating criminal activity
• Regulatory audits by gaming licensing authorities
• Tax authorities requiring transaction reporting

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, your personal data may be transferred to the successor entity as part of the business transfer. You will be notified via email and prominent notice on the platform if such a transfer occurs.

6.4 Data Processing Agreements

All third-party service providers who process personal data on behalf of idr508 are bound by written data processing agreements that require them to maintain the same level of data protection outlined in this Privacy Policy.

7. Cookies & Tracking Technologies

idr508 uses cookies and similar tracking technologies to enhance your user experience, secure our platform, and analyze usage patterns.

7.1 Types of Cookies We Use

• Essential Cookies: Necessary for platform functionality, including session management, authentication, and fraud detection. These cannot be disabled without breaking core features.
• Performance Cookies: Collect anonymous data about how users interact with the platform, helping us identify technical issues and optimize performance.
• Functional Cookies: Remember your preferences, such as language settings, recently played games, and customized display options.
• Advertising Cookies: Track your activity across sites to deliver relevant promotional offers (only used with your consent).

7.2 Managing Cookie Preferences

You can control cookie settings through your browser configuration. Note that disabling essential cookies may prevent you from accessing certain platform features. Most browsers allow you to:

• View what cookies are stored and delete them individually or in bulk
• Block third-party cookies while allowing first-party cookies
• Block all cookies (not recommended for functionality reasons)
• Receive notifications before a cookie is set

8. Data Security Measures

idr508 implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction.

8.1 Technical Safeguards

• Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS. Data at rest is encrypted using AES-256 encryption.
• Firewalls: Multi-layer firewall architecture protects our infrastructure from external attacks and unauthorized access attempts.
• Intrusion Detection: Real-time monitoring systems detect and respond to suspicious activity patterns, unauthorized login attempts, and DDoS attacks.
• Secure Authentication: Passwords are hashed using bcrypt with per-user salts. Optional two-factor authentication (2FA) adds an extra verification layer.
• Database Segmentation: Sensitive data is stored in separate, isolated database environments with restricted access controls.

8.2 Organizational Safeguards

• Access Controls: Employee access to personal data is restricted to authorized personnel only, based on role-based permissions and need-to-know principles.
• Staff Training: All employees handling personal data receive regular training on data protection requirements, security protocols, and incident response procedures.
• Vendor Management: Third-party service providers undergo security audits before engagement and are contractually obligated to maintain equivalent security standards.
• Incident Response Plan: Documented procedures for detecting, containing, and remediating data breaches, including timely notification to affected users and relevant authorities.

8.3 Data Breach Notification

In the unlikely event of a data breach affecting your personal information, idr508 will notify you via email within 72 hours of becoming aware of the breach, in accordance with data protection regulations. The notification will include details about the nature of the breach, the categories of data affected, and the measures taken to mitigate potential harm.

9. Data Retention

idr508 retains your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal obligations.

9.1 Active Accounts

While your account remains active, we retain all account data, transaction histories, and gameplay records to provide continuous service and maintain accurate financial records.

9.2 Closed Accounts

After you voluntarily close your account or we terminate it for Terms violations, we retain your data for the following periods:

• Financial records: 7 years from the date of last transaction (required for tax, auditing, and AML compliance)
• Identity documents: 7 years from account closure (required for KYC compliance and dispute resolution)
• Marketing data: Deleted immediately upon account closure or opt-out request
• Communication records: 3 years from last interaction (for customer service quality assurance)

9.3 Inactive Accounts

Accounts with no login, deposit, or gameplay activity for 12 consecutive months are considered inactive. After 7 years of inactivity, personal data not subject to legal retention requirements will be anonymized or deleted.

10. Your Privacy Rights

You have the following rights regarding your personal data. To exercise any of these rights, contact our customer support team with your account details.

10.1 Right of Access

You have the right to request a copy of all personal data idr508 holds about you. We will provide this information in a structured, commonly used, and machine-readable format within 30 days of your request.

10.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most information directly through your account settings or by contacting support.

10.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data under certain circumstances. However, we may be unable to fulfill deletion requests where data retention is required for legal compliance, regulatory obligations, or ongoing investigations.

10.4 Right to Restriction of Processing

You can request that we temporarily suspend processing of your personal data in specific situations, such as while we verify the accuracy of data you have contested.

10.5 Right to Data Portability

You have the right to receive your personal data in a portable format and to request that we transmit it directly to another service provider where technically feasible.

10.6 Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.

10.7 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing conducted before withdrawal.

11. Children's Privacy

idr508 does not knowingly collect personal data from individuals under the age of 21. Our services are strictly intended for adults aged 21 years or older. If we become aware that we have inadvertently collected information from a minor, we will take immediate steps to delete that data and permanently close the associated account.

If you are a parent or guardian and believe your child has provided personal information to idr508, please contact our support team immediately so we can investigate and take appropriate action.

12. International Data Transfers

idr508 primarily serves Indonesian players and processes data within secure facilities that maintain compliance with international data protection standards. Some of our service providers, particularly game studios and cloud infrastructure providers, may be located outside Indonesia.

When personal data is transferred internationally, we ensure appropriate safeguards are in place through:

• Standard contractual clauses approved by data protection authorities
• Verification that the receiving country provides adequate data protection levels
• Binding corporate rules for intra-group transfers

These safeguards ensure your personal data receives equivalent protection regardless of geographic location.

13. Policy Updates

idr508 reserves the right to update this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or technological advancements. Material changes will be communicated through:

• Email notification to all registered users at least 30 days before the changes take effect
• Prominent notice displayed on the platform homepage
• Updated "Last Updated" date at the top of this policy

Continued use of idr508 services after policy updates constitutes acceptance of the revised terms. If you do not agree with the updated policy, you must cease using our services and may request account closure.

14. Contact & Complaints

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to file a complaint regarding our data practices, please contact us through:

• Email: [email protected] (dedicated privacy inquiries are prioritized for response within 48 hours)
• Live Chat: Available 24/7 through the platform interface for general privacy questions

14.1 Complaint Escalation

If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. We encourage you to contact us first so we can attempt to resolve your concern directly.