Privacy Policy — idx88

This Privacy Policy ("Policy") is issued by idx88 ("the Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://idx88.vip ("the Platform"). This Policy applies to all personal data processed by idx88 in connection with your use of the Platform, including registration, account management, deposit and withdrawal activity, gameplay, customer support interactions, and marketing communications.

This Policy should be read alongside the idx88 Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions on matters relating to privacy and data protection, this Policy shall prevail.

idx88 is committed to processing personal data lawfully, transparently, and in accordance with internationally recognised data protection principles. We apply these principles consistently for all Players, with particular attention to the needs and expectations of our primary audience — players based in Indonesia accessing the Platform in English.

By creating an Account or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood how idx88 processes your personal data as described herein.

The following terms have the meanings given below wherever they appear in this Policy:

idx88 collects Personal Data across several categories depending on how you interact with the Platform. We apply the principle of data minimisation — we collect only what is genuinely necessary for the stated purpose.

• Full legal name (as it appears on your Indonesian National Identity Card / KTP, passport, or driver's licence).
• Date of birth (to verify that you meet the 21+ age requirement).
• Residential address in Indonesia (city, province, postal code).
• Valid email address and contact phone number.
• Copies of government-issued identity documents submitted during KYC verification.

• Bank account details — including bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP), account holder name, and account number — used for processing deposits and withdrawals in IDR.
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja (registered name and account number only — idx88 does not store your e-wallet login credentials or PINs).
• Deposit and withdrawal history: amounts in Indonesian Rupiah (Rp), timestamps, payment method used, and transaction reference numbers.
• Bonus and promotion redemption history.

• Login timestamps, session durations, and geographic region (province-level, derived from IP address).
• Games accessed, bets placed, wager amounts, win/loss outcomes, and game session logs.
• Sportsbook selections — including markets such as BRI Liga 1, Timnas Indonesia fixtures, AFF Cup, EPL, Champions League, and esports events (Mobile Legends MPL, PUBG Mobile).
• Responsible gaming tool activity: deposit limit settings, session time limit configurations, cooling-off period requests, and self-exclusion applications.

• IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and preferred language setting.
• Unique device identifiers and, where applicable, mobile advertising IDs.
• Cookie data and similar tracking technology outputs (see Section 8).

• Records of all communications between you and idx88 customer support, including Live Chat transcripts, WhatsApp message logs, and email correspondence.
• Survey responses, feedback submissions, and complaint records.
• Marketing communication preferences and opt-in/opt-out records.

idx88 collects your Personal Data through the following channels:

• Directly from you: when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, respond to a survey, or update your Account settings.
• Automatically: via Cookies, server logs, and session-tracking technologies when you navigate the Platform. This includes page views, click paths, game launches, and bet placement events.
• From third-party payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja confirm transaction status and, where required for fraud prevention, share transaction metadata with idx88.
• From KYC verification service providers: third-party identity verification providers may confirm the validity of identity documents and provide a verification outcome (pass/fail) to idx88. The underlying document images are processed by the verification provider under their own data protection obligations.
• From fraud and security providers: device fingerprinting and anti-fraud vendors may share risk scores and signals relating to suspicious account activity with idx88 for the purpose of protecting the Platform and its Players.

idx88 processes your Personal Data for the following specific purposes:

idx88 does not use your Personal Data for automated decision-making that produces legally significant effects on you as a Player, except where expressly permitted by applicable law and where you have been informed in advance.

For each purpose described in Section 5, idx88 relies on one or more of the following legal bases:

• Contract performance: processing necessary to provide you with the services you have requested — including Account registration, payment processing, and gameplay — under the Terms & Conditions you have accepted.
• Legal obligation: processing necessary to comply with applicable laws — including KYC/AML regulations, financial reporting requirements, and responsible gaming obligations imposed by our international gaming licence.
• Legitimate interests: processing necessary for idx88's legitimate business interests, including fraud prevention, platform security, analytics, and improving user experience — provided these interests are not overridden by your privacy rights.
• Consent: processing based on your freely given, informed, and specific consent — in particular, sending you marketing communications about promotions, bonuses, and new game releases. You may withdraw this consent at any time by updating your Account marketing preferences or by emailing [email protected].

idx88 does not sell your Personal Data to any third party. We share your data only as described below and only to the extent necessary for the relevant purpose.

idx88 engages carefully selected third-party service providers that process Personal Data on our behalf under binding data processing agreements. These providers include:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja — for processing deposits and withdrawals in IDR.
• KYC / identity verification providers: to validate identity documents and confirm age eligibility.
• Game content providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft — receive session tokens and anonymised player identifiers required to deliver game content and maintain game integrity.
• Cloud hosting and infrastructure providers: for secure hosting of the Platform and Player data.
• Customer support platform providers: for managing Live Chat, WhatsApp, and email support ticket workflows.
• Anti-fraud and security providers: for device fingerprinting, bot detection, and transaction risk scoring.
• Email service providers: for sending transactional emails (deposit confirmations, withdrawal notifications, KYC outcome notifications) and, where you have consented, promotional emails.

idx88 may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law or by a valid legal order. In such cases, idx88 will disclose only the minimum data required and will, where legally permissible, notify you of the disclosure.

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of idx88's assets, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer via email and/or a prominent notice on the Platform, and the acquiring entity will be required to honour the commitments made in this Policy.

idx88 does not share your Personal Data with any third party for that third party's own marketing or advertising purposes. Any marketing communications you receive will be sent by idx88 directly, and only where you have opted in.

idx88 uses Cookies and similar tracking technologies (including local storage objects and session tokens) to operate and improve the Platform. The table below summarises the categories of Cookies we deploy:

You can manage Cookie preferences through your browser settings. Disabling Strictly Necessary Cookies will impair or prevent access to core Platform functionality. Disabling Functional or Analytics Cookies will not affect your ability to log in or place bets, but may reduce the quality of your personalised experience.

idx88 does not use third-party advertising networks that place Cookies for behavioural profiling by entities other than idx88 itself.

idx88 retains Personal Data for no longer than is necessary for the purpose for which it was collected, subject to the following minimum retention periods required by applicable law and licensing obligations:

Following the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where data has been anonymised, it may be retained indefinitely for statistical and research purposes as it no longer constitutes Personal Data.

As a Player on idx88, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please submit a request via Live Chat or by emailing [email protected]. idx88 will acknowledge your request within 48 hours and provide a substantive response within 30 days. Identity verification will be required before any request is actioned.

idx88 implements comprehensive technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes, but is not limited to:

• 256-bit SSL/TLS encryption applied to all data transmissions between your browser or device and the idx88 servers — the same encryption standard used by major Indonesian banks including BCA and Mandiri for their online banking platforms.
• Encrypted data storage for all Sensitive Data at rest, including identity documents, financial account details, and hashed passwords. idx88 never stores passwords in plaintext.
• Role-based access controls (RBAC) ensuring that idx88 employees can only access the Personal Data categories necessary for their specific job function. Access to Sensitive Data requires additional authorisation.
• Two-factor authentication (2FA) available for all Player Accounts and mandatory for all internal staff accounts with administrative access.
• Regular independent security audits and penetration testing conducted by certified third-party cybersecurity firms.
• Incident response procedures with defined escalation paths and a commitment to notify affected Players of any data breach that is likely to result in a high risk to their rights and interests within 72 hours of detection.
• PCI-DSS compliant payment processing — idx88 does not store card numbers or banking login credentials; all payment data is handled by certified third-party payment gateways.

Notwithstanding these measures, no online platform can guarantee absolute security. You are encouraged to protect your Account by using a strong, unique password, enabling 2FA, and notifying idx88 immediately if you suspect that your Account has been compromised.

idx88 is an adult gaming platform. The Platform is strictly for persons aged 21 years and over. idx88 does not knowingly collect, process, or store Personal Data relating to individuals under the age of 21. Age verification is a mandatory component of the KYC process for all Players.

If idx88 becomes aware that Personal Data has been collected from a person under 21, the relevant Account will be immediately suspended, all funds will be returned to source, and the Personal Data in question will be deleted without undue delay, subject to any conflicting legal retention obligations.

If you are a parent or guardian and you believe that a minor in your care has registered an Account on idx88 or accessed the Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action within 24 hours.

Account holders are solely responsible for ensuring that no person under 21 accesses the Platform through their Account. idx88 recommends the use of parental control software to restrict access to online gaming platforms on shared devices.

idx88 reserves the right to update or replace this Privacy Policy at any time. When material changes are made — such as changes to the categories of data collected, a new category of third-party data sharing, or a change in our retention periods — idx88 will notify registered Players via email to their registered address and/or by displaying a prominent notice on the Platform at least seven (7) days before the changes take effect.

Non-material changes (such as clarifications, corrections, or formatting updates that do not affect how your data is processed) may be made without advance notice, but will always be reflected in the "Last Updated" date at the top of this page.

Your continued use of the Platform following the effective date of any amendment to this Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must close your Account and request deletion of your Personal Data (subject to mandatory legal retention obligations) before the effective date of the changes.

If you have any questions, concerns, or complaints about this Privacy Policy or about how idx88 processes your Personal Data, please contact our Data Protection team through any of the following channels. All privacy enquiries are handled by a dedicated team member and are treated with the highest level of confidentiality.

If you are not satisfied with idx88's response to your privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority or to the alternative dispute resolution body specified in our gaming licence terms. idx88 fully cooperates with all legitimate regulatory enquiries relating to data protection.