Privacy Policy

Introduction

cash88 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every individual who registers, visits, or interacts with our platform. This Privacy Policy explains the types of personal information we collect, the purposes for which that information is used, how it is stored and protected, and the rights available to you as a data subject.

This policy applies to all personal data processed by cash88 in connection with the operation of our online betting and gaming platform at https://cash88.cam, including data collected through our website, mobile interface, customer support channels, and any related communications.

By creating an account or continuing to use the cash88 platform, you acknowledge that you have read and understood this Privacy Policy and you consent to the processing of your personal data as described herein. If you do not consent, you must discontinue use of the platform and contact [email protected] to initiate account closure.

This policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which contain additional obligations and rights relevant to your use of cash88.

Definitions

The following definitions apply throughout this Privacy Policy:

• Personal Data: Any information that directly or indirectly identifies a living individual, including name, identification number, location data, online identifiers, or factors specific to the physical, economic, or social identity of that individual.
• Processing: Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• Data Controller: cash88, which determines the purposes and means of processing personal data collected through the Platform.
• Data Processor: Any third-party entity that processes personal data on behalf of cash88 under a binding data processing agreement.
• User / Data Subject: Any individual whose personal data is processed by cash88, including registered members and visitors who have not completed registration.
• Consent: A freely given, specific, informed, and unambiguous indication by the User that they agree to the processing of their personal data for the stated purpose.
• KYC: Know Your Customer — the identity verification process required under our licensing conditions and anti-money laundering (AML) obligations.

Data We Collect

cash88 collects personal data across several categories, depending on your level of engagement with the Platform. The table below summarises the primary categories of personal data we process:

We do not knowingly collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data) beyond what is strictly required for KYC identity verification processes mandated by our licensing conditions.

How We Collect Data

cash88 collects personal data through the following channels:

• Direct Submission: Information you provide when creating an account, completing KYC verification, making a deposit or withdrawal, contacting customer support , or using responsible gaming tools.
• Automated Technologies: Technical and usage data collected automatically via cookies, server logs, device fingerprinting, and analytics platforms each time you access the Platform.
• Third-Party Payment Processors: Transaction metadata and verification status received from banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• Third-Party KYC Providers: Identity verification results from document authentication services used to validate KTP/NIK cards and proof of address during the KYC process.
• Publicly Available Sources: In specific cases where fraud or money laundering is suspected, we may cross-reference your information with publicly accessible databases or government sanction lists as part of enhanced due diligence.

Purpose of Processing

cash88 processes your personal data for the following specific purposes, each of which is described in the table below alongside the categories of data used:

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another purpose that is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis for doing so.

Legal Basis for Processing

Under applicable data protection laws, cash88 must have a lawful basis for processing your personal data. The legal bases we rely on are as follows:

• Performance of Contract: Processing is necessary to fulfil our contractual obligations to you under the Terms & Conditions, including account creation, payment processing, and game delivery.
• Legal Obligation: Processing is required to comply with applicable laws, including KYC requirements, AML regulations, age verification mandates, and responsible gaming enforcement obligations imposed by our international operating licence.
• Legitimate Interests: Processing is necessary for our legitimate business interests in operating a secure platform, preventing fraud, improving our services, and ensuring the integrity of wagering markets. We balance these interests against your fundamental rights and freedoms.
• Consent: Where we rely on your consent to process data (for example, for sending promotional emails), you have the right to withdraw that consent at any time by contacting [email protected] or using the unsubscribe link in any marketing communication.

Data Sharing & Third-Party Disclosure

cash88 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. However, we do share your data with the following categories of third-party service providers under strict data processing agreements:

• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) process your financial data to execute deposits and withdrawals.
• KYC & Identity Verification Providers: Third-party verification services authenticate your identity documents (KTP/NIK) and proof of address as part of our compliance obligations.
• Game Providers: Software providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others) receive session and wager data necessary to deliver game content and calculate outcomes.
• Fraud Prevention & Security Providers: Specialist security firms assist with device fingerprinting, IP analysis, and behavioral fraud detection to protect both cash88 and legitimate Users from criminal activity.
• Cloud Hosting & Infrastructure Providers: Secure data storage and server infrastructure providers host our systems under contracts that mandate encryption, access controls, and data sovereignty compliance.
• Customer Support Platforms: Support ticket systems and live chat providers process communications data solely for the purpose of delivering customer assistance.
• Analytics Providers: Aggregated and anonymized usage data is shared with analytics platforms to measure platform performance and user experience. This data cannot be used to identify individuals.

All third-party processors are contractually bound to process your data only on our instructions, to maintain appropriate security measures, and to delete or return data upon termination of the relationship. We conduct due diligence on all processors before engaging their services.

International Data Transfers

The cash88 platform serves Users primarily located in Indonesia. However, some of our third-party service providers — particularly cloud hosting infrastructure, game studio servers, and fraud prevention systems — operate servers located outside Indonesia.

Where personal data is transferred to jurisdictions that do not provide an equivalent level of data protection to that in Indonesia or the European Economic Area (EEA), we implement appropriate safeguards to protect your data, including:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules for intra-group transfers;
• Certification schemes demonstrating adequate data protection standards (such as ISO 27001 compliance);
• Explicit consent from the data subject where required by law.

You have the right to request details of the safeguards in place for any international data transfer by contacting [email protected].

Data Retention

cash88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or to comply with legal, regulatory, and contractual obligations. The following retention periods apply:

• Active Accounts: Personal data associated with active accounts is retained for the duration of your membership plus any period required to resolve disputes or complete pending transactions.
• Closed Accounts: Following account closure, we retain identity data, financial transaction records, and wagering history for a minimum of 7 years to comply with anti-money laundering regulations, licensing conditions, and tax reporting obligations.
• KYC Documents: Identity verification documents (KTP/NIK scans, selfie photos) are retained for 7 years following the last interaction with your account.
• Communications Data: Customer support transcripts and email correspondence are retained for 5 years to support complaint resolution and regulatory audits.
• Marketing Consent Records: Records of consent (or withdrawal of consent) for marketing communications are retained indefinitely to demonstrate compliance with applicable marketing laws.
• Technical & Usage Data: Server logs, session data, and anonymized analytics are typically retained for 13 months, except where longer retention is required for fraud investigation or legal proceedings.

At the end of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be attributed to an identifiable individual.

Data Security Measures

cash88 employs industry-standard technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or damage. Our security framework includes:

• Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS protocols. Sensitive data at rest (including payment details and identity documents) is encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorized personnel only, on a strict need-to-know basis. All access is logged and monitored.
• Authentication: User accounts are protected by password authentication. We strongly encourage Members to enable two-factor authentication (2FA) for additional security.
• Network Security: Firewall protection, intrusion detection systems, and regular vulnerability scanning protect our infrastructure from external threats.
• Data Segregation: User funds and personal data are held in segregated systems, isolated from operational systems and accessible only via audited interfaces.
• Employee Training: All cash88 staff undergo regular data protection and security awareness training.
• Incident Response: We maintain a documented incident response plan to detect, contain, and remediate any data breach. In the event of a breach affecting your personal data, we will notify you and relevant authorities in accordance with applicable legal requirements.

Cookies & Tracking Technologies

cash88 uses cookies and similar tracking technologies to enhance your experience on the Platform, measure performance, and deliver personalized content. A cookie is a small text file stored on your device that allows the Platform to recognize your browser and remember certain information.

Types of Cookies We Use:

• Essential Cookies: Required for the Platform to function correctly, including session management, authentication, and security. These cannot be disabled without preventing core functionality.
• Performance Cookies: Collect anonymous data on how Users interact with the Platform (pages visited, time spent, click patterns) to help us improve performance and user experience.
• Functional Cookies: Remember your preferences (such as language settings or notification preferences) to provide a more personalized experience.
• Analytics Cookies: Enable aggregated statistical analysis of Platform usage via third-party analytics providers. Data collected is anonymized and cannot identify individual Users.

You can control cookie settings through your browser. Most browsers allow you to refuse cookies or delete existing cookies. However, disabling essential cookies will impair Platform functionality, and you may not be able to access certain features.

We do not use third-party advertising cookies or retargeting pixels. We do not participate in cross-site tracking for advertising purposes.

Your Data Protection Rights

As a data subject, you have the following rights regarding your personal data. These rights are subject to certain legal limitations and exceptions, particularly where retention is required by law:

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Subject Rights Request." Include your full name, registered email address, and account username. We will respond within 30 days of receipt. We may request additional identity verification to prevent fraudulent requests.

You also have the right to lodge a complaint with your local data protection authority if you believe we have processed your personal data unlawfully or failed to respond adequately to a rights request.

Minors & Age Restrictions

cash88 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. Indonesian law and our international operating licence both prohibit minors from registering accounts or placing wagers on the Platform.

All Users must confirm during registration that they are at least 21 years of age. We enforce this requirement through mandatory KYC verification, which includes review of government-issued identification (KTP/NIK) displaying the User's date of birth.

If we discover that an individual under 21 has registered an account or provided false identity information to circumvent age verification, we will:

• Immediately suspend and permanently close the account;
• Void all wagers placed and forfeit all associated winnings;
• Refund any net deposits made by the minor to the payment method used for deposit;
• Report the incident to relevant authorities where required by law.

Parents and guardians who suspect a minor has accessed the cash88 platform using false credentials should contact [email protected] immediately with supporting evidence. We take underage gambling prevention extremely seriously and will cooperate fully with any investigation.

Policy Amendments

cash88 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or business operations. When material changes are made — particularly those that expand the purposes for which data is processed or the categories of third parties with whom data is shared — we will notify registered Users via email and display a prominent notice on the Platform homepage.

The date of the most recent update is displayed at the top of this policy. We encourage you to review this policy periodically to stay informed about how we protect your personal data.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with a material change, you have the right to close your account and request deletion of your data subject to our legal retention obligations.

Contact & Data Protection Enquiries

For any questions, concerns, or formal requests regarding this Privacy Policy or the processing of your personal data, please contact the cash88 Data Protection team:

• Email: [email protected] (use subject line "Privacy Enquiry" or "Data Subject Rights Request" as applicable)
• Response Time: We aim to respond to all privacy-related enquiries within 5 business days, and to formal data subject rights requests within 30 days as required by applicable law.

When contacting us regarding a data protection matter, please include your full name, registered email address, account username, and a clear description of your enquiry or request. For rights requests (access, erasure, rectification, etc.), we may require additional identity verification to ensure we disclose data only to the rightful account holder.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to your local data protection supervisory authority.