898aa Privacy Policy

Introduction

This Privacy Policy describes how 898aa ("we", "us", "our") collects, uses, stores, and discloses personal data in connection with the 898aa online gaming and betting platform, accessible at https://898aa.app (the "Platform"). It applies to all members, registered users, and visitors of the Platform, with particular reference to players based in Indonesia.

By registering an account on 898aa, accessing the Platform, or submitting any personal information to us, you acknowledge that you have read, understood, and agreed to the data practices described in this Privacy Policy. This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming policy, both of which are incorporated herein by reference.

We are committed to handling your personal data responsibly, lawfully, and transparently. If you have any questions about this policy or your data at any time, please contact our support team — details are provided in Section 15.

Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, including name, email address, phone number, financial account details, device identifiers, and IP address.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, storage, retrieval, use, disclosure, and deletion.
• "Data Subject" — the identified or identifiable individual to whom Personal Data relates; in the context of this policy, this is primarily the registered member or visitor.
• "Controller" — the entity that determines the purposes and means of processing Personal Data. 898aa acts as the Controller for all personal data collected through the Platform.
• "Processor" — a third party that processes Personal Data on behalf of the Controller under a data-processing agreement. Examples include KYC verification providers and payment processors.
• "Consent" — freely given, specific, informed, and unambiguous agreement by the Data Subject to the processing of their Personal Data for a stated purpose.
• "Sensitive Data" — a subset of Personal Data that warrants heightened protection, including government-issued identity document numbers, financial account credentials, and data relating to health or vulnerability status (e.g., responsible gaming self-exclusion history).
• "Cookies" — small text files placed on your device by the Platform to enable functionality, remember preferences, and support analytics and fraud prevention.
• "KYC" (Know Your Customer) — the identity and address verification process required to confirm a member's eligibility to hold an account and to comply with anti-money-laundering obligations.

Data We Collect

898aa collects the following categories of Personal Data from members and Platform visitors. The specific data points collected depend on the nature of your interaction with us.

3.1 Registration & Identity Data

• Full legal name (as it appears on your government-issued ID);
• Date of birth (to verify that you meet the minimum age requirement of 21 years);
• Residential address in Indonesia (city, province, postal code);
• Email address;
• Indonesian mobile phone number;
• Username chosen at registration.

3.2 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued photo ID: Indonesian National Identity Card (KTP), passport, or driving licence (SIM);
• Proof of address documents (recent utility bill, bank statement, or official correspondence);
• Selfie or live facial image for liveness verification (where required by our KYC partner);
• Bank account or e-wallet registration name for payment-method verification.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts (in IDR / Rp), timestamps, and payment method used (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja);
• Account balance history;
• Bonus credit and wagering activity records;
• Chargeback or reversal events (if any).

3.4 Gaming & Betting Activity Data

• Bet history, game session logs, and round outcomes for all products including sportsbook markets (BRI Liga 1, EPL, Champions League, Timnas Indonesia), live casino games (Evolution Gaming, Pragmatic Play Live), slot sessions (Pragmatic Play, PG Soft, NetEnt, Microgaming, Spribe), sabung ayam (cockfighting) live event wagers, and togel (Indonesia's traditional numbers lottery) draw entries;
• Total wagered amounts, win/loss records, and session duration;
• Responsible gaming tool activations (deposit limits set, cooling-off periods, self-exclusion requests).

3.5 Technical & Device Data

• IP address and approximate geographic location derived from IP;
• Device type, operating system, and browser version;
• Unique device identifiers (where permitted by your operating system);
• Session timestamps, login and logout times;
• Referral URL (the page from which you navigated to 898aa, if applicable).

3.6 Communications Data

• Content of live chat conversations with our support team;
• Email correspondence submitted to [email protected];
• Complaint and dispute records;
• Feedback and survey responses (where voluntarily submitted).

3.7 Marketing Preference Data

• Your opt-in or opt-out status for email newsletters, SMS promotions, and in-platform push notifications;
• Promotional campaign response history (e.g., whether you claimed a welcome bonus, a Ramadhan cashback offer, or an Idul Fitri reload promotion).

How We Collect Data

898aa collects Personal Data through three primary channels:

4.1 Data You Provide Directly

This includes information you submit through the registration form, KYC document upload portal, deposit and withdrawal forms, live chat conversations, email correspondence, and any feedback or survey tools. You control what you submit through these channels.

4.2 Data Collected Automatically

When you access the Platform — whether through a desktop browser, mobile browser, or the 898aa mobile app — our servers and analytics systems automatically record technical data including your IP address, device type, browser version, operating system, session timestamps, and pages visited. This data is collected via server logs, cookies, and similar tracking technologies (see Section 10 for our Cookies policy).

4.3 Data Received from Third Parties

In limited circumstances, 898aa receives Personal Data about you from trusted third parties, including:

• KYC verification partners — who confirm the validity of your identity documents and return a verification result to our platform;
• Payment processors — who confirm the status of deposit and withdrawal transactions and provide the registered account holder name associated with your payment method;
• Fraud prevention services — who may flag device fingerprints or IP addresses associated with known fraudulent behaviour, enabling us to protect all members on the Platform;
• Referral partners — who may share a minimal data set (typically just an email address or phone number) when a new member is referred to 898aa through an official affiliate programme.

Purposes of Processing

898aa processes your Personal Data only for specific, legitimate purposes. We do not process data beyond what is necessary to fulfil those purposes. The table below summarises our key processing activities:

Legal Basis for Processing

898aa processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract between you and 898aa — i.e., to provide your account, process transactions, and deliver gaming and betting services;
• Legal Obligation: Processing required to comply with our anti-money-laundering (AML) obligations, KYC verification requirements, responsible gaming mandates, and any other applicable legal or regulatory obligations;
• Legitimate Interests: Processing necessary for the legitimate business interests of 898aa, including fraud prevention, platform security, network integrity, and aggregate analytics — where those interests are not overridden by your rights and interests;
• Consent: Processing for marketing communications and non-essential cookies, where we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing

898aa does not sell your Personal Data. We share data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose.

7.1 Payment Processors

To process your deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja, we share your name, transaction amount, and account reference with the relevant payment processing intermediary. These processors are bound by strict data-processing agreements and are prohibited from using your data for any purpose other than processing the specific transaction.

7.2 KYC & Identity Verification Partners

To fulfil our KYC obligations, we transmit copies of your identity documents and personal information to our accredited KYC verification partner. The KYC partner returns a verification result and confidence score to 898aa. Original document images are stored by the KYC partner in accordance with their own ISO-certified data retention policies, and are not accessible to 898aa staff on demand.

7.3 Game Studio Providers

To deliver live casino, slot, and speciality game content from providers including Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, and Spribe, a minimal set of technical identifiers (a pseudonymous player token, game session ID, and bet/win amounts) is shared with the relevant studio's game server. No directly identifying information such as your full name, address, or payment details is shared with game studios.

7.4 Fraud Prevention & Security Services

Device fingerprint data, IP addresses, and behavioural signals may be shared with third-party fraud prevention services to protect the integrity of the Platform and all members. These services process data on behalf of 898aa and are contractually prohibited from disclosing it to any other party.

7.5 Legal & Regulatory Disclosure

898aa may disclose Personal Data to law enforcement authorities, regulatory bodies, or courts when required to do so by a valid legal order, warrant, or regulatory direction. We will notify you of any such disclosure where we are legally permitted to do so.

7.6 Business Transfers

In the event that 898aa undergoes a merger, acquisition, restructuring, or sale of assets, Personal Data held by 898aa may be transferred to the acquiring or successor entity. In such circumstances, we will notify affected members by email or platform notification in advance of any transfer and will ensure that the successor entity is bound by privacy commitments equivalent to those in this policy.

Data Retention

898aa retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised, aggregated data (which carries no personal identifiers) may be retained indefinitely for statistical and business intelligence purposes.

Security Measures

898aa implements a layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our current security controls include:

• Transport Security: All data in transit is encrypted using TLS 1.3. Older protocol versions (TLS 1.0, TLS 1.1, SSL) are disabled across all 898aa infrastructure.
• Data at Rest Encryption: Sensitive data stored in our databases — including KYC document references and financial records — is encrypted at rest using AES-256.
• Password Security: Member passwords are hashed using bcrypt with a work factor calibrated to resist brute-force attacks. Plain-text passwords are never stored or logged anywhere in our system.
• Access Controls: Internal access to Personal Data is strictly role-based and granted on a need-to-know basis. All staff access to production data systems is logged and audited. No single staff member has unilateral access to the full range of Personal Data.
• Two-Factor Authentication (2FA): 898aa strongly recommends enabling 2FA on your account for an additional layer of login security. 2FA can be activated from your account security settings.
• Intrusion Detection: Our infrastructure is protected by real-time intrusion detection and prevention systems (IDS/IPS) that monitor for anomalous traffic patterns and known attack signatures.
• Regular Security Audits: 898aa conducts periodic third-party penetration tests and vulnerability assessments of its Platform infrastructure. Critical findings are remediated on a priority basis.
• Data Breach Response: In the event of a confirmed data breach that poses a risk to your rights and freedoms, 898aa will notify affected members without undue delay — and in any case within 72 hours of becoming aware — via email and/or in-platform notification.

Cookies & Tracking Technologies

898aa uses cookies and similar tracking technologies (including local storage objects and session tokens) on the Platform. Cookies are small text files placed on your device that help us deliver a functional, personalised, and secure experience.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies (to keep you logged in), CSRF protection tokens (to prevent cross-site request forgery attacks), and load-balancing cookies. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and responsible gaming tool configurations. Disabling these cookies may reduce the convenience of your experience but will not prevent Platform access.
• Analytics Cookies: Collect aggregated, pseudonymous data about how members navigate the Platform — which pages are visited most, where users exit, and how long sessions last. This data is used to improve Platform design and user experience. Analytics cookies are only set with your consent.
• Fraud Prevention Cookies: Support device fingerprinting and session integrity checks to detect unauthorised login attempts, multi-accounting, and automated bot activity. These are treated as strictly necessary for security purposes.

10.2 Cookie Consent & Control

On your first visit to 898aa, you will be presented with a cookie preference panel allowing you to accept or decline non-essential cookies (analytics and functional cookies). You may update your cookie preferences at any time through your account settings. Strictly necessary and fraud prevention cookies are always active and do not require consent.

You may also control cookies at the browser level — most modern browsers allow you to view, block, and delete cookies via their settings menus. Note that blocking all cookies will prevent you from logging in to 898aa, as session authentication relies on strictly necessary cookies.

Your Data Rights

As a Data Subject, you hold the following rights in respect of your Personal Data held by 898aa. These rights may be exercised by contacting our support team as described in Section 15:

• Right of Access: You have the right to request a copy of the Personal Data that 898aa holds about you, along with information about how it is being processed. We will respond to verified access requests within 30 calendar days.
• Right to Rectification: You have the right to request correction of any Personal Data that is inaccurate or incomplete. For basic account data (email address, phone number, residential address), you may update this directly in your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that 898aa may be legally required to retain certain categories of data (particularly KYC and transaction records) for minimum retention periods regardless of an erasure request.
• Right to Restriction of Processing: You may request that 898aa restricts the processing of your Personal Data in certain circumstances — for example, while a dispute about accuracy is being resolved.
• Right to Data Portability: Where processing is carried out by automated means on the basis of your consent or a contract, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for marketing purposes. You may also object to marketing communications at any time without providing a reason.
• Right to Withdraw Consent: Where processing relies on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

Minors & Age Restriction

898aa strictly prohibits use of the Platform by anyone under the age of 21 years. We do not knowingly collect Personal Data from individuals under 21. Age verification is a mandatory step in our registration and KYC processes.

If 898aa becomes aware that Personal Data has been collected from a person under the age of 21 — whether through a false declaration during registration or any other means — we will:

• Immediately suspend the associated account;
• Delete all Personal Data collected from the minor to the extent not required to be retained for fraud investigation purposes;
• Return any deposited funds (net of any bonus credits) via the original payment method where it is practicable and lawful to do so.

If you are a parent or guardian and believe that a person under 21 in your household has registered on 898aa, please contact us immediately via live chat or at [email protected]. We will investigate and act promptly.

International Data Transfers

898aa's primary Platform infrastructure is hosted in data centres with strong physical and logical security controls. Some of our third-party service providers — particularly KYC verification partners and certain game studio providers — may process data in jurisdictions outside Indonesia. Where such transfers occur, 898aa ensures that appropriate safeguards are in place, including:

• Contractual data-protection clauses that impose obligations on the recipient equivalent to those described in this Privacy Policy;
• Transfer only to recipients in jurisdictions that maintain an adequate standard of data protection as recognised by internationally accepted frameworks;
• Strict data minimisation — only the data necessary for the specific third-party function (e.g., a pseudonymous player token for a game studio, or document images for a KYC provider) is transferred cross-border.

On request, 898aa will provide further information about the specific safeguards in place for any international data transfer. Submit your request in writing to [email protected].

Policy Amendments

898aa reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory guidance, or Platform functionality. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page;
• Post a prominent notice on the Platform homepage for a minimum of 14 days following the change;
• Send an email notification to all registered members whose accounts are in good standing, to the email address on file.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any amendment, you must discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

We encourage you to review this Privacy Policy periodically to stay informed about how 898aa protects your data. The most current version will always be available at https://898aa.app/privacy-policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 898aa processes your Personal Data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — include "Privacy Request" in the subject line for faster routing to our data protection team.
• Live Chat: Available 24/7 directly on the Platform. Average response time is under 2 minutes. Our support agents are Indonesian-speaking and can assist with data rights requests in both English and Bahasa Indonesia.
• Response Time: We aim to acknowledge all written privacy requests within 2 business days and to provide a substantive response within 30 calendar days of receipt. For complex requests, we may extend this period by a further 30 days, in which case we will notify you promptly and explain the reason for the extension.