Privacy Policy

1. Overview and Our Commitment to Privacy

top288 is committed to protecting the privacy and personal data of every player who uses our platform. As a platform serving Indonesian players, we take data protection seriously and operate under internationally recognised standards for personal data handling, security, and user rights.

We process your data only to the extent necessary to provide our betting and gaming services, verify your identity, process your financial transactions, and maintain a safe platform for all users. We do not sell, rent, or trade your personal data to third parties for marketing purposes without your explicit consent.

Our data protection practices are built around five core principles:

• Transparency: We tell you clearly what data we collect and why.
• Purpose Limitation: We collect data only for specified, legitimate purposes.
• Data Minimisation: We collect only the data that is genuinely necessary.
• Security: We implement appropriate technical and organisational safeguards.
• Your Rights: We respect and facilitate your rights over your personal data.

2. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or can be used to identify you as an individual, including your name, email address, phone number, bank account details, and IP address.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means top288, which determines the purposes and means by which your personal data is processed.
• "Data Processor" means a third party that processes personal data on behalf of top288 under a contractual obligation.
• "KYC Data" means identity verification documents and biometric information collected for Know Your Customer compliance purposes.
• "Cookies" means small text files stored on your device by your browser when you visit our website, used to enhance your experience and analyse usage patterns.
• "Account" means your registered player account on the top288 platform.

3. Categories of Personal Data We Collect

top288 collects the following categories of personal data, depending on how you interact with our platform:

3.1 Registration and Account Data

• Full legal name (as it appears on your government-issued ID)
• Date of birth (to verify that you meet the minimum age requirement of 21 years)
• Email address and mobile phone number
• Residential address in Indonesia (city, province, and postal code)
• Username and encrypted password
• Preferred currency (Indonesian Rupiah, IDR)

3.2 Identity Verification (KYC) Data

• Scanned or photographed copy of your Indonesian KTP (national identity card), passport, or driver's licence
• Proof of residential address document (utility bill, bank statement)
• Selfie photograph or video for facial verification
• Bank account or e-wallet ownership verification documents

3.3 Financial Transaction Data

• Bank account details for deposits and withdrawals (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon)
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction amounts, dates, and reference numbers
• International card details (Visa, Mastercard) — card numbers are never stored in full; only the last four digits and expiry date are retained
• Deposit and withdrawal history in Indonesian Rupiah (IDR)

3.4 Gaming and Betting Activity Data

• Betting history, including sports markets, game types, and bet amounts
• Wagering patterns, session duration, and login frequency
• Game preferences and promotional offer redemptions
• Bonus usage, wagering progress, and winnings or losses

3.5 Technical and Device Data

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Session logs, login timestamps, and activity records
• Referring URL and pages visited on our platform

3.6 Communications Data

• Records of your correspondence with our customer support team via live chat, email, or other channels
• Feedback, survey responses, and complaint records
• Email and notification preference settings

4. How We Collect Your Data

We collect your personal data through the following means:

• Directly from you when you register an account, complete KYC verification, make a deposit or withdrawal, place a bet, contact our support team, or update your account settings.
• Automatically through cookies, web beacons, session tracking scripts, and server logs when you browse or use our platform.
• From third-party identity verification services that we engage to process KYC documents and verify the authenticity of identity information you provide.
• From payment service providers including Indonesian banks and e-wallet operators when processing your deposits and withdrawals.
• From fraud detection and anti-money laundering (AML) screening services that we use to comply with our regulatory obligations.

5. Purposes for Which We Process Your Data

top288 processes your personal data for the following clearly defined purposes:

Purpose	Data Used
Account registration and management	Registration data, contact information
Identity verification (KYC compliance)	KYC documents, selfie photograph, address proof
Processing deposits and withdrawals in IDR	Financial transaction data, bank/e-wallet details
Providing betting and gaming services	Gaming activity data, account data
Fraud prevention and anti-money laundering screening	Transaction data, device data, IP address
Customer support and dispute resolution	Communications data, account data, transaction data
Responsible gaming monitoring and intervention	Gaming activity data, session data, deposit history
Sending account and transaction notifications	Contact information, transaction data
Platform improvement and analytics	Technical data, gaming activity data (anonymised where possible)
Promotional communications (with your consent)	Contact information, gaming preferences

6. Legal Basis for Processing

top288 processes your personal data on the following legal grounds:

• Contractual Necessity: Processing your account data, financial transactions, and gaming activity is necessary for us to fulfil our contractual obligations to you under our Terms & Conditions. Without this processing, we cannot provide our services.
• Legal Obligation: We are required to collect and retain certain data — particularly KYC and AML records — to comply with our licensing conditions and applicable international financial regulations. This includes verifying that you are at least 21 years of age and a resident of Indonesia.
• Legitimate Interests: We process certain technical and behavioural data to maintain platform security, prevent fraud, detect problem gambling patterns, and improve the quality of our services. We conduct a balancing test before relying on this basis, ensuring that our interests do not override your privacy rights.
• Consent: We rely on your explicit consent before sending you marketing communications or placing non-essential cookies on your device. You may withdraw consent at any time without affecting the lawfulness of processing conducted before withdrawal.

7. Sharing Your Personal Data

top288 does not sell your personal data. We share your data only in the limited circumstances described below, and always under contractual data-protection obligations:

7.1 Payment Processors and Banking Partners

To process your deposits and withdrawals in Indonesian Rupiah, we share the minimum necessary financial data with Indonesian bank partners (including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, and Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, and LinkAja). These entities are bound by their own regulatory obligations and data-protection requirements.

7.2 Identity Verification Providers

We engage specialist third-party KYC verification services to process identity documents, verify facial biometrics, and conduct liveness checks. These providers act as data processors under contractual data-processing agreements and may not use your data for any purpose other than verification.

7.3 Fraud Prevention and AML Services

We share data with fraud detection and anti-money laundering screening services to identify suspicious transactions, prevent account takeovers, and comply with our regulatory obligations. Information shared is limited to what is strictly necessary for risk assessment.

7.4 Game Software Providers

Third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive limited session and account data necessary to deliver their games and verify bet outcomes. These providers do not receive full KYC documents or financial details.

7.5 Legal and Regulatory Disclosure

We may disclose your personal data to law enforcement authorities, regulatory bodies, or courts when required to do so by applicable law, a court order, or a valid legal process. We will notify you of such disclosure where legally permitted to do so.

7.6 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business assets, your personal data may be transferred as part of that transaction. We will notify you via email or prominent notice on our platform prior to any such transfer, and the acquiring entity will be required to honour this Privacy Policy.

8. Data Retention

top288 retains your personal data only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law or regulation. Our standard retention schedule is as follows:

• Active account data: Retained for the duration of your account and for five (5) years after account closure, to comply with AML and audit requirements.
• KYC verification documents: Retained for five (5) years from the date of verification or account closure, whichever is later.
• Financial transaction records: Retained for seven (7) years from the date of each transaction in accordance with financial record-keeping obligations.
• Customer support communications: Retained for three (3) years from the date of the most recent communication in a thread.
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year thereafter as evidence of prior consent.
• Technical logs and IP address records: Retained for twelve (12) months, after which they are anonymised or deleted.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to you as an individual.

9. Data Security Measures

top288 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Encryption at Rest: Sensitive data fields — including KYC documents, bank account details, and passwords — are encrypted at the database level using AES-256 encryption.
• Access Controls: Access to personal data is strictly limited to top288 staff and systems that require it to perform specific, authorised functions. Role-based access controls prevent unauthorised internal access.
• Two-Factor Authentication (2FA): We offer 2FA for player accounts and require it for all internal administrative access to systems that hold personal data.
• Regular Security Audits: Our platform undergoes periodic penetration testing and security audits by independent third-party experts to identify and remediate vulnerabilities.
• Fraud Detection Systems: Automated systems monitor account activity in real time to detect and block suspicious behaviour, including unusual login patterns, rapid transaction sequences, and geographic anomalies.
• Segregated Fund Accounts: Player funds are held in accounts that are segregated from top288's operational funds, ensuring your money is protected even in a financial contingency.

Despite these measures, no online system is entirely risk-free. In the event of a data breach that poses a risk to your rights and freedoms, top288 will notify affected users and relevant authorities in accordance with applicable incident-response obligations, without undue delay.

10. Your Data Rights

As a user of top288, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at [email protected]:

• Right of Access: You have the right to request a copy of the personal data we hold about you. We will provide this within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For most basic account information, you can update this directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent. Note that we may be required to retain certain data for legal or regulatory reasons even after an erasure request.
• Right to Restriction of Processing: You may request that we restrict the processing of your data — for example, while we investigate a rectification request or when you have objected to processing pending our response.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format so that it can be transferred to another service provider.
• Right to Object: You have the right to object to processing of your personal data based on legitimate interests, and to object to receiving direct marketing communications at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

We will respond to all data rights requests within 30 days. In complex cases we may extend this to 60 days, in which case we will inform you of the extension and the reasons for it.

11. Cookies and Tracking Technologies

top288 uses cookies and similar tracking technologies to operate and improve our platform. The cookies we use fall into the following categories:

11.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They enable core features such as account login sessions, security tokens, and shopping cart functionality for deposit selections. These cookies cannot be disabled without severely impairing your ability to use the platform.

11.2 Performance and Analytics Cookies

We use analytics tools to understand how users navigate our platform — which pages are visited most, how long sessions last, and where users encounter difficulties. This data is aggregated and anonymised where possible and helps us continuously improve the platform experience for Indonesian players.

11.3 Functional Cookies

Functional cookies remember your preferences — such as your preferred language, display settings, and whether you have acknowledged certain notifications. They enhance your experience by reducing the need to re-enter preferences on each visit.

11.4 Marketing Cookies

With your explicit consent, we may place marketing cookies to help us deliver relevant promotional content and measure the effectiveness of our campaigns. You may opt out of marketing cookies at any time by adjusting your browser settings or contacting our support team.

Most browsers allow you to control cookies through their settings. Blocking all cookies may prevent you from logging into your account or using essential platform features. For detailed instructions on managing cookies, refer to your browser's help documentation.

12. Minors and Age Restriction

top288 is strictly an adults-only platform. Our services are intended exclusively for individuals who are 21 years of age or older. We do not knowingly collect personal data from anyone under the age of 21.

As part of our registration and KYC process, we verify the date of birth of every user and require identity documents confirming eligibility. If we discover that an account has been created by or on behalf of a person under 21 years of age, we will immediately:

• Suspend and permanently close the account.
• Void all bets placed from that account.
• Return any deposited funds (net of any amounts already withdrawn) to the funding source.
• Delete the personal data of the underage individual, except where retention is required to prevent future attempts at underage registration.

If you believe that a minor has registered an account on our platform, please report it immediately to [email protected].

13. Changes to This Privacy Policy

top288 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Post a prominent notice on the top288 platform for a minimum of 30 days.
• Send a notification to the email address registered on your Account where the changes are significant.

Your continued use of the platform following any update to this policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to remain informed of how your data is being handled.

14. Contact Us Regarding Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection team using the details below:

• Email: [email protected]
• Subject Line: Mark privacy-related queries "PRIVACY REQUEST" for priority routing
• Live Chat: Available 24/7 through your Account dashboard — Indonesian-speaking agents available at all times
• Response Time: We aim to acknowledge all privacy requests within 24 hours (WIB) and resolve them within 30 days

---

Acknowledgment: By using top288, you confirm that you have read, understood, and accepted the terms of this Privacy Policy. You consent to the collection and processing of your personal data as described herein. This policy forms part of the binding legal agreement between you and top288 alongside our Terms & Conditions.