Privacy Policy — dew288

1 Overview & Scope

This Privacy Policy applies to all personal data collected and processed by dew288 ("we", "us", "our") through the website located at https://dew288.cam and any associated mobile or desktop applications (collectively, the "Platform"). It covers every interaction you have with the Platform — from browsing as an unregistered visitor through to operating an active member account.

This Policy is incorporated by reference into our Terms & Conditions. By accessing or using the Platform, you acknowledge that you have read, understood, and consent to the data practices described herein. If you do not agree, please discontinue use of the Platform immediately.

Our primary audience is players residing in Indonesia. Where Indonesian data-protection principles overlap with internationally recognized privacy frameworks, we apply the more protective standard. References to "applicable law" throughout this Policy include Indonesian personal data protection regulations and any internationally recognized privacy standards relevant to our operations.

2 Definitions

Term	Meaning
"Personal Data"	Any information that identifies or can reasonably be used to identify a living individual, either alone or in combination with other data.
"Processing"	Any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, or deletion.
"Data Controller"	dew288, which determines the purposes and means of processing your Personal Data.
"Data Processor"	A third party that processes Personal Data on behalf of dew288 under a data-processing agreement (e.g., payment processors, KYC verification providers).
"KYC Data"	Identity verification documents submitted by a member, including national ID (KTP), selfie photographs, and proof-of-address documents.
"Cookies"	Small text files placed on your device by the Platform or third-party services to store session state, preferences, and analytics data.
"You / Member"	Any individual who accesses the Platform, whether as a registered member or an unregistered visitor.

3 Data We Collect

3.1 Account Registration Data

When you create a dew288 account, we collect the information you voluntarily provide, including:

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify the 21+ age requirement)
• Residential address, including province and city (e.g., Jakarta, Surabaya, Bandung, Bali, Medan)
• Email address and Indonesian mobile phone number
• Preferred currency (Indonesian Rupiah, IDR)
• Username and encrypted password

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) obligations and to protect members from unauthorized account access, we collect:

• Copies of your Indonesian National Identity Card (Kartu Tanda Penduduk / KTP)
• Selfie photographs taken while holding your KTP
• Proof-of-address documents (utility bills, bank statements dated within three months)
• Bank account details or e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) registered in your name, used solely for payment processing

3.3 Financial Transaction Data

Every deposit and withdrawal transaction generates a record that we retain. This includes the transaction amount (in IDR), the payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga), transaction timestamps, and the reference numbers assigned by the payment provider. We do not store full bank account credentials — only the masked details necessary to match your account to your payment method.

3.4 Gameplay and Betting Data

We record your activity on the Platform, including bets placed on sports markets (BRI Liga 1, EPL, Champions League, MotoGP Mandalika), live casino sessions with Evolution Gaming or Pragmatic Play tables, slot game sessions, and togel (Indonesia's traditional numbers lottery) ticket purchases. This data is used for account balance calculations, dispute resolution, responsible gaming monitoring, and platform improvement.

3.5 Technical and Device Data

When you access the Platform, our servers automatically log technical information including your IP address, browser type and version, operating system, device identifiers, referring URL, pages visited, session duration, and click-path data. This data helps us detect fraud, enforce our one-account-per-person rule, and optimize platform performance.

3.6 Communications Data

If you contact our support team via live chat, email, or any other channel, we retain a record of that communication, including the content of messages, timestamps, and any attachments. This record is used for quality assurance, staff training, and dispute resolution.

4 How We Collect Data

dew288 collects Personal Data through the following channels:

• Directly from you: Registration forms, KYC submission uploads, support messages, and any other information you voluntarily provide.
• Automatically: Server logs, session cookies, analytics scripts, and device fingerprinting technologies that operate while you use the Platform.
• From third parties: Identity verification providers that cross-reference your KTP details against government databases; payment processors (BCA, BRI, BNI, Mandiri , CIMB Niaga, OCBC NISP) that confirm transaction status; and fraud-prevention services that flag suspicious behavioral patterns.

5 Purposes of Processing

We process your Personal Data only for the purposes listed below. We do not use your data for any purpose that is incompatible with the reason it was originally collected without first obtaining your separate consent.

Purpose	Data Used
Account creation and management	Registration data, KYC data
Processing deposits and withdrawals	Financial transaction data, KYC data
Identity and age verification (21+)	KYC data, registration data
Fraud detection and AML compliance	Technical data, financial data, KYC data
Responsible gaming monitoring	Gameplay data, financial data
Customer support and dispute resolution	Communications data, gameplay data
Platform security and abuse prevention	Technical data, device data
Service improvement and analytics	Technical data, gameplay data (aggregated)
Promotional communications (opt-in only)	Email address, mobile number

6 Legal Basis for Processing

dew288 processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing that is required to fulfill our obligations under the Terms & Conditions you agreed to upon registration — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) regulations, identity verification requirements, and any lawful order from a competent authority.
• Legitimate interests: Processing necessary to pursue our legitimate business interests — such as fraud prevention, platform security, and service analytics — provided those interests are not overridden by your fundamental rights.
• Consent: Where we rely on your consent (e.g., sending promotional emails or SMS messages), you may withdraw that consent at any time by contacting our support team or using the unsubscribe mechanism in any marketing communication. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7 Data Sharing

7.1 Who We Share Data With

dew288 does not sell, rent, or trade your Personal Data to any third party for marketing or advertising purposes. We share your data only with the categories of recipients listed below, and only to the extent strictly necessary:

• Payment processors: Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to execute and confirm your transactions.
• KYC and identity verification providers: Specialist third-party vendors who cross-reference your submitted documents against authoritative databases to confirm your identity and age.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft receive a pseudonymous player identifier and session token to deliver games. They do not receive your full name, national ID, or financial details.
• Fraud and security services: Providers of device fingerprinting, IP reputation, and behavioral analytics tools that help us detect and prevent unauthorized access and bonus abuse.
• Regulatory and law-enforcement authorities: Where required by law or a valid legal order, we may disclose Personal Data to government bodies, regulators, or law-enforcement agencies in Indonesia or internationally.
• Professional advisors: Lawyers, auditors, and other professional advisors who are bound by confidentiality obligations and who access data only as necessary to provide their services to dew288.

7.2 Data Processing Agreements

All third-party Data Processors who handle Personal Data on our behalf are bound by written data-processing agreements that require them to process data only on our documented instructions, implement appropriate security measures, and not share data with further sub-processors without our prior written approval.

8 Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes outlined in this Policy, subject to the following minimum retention periods:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years post-closure	AML compliance, dispute resolution
KYC documents	Duration of account + 5 years post-closure	Regulatory obligation
Financial transaction records	5 years from transaction date	AML and financial reporting obligations
Gameplay and betting records	3 years from date of activity	Dispute resolution, responsible gaming
Support communications	3 years from last interaction	Quality assurance, dispute resolution
Technical / server log data	12 months from collection	Security monitoring, fraud detection
Marketing consent records	Until consent is withdrawn + 3 years	Evidence of lawful processing

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymized so that it can no longer be linked to any individual.

9 Security Measures

dew288 implements a layered security architecture to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. Our key security measures include:

• TLS/SSL encryption: All data transmitted between your browser and our servers is encrypted using Transport Layer Security (TLS 1.2 or higher). Our SSL certificate is maintained and renewed to prevent lapses in coverage.
• Encryption at rest: Sensitive data fields — including national ID numbers, bank account details, and passwords — are encrypted in our database using industry-standard algorithms. Passwords are stored as salted cryptographic hashes and are never recoverable in plain text even by our own staff.
• Access controls: Access to Personal Data within dew288's systems is restricted on a need-to-know basis. Staff are granted the minimum permissions required for their role, and all access is logged and auditable.
• Two-factor authentication (2FA): All internal administrative accounts are protected by 2FA. Members are strongly encouraged to enable 2FA on their own accounts for an additional layer of protection.
• Penetration testing: We commission regular third-party security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach that poses a risk to your rights, we commit to notifying affected members within a reasonable timeframe and taking immediate remedial action.

10 Cookies & Tracking Technologies

10.1 What Cookies We Use

dew288 uses the following categories of cookies and similar tracking technologies:

• Strictly necessary cookies: These are essential for the Platform to function. They maintain your login session, store your language preference, and enable core security features. These cookies cannot be disabled without breaking basic platform functionality.
• Analytical / performance cookies: These help us understand how members navigate the Platform — which pages attract the most visits, where users exit, and how long sessions last. Data collected is aggregated and anonymized wherever possible.
• Functional cookies: These remember your preferences (e.g., preferred payment method, notification settings) to provide a more personalized experience on return visits.
• Fraud-prevention cookies: Device fingerprinting and session-integrity tokens used to detect automated access, multiple-account creation, and other policy violations.

10.2 Managing Cookies

You can control non-essential cookies through your browser settings. Disabling certain cookies may impair the functionality of the Platform. Strictly necessary cookies cannot be disabled via browser settings without logging out and may be reset on each visit. For detailed guidance on managing cookies in your specific browser, please consult your browser's official documentation.

11 Your Rights

As a member and data subject, you hold the following rights with respect to your Personal Data processed by dew288. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request".

• Right of Access You may request a copy of all Personal Data we hold about you, including the categories of data, the purposes for which it is processed, and the third parties with whom it has been shared.
• Right to Rectification If any Personal Data we hold is inaccurate or incomplete, you have the right to request correction. For KYC data, corrections require resubmission of the relevant verification documents.
• Right to Erasure You may request deletion of your Personal Data where it is no longer necessary for the purposes it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal retention obligations — we cannot delete financial records that we are legally required to retain for AML compliance.
• Right to Restrict Processing In certain circumstances you may request that we limit how we process your data — for example, while a rectification request is being assessed, or where you contest the lawfulness of our processing.
• Right to Data Portability Where processing is based on your consent or on a contract, you may request your Personal Data in a structured, commonly used, machine-readable format suitable for transfer to another service provider.
• Right to Object You may object to processing carried out on the basis of our legitimate interests, including profiling for marketing purposes. Objections to marketing are processed immediately; objections to other processing are assessed on a case-by-case basis.
• Right to Withdraw Consent Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

We aim to respond to all data rights requests within 30 calendar days of receipt. For complex or high-volume requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it. We will not charge a fee for reasonable requests.

12 Minors

The dew288 platform is strictly intended for adults aged 21 and above. We do not knowingly collect Personal Data from individuals under the age of 21. If you believe a minor has registered an account or submitted data to us, please contact us immediately at [email protected]. Upon receiving credible notice, we will suspend the account, delete any associated Personal Data, and refund any deposits via the original payment method after identity verification of the requesting adult guardian.

Our registration form requires users to confirm their date of birth, and our KYC process independently verifies this information against government-issued documents. Despite these measures, if a minor circumvents our controls by providing false information, dew288 bears no liability for that misrepresentation; however, we will take all reasonable steps to remediate the situation upon becoming aware of it.

13 International Data Transfers

Some of our Data Processors operate infrastructure located outside Indonesia. Where Personal Data is transferred internationally, dew288 ensures that appropriate safeguards are in place to protect the data to a standard at least equivalent to the protections described in this Policy. Safeguards may include data-processing agreements incorporating standard contractual clauses, adequacy assessments of the recipient country's legal framework, and technical measures such as encryption and pseudonymization.

By submitting your Personal Data to dew288, you acknowledge that your data may be processed in locations outside Indonesia for the purposes described in this Policy, subject to the safeguards described above.

14 Changes to This Policy

dew288 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When we make material changes, we will update the "Last Updated" date at the top of this page and notify registered members via the email address associated with their account, giving them reasonable time to review the changes before they take effect.

We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree to a revised Policy, you should close your account and cease using the Platform.

15 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data rights, please contact our dedicated privacy team through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Data Rights Request — [Your Full Name]"
• Response Time: Within 30 calendar days for data rights requests; within 24 hours for general privacy queries
• Support Hours: 24 hours a day, 7 days a week (WIB, UTC+7)
• Languages: English and Bahasa Indonesia

If you are not satisfied with our response to a privacy complaint, you may have the right to escalate your complaint to the relevant data-protection authority in your jurisdiction. We will always provide details of the appropriate authority upon request.