Privacy Policy

1. Definitions

In this Privacy Policy, the following terms have the meanings set out below, unless context requires otherwise.

2. Data Controller

2.1 The Company acts as the data controller in respect of Personal Data collected and processed through the ug388 Platform. As data controller, the Company determines the purposes for which Personal Data is processed and the means by which that processing is carried out.

2.2 The Company is incorporated in an offshore gaming jurisdiction and operates the Platform under an internationally recognised gaming licence. While Indonesia does not have a dedicated standalone personal data protection framework of the same scope as the European GDPR, the Company voluntarily applies internationally accepted data protection principles — including purpose limitation, data minimisation, storage limitation, and data subject rights — to all processing activities involving Indonesian members' data.

2.3 All data-related queries, access requests, and complaints should be directed to the Company's data team at the contact details provided in Section 14 of this Policy.

3. Information We Collect

3.1 The categories of Personal Data we collect from ug388 members are described in the table below.

4. How We Collect Data

4.1 ug388 collects Personal Data through the following channels:

• Direct submission: Information you provide when registering an Account, completing KYC, making a deposit or withdrawal, contacting support, or updating account preferences.
• Automated collection: Technical Data collected automatically when you access the Platform — including IP address, device identifiers, browser data, and cookie-based session data — via the Platform's server logs and analytics tools.
• Third-party sources: Identity verification data returned by our KYC service provider following document checks; fraud-risk signals provided by our fraud-detection partner; payment confirmation data from Indonesian bank transfer and e-wallet processing systems.
• Support interactions: Information you share during live chat sessions, email correspondence, or formal complaint submissions.

4.2 We do not purchase or acquire Personal Data lists from data brokers, marketing list providers, or other external data sources for the purpose of contacting individuals who have not engaged with ug388 directly.

5. Purposes & Legal Bases for Processing

5.1 The table below summarises the key purposes for which ug388 processes Personal Data and the legal basis applicable to each.

6. Data Sharing & Disclosure

6.1 ug388 does not sell, rent, or trade Member Personal Data to any third party for that party's own commercial or marketing purposes. We share data only in the circumstances described below, and only to the extent necessary for each stated purpose.

6.1 Third-Party Processors

We engage third-party service providers who process Personal Data on our behalf and under our instruction. These include:

• KYC verification providers: Receive Identity Data and Identity Documents to perform document authentication and biometric checks;
• Payment processors and banking partners: Receive Financial Data necessary to execute IDR deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and ShopeePay;
• Fraud-detection and cybersecurity providers: Receive Technical Data and transaction patterns to identify suspicious activity;
• Customer support platform providers: Host live chat and email support tooling through which Communications Data is processed;
• Cloud infrastructure and hosting providers: Store Platform data in secure data centres under contractual data-processing agreements.

All Third-Party Processors are subject to contractual data processing agreements that require them to implement equivalent data security measures, process data only for the specified purpose, and not sub-process data without prior written authorisation from the Company.

6.2 Legal and Regulatory Disclosure

We may disclose Personal Data to competent authorities, regulatory bodies, or law enforcement agencies where we are legally required to do so under our international gaming licence obligations, applicable AML regulations, or in response to a lawfully issued court order. In such cases, we will disclose only the minimum data necessary and, where legally permissible, will notify the affected Member.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring of the Company, Member Personal Data may be transferred to the successor entity, subject to that entity assuming the data protection obligations set out in this Policy. Members will be notified of any such transfer in advance.

7. International Data Transfers

7.1 As an offshore-licensed platform serving Indonesian members, ug388's data infrastructure involves the transfer of Personal Data across international borders — including to the jurisdiction in which the Company is incorporated and the locations of its cloud hosting and service providers.

7.2 Where such transfers occur, the Company takes reasonable steps to ensure that appropriate safeguards are in place, including contractual data transfer agreements with relevant processors and, where applicable, the use of standard contractual clauses modelled on internationally recognised frameworks.

7.3 By registering a ug388 Account and accepting the Terms & Conditions, you acknowledge and consent to the transfer of your Personal Data outside Indonesia for the purposes described in this Policy.

8. Data Retention

8.1 ug388 retains Personal Data only for as long as it is needed for the purpose it was collected, subject to any longer retention period required by our licensing obligations or applicable law. The following standard retention periods apply:

• Account Data (Identity, Contact): Retained for the duration of the Member's active Account plus five (5) years following account closure, to comply with AML record-keeping obligations under our international gaming licence.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable regulatory guidance.
• Financial Transaction Records: Retained for five (5) years from the transaction date, in accordance with standard AML record-keeping requirements.
• Gameplay Logs: Retained for three (3) years from the date of the relevant session, for dispute resolution, responsible gaming monitoring, and licence audit purposes.
• Support Communications: Retained for two (2) years from the date of the relevant interaction, for quality assurance and dispute resolution purposes.
• Technical / Log Data: Retained for up to twelve (12) months in active log systems; archived for up to three (3) years for security and fraud investigation purposes.
• Marketing Preference Data: Retained until you withdraw consent or request deletion, subject to a minimum retention period of six (6) months for regulatory audit trail purposes.

8.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

9. Security Measures

9.1 The Company implements technical and organisational measures designed to protect Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Current measures include:

• Transport security: All data transmitted between Members' devices and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL). HTTP connections are automatically redirected to HTTPS.
• Access controls: Access to production systems containing Personal Data is restricted to authorised Company personnel and Third-Party Processors on a need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
• Encryption at rest: Sensitive data fields — including identity document files and financial account details — are encrypted at rest in the Company's database systems.
• Penetration testing: The Platform undergoes periodic independent security assessments to identify and remediate vulnerabilities.
• Incident response: The Company maintains a documented security incident response procedure. In the event of a data breach affecting Member Personal Data, affected Members will be notified without undue delay where the breach poses a material risk to their rights and interests.

9.2 Members are responsible for maintaining the security of their own Account credentials. ug388 will never ask for your account password through any communication channel. If you believe your Account has been accessed without your authorisation, please contact support immediately via live chat or at [email protected].

10. Cookies & Tracking Technologies

10.1 The ug388 Platform uses cookies and similar tracking technologies to maintain session continuity, improve platform performance, and support security functions. The categories of cookies used are described below:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings and interface configuration to improve your experience across sessions.
• Analytics Cookies: Collect anonymised data about how Members navigate the Platform — pages visited, session duration, and feature engagement — to help us improve the Platform's usability and performance. No personally identifiable information is transmitted to analytics systems.
• Security Cookies: Used by our fraud-detection systems to identify unusual patterns of access and protect Member Accounts from unauthorised login attempts.

10.2 Most web browsers allow you to control cookie settings through your browser preferences. Disabling strictly necessary cookies may impair your ability to log in and use the Platform. Disabling analytics or functional cookies will not prevent you from accessing the Platform but may reduce the quality of your experience.

10.3 The Platform does not use third-party advertising cookies or cross-site tracking pixels for the purpose of serving targeted advertising on external websites.

11. Your Data Rights

11.1 ug388 respects your rights over your own Personal Data. Subject to applicable law and our regulatory obligations (which may require us to retain certain data regardless of your request), you have the following rights:

• Right of Access: You may request a copy of the Personal Data we hold about you. We will respond within thirty (30) days of receiving a verifiable request.
• Right to Rectification: If Personal Data we hold is inaccurate or incomplete, you may request correction. You may update certain data fields directly within your Account settings; other corrections require a written request to the data team.
• Right to Erasure: You may request deletion of your Personal Data in circumstances where it is no longer necessary for the purpose it was collected, you withdraw consent (where consent is the legal basis), or processing is unlawful. This right is subject to overriding regulatory retention obligations.
• Right to Restriction: You may request that we restrict processing of your data in defined circumstances — for example, while the accuracy of data is being contested or while an objection is being assessed.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. Where the legal basis for processing is consent, you may withdraw consent at any time via your Account settings without affecting the lawfulness of prior processing.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your Personal Data in a structured, commonly used, machine-readable format.

11.2 To exercise any of the above rights, please submit a written request to the data team at the contact details in Section 14. We may need to verify your identity before processing a request to protect against fraudulent access to another Member's data.

12. Children & Minors

12.1 The ug388 Platform is strictly intended for adults aged 21 years and over. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21.

12.2 During registration and KYC, the Member's date of birth is verified against identity documents. Any Account found to belong to a person under 21 years of age will be immediately suspended, all funds returned to the verified originating payment method, and all associated Personal Data deleted in accordance with applicable retention obligations.

12.3 If you have reason to believe that a person under the age of 21 has registered an Account on the Platform using false identity information, please notify the data team immediately at the contact details in Section 14.

13. Policy Updates

13.1 ug388 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, Platform services, applicable law, or regulatory requirements.

13.2 Material changes to this Policy will be communicated to Members by email to the registered address and by a notification within the Platform at least seven (7) days before the revised Policy takes effect, except where immediate changes are required to comply with a legal obligation.

13.3 The "Last Reviewed" date at the top of this Policy indicates when it was most recently updated. Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy. If you do not accept the revised Policy, please contact the support team to request Account closure.

14. Contact the Data Team

If you have any questions about this Privacy Policy, wish to exercise a data right, or want to raise a concern about how your Personal Data is handled, please contact the ug388 data protection team through the following channels:

• Email: support@ug388.cam — please include "Privacy Request" or "Data Rights Request" in the subject line
• Live Chat: Available 24/7 on the Platform in both English and Indonesian (WIB UTC+7)
• Registered Entity: International Gaming Zone (offshore)

We aim to respond to all data-related queries and formal data rights requests within thirty (30) calendar days of receipt. Where a request is particularly complex or we have received a high volume of requests, we may extend this period by a further thirty (30) days with notification to the requester.

Where you are not satisfied with our response to a data rights request or complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction applicable to you.