ido98 Privacy Policy

The following definitions apply throughout this Privacy Policy. Capitalized terms not defined here carry the meaning given to them in the ido98 Terms & Conditions.

ido98 collects the minimum Personal Data necessary to operate a secure, compliant, and high-quality betting and gaming platform for Indonesian members. The categories of data we collect are set out below.

2.1 Registration Data. When you create an ido98 account, we collect:

• Full legal name (as it appears on your government-issued ID);
• Date of birth (to verify you are 21 or older);
• Indonesian residential address;
• Email address;
• Mobile phone number;
• Username and hashed password.

2.2 Identity Verification (KYC) Data. Prior to processing withdrawals, we collect:

• A copy of your national identity card (KTP) or passport;
• Proof of address (e.g., a recent utility bill or bank statement dated within 3 months);
• A selfie photograph holding your identity document, where required;
• Bank account or e-wallet ownership documentation (for BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja).

2.3 Transaction Data. For every deposit, withdrawal, bet, and bonus claim, we record:

• Transaction amount (in IDR — Indonesian Rupiah);
• Transaction date and time (WIB — Western Indonesia Time);
• Payment method and account reference;
• Bet type, market, odds, and outcome;
• Bonus type claimed and wagering progress.

2.4 Technical & Device Data. Automatically collected when you access the Platform:

• IP address and approximate geolocation (city/region level);
• Browser type, version, and language;
• Operating system and device type;
• Session start and end times;
• Pages visited, click paths, and feature interactions;
• Cookie identifiers and local storage data.

2.5 Communications Data. If you contact our support team, we retain:

• Live chat transcripts;
• Email correspondence (sent to or from [email protected]);
• Support ticket content and resolution notes.

2.6 Responsible Gaming Data. If you use self-exclusion, deposit limits, or other responsible gaming tools, we record:

• The type of limit or exclusion applied;
• The duration and date of any self-exclusion period;
• Any requests to modify or lift restrictions, and the outcome.

3.1 Directly from You. The majority of Personal Data we hold is provided directly by you — during account registration, during the KYC process, when you make deposits or withdrawals, when you place bets, and when you contact our support team.

3.2 Automatically. Technical and device data is collected automatically via server logs, cookies, and similar tracking technologies when you access or interact with the Platform. See Clause 9 for full details on our cookie practices.

3.3 From Third Parties. We may receive data from the following third-party sources:

• Payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) — transaction status, account ownership confirmation;
• Identity verification providers — document authenticity checks and facial recognition matching results;
• Fraud and AML screening services — watchlist screening results, risk scores;
• Game content providers (Pragmatic Play, Evolution Gaming, Microgaming, Spribe, Pocket Games Soft, NetEnt) — game session data, RNG outcomes, and Return-to-Player audit logs.

ido98 processes your Personal Data only for the purposes listed below. We do not process Personal Data for any purpose that is incompatible with these stated purposes without first obtaining your explicit consent or as otherwise permitted by applicable law.

ido98 processes your Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — delivering the Platform's services, processing transactions, managing your account, and providing customer support.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations, age verification, and responses to lawful regulatory requests.
• Legitimate interests: Processing carried out in furtherance of ido98's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and service analytics — where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6.1 We do not sell your Personal Data. ido98 will never sell, rent, or trade your Personal Data to third parties for their own marketing purposes. Data sharing is limited to the categories of recipients described below, and only to the extent necessary to fulfill the stated purpose.

6.2 Payment Processors. When you make a deposit or request a withdrawal, we share the minimum necessary transaction and identity data with the relevant payment processor — BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja — solely to authorize and complete the transaction. Each processor is contractually bound to handle your data in accordance with applicable data protection standards.

6.3 Identity Verification Providers. To fulfill our KYC obligations, we may share your identity documents and registration data with accredited third-party identity verification services. These providers act as Processors under our instructions and are prohibited from using your data for any other purpose.

6.4 Game Content Providers. When you play a game supplied by a third-party studio (such as Pragmatic Play, Evolution Gaming, or Spribe), a game session token and your account balance information are shared with that studio's systems to enable gameplay. Game providers do not receive your full registration or payment details.

6.5 Fraud and AML Screening. Your data may be checked against industry fraud databases and financial crime watchlists. This processing is a legal obligation for ido98 as a licensed gaming operator.

6.6 Legal and Regulatory Authorities. ido98 may disclose your Personal Data to competent authorities — including law enforcement, financial intelligence units, or our licensing authority — when required to do so by a lawful order or applicable regulation. Where legally permitted, ido98 will notify you of such a disclosure.

6.7 Corporate Transactions. In the event of a merger, acquisition, or sale of all or substantially all of ido98's assets, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

7.1 Active Accounts. ido98 retains your Personal Data for as long as your account remains active and for a period of five (5) years following account closure, unless a longer retention period is required by applicable law or regulatory obligation.

7.2 KYC and Transaction Records. KYC documents and transaction records are retained for a minimum of five (5) years from the date of the last transaction on your account, in compliance with anti-money laundering record-keeping requirements.

7.3 Responsible Gaming Records. Self-exclusion records and responsible gaming tool settings are retained for the duration of any active exclusion period plus five (5) years, to prevent inadvertent re-registration by excluded Members.

7.4 Communications Data. Support chat transcripts and email correspondence are retained for three (3) years from the date of the relevant interaction, for quality assurance and dispute resolution purposes.

7.5 Anonymized Analytics. Aggregated, anonymized analytics data that cannot be linked back to any individual may be retained indefinitely for product improvement and business intelligence purposes.

8.1 Technical Safeguards. ido98 employs industry-standard technical security measures to protect your Personal Data, including:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers;
• AES-256 encryption for sensitive data at rest (including KYC documents and payment references);
• Firewalls, intrusion detection systems, and real-time threat monitoring;
• Two-factor authentication (2FA) available for all Member accounts;
• Regular independent security audits and penetration testing.

8.2 Organizational Safeguards. Access to Personal Data within ido98 is governed by the principle of least privilege — team members access only the data necessary for their specific role. All personnel with access to Personal Data are bound by confidentiality obligations and receive regular data protection training.

8.3 Breach Response. In the event of a data breach that poses a risk to your rights and freedoms, ido98 will notify affected Members without undue delay and will take all reasonable steps to contain, investigate, and remediate the breach. ido98 maintains a documented incident response plan reviewed annually.

8.4 Your Responsibility. The security of your account also depends on you. You are responsible for keeping your ido98 login credentials confidential and for logging out of shared devices. If you believe your account has been compromised, contact [email protected] immediately.

9.1 What Are Cookies. Cookies are small text files stored on your device by your browser when you visit a website. ido98 uses cookies and similar technologies (such as local storage and session tokens) to operate the Platform, remember your preferences, and analyze how the Platform is used.

9.2 Types of Cookies We Use.

9.3 Managing Cookies. You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect Platform functionality — for example, disabling strictly necessary cookies will prevent you from staying logged in.

9.4 No Third-Party Advertising Cookies. ido98 does not place third-party advertising or retargeting cookies on the Platform. We do not permit external ad networks to track your browsing behavior across other websites via the ido98 Platform.

As a Member of ido98, you have the following rights in relation to your Personal Data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) calendar days of receiving a valid, verified request.

• Right of Access: You may request a copy of the Personal Data ido98 holds about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. For name and date-of-birth corrections, supporting documentation will be required.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations described in Clause 7.
• Right to Restriction of Processing: You may request that ido98 restrict processing of your data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: You may request a copy of Personal Data you have actively provided to ido98 (such as registration and transaction data) in a structured, machine-readable format.
• Right to Object: You may object to processing based on ido98's legitimate interests, and you may withdraw consent for marketing communications at any time.
• Right Not to be Subject to Automated Decisions: ido98 does not make solely automated decisions that produce significant legal effects on Members. Fraud risk scores are always reviewed by a qualified analyst before account action is taken.

11.1 The ido98 Platform is strictly for adults aged 21 and over. We do not knowingly collect Personal Data from any person under the age of 21. Age verification is conducted at registration and at the KYC stage.

11.2 If ido98 becomes aware that Personal Data has been collected from a person under 21, the relevant account will be closed immediately, all data will be deleted (subject to any legal retention obligations), and any deposited funds will be returned to the original payment source where technically possible.

11.3 If you are a parent or guardian and believe a minor may have registered an account on ido98, please contact us immediately at [email protected]. We will investigate and act on all such reports with priority.

12.1 The ido98 Platform may contain links to third-party websites or services — for example, game provider studios or payment processor portals. This Privacy Policy applies solely to Personal Data processed by ido98 on the ido98 Platform. It does not apply to the data practices of third-party websites.

12.2 When you click a link to a third-party site, you leave the ido98 Platform and become subject to that site's own privacy policy and terms. ido98 is not responsible for the content, security, or privacy practices of any third-party website.

12.3 We encourage you to review the privacy policies of all third-party services you interact with in connection with your ido98 account — particularly those of your chosen bank or e-wallet provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay).

13.1 ido98 stores the majority of Member data on servers located within or serving the Southeast Asian region. However, some of our third-party Processors — including game content providers such as Pragmatic Play, Evolution Gaming, and Microgaming — may process data on servers located outside Indonesia.

13.2 Where Personal Data is transferred internationally, ido98 ensures that appropriate safeguards are in place, including contractual obligations on the receiving party to protect the data to a standard equivalent to that applied by ido98, consistent with applicable data protection law.

13.3 By using the ido98 Platform, you acknowledge that your Personal Data may be transferred to, stored in, and processed in countries other than Indonesia. ido98 takes all reasonable steps to ensure such transfers are conducted securely and lawfully.

14.1 ido98 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will notify you via a platform notification or by email to your registered address at least seven (7) days before the changes take effect.

14.2 The "Effective Date" and "Last Reviewed" date at the top of this document indicate the version currently in force. The most current version of this Privacy Policy is always available at ido98.app/privacy-policy.

14.3 Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to any update, you must stop using the Platform and may request account closure in accordance with the Terms & Conditions.

15.1 If you have any questions, concerns, or complaints about this Privacy Policy or about how ido98 handles your Personal Data, please reach out to our dedicated support team:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy Policy Inquiry" or "Data Rights Request"
• Live Chat: Available 24/7 on the ido98 Platform (WIB)
• Response Time: Email responses within 24 hours; live chat average first-response under 3 minutes during peak hours.

15.2 For responsible gaming concerns — including self-exclusion requests, deposit limit adjustments, or questions about your gaming patterns — please visit our Responsible Gaming page or contact support directly.