Privacy Policy

1. Definitions

The following terms carry specific meanings throughout this Privacy Policy:

• "Personal Data" means any information that can, directly or indirectly, identify a living individual. This includes names, identification numbers, email addresses, financial account details, IP addresses, device identifiers, and any combination of data points that together make an individual identifiable.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction — whether carried out by automated means or otherwise.
• "Data Controller" means pura88, the entity that determines the purposes and means by which your Personal Data is processed.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of pura88 under a contractual data-processing agreement.
• "Player" or "User" means any natural person who holds a registered account with pura88 or who accesses the pura88 website without registration.
• "KYC" (Know Your Customer) refers to our identity verification procedures, which involve collecting and validating official identification documents such as the Indonesian identity card (KTP), driver's license, or passport.
• "Cookies" means small text files stored on your device by your web browser when you visit the pura88 website, enabling us to recognise your browser and remember certain preferences or session states.

2. Data We Collect

pura88 collects only the data necessary to provide, secure, and improve our services. The categories below summarise what we hold:

2.1 Identity and Contact Data

• Full legal name as it appears on official government-issued identification
• Date of birth (for age verification — you must be at least 21 years old)
• Residential address in Indonesia (city, province, postal code)
• Email address (used for account communications and transactional notifications)
• Mobile phone number registered to your Indonesian SIM card
• Gender (collected during registration; optional for platform personalisation)

2.2 Verification Documents

• Copy of your Indonesian National Identity Card (KTP) — front and back images
• Passport or driver's licence (accepted as alternative to KTP)
• Selfie or live photograph taken during KYC verification
• Proof of payment method ownership (e.g., bank statement or e-wallet screenshot showing your name and account number matching your registration details)

2.3 Financial Data

• Bank account numbers and bank names (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) used for deposits and withdrawals
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method references
• We do not store full bank account passwords, internet banking PINs, or card CVV numbers

2.4 Gaming Activity Data

• Account balance history and wagering records
• Game session logs including games played, bet sizes, win/loss outcomes, and session duration
• Sports betting selections, odds accepted, settlement results, and cashout actions
• Bonus claims, wagering progress toward requirements, and promotional participation records
• Responsible gaming settings you have applied (deposit limits, session reminders, self-exclusion periods)

2.5 Technical and Device Data

• IP address at time of login and transactions
• Device type, operating system, and browser version
• Geolocation data (city and country level) derived from your IP address
• Unique device identifiers used for fraud detection and multi-account prevention
• Log files including page views, clicks, session timestamps, and error reports

2.6 Communications Data

• Customer support conversation transcripts (live chat, email, WhatsApp message content)
• Survey responses and feedback submissions
• Marketing preference settings (opt-in / opt-out records for promotional communications)

3. How We Collect Your Data

pura88 collects Personal Data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical data gathered automatically through cookies, web beacons, server logs, and analytics tools when you browse or interact with the pura88 website or mobile application.
• Payment processors: Transaction confirmation data received from Indonesian bank payment gateways and e-wallet providers when you initiate a deposit or withdrawal.
• Identity verification partners: Confirmation data returned from third-party KYC verification services used to validate the authenticity of documents you submit.
• Fraud prevention partners: Risk signals and flagging information provided by anti-fraud technology providers to protect the integrity of our platform.
• Publicly available sources: In limited circumstances, we may cross-reference information against publicly available databases to verify identity or detect fraudulent activity.

4. Purpose and Legal Basis for Processing

pura88 processes your Personal Data only for specific, documented purposes. The table below outlines our primary processing activities and the corresponding legal justification:

Purpose	Data Categories Used	Legal Basis
Account registration and management	Identity, contact, verification documents	Performance of contract
Age and identity verification (KYC)	Identity documents, selfie, date of birth	Legal obligation; contract performance
Processing deposits and withdrawals	Financial data, transaction records	Performance of contract
Providing gaming and betting services	Gaming activity data, account balance	Performance of contract
Customer support	Communications data, account data	Legitimate interest; contract performance
Responsible gaming monitoring	Gaming activity, session data, financial data	Legal obligation; legitimate interest
Fraud prevention and security	Technical data, IP address, device identifiers	Legitimate interest; legal obligation
Anti-money laundering (AML) compliance	Financial data, identity data, transaction logs	Legal obligation
Personalised promotional communications	Contact data, gaming activity, preferences	Consent (opt-in)
Platform improvement and analytics	Technical data, anonymised usage data	Legitimate interest

5. Data Sharing and Third-Party Disclosure

pura88 does not sell, rent, or trade your Personal Data to any third party for marketing purposes. We share Personal Data only in the following limited and controlled circumstances:

5.1 Service Providers and Data Processors

We engage reputable third-party service providers to perform specific functions on our behalf. These providers have contractual obligations to process your data only as instructed by pura88 and to implement appropriate security measures. Categories of service providers include: identity verification and KYC platforms, Indonesian bank payment gateways and e-wallet integrators, anti-fraud and AML screening services, cloud infrastructure and data hosting providers, customer support platform providers, email and messaging delivery services, and game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and others) who receive gaming session data necessary to deliver their games.

5.2 Legal and Regulatory Disclosure

pura88 may disclose your Personal Data to law enforcement agencies, regulatory bodies, or government authorities where required by applicable law or valid legal process. Such disclosures may include requests related to criminal investigations, anti-money laundering investigations, tax reporting obligations, or court orders. We will notify you of such disclosures where legally permitted to do so.

5.3 Business Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the successor entity as part of the transaction. We will notify you via email and prominent website notice before your data becomes subject to a different privacy policy as a result of such a transaction.

5.4 Consent-Based Sharing

With your explicit consent, pura88 may share your data for purposes not covered by this policy. You may withdraw such consent at any time by contacting our support team at [email protected].

6. International Data Transfers

As a platform operating internationally with data processors located in multiple jurisdictions, some of your Personal Data may be transferred to and processed in countries outside Indonesia. pura88 ensures such transfers are conducted with appropriate safeguards, including contractual data protection clauses that require recipient organisations to protect your data to standards equivalent to those applied within Indonesia. Our primary data hosting infrastructure is located in data centres with industry-standard physical and technical security certifications (ISO 27001, SOC 2).

Game providers such as Pragmatic Play, Evolution Gaming, Microgaming, and NetEnt may process gaming session data on servers located in their respective jurisdictions. These providers operate under internationally recognised gaming certifications and data protection frameworks. By using pura88 services, you acknowledge and consent to these international data transfers as necessary for service delivery.

7. Data Retention

pura88 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply:

• Account and identity data: Retained for the duration of your active account plus a minimum of 5 years following account closure, to satisfy anti-money laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction, consistent with standard financial record-keeping obligations.
• KYC verification documents: Retained for the duration of your account and for 5 years after closure. Documents found to be fraudulent may be retained longer in connection with legal proceedings.
• Gaming activity logs: Retained for 3 years from the date of each session, used for dispute resolution, responsible gaming monitoring, and regulatory reporting.
• Customer support communications: Retained for 2 years from the date of the last interaction in a given case thread.
• Marketing preference records: Retained for 3 years from the date of last consent update to demonstrate compliance with opt-in and opt-out requests.
• Technical and device logs: Retained for 12 months on a rolling basis for security monitoring and fraud detection purposes.

When data is no longer required under the retention periods above, pura88 will securely delete or anonymise it so that it can no longer be associated with any individual.

8. Cookies and Tracking Technologies

pura88 uses cookies and similar tracking technologies on our website to enable core functionality, improve user experience, and gather analytics. The categories of cookies we deploy are as follows:

8.1 Strictly Necessary Cookies

These cookies are essential for the website to function correctly. They maintain your login session, remember your security preferences, and ensure transactions are processed correctly. These cookies cannot be disabled without impairing your ability to use the Platform.

8.2 Performance and Analytics Cookies

These cookies collect anonymous information about how visitors use the pura88 website — for example, which pages are visited most frequently, how long sessions last, and where users navigate from. We use this data to identify usability improvements and optimise Platform performance. The data collected is aggregated and does not identify individual users.

8.3 Functional Cookies

Functional cookies remember your preferences and personalisation choices, such as your preferred language display, notification settings, and recently viewed game categories. Disabling these cookies will not prevent you from using the Platform but may reduce the convenience of your experience.

8.4 Marketing and Retargeting Cookies

With your consent, pura88 may deploy marketing cookies that track your interactions across browsing sessions to deliver relevant promotional content. You may withdraw consent for marketing cookies at any time through your browser settings or by contacting our support team. Withdrawing marketing cookie consent does not affect the validity of processing carried out prior to withdrawal.

Most web browsers allow you to manage cookie preferences through their settings menus. Please note that disabling strictly necessary cookies may prevent certain features of the pura88 Platform from functioning as intended.

9. Security Measures

pura88 implements a comprehensive, layered approach to data security to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security framework includes the following measures:

• SSL/TLS Encryption: All data transmitted between your browser and the pura88 servers is encrypted using industry-standard Transport Layer Security (TLS 1.2 or higher), protecting your data in transit from interception.
• Encryption at Rest: Sensitive Personal Data, including financial account details and identity documents, is encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Controls: Access to Personal Data within pura88 is restricted to staff members whose roles require it. Role-based access controls, multi-factor authentication for administrative systems, and comprehensive audit logging ensure accountability for all data access events.
• Penetration Testing: Our platform undergoes regular third-party security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: pura88 maintains a documented data breach response plan. In the event of a breach affecting your Personal Data, we will notify affected users and relevant authorities within required timeframes.
• Fraud Detection Systems: Automated systems monitor transactions and account activity in real time for anomalous patterns, triggering additional verification steps or account holds where suspicious activity is detected.

Despite these measures, no data transmission over the internet or electronic storage system is unconditionally secure. We cannot guarantee absolute security, and you use pura88 services with this understanding. You are responsible for maintaining the security of your account credentials and notifying us promptly of any suspected unauthorised access.

10. Your Rights

As a player whose Personal Data pura88 processes, you hold the following rights with respect to your information:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is being used and with whom it has been shared.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you may request correction. Minor corrections (such as email address updates) can often be made directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that we may be unable to delete data we are legally required to retain under AML or financial record-keeping obligations.
• Right to Restriction of Processing: You may request that we restrict processing of your Personal Data in certain circumstances, such as while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or contract performance, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. Upon receipt of a valid objection to marketing, we will cease sending promotional communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our support team at [email protected] with the subject line "DATA RIGHTS REQUEST." We will acknowledge your request within 2 business days and fulfil it within 30 days, or inform you if a longer period is required due to complexity. We may request proof of identity before processing rights requests to prevent unauthorised disclosure.

11. Children's Privacy

pura88 is an adult-only platform. We do not knowingly collect Personal Data from individuals under 21 years of age. Our registration process includes mandatory date-of-birth verification, and all accounts are subject to KYC identity checks to confirm age eligibility. If we discover that a minor has created an account or provided personal information, we will immediately suspend the account, void all gaming activity, return any deposited funds where lawfully possible, and permanently delete all associated Personal Data.

If you are a parent or guardian and believe your child has registered with pura88, please contact us immediately at [email protected]. We take underage gambling extremely seriously and will prioritise any such reports for urgent investigation.

12. Responsible Gaming and Data Use

pura88 uses gaming activity data in a constructive way to support player welfare. Our responsible gaming systems analyse betting patterns, session duration, deposit frequency, and loss trajectories to identify players who may be exhibiting signs of problem gambling. Where such indicators are detected, our team may reach out proactively to offer information about responsible gaming tools, suggest cooling-off periods, or recommend professional support resources.

Responsible gaming data — including self-imposed deposit limits, session time reminders, cooling-off periods, and self-exclusion records — is treated with the highest level of confidentiality. It is not used for marketing personalisation and is never shared with third parties except where required by law. If you self-exclude from pura88, your exclusion record is retained for the full exclusion period and beyond to prevent inadvertent re-registration, consistent with our duty of care obligations.

For full details of the responsible gaming tools available to you and guidance on accessing support, please read our dedicated Responsible Gaming page.

13. Amendments to This Policy

pura88 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform functionality. When material changes are made, we will notify active players via email and display a prominent notice on the pura88 website for a minimum of 30 days following the update. The "Last Updated" date at the top of this document will always reflect the most recent revision.

Your continued use of pura88 following notification of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree with any changes, you should discontinue use of the Platform and contact us to exercise your data rights, including erasure where applicable.

14. Contact and Data Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or the Personal Data pura88 holds about you, please reach out through the following channels:

• Email: [email protected] — include "PRIVACY" or "DATA REQUEST" in the subject line for prompt routing to our data protection team.
• Live Chat: Available 24/7 through your pura88 account dashboard for general privacy inquiries.
• Response Times: General inquiries — within 2 business days. Formal data rights requests — within 30 calendar days of acknowledgement.

We are committed to addressing all privacy concerns transparently and in good faith. If you feel your privacy rights have not been adequately addressed, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.