Privacy Policy — gg388 Platform

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, IP address, payment details, and identification documents.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or any other handling activity.
• "Controller" means gg388 — the operator of the platform at https://gg388.cam — which determines the purposes and means of processing your Personal Data.
• "Data Subject" / "You" means any registered Member or visitor whose Personal Data is processed by gg388.
• "Processor" means a third-party service provider that processes Personal Data on behalf of gg388, under written agreement and subject to data protection obligations.
• "KYC Data" means identity verification documents and information submitted by Members to satisfy the Know Your Customer process, as defined in the platform's Terms & Conditions.
• "Cookies" means small text files placed on your device by the gg388 platform to manage sessions, retain preferences, and support platform security.

gg388 collects the following categories of Personal Data in the course of providing its services:

gg388 collects Personal Data through the following channels and mechanisms:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your profile.
• Automated collection: Technical and behavioral data collected automatically when you access or interact with the gg388 platform, including via cookies, server logs, and analytics tools.
• Payment processing partners: Transaction confirmation data relayed from Indonesian banking institutions (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate deposits or withdrawals.
• Identity verification services: Data returned from third-party KYC and anti-fraud screening services used to validate identity documents and detect impersonation or identity theft.
• Publicly available sources: In limited circumstances, gg388 may cross-reference publicly available information (such as government sanction lists or fraud databases) as part of its AML compliance obligations.

gg388 processes your Personal Data exclusively for the following defined and lawful purposes:

• Account creation and management: To register your account, verify your identity, and maintain your membership profile on the gg388 platform.
• Service delivery: To enable you to place bets, access games, process deposits and withdrawals, and use all features of the platform.
• KYC and AML compliance: To verify your identity, prevent underage gambling, detect money laundering, and satisfy our obligations under the requirements of our international gaming license authority.
• Payment processing: To initiate, authorize, and confirm financial transactions between your payment method and your gg388 wallet balance.
• Fraud and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, and abusive conduct on the platform.
• Customer support: To respond to your inquiries, resolve disputes, and maintain records of support interactions for quality assurance purposes.
• Responsible gaming: To monitor betting patterns for indicators of problem gambling, enforce self-exclusion and deposit limits, and provide welfare interventions when appropriate.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — only where you have provided explicit consent and only to the extent permitted by applicable law.
• Platform improvement: To analyze behavioral and technical data in aggregated, anonymized form to improve platform performance, user experience, and game offering.
• Legal and regulatory obligations: To comply with applicable laws, respond to lawful requests from regulatory authorities, and protect gg388's legal rights and interests.

gg388 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfill the contract between you and gg388 — including operating your account, processing bets, and handling deposits and withdrawals.
• Legal obligation: Processing required to comply with regulatory requirements, including KYC identity verification, anti-money-laundering checks, and cooperation with gaming license authority oversight.
• Legitimate interests: Processing conducted for the legitimate business interests of gg388, including fraud prevention, platform security, and internal analytics — provided such interests are not overridden by your fundamental rights.
• Consent: Processing of data for optional purposes — including marketing communications and certain cookie categories — where you have provided clear, freely given, and revocable consent.

gg388 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to contractual data protection obligations:

• Payment service providers: Indonesian banking institutions (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data necessary to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged to verify the authenticity of identity documents and to screen against sanction lists or fraud databases.
• Game content providers: Licensed game studios (such as Pragmatic Play, Evolution Gaming, and others) may receive anonymized session identifiers to facilitate game delivery. They do not receive your name, payment data, or contact details.
• IT infrastructure and cloud providers: Hosting, database, and security service providers that support the gg388 platform under strict data processing agreements.
• Regulatory and law enforcement authorities: Where required by law, court order, regulatory directive, or the requirements of our gaming license authority, gg388 will disclose data to competent authorities. We will notify you of such disclosure where legally permitted to do so.
• Professional advisors: Lawyers, auditors, and compliance consultants who are bound by professional confidentiality obligations.

gg388 operates as an international platform. In the course of delivering our services, your Personal Data may be transferred to, stored, or processed in countries outside of Indonesia, including the jurisdiction where our gaming license is registered and where our infrastructure providers are located.

Where such transfers occur, gg388 ensures that appropriate safeguards are in place, including:

• Contractual clauses between gg388 and the recipient entity that impose data protection standards equivalent to those applied within Indonesia.
• Use of service providers that operate in jurisdictions recognized as providing adequate data protection standards.
• Technical and organizational security measures applied to data in transit and at rest, regardless of the storage location.

By using gg388's services, you acknowledge and consent to the transfer of your Personal Data to the jurisdictions described in this clause, subject to the safeguards detailed above.

gg388 retains your Personal Data for no longer than is necessary to fulfill the purposes for which it was collected, subject to the following retention periods and obligations:

• Account data and transaction records: Retained for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements imposed by our gaming license authority.
• KYC documentation: Retained for five (5) years from the date of submission or account closure, whichever is later, as required by applicable anti-money-laundering regulations.
• Customer support communications: Retained for three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Marketing data: Retained until you withdraw consent or request erasure, subject to a maximum period of three (3) years of inactivity.
• Technical logs: Server and security logs are retained for ninety (90) days, after which they are automatically deleted unless flagged as relevant to an ongoing security investigation.

Following the expiry of applicable retention periods, gg388 will securely delete or anonymize your Personal Data in a manner that prevents its recovery or re-identification.

gg388 implements a comprehensive range of technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the gg388 platform is encrypted using industry-standard TLS protocols.
• Encrypted data storage: Sensitive personal data, including payment details and identity documents, is encrypted at rest using AES-256 encryption.
• Access controls: Access to Personal Data within gg388's systems is restricted on a strict need-to-know basis. Staff access is controlled via role-based permissions and multi-factor authentication.
• Regular security audits: gg388's platform and infrastructure undergo periodic penetration testing and security audits conducted by independent cybersecurity firms.
• Incident response: gg388 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights, we will notify you and relevant regulatory authorities within the timeframe required by applicable law.

gg388 uses cookies and similar technologies on the platform. The following categories of cookies are deployed:

• Essential / Strictly Necessary Cookies: Required for the platform to function. These include session management cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without impairing core platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and notification preferences, to improve your experience on subsequent visits.
• Analytics Cookies: Used by gg388's internal analytics systems to understand aggregate platform usage patterns, identify technical errors, and improve platform performance. These are first-party analytics only; gg388 does not use Google Analytics or similar third-party analytics services that transmit your data to external platforms.
• Security Cookies: Short-lived tokens used to detect and prevent fraudulent session activity and bot-driven access attempts.

gg388 does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts. You may manage cookie preferences through your browser settings, though disabling essential cookies will affect your ability to use the platform.

Depending on your jurisdiction of residence, you may hold some or all of the following rights with respect to your Personal Data held by gg388. You may exercise these rights at any time by contacting our Data Protection team:

gg388 strictly prohibits the use of its platform by any individual under the age of 21 years. We do not knowingly collect Personal Data from individuals under this age threshold.

As part of our KYC process, all Members are required to verify their age by submitting a valid government-issued identity document. If gg388 discovers or has reasonable grounds to believe that a Member is under 21, the account will be immediately suspended, all associated data will be retained only to the extent required by our AML compliance obligations, and the matter may be referred to relevant authorities where appropriate.

If you are a parent or guardian and believe your minor child has registered an account with gg388, please contact our support team immediately at [email protected]. We will investigate and take appropriate action without delay.

The gg388 platform may reference or incorporate services from third-party game studios and payment providers in the course of delivering its product offering. These third parties operate under their own privacy policies and data processing terms.

gg388 is not responsible for the privacy practices of third-party service providers beyond the contractual data protection obligations we impose on them as processors. We recommend that you review the privacy policies of any third-party service with which you interact directly.

gg388 does not link to external websites for advertising, affiliate, or promotional purposes. All navigation on the platform remains within the gg388 domain.

gg388 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the requirements of our licensing authority. Material changes will be communicated to Members by email notification to the registered address and by a prominent notice on the platform, no fewer than seven (7) calendar days before the changes take effect.

Your continued use of the gg388 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you disagree with the changes, you should cease using the platform and request account closure in accordance with our Terms & Conditions.

The current version of this Privacy Policy is always available at https://gg388.cam/privacy-policy. The effective date at the top of this document indicates when the most recent version came into force.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your Personal Data by gg388, please contact us through the following channels:

• Email (Data Requests & Privacy Queries): [email protected] — Please include "Privacy Policy" or "Data Rights Request" in the subject line.
• 24/7 Live Chat: Available directly on the gg388 platform for immediate general queries. For formal data requests, email is the recommended channel to ensure a documented response trail.
• WhatsApp: +62 811 0388 000 — Available 08:00–24:00 WIB for general support. Formal data rights requests should be directed to email.

All data rights requests will be acknowledged within two (2) business days and fulfilled within thirty (30) calendar days of identity verification. gg388 does not charge a fee for processing standard data rights requests.