Privacy Policy — gwp888

1.1 gwp888 ("we", "us", "our") operates the online betting and casino platform accessible at gwp888.app (the "Platform"). We are committed to protecting the personal information of every individual who accesses or uses our services, and we take our privacy obligations seriously.

1.2 This Privacy Policy describes: (a) the categories of personal data we collect; (b) the purposes for which we process that data; (c) the legal bases that justify our processing; (d) how long we retain data; (e) the circumstances in which we share data with third parties; and (f) the rights available to you as an individual whose data we hold.

1.3 This policy applies to all personal data collected through the gwp888 Platform, including data collected via our website, mobile site, live chat system, email correspondence, and customer support interactions. It applies to all current and former gwp888 members, as well as to individuals who browse the Platform without registering an account.

1.4 This policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between this Privacy Policy and our Terms & Conditions on a privacy matter, this Privacy Policy takes precedence.

2.1 For the purposes of this Privacy Policy, the data controller responsible for your personal data is gwp888, the operator of the Platform accessible at gwp888.app. The data controller determines the purposes and means of processing your personal data.

2.2 gwp888 is an internationally regulated platform operating under a valid gaming licence issued by its licensing authority. All data processing activities carried out by gwp888 are conducted in compliance with the conditions of that licence and with applicable international data protection standards.

2.3 If you have any questions regarding how gwp888 processes your personal data, or if you wish to exercise any of your data rights as described in Clause 10, you may contact our dedicated privacy team at support@gwp888.app. Please include "Privacy Request" in the subject line of your email.

2.4 Where gwp888 engages third-party service providers to process personal data on its behalf (for example, KYC verification providers or payment processors), those providers act as data processors under gwp888's instruction and are contractually obligated to handle data only in accordance with gwp888's documented instructions and applicable data protection law.

gwp888 collects personal data in several ways: directly from you when you register an account or use our services; automatically through your interaction with the Platform; and in limited circumstances from trusted third-party sources. The categories of data collected are set out below.

3.1 Registration & Account Data

When you create a gwp888 account, we collect the following information:

• Full legal name — as it appears on your official Indonesian identity document (KTP or passport)
• Date of birth — used to verify that you meet our 21+ age requirement
• Indonesian residential address — including street address, city (e.g., Jakarta, Surabaya, Bandung, Medan, Bali), and postal code
• Mobile telephone number — registered in Indonesia
• Email address — used for account notifications, security alerts, and (where consented) marketing communications
• Username and password — your chosen login credentials (passwords are stored in hashed, salted form and are never readable by gwp888 staff)
• Preferred currency — IDR (Indonesian Rupiah) is the sole supported currency on the gwp888 platform

3.2 Identity Verification (KYC) Data

To comply with our responsible gaming and anti-money-laundering obligations, gwp888 may collect additional identity documentation during the KYC process, including:

• Scanned copy or photograph of your Indonesian National Identity Card (KTP), passport, or driver's licence
• Proof of residential address (e.g., utility bill, bank statement from BCA, BRI, BNI, Mandiri, or CIMB Niaga, dated within 3 months)
• Selfie or live photo for facial identity matching
• Bank account or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja) ownership documentation
• Source-of-funds documentation where required by gwp888's internal risk thresholds

3.3 Financial Transaction Data

When you deposit funds into or withdraw funds from your gwp888 account, we collect transaction records including:

• Deposit amount and timestamp (in IDR, WIB timezone)
• Payment method used (bank transfer details for BCA, BRI, BNI, Mandiri, BSI, Bank Permata, OCBC NISP, CIMB Niaga; or e-wallet identifier for OVO, DANA, GoPay, ShopeePay, LinkAja)
• Withdrawal requests, amounts, and processing status
• Transaction reference numbers issued by payment processors

gwp888 does not store full card numbers or sensitive authentication data. Payment processing is handled by PCI-DSS-compliant third-party payment processors.

3.4 Betting & Gaming Activity Data

We maintain a complete record of your activity on the gwp888 Platform, including:

• Bets placed, odds accepted, stake amounts, and settlement outcomes across all sportsbook markets (including BRI Liga 1, EPL, La Liga, Champions League, and Timnas Indonesia fixtures)
• Casino game sessions, including game title (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Spribe), session duration, wager amounts, and results
• Togel (Indonesia's traditional numbers lottery) ticket purchases, number selections, and draw results
• Esports betting activity across supported titles
• Bonus claims and wagering progress

This data is used for account management, responsible gaming monitoring, dispute resolution, and the prevention of fraud and match-fixing.

3.5 Technical & Device Data

When you access the gwp888 Platform, we automatically collect technical information, including:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Screen resolution and language settings
• Pages visited, features used, and time spent on each section of the Platform
• Referring URL (if you arrived at gwp888 from another website)
• Session identifiers and authentication tokens

3.6 Communications Data

We retain records of communications between you and gwp888, including live chat transcripts, email correspondence, and support ticket histories. This data is used for quality assurance, dispute resolution, and staff training purposes.

gwp888 processes your personal data only for specific, documented purposes. The table below summarises our primary processing purposes and the corresponding data categories used.

gwp888 processes personal data only where a valid legal basis applies. The legal bases on which we rely are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between you and gwp888 — specifically, to operate your account, process your bets, and facilitate deposits and withdrawals in IDR.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC identity verification, AML transaction monitoring, responsible gaming obligations, and record-keeping requirements imposed by our licensing authority.
• Legitimate Interests: Processing for purposes that gwp888 has determined represent a legitimate interest — including fraud detection, security monitoring, platform analytics, and improvement of our services — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we send you marketing communications or use non-essential cookies, we will obtain your prior consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.
• Vital Interests: In exceptional circumstances where processing is necessary to protect the vital interests of a person, for example where a member discloses a risk of self-harm in the context of a problem gambling disclosure.

6.1 General Principle. gwp888 does not sell, rent, or disclose your personal data to third parties for their own independent commercial purposes. Data is shared with third parties only in the specific circumstances described below.

6.2 Service Providers (Data Processors). gwp888 engages carefully selected third-party service providers to support the delivery of our Platform. These providers process data strictly on gwp888's instruction and are bound by data processing agreements that prohibit them from using your data for any other purpose. Categories of processor include:

• KYC and identity verification providers — to verify the identity and age of members in accordance with Clause 8 of our Terms & Conditions
• Payment processors — to facilitate deposits and withdrawals via Indonesian local banks (BCA, BRI, BNI, Mandiri, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Game studio technology providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, and Spribe — to deliver game content; these providers receive session tokens and wagering data necessary to operate the game but do not receive your full profile
• Cloud hosting and infrastructure providers — to host gwp888 servers and databases in secure, internationally certified data centres
• Customer support platform providers — to power our 24/7 live chat and email ticketing systems
• Fraud prevention and cybersecurity providers — to detect and prevent unauthorised access, account takeover, and financial fraud

6.3 Regulatory and Law Enforcement Authorities. gwp888 may disclose personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, court order, or formal legal process. gwp888 will notify affected members of such disclosures where legally permitted to do so.

6.4 Responsible Gaming Organisations. Where a member has requested self-exclusion or where gwp888's responsible gaming monitoring system identifies a member as at risk, gwp888 may share limited identifying information with recognised problem gambling support organisations to facilitate intervention and support services.

6.5 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of gwp888's assets, personal data held by gwp888 may be transferred to the acquiring entity. Members will be notified of any such transfer in advance, and the receiving entity will be required to honour the terms of this Privacy Policy.

7.1 gwp888 retains personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to protect gwp888's legitimate business interests. The following retention periods apply:

• Account and registration data: Retained for the duration of your active gwp888 account, plus a minimum of 5 years following account closure, in accordance with our licensing authority's record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of verification, or for such longer period as required by applicable AML regulations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, consistent with standard financial record-keeping obligations.
• Betting and gaming activity logs: Retained for a minimum of 3 years from the date of each recorded session or wager, and for longer periods where the data is relevant to an open dispute or investigation.
• Customer support communications: Retained for 2 years from the date of the last interaction, unless the communication relates to an ongoing dispute in which case it is retained until resolution plus 1 year.
• Marketing preferences and consent records: Retained for the duration of your account and for 2 years thereafter, to demonstrate compliance with consent obligations.
• Technical and device logs: Retained for 12 months on a rolling basis, subject to extension where required for fraud investigation or security incident response.

7.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual. Anonymised data may be retained indefinitely for statistical and analytical purposes without further restriction.

7.3 Where you exercise your right to erasure (described in Clause 10.4), gwp888 will assess whether an overriding legal obligation prevents immediate deletion. Where deletion is not possible within the requested timeframe due to a mandatory retention obligation, gwp888 will restrict processing of the relevant data and notify you of the applicable retention period.

8.1 gwp888 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security controls include:

• Encryption in transit: All data transmitted between your device and the gwp888 Platform is encrypted using TLS 1.2 or higher, enforced across all platform endpoints.
• Encryption at rest: Sensitive personal data stored in gwp888's databases — including identity documents, financial records, and hashed authentication credentials — is encrypted at rest using AES-256 encryption.
• Password security: Member passwords are stored exclusively in hashed, salted form using a modern cryptographic hashing algorithm. gwp888 staff cannot access or read your password in its original form under any circumstances.
• Access controls: Access to personal data systems is restricted to authorised gwp888 personnel on a strict need-to-know basis. All internal access is logged and subject to periodic audit.
• Intrusion detection: gwp888's infrastructure is monitored 24/7 by automated intrusion detection systems that flag and respond to anomalous activity in real time.
• Vulnerability management: Regular penetration testing and vulnerability scanning are conducted on all gwp888 systems. Critical vulnerabilities are remediated on a priority basis.
• Physical security: gwp888 data is hosted in Tier-3 or higher certified data centres with multi-layer physical access controls, CCTV monitoring, and environmental protection systems.

8.2 Incident Response. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, gwp888 will notify affected members without undue delay and will take all necessary steps to contain the breach, assess its impact, and prevent recurrence. gwp888 will also notify the relevant regulatory authority in accordance with its licensing obligations.

9.1 gwp888 uses cookies and similar tracking technologies — including browser local storage and session tokens — to operate the Platform, remember your preferences, maintain your login session, and analyse how members use our services. Cookies are small text files stored on your device by your browser.

9.2 The categories of cookies used by gwp888 are as follows:

• Strictly Necessary Cookies: Essential to the operation of the Platform. Without these cookies, core functions such as account login, session management, and secure payment processing would not work. These cookies do not require your consent and cannot be disabled without severely impairing your ability to use the Platform.
• Functional Cookies: Remember your preferences and personalisation settings, such as your preferred display language and notification settings. These enhance your experience but are not essential to Platform operation.
• Analytics Cookies: Collect aggregated, anonymised information about how members navigate the Platform, which pages are visited most frequently, and where technical errors occur. This information is used to improve Platform performance. Analytics cookies require your consent.
• Marketing Cookies: Used to deliver relevant promotional content and measure the effectiveness of gwp888's marketing activities. Marketing cookies are only placed with your explicit prior consent and can be withdrawn at any time.

9.3 You may manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies will impair core Platform functionality, including your ability to log in to your gwp888 account.

9.4 gwp888 does not use third-party advertising network cookies or pixel tracking technologies from social media platforms (such as Facebook Pixel or Google Ads remarketing tags) in a manner that would share your identifiable data with those platforms without your consent.

As an individual whose personal data is processed by gwp888, you hold the following rights. To exercise any of these rights, contact our privacy team at support@gwp888.app with the subject line "Data Rights Request":

• 10.1 Right of Access. You have the right to request a copy of all personal data that gwp888 holds about you, together with information about how that data is processed, the legal basis for processing, the categories of recipients with whom it has been shared, and the applicable retention period. gwp888 will respond to access requests within 30 days.
• 10.2 Right to Rectification. If any personal data that gwp888 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may also update certain account details (such as your email address or phone number) directly within your gwp888 account settings.
• 10.3 Right to Restriction. You have the right to request that gwp888 restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is resolved, or where you have objected to processing and gwp888 is assessing whether its legitimate interests override your rights.
• 10.4 Right to Erasure. You have the right to request deletion of your personal data where: (a) the data is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and no other legal basis applies; (c) you object to processing and gwp888 has no overriding legitimate grounds; or (d) the data has been unlawfully processed. gwp888 may decline or defer erasure requests where a mandatory legal retention obligation applies, as described in Clause 7.
• 10.5 Right to Data Portability. Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and to have that data transmitted directly to another controller where technically feasible.
• 10.6 Right to Object. You have the right to object at any time to the processing of your personal data where gwp888 relies on legitimate interests as its legal basis. gwp888 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• 10.7 Right to Withdraw Consent. Where gwp888 processes your personal data on the basis of your consent — for example, for marketing communications or non-essential cookies — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.
• 10.8 Right to Lodge a Complaint. If you are dissatisfied with how gwp888 has handled your personal data or responded to a data rights request, you have the right to lodge a complaint with the supervisory authority in your jurisdiction. gwp888 encourages you to contact us directly in the first instance, as we are committed to resolving privacy concerns promptly and fairly.

11.1 The gwp888 Platform is strictly intended for adults aged 21 and older. gwp888 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the gwp888 account registration and KYC process, and accounts are suspended immediately where a member is found to be under the required age.

11.2 If gwp888 becomes aware that personal data has been collected from a person under 21 years of age, that data will be deleted immediately and the associated account will be permanently closed. Any winnings or balances held in the account of an underage member will be forfeited in accordance with our Terms & Conditions.

11.3 Parents and guardians who believe that a minor may have registered a gwp888 account or submitted personal data to the Platform are encouraged to contact us immediately at support@gwp888.app. gwp888 will investigate all such reports as a matter of the highest priority and will take all necessary remedial action without delay.

12.1 gwp888 is an internationally operated platform. In the course of delivering our services, your personal data may be transferred to, stored in, or processed by third-party service providers located in countries outside Indonesia. Such transfers may occur in connection with cloud hosting, KYC verification, payment processing, or game content delivery.

12.2 Where personal data is transferred to a country that does not provide a level of data protection equivalent to that applicable in Indonesia, gwp888 will ensure that appropriate safeguards are in place to protect your data. These safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities, incorporated into contracts with the receiving party
• Binding corporate rules where the transfer is to a member of gwp888's corporate group
• Certification schemes or codes of conduct recognised under applicable data protection frameworks

12.3 You may request further information about the specific safeguards in place for international transfers of your personal data by contacting our privacy team at support@gwp888.app with the subject line "International Transfer Query".

12.4 By creating a gwp888 account and accepting our Terms & Conditions and this Privacy Policy, you acknowledge that your personal data may be transferred internationally as described in this Clause, and that such transfers are subject to the safeguards described herein.

13.1 gwp888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the services we offer. The "Last Updated" date at the top of this page will be revised each time a material change is made.

13.2 Where a change to this Privacy Policy is material — meaning it affects your rights or the way in which gwp888 uses your personal data in a meaningful way — gwp888 will provide advance notice of the change by posting a prominent notice on the Platform homepage and/or sending an email notification to the address registered on your gwp888 account, no less than 14 days before the updated policy takes effect.

13.3 Your continued use of the gwp888 Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with a material change to this policy, you should stop using the Platform and close your account in accordance with the account closure procedure described in our Terms & Conditions before the revised policy takes effect.

13.4 For minor amendments — such as typographical corrections, clarifications that do not materially affect your rights, or updates to contact information — gwp888 may update this Privacy Policy without advance notice. gwp888 recommends that you review this page periodically to remain informed of any updates.

14.1 If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how gwp888 handles your personal data, please contact our dedicated privacy and support team through any of the following channels:

• Email: support@gwp888.app — Please include "Privacy Request" or "Data Rights Request" in the subject line, along with your registered gwp888 username and a clear description of your query. We aim to acknowledge all privacy-related emails within 2 business days (WIB, UTC+7) and to provide a substantive response within 30 calendar days.
• Live Chat: Available 24 hours a day, 7 days a week, directly within the gwp888 Platform interface. Our support team includes native Indonesian-speaking agents on every shift, in addition to English-language support staff.

14.2 For formal written data protection complaints or legal notices, please direct your communication to support@gwp888.app with the subject line "Formal Privacy Complaint — [Nature of Matter]". gwp888 will acknowledge receipt of formal privacy complaints within 2 business days and will provide a full written response within 30 calendar days.

14.3 gwp888 is committed to resolving all privacy concerns fairly and efficiently. If you remain dissatisfied after receiving gwp888's response to a formal complaint, you retain the right to escalate your concern to the relevant supervisory authority as described in Clause 10.8.