wso288 Privacy Policy

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, including name, date of birth, email address, mobile phone number, Indonesian national identity card (KTP) number, passport number, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction, whether by automated or manual means.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. wso288 is the Data Controller for all Personal Data collected through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of wso288 under a contractual arrangement, such as a payment service provider or a KYC verification partner.
• "Account" — a registered member account on the wso288 Platform.
• "KYC" — Know Your Customer, the identity and age verification process required before a Player may withdraw funds from the Platform.
• "Cookie" — a small text file placed on your device by the Platform to store session or preference information.
• "Platform" — the wso288 website, mobile web interface, and all associated services available at wso288.club.

wso288 is the Data Controller responsible for the Personal Data of all registered members and visitors to the Platform. wso288 determines what data is collected, why it is collected, and how it is processed. All data-protection inquiries and rights requests should be directed to the wso288 data protection contact specified in Section 16 of this Policy.

wso288 collects Personal Data through several channels: during Account registration, during the KYC verification process, during your use of the Platform, and through automated technical collection when you browse the Platform. The categories of Personal Data we collect are set out in the table below.

wso288 does not collect sensitive categories of Personal Data such as racial or ethnic origin, religious beliefs, health data, or political opinions, and does not request such data at any stage of the registration or KYC process.

wso288 processes your Personal Data on one or more of the following legal grounds:

1. Contractual necessity: Processing that is necessary to fulfil the Account agreement between you and wso288, including managing your Account, processing deposits and withdrawals in IDR, and delivering the games and services you have requested.
2. Legal obligation: Processing required to comply with applicable anti-money-laundering (AML) regulations, age-verification requirements (21+), KYC obligations, fraud-prevention requirements, and lawful requests from competent authorities.
3. Legitimate interests: Processing necessary for wso288's legitimate business interests, including platform security monitoring, fraud detection, responsible gaming compliance, and improving the quality of the Platform — provided these interests are not overridden by your rights and interests.
4. Consent: Processing based on your freely given, specific, and informed consent, primarily in respect of marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

wso288 uses the Personal Data it collects for the following purposes:

• Account management: Creating, maintaining, and closing your Account; authenticating your identity at login; enabling SMS OTP two-factor authentication.
• Transaction processing: Processing IDR deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, GoPay, OVO, DANA, ShopeePay, and LinkAja; reconciling transaction records; issuing bonus credits.
• Identity and age verification: Conducting KYC checks to confirm that you are who you claim to be and that you are at least 21 years of age, as required by wso288's operating standards.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, multi-accounting, money laundering, bonus abuse, and other prohibited conduct as defined in the wso288 Terms & Conditions.
• Responsible gaming: Monitoring gaming behaviour for indicators of problem gambling; administering deposit limits, session timers, cooling-off periods, and self-exclusion tools; complying with responsible gaming obligations.
• Customer support: Responding to your inquiries, complaints, and disputes via live chat and email in English and Indonesian, across all Indonesian time zones (WIB, WITA, WIT).
• Platform improvement: Analysing aggregated, anonymised usage data to identify and resolve technical issues, optimise game loading performance, and improve the overall player experience on mobile and desktop devices.
• Legal compliance: Retaining records as required by applicable AML, KYC, and financial regulations; responding to lawful requests from competent authorities.
• Marketing: Sending promotional offers, bonus notifications, and platform updates where you have given explicit consent. See Section 12 for details on marketing preferences and opt-out.

wso288 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. Your data may be shared with the following categories of third parties, strictly to the extent necessary for the purposes described in this Policy:

• Game content suppliers: Licensed studio partners including Evolution Gaming, Pragmatic Play, PG Soft (Pocket Games Soft), NetEnt, Microgaming, and Spribe receive session tokens and anonymised player identifiers to deliver live casino streams and RNG game sessions. These suppliers do not receive your full identity data.
• Payment service providers: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (GoPay, OVO, DANA, ShopeePay, LinkAja) receive the minimum transaction data required to process your deposits and withdrawals in IDR.
• KYC and identity verification partners: wso288 may use a third-party identity verification service to assist in validating KTP documents, passport photographs, and proof-of-payment-method submissions. Such partners operate under data-processing agreements that prohibit independent use of your data.
• Fraud prevention and security services: wso288 works with specialist anti-fraud providers to detect and prevent money laundering, bonus fraud, and multi-accounting. Relevant technical signals (IP address, device fingerprint, login patterns) may be shared with these providers.
• Regulatory and law enforcement authorities: wso288 will disclose Personal Data to competent governmental or regulatory authorities where required to do so by applicable law, court order, or binding regulatory direction. Where legally permitted, wso288 will notify you of such a disclosure.
• Professional advisors: Legal counsel, auditors, and other professional advisors engaged by wso288 may access relevant Personal Data under binding confidentiality obligations where necessary for their advisory functions.

Some of wso288's third-party service providers, including certain game studio partners and technical infrastructure providers, operate servers located outside Indonesia. Where your Personal Data is transferred to a country that does not provide an equivalent level of data protection, wso288 ensures that such transfers are subject to appropriate contractual safeguards, including standard contractual clauses or equivalent instruments recognised under applicable international data-protection frameworks.

By registering an Account and using the Platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Indonesia as described in this Section. wso288 takes all reasonable steps to ensure that such transfers are conducted securely and in accordance with this Policy.

wso288 retains your Personal Data for as long as your Account remains active and for a defined period thereafter, as set out in the table below. Retention periods are determined by the purpose for which data was collected and by applicable legal and regulatory requirements.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with wso288's data-deletion procedures. Where data has been anonymised, the resulting dataset no longer constitutes Personal Data and may be retained indefinitely for statistical and analytical purposes.

wso288 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures include:

• Encryption in transit: All data exchanged between your browser or mobile device and the Platform is encrypted using TLS 1.2 or higher with 256-bit AES encryption. The Platform enforces HTTPS on all pages; unencrypted HTTP connections are automatically redirected.
• Encryption at rest: Sensitive database fields, including identity document references and financial identifiers, are encrypted at rest using AES-256.
• Password security: Passwords are hashed using bcrypt with a work factor calibrated to current hardware capabilities. Passwords are never stored or transmitted in plain text.
• Access controls: Production database and administrative system access is restricted by role-based access controls (RBAC). All privileged access events are logged and subject to regular review.
• Two-factor authentication: Optional SMS OTP two-factor authentication is available for all member Accounts and is strongly recommended.
• Intrusion detection: The Platform's infrastructure is monitored by automated intrusion detection and anomaly-detection systems. Suspected security incidents trigger an immediate internal escalation procedure.
• Penetration testing: wso288 conducts periodic penetration testing of its Platform and infrastructure to identify and remediate security vulnerabilities before they can be exploited.

wso288 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device by your browser when you visit the Platform. Cookies allow the Platform to recognise your device, remember your preferences, maintain your login session, and collect anonymised usage statistics.

wso288 uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your authentication state, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without preventing you from using the Platform.
• Analytical cookies: These cookies collect anonymised data about how visitors use the Platform — which pages are visited most frequently, how long sessions last, and where technical errors occur. This data is used to improve Platform performance and user experience. Analytical cookies require your consent.
• Preference cookies: These cookies remember your settings and preferences, such as your selected language or notification configuration, so that you do not need to re-enter them on each visit.
• Marketing cookies: wso288 does not use advertising or retargeting cookies without your explicit prior consent. If you consent, these cookies may track whether you clicked on a particular promotion or game category.

You may manage your cookie preferences at any time via your browser's cookie settings. Note that disabling strictly necessary cookies will impair or prevent access to the Platform. Disabling analytical or preference cookies will not affect your ability to play games or make transactions.

Subject to applicable law and certain limitations, you hold the following rights in respect of your Personal Data held by wso288:

1. Right of access: You may request a copy of the Personal Data that wso288 holds about you, together with information about how it is being processed. wso288 will respond to subject access requests within 30 days of receipt.
2. Right to rectification: If any Personal Data held by wso288 is inaccurate or incomplete, you have the right to request that it be corrected. Some corrections (e.g., changes to registered name or date of birth) may require documentary evidence.
3. Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data. This right is subject to wso288's legal retention obligations; data held for AML, KYC, or financial regulatory purposes cannot be deleted ahead of the mandatory retention period.
4. Right to restriction: You may request that wso288 restrict the processing of your Personal Data in certain circumstances, for example while a dispute about data accuracy is pending.
5. Right to data portability: You may request that wso288 provide your Personal Data in a structured, commonly used, machine-readable format, where technically feasible and where processing is based on consent or contract.
6. Right to object: You may object to processing based on legitimate interests. wso288 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
7. Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing that occurred prior to withdrawal.

To exercise any of these rights, please contact wso288 at support@wso288.club with the subject line "Data Rights Request". Please include your registered username and a clear description of the right you wish to exercise. wso288 may request proof of identity before processing your request.

wso288 may send you promotional communications — including bonus offers, free-spin notifications, sportsbook promotions, and seasonal campaign updates for occasions such as Idul Fitri, Imlek, Ramadhan, and Indonesian Independence Day — by email or SMS where you have given your explicit prior consent during registration or Account settings.

wso288 will not send marketing communications based on any third-party purchased contact list. All marketing is sent exclusively to Account holders who have actively opted in on the Platform.

If wso288 discovers or has reasonable grounds to believe that Personal Data has been collected from an individual under the age of 21, the Account will be suspended immediately, all associated Personal Data will be deleted in accordance with applicable law, and any funds held in the Account will be handled in accordance with wso288's underage account procedures.

If you believe that a minor may have created an Account on the Platform using false information, please contact wso288 immediately at support@wso288.club. wso288 takes these reports seriously and will investigate promptly.

The wso288 Platform may contain links to third-party websites or services, for example links to game studios' own information pages or payment processor support portals. These third-party sites are not operated by wso288 and are not subject to this Privacy Policy. wso288 has no control over, and accepts no responsibility for, the content, privacy practices, or security measures of any third-party website. We encourage you to review the privacy policy of any third-party site you visit before providing your personal data to that site.

wso288 reserves the right to update or revise this Privacy Policy at any time. When material changes are made, wso288 will publish the revised Policy on this page with an updated effective date, and where practicable, notify registered Account holders by email or via an in-Platform notification.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acknowledgement of the changes. If you do not agree with the revised Policy, you must discontinue use of the Platform and contact us to request Account closure and data deletion, subject to applicable retention obligations.

For all questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the wso288 data protection team through the following channels:

• Email: support@wso288.club — please use the subject line "Privacy Inquiry" or "Data Rights Request" to ensure prompt routing to the appropriate team member.
• Live Chat: Available 24 hours a day, 7 days a week via the Platform. Native Indonesian-speaking agents are on hand across all Indonesian time zones (WIB, WITA, WIT) and can assist with data-related questions in both English and Indonesian.

wso288 aims to acknowledge all privacy-related inquiries within one (1) Working Day (Monday to Friday, 08:00–22:00 WIB, excluding Indonesian public holidays) and to provide a substantive response within thirty (30) calendar days of receipt. Where a request is particularly complex or where a high volume of requests is being processed, wso288 may extend this period by a further thirty (30) days with written notice.