Privacy Policy

Definitions

The following definitions apply throughout this Privacy Policy:

Data Controller Identity

pena88 is the Data Controller responsible for the Personal Data of its Members. pena88 operates the Platform at pena88.bet and is the primary point of contact for all data protection queries and requests from Members.

pena88 is licensed and regulated as an international online gaming operator. The Platform is operated in compliance with applicable data protection obligations under the licensing jurisdiction's regulatory framework, as well as with due regard for Indonesian data protection principles under Law Number 27 of 2022 concerning Personal Data Protection (Undang-Undang Perlindungan Data Pribadi / UU PDP), which came into force in Indonesia in 2024.

Personal Data We Collect

pena88 collects Personal Data in the following categories. The specific data points collected depend on the nature of your interaction with the Platform:

3.1 Registration and Account Data

• Full legal name
• Date of birth (used for age verification — minimum 21 years)
• Residential address, including city and province (e.g., Jakarta, Surabaya, Bandung, Bali)
• Email address
• Mobile phone number
• Username and encrypted password
• Security question answers (where applicable)

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo ID (Indonesian National ID / KTP, passport, or Driving Licence / SIM)
• Proof of address documentation (utility bill, bank statement, or official government correspondence dated within 90 days)
• Proof of payment method ownership (bank account statement or e-wallet screenshot)
• Facial photograph or selfie (where required by our KYC provider for liveness verification)

3.3 Financial and Transaction Data

• Bank account details (account number, account name, and bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata)
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Deposit and withdrawal history
• Wagering history, game session records, and win/loss records
• Bonus redemption history

3.4 Technical and Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Session timestamps and duration
• Pages visited within the Platform and navigation path
• Referral source (the URL or campaign that directed you to pena88.bet)

3.5 Communication Data

• Records of live chat conversations with pena88 support agents
• Email correspondence with pena88
• Survey responses and feedback submitted voluntarily
• Records of any formal complaints or dispute correspondence

How We Collect Your Data

pena88 collects Personal Data through the following channels:

1. Directly from you: When you register an account, complete the KYC verification process, make a deposit or withdrawal, place a wager, contact our support team, or respond to a promotional survey.
2. Automatically through the Platform: Technical and device data is collected automatically when you access pena88.bet via cookies, server logs, and analytics tools. See Section 7 (Cookies & Tracking) for full details.
3. From third-party KYC providers: pena88 uses accredited third-party identity verification services to assist with document and liveness checks. These providers return a verification result and relevant confidence scores to pena88, which are added to your account record.
4. From payment processors: When you initiate a deposit or withdrawal, our payment processing partners confirm transaction details (reference numbers, amounts, timestamps, and payment account identifiers) which are recorded against your account.
5. From fraud prevention and anti-money laundering services: pena88 may receive risk signals or alerts from third-party fraud detection services that cross-reference known fraud patterns, sanctioned entities lists, and politically exposed persons (PEP) databases.

Purposes of Processing & Legal Basis

pena88 processes your Personal Data for the following purposes, each underpinned by an identified legal basis:

Where pena88 relies on legitimate interests as a legal basis, we have assessed that our interests do not override the fundamental rights and freedoms of Members. Members may object to processing based on legitimate interests by contacting [email protected].

Sharing Your Personal Data

pena88 does not sell your Personal Data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to binding data processing agreements:

• Payment Processors: Indonesian bank and e-wallet partners (including those operating BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja integrations) receive transaction-level data necessary to execute deposits and withdrawals.
• KYC Verification Providers: Accredited identity verification partners receive copies of KYC documents submitted by Members for the purpose of age and identity verification. These providers act as Data Processors under contract with pena88.
• Fraud and AML Screening Services: Third-party fraud prevention and anti-money laundering screening providers may receive account-level risk data to cross-reference against sanctions lists, PEP databases, and fraud pattern libraries.
• Game Software Providers: Game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive a pseudonymised player identifier to manage game sessions, track wagering history for RTP compliance, and populate jackpot systems.
• IT Infrastructure and Cloud Providers: Managed hosting, content delivery network (CDN), and cloud storage providers may hold encrypted copies of Member data as part of the platform's technical infrastructure. These providers operate under strict data processor agreements.
• Regulatory Authorities and Law Enforcement: pena88 may be required by law, court order, or regulatory direction to disclose Personal Data to competent authorities. Disclosures of this nature are made only to the extent legally required.
• Professional Advisors: Legal counsel, auditors, and compliance consultants may access limited Personal Data in the context of providing professional services to pena88, subject to professional confidentiality obligations.

Cookies & Tracking Technologies

pena88 uses cookies and similar tracking technologies on pena88.bet to ensure the Platform functions correctly, to remember your preferences, to analyse usage patterns, and to support fraud detection. The categories of cookies we use are described below:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use pena88. Disabling analytics cookies will not affect your core Platform experience.

Data Retention

pena88 retains Personal Data for no longer than is necessary to fulfil the purpose for which it was collected, having regard to any legal retention obligations imposed by applicable law or our licensing authority. The following general retention periods apply:

• Active Account Data: Retained for the lifetime of the Member's account and for a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of 5 years from the date of verification, as required by AML regulations applicable to our licensing jurisdiction.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction, for regulatory reporting and audit purposes.
• Support Correspondence: Retained for 3 years from the date of the final correspondence in a support thread, to support complaint resolution and quality assurance.
• Analytics Data: Aggregated, anonymised analytics data may be retained indefinitely as it cannot be used to identify individual Members. Session-level pseudonymised analytics data is retained for 24 months.
• Marketing Consent Records: Retained for the duration of the Member's account and for 3 years following account closure, to evidence consent history in case of regulatory inquiry.

When data reaches the end of its applicable retention period and is no longer required for any secondary legal purpose, it is securely deleted or rendered permanently anonymous in accordance with pena88's data destruction policy.

Data Security

pena88 implements a layered security architecture to protect Member data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• Encryption in Transit: All data transmitted between the Member's device and pena88 servers is encrypted using TLS 1.2 or higher. Connections using older, less secure protocols are rejected.
• Encryption at Rest: Sensitive Personal Data stored on pena88 servers — including KYC documents, payment details, and passwords — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to systems holding Member Personal Data is restricted to authorised employees and contractors whose role requires that access. Access privileges are reviewed regularly and revoked immediately upon role change or departure.
• Two-Factor Authentication: Administrative access to pena88's data systems requires multi-factor authentication. Members are encouraged to enable two-factor authentication on their accounts for an additional layer of security.
• Penetration Testing and Audits: pena88 engages independent security specialists to conduct regular penetration testing of its platform infrastructure. Findings are remediated within defined timelines based on severity classification.
• Data Breach Response: In the event of a data breach affecting Member Personal Data, pena88 maintains an incident response plan to contain the breach, assess the impact, notify affected Members promptly, and report to relevant regulatory authorities where legally required.

Your Data Rights

As a Member of pena88 and a data subject, you have the following rights regarding your Personal Data. These rights may be subject to certain legal limitations where data Processing is required by law or for the establishment, exercise, or defence of legal claims.

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request" and include your account username and a description of the right you wish to exercise. pena88 will respond within 30 calendar days. Requests that are manifestly unfounded or excessive may be declined or subject to a reasonable administrative charge.

Minors

pena88 strictly prohibits access to and use of the Platform by individuals under the age of 21. pena88 does not knowingly collect Personal Data from individuals under 21. If pena88 becomes aware that Personal Data has been collected from a person under 21, that data will be immediately deleted and the associated account will be permanently closed.

If you are a parent or guardian and you believe that a minor under your supervision has registered an account on pena88 or provided Personal Data to pena88, please contact us immediately at [email protected] so that we can take appropriate remedial action.

The minimum age requirement of 21 applies to all Members regardless of their location within Indonesia — whether in Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, or any other city or region.

International Data Transfers

pena88 operates internationally and may transfer Personal Data to countries outside Indonesia for the purposes described in this Privacy Policy — for example, to cloud infrastructure providers or KYC verification partners whose servers are located in other jurisdictions.

Where Personal Data is transferred outside Indonesia, pena88 ensures that appropriate safeguards are in place to protect the data, including:

• Transfers to countries recognised as providing an adequate level of data protection by relevant Indonesian or international regulatory standards.
• Use of binding contractual clauses in data processing agreements with third-party recipients that require equivalent data protection standards to those applied by pena88.
• Application of technical safeguards including encryption so that data in transit and at rest remains protected regardless of the jurisdiction in which it is stored.

By using the pena88 Platform and providing Personal Data to pena88, you acknowledge that your data may be processed in jurisdictions outside Indonesia and consent to such transfers as described in this Privacy Policy.

Amendments to This Privacy Policy

pena88 reserves the right to amend this Privacy Policy at any time to reflect changes in our data Processing practices, applicable law, or the services we offer. Where amendments are material — meaning they significantly affect how we use your Personal Data or the rights available to you — pena88 will notify registered Members via email to the address associated with their account no less than 14 days before the revised Policy takes effect.

For minor amendments (such as clarifications, formatting changes, or corrections to typographical errors), the Policy may be updated without advance notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Your continued use of the pena88 Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you must cease using the Platform and may request account closure by contacting [email protected].

Contact & Complaints

For all data protection enquiries, rights requests, or complaints relating to how pena88 handles your Personal Data, please contact us using the details below:

• Email: [email protected] — use the subject line "Data Protection Request" or "Privacy Complaint" to ensure your message is routed to the correct team. The email address is displayed as plain text only and is not a clickable link.
• Live Chat: Available 24 hours a day, 7 days a week via the pena88 Platform after logging in. For data protection matters, please select "Account & Privacy" as the contact category so your query reaches the appropriate team.

pena88 is committed to resolving all privacy-related complaints fairly and promptly. If you are not satisfied with pena88's response to your complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction or to the regulatory authority overseeing pena88's gaming licence.