Privacy Policy — wd138 Data Protection Commitment

1.1 This Privacy Policy applies to all personal data collected and processed by wd138 in connection with the online gaming platform accessible at https://wd138.asia and all associated subdomains, mobile interfaces, and customer-support channels (collectively, the "Platform"). It governs the relationship between wd138 (the "Data Controller") and any individual who visits, registers on, or interacts with the Platform (each a "Member" or "you").

1.2 wd138 operates as the data controller for all personal data processed under this policy. Where wd138 engages third-party service providers to process data on its behalf, those providers act as data processors under written contracts that impose data-protection obligations at least equivalent to those set out here.

1.3 This policy is written in English and is directed at Members and prospective Members in Indonesia. It should be read alongside the wd138 Terms & Conditions, which are incorporated herein by reference. By creating an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy.

2.1 The categories of personal data wd138 collects are set out in the table below. In each case, the data is collected only to the extent necessary for the stated purpose.

2.2 wd138 does not collect or process special categories of sensitive personal data (e.g., racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data used for identification), except where a Member voluntarily discloses such information in a support communication. Any such information is handled with the highest level of care and is not used for any commercial purpose.

3.1 Directly from you. The majority of your personal data is provided directly by you when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or opt into a promotional offer. You are not obliged to provide all requested information, but failure to do so may prevent us from opening or maintaining your account.

3.2 Automatically during platform use. When you access the Platform, our servers and analytics tools automatically record Technical Data and Usage Data. This includes your IP address, device identifiers, session duration, and interaction events. This collection is essential for security, fraud prevention, and platform reliability.

3.3 From third-party service providers. We receive verification data from identity-check and fraud-prevention partners when you complete KYC. We also receive transaction confirmation data from payment processors (such as the banks and e-wallets listed in Section 2) to reconcile your deposit and withdrawal records. These providers supply only the minimum data necessary for the specific task.

3.4 Cookies and similar technologies. wd138 uses cookies, local storage, and similar browser technologies to maintain your login session, remember your preferences, and gather aggregate analytics data. For full details, see Section 9 (Cookies & Tracking).

4.1 wd138 processes your personal data on one or more of the following legal grounds:

• Contract performance: Processing is necessary to open your account, execute your deposits and withdrawals, settle your wagers, and deliver the services you have contracted for under the Terms & Conditions.
• Legal obligation: Certain data processing — particularly KYC identity verification, transaction record-keeping, and anti-money-laundering checks — is required by our international licensing obligations and applicable financial regulations. We cannot waive these requirements.
• Legitimate interests: wd138 processes Technical Data and Usage Data on the basis of its legitimate interest in maintaining the security, integrity, and quality of the Platform, preventing fraud, and improving the member experience. These interests are balanced against your privacy rights and do not override them.
• Consent: Where we send you direct marketing communications (e.g., promotional emails about new bonuses or seasonal campaigns tied to Idul Fitri or Indonesian Independence Day on 17 August), we do so on the basis of your explicit consent. You may withdraw this consent at any time by contacting our support team or using the unsubscribe link in any marketing email.

5.1 wd138 uses your personal data for the following purposes, each of which maps to one or more of the legal bases described in Section 4:

• Account creation and management: Registering your account, verifying your age and identity (21+ strictly enforced), maintaining your account balance, and enforcing your account preferences.
• Transaction processing: Processing deposits and same-day IDR withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja; reconciling your transaction history; and investigating payment disputes.
• Wager settlement and game delivery: Recording and settling bets on BRI Liga 1, EPL, La Liga, Champions League, and all other sportsbook markets; delivering live casino games via Evolution Gaming and certified slot titles; and maintaining provably fair RNG game records.
• Fraud prevention and security: Detecting and blocking unauthorised account access, identifying multi-accounting and bonus abuse, monitoring for match-fixing indicators, and preventing money laundering. This processing uses automated profiling combined with manual review.
• Customer support: Handling your queries, resolving disputes about wager settlements, and maintaining records of support interactions for quality assurance.
• Responsible gaming: Monitoring betting patterns that may indicate problem gambling behaviour; activating cooling-off periods, deposit limits, or self-exclusion as requested; and proactively reaching out to Members who exhibit high-risk patterns.
• Platform improvement: Analysing aggregated, anonymised usage data to improve game navigation, page load times, and the overall member experience.
• Marketing communications: Sending you bonus offers, promotional campaigns, and seasonal announcements — subject to your consent and with a clear opt-out mechanism in every communication.

5.2 wd138 will not use your personal data for any purpose that is materially different from those listed above without first informing you and, where required, obtaining your consent.

6.1 wd138 does not sell, rent, or trade your personal data to any third party for commercial gain. Data is shared only in the following circumstances and only to the extent necessary:

• Payment processors: Your name and payment account details are shared with BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja solely to execute the deposit or withdrawal transaction you have authorised.
• Identity verification providers: For KYC purposes, your identity documents and photograph may be shared with a certified third-party verification service. That service returns only a pass/fail result and a risk score to wd138; it does not retain your documents beyond its own legally required period.
• Fraud prevention networks: Anonymised risk signals (not your full identity) may be contributed to industry fraud-prevention networks to protect the broader gaming community. These networks are bound by strict confidentiality and data-minimisation agreements.
• Game content providers: Providers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive only a session token and your currency denomination — they do not receive your name, contact details, or financial records.
• Legal and regulatory authorities: wd138 will disclose personal data to law enforcement, financial intelligence units, or regulatory bodies when legally compelled to do so, or when disclosure is necessary to protect the rights, property, or safety of wd138 or its Members.
• Professional advisers: Legal counsel, auditors, and insurers may access personal data on a strictly confidential basis in connection with their professional services.

6.2 All third-party processors engaged by wd138 are subject to written data-processing agreements that prohibit them from using member data for any purpose beyond the specific task for which they were engaged and that require them to implement security measures equivalent to or stronger than those described in Section 8.

7.1 wd138 retains your personal data only for as long as is necessary for the purposes set out in this policy, or as required by applicable law and our international licensing obligations. The following indicative retention periods apply:

7.2 Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where full deletion is not technically feasible within a specific system, data is quarantined and access restricted until deletion is possible.

8.1 wd138 implements a layered security architecture designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• Transport security: All data in transit is encrypted using TLS 1.2 or higher (256-bit SSL). HTTP connections are automatically redirected to HTTPS.
• Data at rest: Sensitive data fields — including identity document images and payment account details — are encrypted at rest using AES-256.
• Password handling: Member passwords are never stored in plain text. They are hashed using a strong adaptive algorithm (bcrypt) with per-account salting.
• Access controls: Internal access to member data is governed by role-based access control (RBAC). All access events are logged and reviewed periodically by the security team.
• Two-factor authentication (2FA): Members are strongly encouraged to enable 2FA on their accounts. Staff with access to sensitive systems are required to use 2FA.
• Intrusion detection: wd138 operates continuous network monitoring and automated intrusion-detection systems to identify and respond to anomalous activity in real time.
• Regular security reviews: The platform undergoes periodic penetration testing and security audits conducted by independent third parties.

8.2 In the event of a personal data breach that poses a risk to Members' rights and freedoms, wd138 will notify affected Members without undue delay and take all reasonable steps to mitigate the impact of the breach.

9.1 wd138 uses cookies and similar client-side storage technologies to provide a functional, secure, and personalised platform experience. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your login session, remember your currency setting (IDR), and preserve your responsible-gaming preferences. These cookies cannot be disabled without impairing core functionality.
• Performance & Analytics Cookies: These cookies collect anonymised data about how Members use the Platform — such as which game categories are most visited and which pages generate support queries — to help us improve the experience. No personally identifiable information is stored in these cookies.
• Functionality Cookies: These cookies remember choices you make (such as your preferred sports league view or lobby sort order) to provide a more personalised experience on your next visit.
• Security Cookies: Short-lived cookies used to detect and prevent fraudulent login attempts, CSRF attacks, and session hijacking.

9.2 wd138 does not use third-party advertising or retargeting cookies. We do not participate in cross-site tracking networks or share browsing data with external ad platforms.

9.3 You may configure your browser to block or delete cookies. Note that blocking strictly necessary cookies will prevent you from logging in to your account. All other cookie categories can be declined without loss of core functionality, though some personalisation features may not work as expected.

10.1 As a Member whose data is processed by wd138, you hold the following rights with respect to your personal information. To exercise any of these rights, contact our support team via live chat or at [email protected]. We will respond within 30 days of a verified request.

10.2 Where a data request intersects with our legal obligation to retain records (e.g., KYC documents and transaction history required under anti-money-laundering rules), we will explain the specific legal basis for retention and delete all non-legally-required data in scope of the request.

11.1 wd138 operates an adults-only platform. Registration and participation are strictly limited to individuals aged 21 years or older. This age restriction is enforced both at registration (via date-of-birth input and KYC document verification) and on an ongoing basis through our account-review processes.

11.2 wd138 does not knowingly collect personal data from any individual under the age of 21. If we become aware that a minor has registered an account, we will immediately close the account, return any net deposits, and permanently delete all associated personal data, except where retention is required to document the breach and prevent re-registration.

11.3 If you are a parent or guardian and believe your child has registered on wd138, please contact our support team immediately at [email protected]. We will investigate and take action within 24 hours of a verified report.

12.1 wd138 reviews this Privacy Policy at least annually and whenever there is a material change to the way we process personal data. The effective date at the top of this page reflects the most recent review.

12.2 Where a change is material — for example, a new category of data being collected, a new third-party processor being engaged, or a change to retention periods — we will notify active Members via their registered email address at least seven (7) days before the change takes effect. Minor clarifications and editorial corrections will be updated on this page without individual notification.

12.3 Your continued use of the Platform following the effective date of a material change constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should close your account before the new policy takes effect and contact our support team to exercise your data rights under Section 10.

13.1 For all privacy-related inquiries, data subject requests, or concerns about how wd138 handles your personal information, please contact us through one of the following channels:

• Live Chat: Available 24/7 within your wd138 account dashboard. Responses within two minutes. Our Indonesian-speaking agents are trained to handle data requests and will escalate to the data protection team as needed.
• Email: [email protected] — for formal data subject requests, please include "Data Request" in the subject line and provide your registered username and account email for identity verification purposes. We aim to respond within 30 days.

13.2 When submitting a data access, rectification, or deletion request, please provide your registered username, the email address associated with your account, and a clear description of the request. This allows our team to verify your identity and process your request efficiently without unnecessary delay.

13.3 wd138 is committed to resolving all privacy concerns directly with Members. If you believe your data rights have not been adequately addressed after contacting us, you may escalate the matter to the relevant supervisory authority in your jurisdiction.