gol88 Privacy Policy

This Privacy Policy ("Policy") applies to all personal data collected, stored, and processed by gol88 in connection with the online gaming platform accessible at https://gol88.cam ("Platform"). It covers data relating to all visitors, registered Members, and former Members of gol88, regardless of how they access the Platform (desktop browser, mobile browser, or any future application).

For the purposes of applicable data protection legislation, gol88's operating entity ("gol88", "we", "us", "the Controller") is the data controller — meaning the entity that determines the purposes for which and the means by which personal data is processed. The Controller's contact details for privacy matters are set out in Clause 14.

This Policy should be read alongside gol88's Terms and Conditions, which form part of the same binding agreement between gol88 and each Member. Capitalized terms used herein that are not separately defined carry the meanings given to them in the Terms and Conditions.

gol88 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

gol88 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (except for identity document photos required for KYC), or data concerning health (except where voluntarily shared in a responsible gaming context).

gol88 collects personal data through the following channels:

• Direct submission: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawals, applying for promotions, or contacting our support team.
• Automated technical collection: Data collected automatically by our servers when you access the Platform — including IP address, device information, and session activity logs — via server logs, cookies, and similar technologies. See Clause 7 for details on cookies.
• Payment processors: Transaction confirmation data (but not full payment credentials) received from our integrated payment partners including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, and ShopeePay.
• Third-party identity verification services: During KYC, gol88 may use accredited third-party identity verification providers to cross-reference the documents you submit. These providers confirm authenticity without retaining a copy of your documents beyond the verification session.
• Publicly available sources: In limited circumstances related to fraud prevention or AML compliance, gol88 may supplement data with information from publicly available registries, sanctions lists, or adverse media databases.

gol88 processes your personal data for the following purposes:

• Account creation and management: To register your Account, verify your identity and age, and maintain your Account throughout its lifecycle.
• Service delivery: To process wagers, settle bets, handle deposits and withdrawals in Indonesian Rupiah (IDR), apply bonuses, and provide access to all Platform features.
• KYC and AML compliance: To verify that you meet gol88's eligibility requirements (21+, Indonesia residency) and to fulfil obligations under applicable anti-money-laundering and counter-financing-of-terrorism regulations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, cheating, and other prohibited conduct as defined in the Terms and Conditions.
• Customer support: To respond to enquiries, complaints, and requests submitted via live chat, email, or WhatsApp, and to maintain records of those interactions for quality assurance.
• Responsible gaming: To apply and monitor deposit limits, session timers, self-exclusion requests, and other protective measures requested by Members or triggered by gol88's welfare monitoring processes.
• Marketing communications: Where you have provided consent, to send promotional offers, bonus notifications, and platform updates via email or in-app messaging. You may withdraw consent at any time by updating your communication preferences in your Account settings or by contacting support.
• Platform improvement: To analyze usage patterns, identify technical issues, and improve the features, design, and performance of the gol88 Platform in aggregate anonymized form.
• Legal compliance: To comply with court orders, regulatory investigations, and other lawful demands from competent authorities.

gol88 relies on the following legal bases to process personal data:

• Contractual necessity: Processing required to perform the contract between gol88 and a Member — including Account creation, game operation, payment processing, and KYC verification.
• Legitimate interests: Processing necessary for gol88's legitimate business interests, including fraud detection, platform security, and service improvement, where those interests are not overridden by your fundamental rights.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering obligations, age verification requirements, and responses to lawful authority requests.
• Consent: Processing for optional activities — principally direct marketing communications — where you have given clear, informed, and freely given consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

gol88 does not sell, rent, or trade your personal data. We share data with third parties only in the limited circumstances described below:

• Payment service providers: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja receive the minimum transaction data necessary to process deposits and withdrawals on your behalf.
• Identity verification providers: Accredited KYC service providers receive identity document images and personal details solely for the purpose of age and identity verification. These providers are contractually bound to process data only for that purpose.
• Game technology providers: Licensed game studios (including Pragmatic Play, Evolution Gaming, Microgaming, Spribe, and Pocket Games Soft) receive the Account identifiers and bet data required to deliver their games and settle results.
• IT infrastructure providers: Cloud hosting and server providers who process data on our behalf under strict data processing agreements that prohibit independent use of the data.
• Fraud and AML screening services: Providers of sanctions list screening, adverse media monitoring, and behavioral analytics tools used to detect and prevent financial crime.
• Legal authorities: Law enforcement agencies, courts, or regulatory bodies where gol88 is legally compelled to disclose information, or where disclosure is necessary to protect the rights and safety of gol88, its Members, or third parties.

All third-party processors engaged by gol88 are subject to contractual data processing agreements that require them to maintain confidentiality, implement adequate security measures, and process personal data only in accordance with gol88's documented instructions.

gol88 uses cookies and similar tracking technologies to operate the Platform effectively and to understand how Members use it. The following cookie categories are in use:

• Strictly necessary cookies: Essential for the Platform to function — including session authentication cookies that keep you logged in and security tokens that protect against cross-site request forgery (CSRF). These cannot be disabled.
• Performance cookies: Anonymous analytics cookies that help gol88 understand page load times, error rates, and feature usage patterns, allowing us to optimize the Platform's technical performance. No personally identifiable data is included.
• Functional cookies: Cookies that remember your language preferences, theme settings, and last-visited game categories to personalize your experience without requiring repeated manual configuration.
• Marketing cookies: Used only with your consent to measure the effectiveness of promotional communications and to ensure that marketing messages shown on the Platform are relevant to your activity. You may opt out via your Account marketing preferences.

gol88 retains personal data for no longer than is necessary for the purpose for which it was collected, taking into account legal, regulatory, and operational requirements. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of the Member relationship plus five (5) years following Account closure, to satisfy anti-money-laundering record-keeping obligations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, consistent with financial reporting and AML regulatory requirements.
• KYC verification documents: Retained for five (5) years from Account closure or the last transaction date, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the relevant interaction, to facilitate dispute resolution and service quality review.
• Technical and usage logs: Retained for twelve (12) months on a rolling basis, after which they are automatically purged or anonymized.
• Marketing consent records: Retained for the duration of the consent plus three (3) years thereafter, to evidence that consent was validly obtained.

Upon expiry of the applicable retention period, data is securely deleted using industry-standard deletion protocols, or anonymized such that it can no longer be attributed to any identifiable individual and used only for aggregate statistical analysis.

As a gol88 Member, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our Data Privacy team at the email address in Clause 14.

gol88 implements a multi-layered security infrastructure to protect Member personal data against unauthorized access, disclosure, alteration, and destruction. Key measures include:

• Encryption: All data in transit is protected by TLS 1.3. Data at rest on gol88's servers is encrypted using AES-256.
• Access controls: Personal data is accessible only to gol88 personnel with a documented business need. Role-based access controls (RBAC) and multi-factor authentication (MFA) are enforced for all staff accessing Member data systems.
• Intrusion detection: Real-time monitoring systems flag anomalous access patterns, brute-force login attempts, and unusual transaction activity for immediate review.
• Penetration testing: gol88's platform undergoes regular independent penetration testing by certified security professionals. Critical findings are remediated within defined SLA windows.
• Incident response: gol88 maintains a documented data breach response procedure. In the event of a data breach that creates a risk to your rights and freedoms, gol88 will notify affected Members without undue delay and report to relevant authorities as required by applicable law.

While gol88 takes all reasonable precautions, no system is entirely immune to risk. Members are also responsible for maintaining the security of their own Account credentials. Never share your password. If you suspect unauthorized access to your Account, contact gol88 support immediately.

gol88 is strictly an adults-only platform. You must be at least 21 years of age to register an Account or use any service on gol88. We do not knowingly collect or process personal data relating to individuals under the age of 21.

If gol88 discovers or has reasonable grounds to believe that personal data of a person under 21 has been collected — whether through deliberate misrepresentation or otherwise — the affected Account will be closed immediately, all funds and Bonus Credits will be forfeited, and the data will be deleted as promptly as legally permissible (subject to any AML record-keeping obligations that may require retention).

Parents or guardians who believe that a minor has registered an Account on gol88 should contact us immediately at the details provided in Clause 14. We will investigate and take appropriate action within two (2) business days of notification.

As an internationally operated platform serving Indonesian Members, gol88 may transfer personal data to, and store it in, countries outside of Indonesia, including the jurisdiction(s) in which our servers and third-party service providers are located.

Where such transfers occur, gol88 ensures that adequate safeguards are in place, including:

• Standard contractual clauses (SCCs) approved by relevant data protection authorities, incorporated into contracts with all data processors receiving Indonesian Member data.
• Transfer only to jurisdictions that provide an adequate level of data protection as assessed by gol88's legal team, with reference to international standards.
• Binding data processing agreements that restrict the recipient's use of data to the purposes specified by gol88.

By using gol88, you acknowledge that your personal data may be processed in countries outside Indonesia. gol88 is committed to ensuring such processing meets the standards set out in this Policy, regardless of where it physically occurs.

gol88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. When material changes are made, we will:

• Display a prominent notice on the Platform for a minimum of 14 days before the updated Policy takes effect; and/or
• Send a notification to your registered email address summarizing the key changes.

Continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy. The "Last Updated" date at the top of this page reflects the date of the most recent revision. We encourage Members to review this Policy periodically.

If you do not agree with a material change to this Policy, please close your Account and cease using the Platform before the effective date. Outstanding Account Balances will be refunded to your registered payment method following standard withdrawal processing procedures.

For any question, request, or complaint relating to your personal data and gol88's privacy practices, please contact our Data Privacy team through the following channels:

• Email (Privacy): [email protected] — subject line: "Data Privacy Request"
• WhatsApp: +62 811 9988 001 (available 08:00–24:00 WIB)
• Live Chat: Available 24/7 through the gol88 Platform interface

Data subject requests will be acknowledged within 48 hours of receipt. We aim to fully resolve privacy requests within 30 calendar days, and will notify you if additional time is required due to the complexity of the request.

If you are dissatisfied with gol88's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. Indonesian Members may refer to the Ministry of Communication and Information Technology (Kementerian Komunikasi dan Informatika / Kominfo) or the designated authority under the PDP Law for guidance on escalating unresolved data protection complaints.