Privacy Policy

koi138 ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access or use the koi138 online betting and casino platform, accessible at https://koi138.cam ("the Platform"). This Privacy Policy describes the types of personal data we collect, the purposes for which we process that data, the parties with whom we may share it, and the rights available to you in relation to your personal information.

This policy applies to all users of the koi138 Platform, including registered account holders, prospective players who browse the site without registering, and any individual whose personal data koi138 receives in connection with the provision of its services. It covers all data processing activities conducted by koi138 through the Platform, including via desktop browsers, mobile browsers, and any koi138-branded application.

By accessing the koi138 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, processing, and use of your personal data as described herein. If you do not agree to the terms of this policy, please discontinue use of the Platform and contact our support team to arrange account closure.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, email address, phone number, date of birth, financial account details, IP address, device identifiers, and behavioral data linked to a specific individual.
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" means koi138, which determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of koi138 — for example, payment processors, KYC verification providers, or cloud hosting services.
• "KYC" means Know Your Customer — the identity verification process used by koi138 to confirm a player's identity in compliance with its anti-money-laundering (AML) obligations.
• "Cookies" means small text files placed on your device by the koi138 Platform to facilitate session management, preference recall, and platform analytics.
• "Sensitive Personal Data" means special categories of personal data that require additional protection — such as financial account details, identification document numbers, and data relating to health or problem gambling indicators.

koi138 collects the following categories of personal data in connection with the provision of its services:

koi138 does not knowingly collect data that is not necessary for the purposes listed above. Where you choose not to provide certain categories of data, we will inform you of the impact on your ability to access specific features of the Platform.

koi138 collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, submitting a support request, or responding to a promotional offer.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and similar tracking technologies. This data is collected regardless of whether you are logged into your account.
• Third-party sources: Identity and address verification data received from our KYC partners in connection with document verification checks. Fraud-risk signals received from payment processors and fraud-prevention service providers. Publicly available information used to enhance our understanding of account activity where fraud or AML concerns arise.
• Payment providers: Transaction confirmation data from Indonesian payment networks including BCA, BRI, BNI, Mandiri, and e-wallet providers such as OVO, DANA, GoPay, ShopeePay, and LinkAja. This data is shared with koi138 solely to confirm the status of deposit and withdrawal transactions.

koi138 uses your personal data for the following purposes:

1. Account management: Creating and maintaining your player account, verifying your identity, managing your login credentials, and sending account-related notifications such as password reset emails and security alerts.
2. Service delivery: Processing deposits and withdrawals, crediting bonuses, resolving disputes, providing live chat and email support, and delivering the full range of betting and gaming services available on the koi138 Platform.
3. Legal and regulatory compliance: Fulfilling koi138's obligations under its international gaming license, including KYC identity verification, AML transaction monitoring, age verification, and record retention as required by applicable regulations.
4. Fraud and security: Detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, multi-accounting, and other prohibited conduct as defined in the koi138 Terms & Conditions.
5. Responsible gaming: Monitoring gameplay patterns to identify indicators of potential problem gambling behavior, and proactively offering responsible gaming tools such as deposit limits, session time limits, and self-exclusion where appropriate.
6. Platform improvement: Analyzing aggregated usage data to understand how players interact with the koi138 Platform, identify areas for improvement, and optimize the user experience across devices.
7. Marketing communications: Sending promotional emails, SMS notifications, and in-platform messages about bonuses, special events (including promotions tied to Indonesian occasions such as Idul Fitri, Ramadhan, and Independence Day), and new game launches — but only where you have explicitly opted in to receive such communications.

koi138 processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to perform the contract between koi138 and you as a registered player — including account creation, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with koi138's legal and regulatory obligations under its gaming license — including KYC verification, AML transaction monitoring, and mandatory record retention.
• Legitimate interests: Processing carried out in pursuit of koi138's legitimate business interests — including fraud prevention, platform security, product improvement, and responsible gaming monitoring — where those interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and any optional data sharing that falls outside the categories above. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

koi138 does not sell your personal data. We share personal data with third parties only to the extent necessary for the purposes described in this Privacy Policy, and only with parties that have agreed to maintain appropriate data protection standards. Categories of recipients include:

• KYC and identity verification partners: Third-party providers that assist koi138 in verifying player identities and authenticating identity documents in connection with our licensing obligations.
• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — solely for the purpose of processing player deposit and withdrawal transactions.
• Fraud prevention and AML service providers: Specialized third-party services that assist koi138 in detecting and preventing fraudulent transactions, money laundering, and other financial crime risks.
• Cloud infrastructure and hosting providers: Third-party data center and cloud hosting operators that provide the underlying infrastructure on which the koi138 Platform is hosted and operated. These providers process data only on koi138's documented instructions and under contractual data processing agreements.
• Regulatory and law enforcement authorities: Where koi138 is legally required to disclose personal data by court order, regulatory mandate, or lawful request from a competent government authority. koi138 will notify you of any such disclosure to the extent permitted by law.
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by koi138 in connection with legal proceedings, licensing audits, or regulatory reviews — subject to strict confidentiality obligations.

All third-party data processors engaged by koi138 are contractually required to process personal data only for the specified purpose, to maintain appropriate technical and organizational security measures, and to delete or return data to koi138 upon termination of the processing relationship.

The koi138 Platform uses cookies and similar tracking technologies to provide a functional, secure, and optimized user experience. The following types of cookies are used:

koi138 does not use third-party advertising cookies or participate in cross-site behavioral advertising networks. You may control or disable cookies through your browser settings; however, disabling strictly necessary cookies will impair Platform functionality and may prevent you from logging into your account.

koi138 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active account data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, in accordance with standard AML record-keeping requirements applicable under koi138's international gaming license.
• Transaction records: Deposit, withdrawal, and wagering transaction records are retained for a minimum of 5 years from the date of the transaction, to support financial audits, dispute resolution, and regulatory inquiries.
• KYC documentation: Identity and address verification documents are retained for a minimum of 5 years after the end of the account relationship, in line with standard AML document retention requirements.
• Support communications: Live chat transcripts and email correspondence are retained for a minimum of 2 years from the date of the communication, to support quality assurance, dispute resolution, and regulatory record-keeping.
• Marketing preference records: Opt-in and opt-out records are retained for as long as your account remains active, plus an additional period of 2 years following account closure, to demonstrate compliance with applicable marketing consent requirements.
• Technical logs: Server access logs and security event logs are retained for up to 12 months on a rolling basis, for fraud detection and platform security purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized such that it can no longer be associated with any identifiable individual.

koi138 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• Encryption in transit: All data transmitted between your device and the koi138 Platform is protected using TLS 1.2 or higher encryption, ensuring that your personal and financial data cannot be read by unauthorized parties during transmission.
• Encryption at rest: Sensitive personal data — including financial account details and identity document data — is stored in encrypted form using AES-256 or equivalent encryption standards.
• Access controls: Access to personal data within koi138's systems is restricted to authorized personnel on a strict need-to-know basis. All access is authenticated, logged, and subject to periodic access rights review.
• Two-factor authentication: koi138 supports and encourages the use of two-factor authentication (2FA) for player accounts to provide an additional layer of protection against unauthorized access.
• Penetration testing and security audits: koi138 conducts regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities in the Platform's infrastructure and application code.
• Incident response: koi138 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, affected players will be notified without undue delay.

As a player on the koi138 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team using the details provided in Section 16 of this policy.

• Right of access: You have the right to request a copy of the personal data koi138 holds about you, along with information about how that data is being processed. We will respond to access requests within 30 days of receipt.
• Right to rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. For account-level data such as your name or contact details, you may be able to update this directly within your account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that certain data must be retained to fulfill our legal obligations — in such cases, we will inform you of the specific retention requirement that prevents full deletion.
• Right to restriction: You have the right to request that koi138 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: Where processing is based on your consent or on a contract, you have the right to receive a copy of the personal data you have provided to koi138 in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on koi138's legitimate interests, including profiling conducted for responsible gaming monitoring purposes. koi138 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to the withdrawal.

All privacy rights requests are handled free of charge and are responded to within 30 days of receipt. Where a request is particularly complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

koi138 is an internationally operated platform. As a result, your personal data may be transferred to, and processed in, countries outside Indonesia — including the jurisdiction in which koi138's international gaming license is held and the locations of our cloud infrastructure and third-party service providers.

Where personal data is transferred internationally, koi138 ensures that appropriate safeguards are in place to protect that data at a level equivalent to the protections described in this Privacy Policy. These safeguards may include:

• Contractual data processing agreements incorporating standard data protection clauses that bind the recipient to data protection obligations equivalent to those applicable to koi138.
• Transfers to jurisdictions that maintain data protection standards recognized as adequate for the purposes of international data transfers.
• Technical measures such as end-to-end encryption that ensure data remains protected regardless of the location in which it is processed or stored.

If you have questions about the safeguards applied to any specific international transfer of your personal data, please contact our support team using the details in Section 16.

The koi138 Platform is strictly for adults aged 21 years or older. koi138 does not knowingly collect personal data from individuals under the age of 21. If we discover or are notified that we have inadvertently collected data from a minor, we will immediately close the associated account, delete the personal data in question, and — where applicable — return any deposited funds in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a minor in your care has accessed the koi138 Platform or provided personal data without your consent, please contact our support team immediately at [email protected]. We take such reports seriously and will act promptly to investigate and resolve the matter.

The koi138 Platform may, from time to time, contain references to or information about third-party services — for example, game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft, or sports organizations such as PSSI, AFC, FIFA, and the BWF. While koi138 works with these partners to deliver games and content on the Platform, koi138 is not responsible for the privacy practices or data handling policies of any third-party organization.

This Privacy Policy applies solely to the koi138 Platform at https://koi138.cam. If you visit any third-party website or interact with a third-party service outside of the koi138 Platform, we encourage you to review the relevant third party's privacy policy before providing any personal data.

koi138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. When material changes are made to this policy, koi138 will notify registered players via the email address associated with their account and will update the "Last updated" date displayed at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how koi138 is protecting your personal data. Your continued use of the koi138 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms, to the extent permitted by applicable law.

Where a proposed change to this Privacy Policy requires your active consent under applicable data protection requirements — for example, a change to the purposes for which we process data originally collected under consent — we will seek that consent before the change takes effect.

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or need to report a data protection concern, please contact the koi138 Data Protection team through any of the following channels:

• Live Chat: Available 24/7 within the koi138 Platform. For privacy-related requests, please identify your query as a "Data Protection Request" at the start of the chat so it can be routed to the appropriate team.
• Email: [email protected] — please include your registered username, a clear description of your request or concern, and the words "Privacy Request" in the subject line to help us prioritize your inquiry. We aim to acknowledge all privacy-related emails within 48 hours and to provide a substantive response within 30 days.

Our support team operates in both Bahasa Indonesia and English, 24 hours a day, 7 days a week — including Indonesian public holidays. For complex data subject access requests, we may require proof of identity before processing the request, to ensure that personal data is not disclosed to unauthorized parties.