Privacy Policy — pin88

The following defined terms are used consistently throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. This includes but is not limited to full name, date of birth, national identity number, email address, phone number, residential address, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Controller" means pin88, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means any third party that processes Personal Data on behalf of pin88 under a written data processing agreement (for example, payment processors, KYC verification providers, and cloud hosting providers).
• "Consent" means any freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data.
• "KYC" (Know Your Customer) means the identity verification process required by international anti-money laundering (AML) and counter-terrorism financing (CTF) standards.
• "Cookies" means small text files placed on your device by your web browser when you visit pin88, used to store session state, preferences, and anonymised analytics data.

pin88 collects Personal Data across several categories depending on how you interact with our platform. The table below summarises the categories of data we collect and typical examples within each category.

pin88 collects Personal Data through the following channels and mechanisms:

• Direct Submission: When you register an account, complete KYC verification, submit a deposit or withdrawal request, contact our support team, or participate in a promotional activity, you provide Personal Data directly to pin88.
• Automated Technical Collection: When you access pin88's website or mobile interface, our servers automatically record Technical Data (IP address, browser fingerprint, session metadata) and Usage Data via server logs and first-party cookies.
• Payment Processors: When you complete a deposit or withdrawal, our integrated payment partners (local bank transfer gateways, e-wallet APIs, cryptocurrency processing services) transmit transaction confirmation data back to pin88 for reconciliation purposes.
• KYC & Identity Verification Providers: pin88 uses internationally accredited third-party KYC providers to verify the authenticity of identity documents you submit. These providers process your identity images and return a verification result; pin88 stores the result and a reference identifier, not the raw document image, beyond what is required for our audit records.
• Fraud Detection Systems: Automated risk-scoring systems analyse Technical Data and Transaction Data patterns to detect potentially fraudulent, abusive, or problem-gambling behaviour in real time.

pin88 processes your Personal Data only for specified, explicit, and legitimate purposes. The table below maps each processing purpose to the relevant lawful basis under internationally recognised data protection principles:

Where pin88 relies on Consent as the legal basis for processing (primarily for personalised marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. Withdrawal of marketing consent will not affect your ability to use pin88's core gaming services.

pin88 does not sell, rent, or otherwise commercially exploit your Personal Data to third parties. We share data only in the following limited and controlled circumstances:

• Service Providers (Processors): We engage a select number of vetted third-party service providers who process data strictly on our behalf and under our instructions, including: payment gateway operators (for processing IDR bank transfers and USDT cryptocurrency transactions), KYC/AML verification platforms, cloud infrastructure providers, fraud detection systems, and customer support platform vendors. All such providers are bound by written data processing agreements that prohibit them from using your data for any purpose other than providing services to pin88.
• Licensing & Regulatory Authorities: pin88's international gaming licence may require us to submit periodic compliance reports to our licensing jurisdiction's regulatory body. Such reports may include aggregated transaction data and identity verification records. We disclose only what is legally required and do not share data with Indonesian domestic government bodies unless compelled by a validly issued court order or equivalent legal process.
• Law Enforcement & Legal Process: If pin88 receives a validly issued subpoena, court order, or equivalent legal process from a competent authority, we may be required to disclose certain Personal Data. Where permitted by law, we will attempt to notify you before complying with such a request.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of pin88's business, Personal Data may be transferred to the acquiring entity, subject to the same or equivalent privacy protections as described in this Policy. We will notify you of any such transfer via our platform or by email.
• With Your Explicit Consent: In any other circumstance not listed above, pin88 will share your Personal Data with a third party only if you have given explicit, informed consent to that specific disclosure.

pin88 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention schedule applies:

• Active Account Data: Retained for the full duration of your membership plus a minimum of 5 years following account closure, to satisfy AML/CTF record-keeping requirements imposed by international gaming regulators.
• KYC & Identity Verification Records: Retained for a minimum of 5 years from the date of verification, as required by international AML standards. Document images are purged earlier where technically feasible once verification is confirmed.
• Transaction & Betting Records: Retained for a minimum of 5 years from the date of each transaction for audit, dispute resolution, and regulatory compliance purposes.
• Support Communications: Retained for 3 years from the date of the last communication in a thread, then deleted unless the communication is directly relevant to an unresolved legal dispute.
• Technical & Usage Logs: Retained for 12 months in identifiable form, then aggregated or anonymised for long-term analytics. Anonymised analytical data may be retained indefinitely.
• Marketing Consent Records: Retained for the duration of the consent plus 2 years thereafter as evidence of consent, even if you subsequently withdraw consent for active marketing.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be linked back to you as an individual. Deletion requests received under your data rights (Clause 9) are subject to the minimum retention requirements above — pin88 cannot delete data that we are legally required to hold.

pin88 implements a layered, defence-in-depth security architecture to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. Our key security controls include:

• Transport Layer Security: All data in transit is protected by TLS 1.2 or higher with 256-bit AES encryption. HTTP connections are automatically redirected to HTTPS. Our SSL certificate is maintained with a reputable Certificate Authority and renewed before expiry.
• Data Encryption at Rest: Sensitive fields within our database (including financial account references and identity document hashes) are encrypted at rest using AES-256. Encryption keys are managed separately from the encrypted data and rotated on a scheduled basis.
• Access Controls: Access to production systems containing Personal Data is restricted to authorised personnel only, enforced through role-based access control (RBAC), multi-factor authentication (MFA), and principle-of-least-privilege policies. All privileged access is logged and subject to periodic review.
• Penetration Testing & Vulnerability Management: pin88 commissions independent penetration tests at least once per year and conducts continuous automated vulnerability scanning. Critical and high-severity findings are remediated within defined SLA windows.
• Incident Response: pin88 maintains a documented data breach response plan. In the event of a confirmed data breach that poses a risk to your rights and freedoms, we will notify affected members without undue delay and, where required, report to the relevant supervisory authority within the timeframes specified by applicable law.
• Staff Training: All pin88 personnel with access to Personal Data receive mandatory data protection and security awareness training at onboarding and at least annually thereafter.

pin88 uses first-party cookies and similar tracking technologies on our website and platform. We do not use third-party advertising cookies or cross-site tracking scripts. The types of cookies we use are:

You may manage cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies stored by specific sites. Note that blocking strictly necessary cookies will prevent you from logging in and using core platform features. pin88 does not respond to browser "Do Not Track" (DNT) signals at this time, as there is no universally accepted standard for their interpretation.

As a member of pin88, you hold meaningful rights over your Personal Data. pin88 is committed to honouring these rights promptly and without unnecessary barriers. The following rights apply to all members regardless of country of residence:

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Identity verification may be required before we can action any request to prevent unauthorised access to another member's data.

pin88's services are strictly intended for adults aged 21 years or older. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21. This threshold is consistent with Indonesia's responsible gaming guidelines and international best practice for online gambling platforms targeting the Indonesian market.

At the time of registration and during KYC verification, pin88 requires documentary proof of age (national identity card, passport, or equivalent government-issued document). Any account found to belong to a person under the age of 21 will be immediately suspended, all funds will be handled in accordance with our Terms & Conditions, and all Personal Data associated with that account will be securely deleted as soon as legally permissible.

pin88 operates as an internationally licensed platform and may store or process your Personal Data on servers located outside Indonesia. When Personal Data is transferred to a country or territory that does not provide an equivalent level of data protection to that applicable in your country of residence, pin88 ensures appropriate safeguards are in place, including:

• Standard contractual clauses (SCCs) or equivalent contractual protections incorporated into our agreements with all data processors located outside our primary hosting jurisdiction.
• Technical safeguards (encryption in transit and at rest) that protect data regardless of the geographic location of the server on which it is processed or stored.
• Strict vendor assessment and ongoing monitoring to confirm that our international processors maintain adequate security and privacy standards equivalent to our own.

By using pin88's services, you acknowledge and consent to the transfer of your Personal Data to our servers and processors as described in this clause, subject to the safeguards described above.

pin88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our business operations. When we make material changes to this Policy, we will notify you through one or more of the following methods:

• A prominent notice on the pin88 homepage or within your account dashboard, displayed for a minimum of 14 days following the change.
• An email notification to the address registered on your account, sent no later than the date the revised Policy takes effect.
• An in-platform notification visible upon your next login following a material update.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. Minor changes — such as typographical corrections, clarifications that do not alter the substance of the Policy, or updates to contact details — may be made without active notification but will always be reflected in the updated document published at https://pin88.asia/privacy-policy.

Your continued use of pin88's services following notification of a material change constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you must stop using pin88's services and may request account closure and data deletion as described in Clause 9.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way pin88 processes your Personal Data, please reach out through any of the channels below. Our Data Protection team is available to assist you:

When submitting a data rights request, please include your registered username, the email address associated with your account, and a clear description of the right you wish to exercise. Providing complete information upfront will help us process your request within the 30-day window without the need for follow-up clarification.