Privacy Policy

1. Introduction

duwit8 is committed to protecting the privacy and security of our users' personal information. As an online gaming operator serving Indonesian players, we understand the sensitivity of the data you entrust to us - from identity documents to financial information to gaming activity. This Privacy Policy outlines our practices in full transparency, explaining:

• What personal data we collect and why
• How we use and protect your information
• Who we share data with and under what circumstances
• How long we retain your data
• Your rights to access, correct, or delete your information
• How we use cookies and tracking technologies

We process personal data in accordance with international data protection standards, including principles equivalent to the European Union's General Data Protection Regulation (GDPR), even though we operate under international gaming licenses rather than Indonesian jurisdiction. Your privacy is not an afterthought - it's built into every system and process at duwit8.

2. Data We Collect

duwit8 collects several categories of personal information necessary to provide gaming services, ensure regulatory compliance, and maintain platform security:

2.1 Account Registration Data

When you create an account, we collect:

• Identity Information: Full legal name, date of birth, gender, nationality
• Contact Information: Email address, mobile phone number, residential address
• Login Credentials: Username, encrypted password (we never store passwords in plain text)
• Geographic Data: Country of residence, IP address at registration

This data is mandatory to comply with Know Your Customer (KYC) and anti-money-laundering (AML) regulations imposed by our licensing authorities.

2.2 Verification Documents (KYC)

Before your first withdrawal, we collect identity verification documents:

• Government-Issued ID: Indonesian National ID card (KTP), passport, or driver's license
• Selfie Verification: Photograph of you holding your ID next to your face
• Proof of Address: Utility bill, bank statement, or government correspondence dated within 3 months (required for large withdrawals)

These documents are securely encrypted and accessed only by our Compliance team for verification purposes. We never share KYC documents with third parties except as required by law enforcement or regulatory authorities.

2.3 Financial Transaction Data

To process deposits and withdrawals, we collect:

• Payment Method Details: Bank account number (last 4 digits only for display), bank name (BCA, BRI, BNI, Mandiri, etc.), e-wallet account identifier
• Transaction Records: Deposit amounts, withdrawal requests, payment method used, transaction timestamps
• Cryptocurrency Details: Wallet addresses if using crypto payments (where available)

We do NOT store full credit/debit card numbers or CVV codes. Payment processing is handled by certified third-party payment processors who maintain PCI-DSS compliance.

2.4 Gaming Activity & Behavior Data

While you use duwit8, we automatically collect:

• Gameplay Records: Games played, bet amounts, win/loss history, session duration, favorite games
• Bonus Usage: Bonuses claimed, wagering progress, bonus forfeitures
• Account Activity: Login timestamps, device used, IP addresses, geolocation data
• Responsible Gaming: Deposit limits set, self-exclusion requests, reality check settings

This data helps us detect problem gambling patterns, prevent fraud, personalize your experience, and comply with responsible gaming obligations.

2.5 Customer Support Communications

When you contact our support team, we retain:

• Communication Records: Live chat transcripts, email correspondence, phone call recordings (where permitted), WhatsApp messages
• Support Tickets: Issue descriptions, resolutions provided, satisfaction ratings

These records help us improve service quality and resolve disputes.

2.6 Technical & Device Data

Our systems automatically collect technical information:

• Device Information: Device type (mobile/desktop), operating system, browser type and version, screen resolution
• Network Data: IP address, ISP, approximate geographic location derived from IP
• Website Interaction: Pages viewed, links clicked, time spent on pages, referral sources
• Cookies & Similar Technologies: Session cookies, preference cookies, analytics cookies (see Section 8 for details)

3. How We Use Your Data

duwit8 processes your personal data for the following legitimate purposes:

3.1 Account Management & Service Provision

• Create and maintain your gaming account
• Process deposits, withdrawals, and balance adjustments
• Enable gameplay across our casino, sports betting, togel lottery, and other products
• Apply bonuses, promotions, and loyalty rewards
• Enforce responsible gaming limits you've set

3.2 Legal & Regulatory Compliance

• Verify your identity and age (21+ requirement)
• Comply with anti-money-laundering (AML) regulations
• Prevent fraud, collusion, and bonus abuse
• Respond to legal requests from law enforcement or regulators
• Maintain audit trails for financial transactions (required for 7 years under most jurisdictions)

3.3 Security & Fraud Prevention

• Detect and prevent unauthorized account access
• Identify suspicious betting patterns or software exploitation
• Block multiple accounts created by the same individual
• Monitor for payment fraud and chargeback abuse

3.4 Customer Support

• Respond to your inquiries via live chat, email, WhatsApp, or phone
• Resolve technical issues, payment problems, or gameplay disputes
• Provide account assistance and guidance

3.5 Marketing & Communication (With Your Consent)

• Send promotional offers, bonus announcements, and new game launches (you can opt out anytime)
• Notify you of important account updates or policy changes
• Request feedback on your gaming experience

We only send marketing communications if you've opted in during registration or account settings. You can unsubscribe via the link in any email or by contacting support.

3.6 Platform Improvement & Analytics

• Analyze user behavior to improve website design and navigation
• Identify popular games and optimize our portfolio
• Test new features and measure their effectiveness
• Generate aggregate statistics (e.g., "average session length") that don't identify individuals

4. Data Sharing & Disclosure

duwit8 does NOT sell your personal data to third parties. We only share information in the following limited circumstances:

4.1 Service Providers & Processors

We share data with trusted third-party vendors who help us operate the platform:

• Payment Processors: To process deposits and withdrawals via bank transfer, e-wallets, or other methods
• Game Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming - they receive limited gameplay data to operate their games
• KYC Verification Services: Identity verification specialists who check document authenticity
• Cloud Hosting Providers: Secure data centers where our servers and databases are hosted
• Analytics Services: Google Analytics and similar tools (configured to anonymize IP addresses)

All service providers are bound by strict data processing agreements requiring them to protect your information and use it only for specified purposes.

4.2 Legal Requirements

We may disclose your information to:

• Law enforcement agencies investigating fraud, money laundering, or other crimes
• Regulatory authorities overseeing our gaming licenses
• Courts or government bodies in response to valid legal process (subpoenas, court orders)
• Tax authorities as required by financial reporting laws

We will resist overly broad requests and notify you of disclosures where legally permitted.

4.3 Business Transfers

In the event duwit8 is acquired by or merges with another company, your data may be transferred to the new entity. You will be notified of any such change and given options regarding your data.

4.4 Consent-Based Sharing

We may share data with other parties if you provide explicit consent (e.g., opting into a partner promotion or requesting support from a third-party tool).

5. Data Security

duwit8 employs comprehensive security measures to protect your personal information:

5.1 Encryption

• In Transit: All data transmitted between your device and our servers uses TLS/SSL 256-bit encryption (look for the padlock icon in your browser)
• At Rest: Databases storing personal information are encrypted using AES-256 encryption
• Passwords: Hashed using bcrypt algorithm - we cannot see your password, only verify it

5.2 Access Controls

• Personal data accessible only to authorized employees with legitimate business need
• Role-based access control (RBAC) - support agents see different data than finance team
• Multi-factor authentication required for staff accessing sensitive systems
• Regular access audits and automatic logging of all data access

5.3 Infrastructure Security

• Servers hosted in Tier 3+ data centers with 24/7 physical security
• Firewalls, intrusion detection systems (IDS), and DDoS protection
• Regular security patches and vulnerability scanning
• Redundant backups stored in geographically separate locations

5.4 Third-Party Audits

We undergo regular security audits by independent firms to verify compliance with industry standards (ISO 27001, PCI-DSS for payment handling).

5.5 Data Breach Protocol

In the unlikely event of a data breach:

• We will notify affected users within 72 hours of discovering the breach
• We will report the breach to relevant data protection authorities as required
• We will provide guidance on protecting yourself (e.g., changing passwords)
• We will conduct a full investigation and implement additional safeguards

6. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy, or as required by law:

Data Type	Retention Period	Reason
Account Registration Data	7 years after account closure	Financial regulations require transaction history retention
KYC Documents	7 years after account closure	AML compliance and regulatory audit requirements
Financial Transactions	7 years after transaction	Tax reporting and financial audit requirements
Gameplay Records	7 years after account closure	Dispute resolution and regulatory compliance
Support Communications	3 years after last contact	Service improvement and dispute resolution
Marketing Preferences	Until you unsubscribe or account closure	Compliance with marketing consent
Website Analytics	26 months (Google Analytics default)	Platform improvement and usage analysis
Cookies	Up to 2 years or until you clear them	Session management and preferences

Active Account Data: While your account is active, we retain all data indefinitely to provide continuous service.

Closed Account Data: When you close your account, we delete non-essential data (gameplay preferences, device history) within 30 days, but retain legally-required records (financial transactions, KYC) for 7 years.

Right to Erasure: After the mandatory retention period expires, you can request permanent deletion of all your data. Contact our Privacy Officer at [email protected] (plain text - copy into your email client).

7. Your Privacy Rights

Under international data protection standards (GDPR-equivalent), you have the following rights regarding your personal data:

7.1 Right to Access

You can request a copy of all personal data we hold about you. We'll provide this in a structured, machine-readable format (typically JSON or CSV) within 30 days. Free of charge for the first request per year.

7.2 Right to Rectification

If any information we hold is inaccurate or incomplete, you can request corrections. Update your name, address, email, or phone number directly in your account settings, or contact support for changes to verified data (which may require re-verification).

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your account and all associated personal data, subject to:

• Legal retention requirements (we must keep financial records for 7 years)
• Active legal claims or disputes
• Outstanding balances or pending withdrawals (must be resolved first)

Once eligible, deletion is completed within 30 days.

7.4 Right to Data Portability

You can request your data in a portable format to transfer to another service provider. We'll export your gameplay history, transaction records, and account information in CSV or JSON format.

7.5 Right to Object

You can object to:

• Marketing Communications: Unsubscribe via email links or account settings
• Profiling: Opt out of automated decision-making for bonuses or offers
• Analytics: Disable non-essential cookies via our cookie banner or browser settings

7.6 Right to Restrict Processing

You can request we temporarily stop processing your data while we investigate a dispute or verify accuracy. Your account may be suspended during this period.

7.7 Right to Lodge a Complaint

If you believe we've mishandled your data, you can:

1. Contact our Privacy Officer directly: [email protected]
2. Escalate to the data protection authority in our licensing jurisdiction (details provided upon request)

How to Exercise Your Rights

Email [email protected] with your request, including:

• Your full name and account username
• The right you wish to exercise (access, deletion, correction, etc.)
• Verification of your identity (date of birth, last 4 digits of registered phone number)

We'll respond within 30 days. For complex requests, we may extend this to 60 days with notification.

8. Cookies & Tracking Technologies

duwit8 uses cookies (small text files stored on your device) and similar technologies to enhance your experience and analyze platform usage.

8.1 Types of Cookies We Use

Essential Cookies (Cannot be Disabled):

• Session Cookies: Keep you logged in as you navigate the site. Deleted when you close your browser.
• Security Cookies: Detect suspicious activity and protect against fraud
• Load Balancing: Distribute traffic across servers for optimal performance

Functional Cookies (Can be Disabled):

• Preference Cookies: Remember your language, currency, and favorite games
• Gameplay Settings: Save your bet levels and game configurations

Analytics Cookies (Can be Disabled):

• Google Analytics: Tracks page views, session duration, and user flow (IP addresses anonymized)
• Heatmaps: Show where users click and scroll to improve design

Marketing Cookies (Can be Disabled):

• Retargeting: Show relevant ads if you visit other websites (only if you've opted in)
• Campaign Tracking: Measure effectiveness of our promotions

8.2 Managing Cookies

You can control cookies through:

• Our Cookie Banner: Accept all, reject non-essential, or customize preferences when you first visit
• Account Settings: Manage cookie preferences in your profile
• Browser Settings: Most browsers let you block or delete cookies (note: this may break site functionality)

8.3 Do Not Track

We respect Do Not Track (DNT) browser signals. If DNT is enabled, we disable non-essential tracking.

9. International Data Transfers

duwit8 operates internationally, which means your data may be transferred to and processed in countries outside Indonesia:

• Data Centers: Our primary servers are located in Singapore and Europe (specific locations available upon request)
• Payment Processors: May process transactions through international banking networks
• Game Providers: Some game studios operate servers in Europe or Asia

Data Protection Safeguards: When transferring data internationally, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions (transferring data only to countries with equivalent data protection laws)
• Binding Corporate Rules (BCRs) within our corporate group

Your data enjoys the same protections regardless of where it's physically stored.

10. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

• Privacy Officer: [email protected] (displayed as plain text - copy and paste into your email client)
• General Support: [email protected]
• Live Chat: Available 24/7 via the chat icon on our website
• WhatsApp: +62 812-3456-7890
• Mailing Address: duwit8 Privacy Department, [International Licensing Jurisdiction Address - available upon request]

Response Time: We aim to respond to privacy inquiries within 48 hours, with full resolution within 30 days (60 days for complex requests).