pg638 Privacy Policy

1 Definitions

For the purposes of this Policy, the following terms carry the meanings stated below:

• "Personal Data" means any information that relates to an identified or identifiable natural person — including but not limited to name, email address, Indonesian national ID number (NIK on KTP), date of birth, phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means pg638, as the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means any third party that Processes Personal Data on behalf of pg638 under a written data-processing agreement.
• "Cookies" means small text files placed on your device by the pg638 platform or its authorized third-party service providers for the purposes described in Section 7.
• "KYC" means Know Your Customer — the identity verification process described in the pg638 Terms & Conditions and in Section 3.2 of this Policy.

2 Data Controller

pg638 is the Data Controller with respect to all Personal Data collected through the pg638 platform. All questions, requests, and complaints regarding Personal Data should be directed to the pg638 data privacy team via the contact details set out in Section 14 of this Policy.

Where pg638 engages third-party Data Processors to carry out specific functions — such as payment processing, fraud detection, or customer support tooling — pg638 remains responsible for ensuring that those processors handle your data in accordance with this Policy and applicable data protection standards. pg638 maintains written data-processing agreements with all Data Processors that access Personal Data on pg638's behalf.

3 Data We Collect

3.1 Data You Provide Directly

When you register an account on pg638, complete KYC verification, make a deposit or withdrawal, contact support, or participate in a promotion, you provide pg638 with Personal Data. The categories of data collected at each stage are summarized in the table below:

3.2 Data Collected Automatically

When you access and use the pg638 platform, our systems automatically collect certain technical and behavioral data, including:

• Device and network data: IP address, device type, operating system, browser type and version, screen resolution, and mobile carrier (where applicable).
• Session and activity data: Login timestamps, pages visited within the platform, game titles launched, bet amounts and outcomes, session duration, and navigation paths.
• Location data: General geographic location inferred from your IP address (country and city level). pg638 does not collect precise GPS location data.
• Cookie and tracking data: As described in Section 7 of this Policy.

3.3 Data from Third Parties

pg638 may receive supplementary Personal Data from authorized third-party sources for the purposes of fraud prevention and identity verification. This includes data from identity-verification service providers and payment fraud detection systems that cross-reference information you have provided against publicly available or commercially licensed datasets. pg638 does not receive data from social media platforms unless you explicitly use a social login feature, which is not currently offered on the platform.

4 How We Use Your Data

pg638 uses your Personal Data for the following purposes. Each purpose is linked to a legal basis, which is set out in Section 5.

• Account creation and management: To register your account, authenticate your identity at login, manage your account settings, and communicate account-related notifications.
• Payment processing: To facilitate deposits and withdrawals to and from your verified Indonesian bank account or e-wallet, and to maintain an accurate transaction record for your account.
• KYC and regulatory compliance: To verify your identity, confirm your age (21+ requirement), detect and prevent money laundering and fraud, and comply with applicable international anti-financial-crime obligations.
• Platform operation and improvement: To deliver game content, calculate bet outcomes, detect and resolve technical issues, monitor platform performance, and develop new features.
• Customer support: To respond to your inquiries, investigate complaints, and maintain records of support interactions for quality assurance.
• Responsible gaming: To monitor gaming activity for signs of problematic gambling behavior, administer deposit limits and self-exclusion requests, and contact you if our responsible gaming systems flag a concern with your account activity.
• Marketing and promotions: To send you promotional communications about pg638 bonuses, new game titles, sportsbook offers (including BRI Liga 1 and EPL markets), and seasonal promotions (such as Idul Fitri or Ramadhan bonus campaigns) — subject to your marketing preferences and opt-out rights described in Section 10.
• Security monitoring: To detect unauthorized access attempts, collusion, bot activity, and other forms of Prohibited Conduct as defined in the pg638 Terms & Conditions.

5 Legal Basis for Processing

pg638 relies on the following legal bases when Processing your Personal Data:

• Contractual necessity: Processing required to provide the Services described in the pg638 Terms & Conditions — including account registration, payment processing, game delivery, and customer support. Without this Processing, pg638 cannot provide the Services.
• Legal obligation: Processing required to comply with applicable anti-money-laundering, counter-terrorist-financing, and identity-verification obligations. This includes KYC verification and the retention of transaction records for audit purposes.
• Legitimate interests: Processing undertaken for pg638's legitimate business interests, including fraud detection, security monitoring, platform analytics, and responsible gaming monitoring — provided those interests are not overridden by your privacy rights. pg638 has assessed each legitimate-interest basis and determined that the processing is necessary, proportionate, and not unduly prejudicial to your privacy.
• Consent: Processing of your data for direct marketing communications. You may withdraw this consent at any time through the opt-out mechanism in any marketing communication or via your account settings, without affecting the lawfulness of prior processing.

6 Data Sharing and Disclosure

6.1 pg638 Does Not Sell Your Data

pg638 does not sell, rent, or otherwise make available your Personal Data to third-party marketing companies, data brokers, or advertising networks. Your data is shared only in the circumstances described below.

6.2 Authorized Third-Party Processors

pg638 engages the following categories of Data Processors who may access your Personal Data solely to provide services to pg638 on a contractually bound, need-to-know basis:

• Payment processors and banking partners: Including Indonesian bank transfer gateways and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — to facilitate deposits and withdrawals.
• Identity verification and KYC service providers: To verify government-issued ID documents and cross-check details for age and identity confirmation.
• Fraud detection and cybersecurity providers: To analyze behavioral data and transaction patterns for signs of fraudulent activity, account takeover, or collusion.
• Game content providers: Including Evolution Gaming, Pragmatic Play, PG Soft, Microgaming, Spribe, and Habanero — who receive your session-level data (bet amounts, game outcomes) for the purposes of delivering and auditing game outcomes. These providers do not receive your identity documents or financial account details.
• Customer support platforms: Live chat and email support tooling providers who process support inquiry data under strict confidentiality agreements.
• Cloud infrastructure and hosting providers: Data center and hosting partners who process data under standard contractual clauses ensuring adequate data-protection measures.

6.3 Legal Disclosures

pg638 may disclose your Personal Data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, valid legal process, or an order of a competent authority. In such cases, pg638 will notify you of the disclosure to the extent permitted by applicable law and the terms of the relevant order.

7 Cookies & Tracking Technologies

7.1 Types of Cookies Used

pg638 uses cookies and similar tracking technologies on the platform for the following purposes:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during a gaming session, and security cookies that help detect and prevent fraudulent access. These cookies cannot be disabled without disrupting platform functionality.
• Functional cookies: Remember your preferences within the platform, such as your preferred language, last-visited game category, and notification settings.
• Analytics cookies: Collect aggregated, anonymized data about how Players use the platform — which pages are visited most frequently, where users drop off during the registration flow, and which game categories generate the most engagement. This data is used to improve platform design and user experience.
• Responsible gaming cookies: Track session duration to support the session-time reminder feature. These cookies are tied to your account and are not shared with third-party advertisers.

7.2 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies; however, blocking strictly necessary cookies will impair or prevent your use of the platform. Clearing session cookies will log you out of your pg638 account. pg638 does not use third-party advertising network cookies (such as those used for cross-site retargeting) on the platform.

8 Data Retention

pg638 retains your Personal Data for as long as your account is active, and for a defined period following account closure, as required by applicable anti-money-laundering, financial record-keeping, and dispute-resolution obligations. The standard retention periods applied by pg638 are as follows:

• Account and identity data (name, KTP/passport, date of birth): Retained for the duration of account activity plus a minimum of 5 years following permanent account closure, in accordance with international AML record-keeping standards.
• Transaction records (deposits, withdrawals, bet history): Retained for a minimum of 5 years following each transaction.
• Support interaction records: Retained for 3 years following the resolution of each interaction.
• Marketing preferences and opt-out records: Retained indefinitely to ensure suppression lists remain effective.
• Technical logs and session data: Retained for up to 12 months for fraud-detection and platform-debugging purposes, then automatically deleted or anonymized.

Upon expiry of the applicable retention period, pg638 will either securely delete or irreversibly anonymize the relevant Personal Data, depending on the nature of the data and the storage system in which it is held.

9 Data Security

pg638 implements a layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. The measures in place include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and the pg638 platform is encrypted in transit using TLS 1.3 as a minimum standard.
• AES-256 encryption at rest: Personal Data and financial records stored in pg638's databases are encrypted at rest using AES-256, with encryption keys managed through a dedicated key-management service.
• Access controls: Access to production systems containing Personal Data is restricted to pg638 personnel with a documented operational need. Access is enforced through role-based permissions and multi-factor authentication.
• Penetration testing and security audits: pg638 engages independent security firms to conduct regular penetration tests and vulnerability assessments of the platform infrastructure.
• Incident response: pg638 maintains a documented data-breach response plan. In the event of a security incident that poses a material risk to affected Players, pg638 will notify impacted account holders via their registered email address within 72 hours of becoming aware of the incident, and will describe the nature of the breach, the data categories affected, and the remediation steps taken.

10 Your Privacy Rights

As a pg638 account holder, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact the pg638 privacy team at the details in Section 14. pg638 will respond to all verified rights requests within 30 calendar days of receipt.

11 Children's Privacy

The pg638 platform is strictly intended for adults aged 21 and over. pg638 does not knowingly collect Personal Data from any individual under the age of 21. If pg638 becomes aware that it has inadvertently collected Personal Data from a person under 21, that data will be deleted immediately, the associated account will be closed, and any deposits will be returned to the originating payment account where practicable.

If you are a parent or guardian and have reason to believe your child under the age of 21 has registered an account on pg638, please contact support at the details in Section 14 immediately so that the account can be reviewed and closed.

12 International Data Transfers

pg638 operates a global platform and may transfer your Personal Data to servers and Data Processors located outside of Indonesia. Where such transfers occur, pg638 ensures that appropriate safeguards are in place to protect your data, including standard contractual clauses, encryption in transit and at rest, and contractual data-processing agreements that impose equivalent data-protection obligations on the receiving party.

pg638 does not transfer Personal Data to jurisdictions that do not provide an adequate level of data protection without ensuring that the transfer is covered by appropriate contractual or technical safeguards. If you have questions about the specific jurisdictions in which pg638 processes your data, contact the privacy team at the details in Section 14.

13 Changes to This Policy

pg638 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the Services we provide. When changes are made, the version number and effective date at the top of this document will be updated. Material changes — defined as changes that substantially affect how pg638 uses or shares your Personal Data — will be communicated to registered Players via the email address on file at least 7 calendar days before taking effect.

Your continued use of the pg638 platform after a Policy update takes effect constitutes your acceptance of the revised Policy. The current version of this Policy is always available at pg638.app/privacy-policy. We encourage you to review this page periodically to stay informed about how pg638 protects your data.

14 Contact Us

If you wish to exercise any of your privacy rights, submit a data-related complaint, or simply ask a question about how pg638 handles your Personal Data, please reach out to the pg638 privacy team through either of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly from the pg638 platform. Indonesian-speaking agents are on hand at all times and can handle data-privacy inquiries in addition to general support.
• Email: [email protected] — please include "Privacy Request" in the subject line so your message is routed to the correct team. Responses to privacy-related inquiries are provided within 5 business days.

When submitting a rights request by email, please include your registered username and the email address associated with your pg638 account so that we can verify your identity before acting on the request. pg638 will not process any rights request without first completing a reasonable identity verification step to prevent unauthorized access to another Player's data.