Privacy Policy — Your Data Protection Rights

1. Privacy Overview

api28 is an internationally operated online betting and gaming platform serving English-preference players across Indonesia. We are committed to protecting your personal information and respecting your privacy rights. This Privacy Policy outlines our practices regarding the collection, use, storage, and protection of personal data you provide when creating an account, placing wagers, making deposits or withdrawals, or otherwise interacting with our platform.

By accessing or using api28, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, you should not use our services. We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational needs. The "Last Updated" date at the top of this document indicates when the most recent revisions were made. Continued use of api28 after any changes constitutes your acceptance of the updated policy.

2. Information We Collect

To provide a secure, personalized, and legally compliant betting experience, api28 collects several categories of personal information. The types of data we collect include:

2.1 Account Registration Data

When you create an account with api28, we collect the following personal information:

• Full Legal Name: As it appears on your Indonesian KTP (Kartu Tanda Penduduk) identity card.
• Date of Birth: To verify that you meet the minimum age requirement of 21 years.
• Email Address: Used for account communications, security notifications, and promotional offers (if you opt in).
• Mobile Phone Number: Used for account verification, two-factor authentication (2FA), and important account alerts.
• Residential Address: Your current address in Indonesia, used for KYC (Know Your Customer) compliance and withdrawal verification.
• Username and Password: Your chosen login credentials. Passwords are encrypted and stored securely using industry-standard hashing algorithms.

2.2 Identity Verification (KYC) Documents

To comply with anti-money laundering (AML) and responsible gaming regulations, api28 requires users to complete identity verification before processing withdrawals. During the KYC process, we collect:

• A clear, color photograph or scan of your Indonesian KTP identity card.
• Proof of address documents (such as a recent utility bill, bank statement, or government-issued document showing your residential address).
• A selfie photograph holding your KTP for additional identity confirmation.

All KYC documents are stored securely in encrypted databases and are accessed only by authorized compliance personnel. We do not share your identity documents with third parties except as required by law or by regulatory authorities.

2.3 Financial Transaction Data

To process deposits and withdrawals, api28 collects financial information including:

• Bank Account Details: Bank name (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon), account number, and account holder name (which must match your registered name).
• E-Wallet Information: E-wallet provider name (e.g., OVO, DANA, GoPay, ShopeePay, LinkAja), registered phone number or account ID, and account holder name.
• Transaction History: Records of all deposits, withdrawals, wagers, winnings, and account balance changes. This information is used for accounting, fraud prevention, dispute resolution, and regulatory compliance.

api28 does not store your full bank account passwords or e-wallet PINs. Payment processing is handled through secure, PCI-DSS compliant third-party payment gateways that encrypt sensitive financial data during transmission.

2.4 Betting and Gaming Activity

To provide personalized recommendations, monitor responsible gaming indicators, and comply with gaming regulations, we track your betting and gaming activity, including:

• Types of games played (sportsbook, live casino, slot gacor, togel, crash games, etc.).
• Amounts wagered, winnings, and losses over various time periods.
• Session duration, frequency of play, and gameplay patterns.
• Bonus claims, wagering progress toward bonus requirements, and promotional participation.

This data helps us identify users who may be exhibiting signs of problem gambling and allows us to proactively offer responsible gaming tools such as deposit limits, loss limits, and self-exclusion options.

2.5 Technical and Device Information

When you access api28, we automatically collect certain technical information to improve platform performance, prevent fraud, and enhance security:

• IP Address: Used to verify your location (Indonesia residency requirement), detect suspicious login attempts, and prevent multiple account registrations from the same device.
• Device Information: Device type (mobile, tablet, desktop), operating system (Android, iOS, Windows, macOS), browser type and version, screen resolution, and device identifiers.
• Cookies and Tracking Technologies: Small data files stored on your device that remember your preferences, keep you logged in, and track your navigation through the site. See Section 8 (Cookies & Tracking) for more details.
• Geolocation Data: With your consent, we may collect precise geolocation data to verify that you are physically located within Indonesia when accessing the platform.

2.6 Communications and Customer Support

When you contact api28 customer support via email, live chat, or phone, we collect and store:

• The content of your messages and inquiries.
• Support ticket records, including timestamps, agent responses, and resolution notes.
• Call recordings (if you contact us by phone) for quality assurance and training purposes. You will be notified at the beginning of the call if recording is in progress.

3. How We Use Your Data

api28 uses the personal information we collect for the following purposes:

3.1 Account Management and Service Delivery

• To create, maintain, and manage your api28 account.
• To process deposits, withdrawals, and other financial transactions.
• To authenticate your identity and prevent unauthorized account access.
• To provide customer support and respond to your inquiries.
• To send you important account-related notifications (e.g., withdrawal confirmations, security alerts, policy updates).

3.2 Legal Compliance and Fraud Prevention

• To comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations.
• To verify your age and residency in accordance with Indonesian gambling laws and api28's eligibility requirements (21+ only).
• To detect, prevent, and investigate fraudulent activity, money laundering, bonus abuse, and other violations of our Terms & Conditions.
• To cooperate with law enforcement agencies and regulatory authorities when legally required.

3.3 Responsible Gaming and Player Protection

• To monitor gameplay patterns and identify users who may be at risk of problem gambling.
• To enforce deposit limits, loss limits, session timers, and self-exclusion requests.
• To provide personalized responsible gaming recommendations and resources.

3.4 Platform Improvement and Personalization

• To analyze user behavior and preferences in order to improve our website, mobile experience, and game offerings.
• To personalize your experience by recommending games, promotions, and features based on your activity and preferences.
• To conduct internal research, statistical analysis, and business intelligence.

3.5 Marketing and Promotional Communications (With Your Consent)

• To send you promotional offers, bonus announcements, and newsletters if you have opted in to receive marketing communications.
• To inform you about new games, features, and special events on the api28 platform.

You may opt out of marketing communications at any time by adjusting your account settings or clicking the "unsubscribe" link in any promotional email. Opting out of marketing emails will not affect transactional or account-related communications, which are necessary for service delivery.

4. Data Sharing and Disclosure

api28 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we may share your data with the following categories of recipients under specific circumstances:

4.1 Service Providers and Business Partners

We work with trusted third-party service providers to deliver our services. These providers have access to your personal information only to the extent necessary to perform their functions and are contractually obligated to protect your data. Categories of service providers include:

• Payment Processors: To facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Game Providers: To deliver live casino tables, slots, and other gaming content from studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, and Spribe.
• Identity Verification Services: To perform KYC checks and verify the authenticity of identity documents.
• Customer Support Tools: To manage live chat, email ticketing, and call center operations.
• Cloud Hosting and IT Infrastructure: To store data securely and ensure platform availability.
• Analytics and Marketing Platforms: To track website performance, user behavior, and campaign effectiveness (with your consent).

4.2 Legal and Regulatory Authorities

We may disclose your personal information to government agencies, law enforcement, regulatory bodies, or courts when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, or subpoena.
• Enforce our Terms & Conditions or other agreements.
• Investigate and prevent fraud, money laundering, or other illegal activity.
• Protect the rights, property, or safety of api28, our users, or the public.

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the acquiring entity. You will be notified via email or a prominent notice on our website if your data is transferred as part of such a transaction, and you will be given the opportunity to delete your account if you do not wish to continue under the new ownership.

5. Data Security Measures

api28 employs industry-standard security technologies and practices to protect your personal information from unauthorized access, disclosure, alteration, or destruction. Our security measures include:

5.1 Encryption

• SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL (Secure Sockets Layer) technology. This ensures that sensitive information such as login credentials, financial data, and personal details cannot be intercepted by third parties.
• Database Encryption: Personal information stored in our databases is encrypted at rest using AES-256 encryption standards.

5.2 Access Controls

• Access to personal data is restricted to authorized employees and contractors who need the information to perform their job functions.
• Multi-factor authentication (MFA) is required for all administrative access to sensitive systems.
• Regular access audits are conducted to ensure compliance with our internal security policies.

5.3 Network Security

• Firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) protect our network infrastructure from unauthorized access and cyberattacks.
• Regular vulnerability assessments and penetration testing are conducted by independent security firms.

5.4 Secure Password Storage

• User passwords are never stored in plain text. We use bcrypt or similar cryptographic hashing algorithms to store passwords securely.
• Users are encouraged to create strong, unique passwords and enable two-factor authentication (2FA) for an additional layer of account security.

5.5 Employee Training and Policies

• All api28 employees undergo regular training on data protection best practices, confidentiality obligations, and security protocols.
• Our internal policies prohibit the unauthorized disclosure or misuse of personal information.

6. Data Retention

api28 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Active Accounts: Personal data is retained for the duration of your account's active status and for a minimum of 5 years after account closure to comply with financial regulations and AML requirements.
• KYC Documents: Identity verification documents are retained for at least 7 years following account closure as required by international AML standards.
• Transaction Records: Financial transaction history, including deposits, withdrawals, and wagers, is retained for at least 7 years for accounting, tax, and regulatory compliance purposes.
• Customer Support Communications: Support tickets and correspondence are retained for 3 years to facilitate dispute resolution and service improvement.
• Marketing Data: If you opt in to receive marketing communications, your contact information and preferences are retained until you unsubscribe or request deletion.

After the applicable retention period expires, personal data is securely deleted or anonymized so that it can no longer be associated with you. You may request early deletion of your data by contacting us at [email protected], subject to our legal and regulatory obligations.

7. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information:

7.1 Right of Access

You have the right to request a copy of the personal information we hold about you. To exercise this right, contact us at [email protected]. We will provide the requested information within 30 days in a commonly used electronic format.

7.2 Right to Rectification

If you believe that any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most of your information directly through your account settings, or contact customer support for assistance.

7.3 Right to Erasure (Right to Be Forgotten)

You may request deletion of your personal information under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected or when you withdraw your consent. However, we may be required to retain certain data to comply with legal obligations (e.g., AML record-keeping requirements).

7.4 Right to Restriction of Processing

You have the right to request that we limit the processing of your personal information in certain situations, such as when you contest the accuracy of the data or when you object to processing for marketing purposes.

7.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another service provider where technically feasible.

7.6 Right to Object

You may object to the processing of your personal information for direct marketing purposes at any time by adjusting your account settings or unsubscribing from marketing emails.

7.7 Right to Withdraw Consent

Where we process your personal information based on your consent (e.g., for marketing communications or geolocation tracking), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing conducted before the withdrawal.

To exercise any of these rights, please contact us at [email protected] with your account details and a description of your request. We will respond within 30 days. If we are unable to fulfill your request due to legal obligations or other valid reasons, we will explain the basis for our decision.

8. Cookies and Tracking Technologies

api28 uses cookies and similar tracking technologies to enhance your experience, analyze site usage, and deliver personalized content. A cookie is a small text file stored on your device that allows us to recognize you and remember your preferences.

8.1 Types of Cookies We Use

• Essential Cookies: Required for the platform to function properly. These cookies enable core features such as logging in, navigating between pages, and processing transactions. You cannot opt out of essential cookies without disabling functionality.
• Performance Cookies: Collect anonymous data about how users interact with our website, such as pages visited, time spent on the site, and error messages encountered. This information helps us improve performance and user experience.
• Functionality Cookies: Remember your preferences and settings (e.g., language, display options) to provide a more personalized experience.
• Marketing and Advertising Cookies: Track your activity across websites to deliver targeted advertisements and measure the effectiveness of our marketing campaigns. These cookies are only used if you provide consent.

8.2 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies, though doing so may impair certain features of the api28 platform. To learn more about managing cookies, consult your browser's help documentation.

9. Third-Party Services and Links

The api28 platform may contain links to third-party websites, game providers, or payment processors. This Privacy Policy applies only to api28 and does not cover the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party sites you visit. api28 is not responsible for the content, security, or privacy practices of external websites.

10. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact api28's Data Protection Officer:

• Email (Customer Support): [email protected]
• Email (Privacy Inquiries): [email protected]

We are committed to resolving privacy concerns promptly and transparently. If you believe that we have not addressed your concerns adequately, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.