Privacy Policy

1. Introduction and Scope

asu138 ("we," "us," or "our") operates the online gaming platform accessible at https://asu138.cam. We understand that the privacy of our players is of fundamental importance, and we are committed to handling all personal data with the highest standards of transparency, security, and accountability.

This Privacy Policy describes the types of personal information we collect from individuals who register accounts, access the Platform, place bets, or otherwise interact with asu138 Services (collectively, "Players" or "you"). It explains how we collect, use, store, share, and protect that information, and it sets out the rights you hold with respect to your personal data.

This Policy applies to all Players located in Indonesia and to any person accessing asu138 from outside Indonesia whose personal data we process. By creating an account on asu138 or continuing to use our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with the terms of this Policy, you must immediately discontinue your use of the Platform.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, either directly or indirectly, including name, national identity number, contact details, financial data, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means asu138, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of asu138 under contractual obligation and our written instructions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" (Know Your Customer) means our identity verification process, mandated by anti-money laundering obligations and age-restriction enforcement requirements.
• "Cookie" means a small text file placed on your device by the Platform to store preferences, session information, and analytical data.

3. Data We Collect

3.1 Identity and Contact Information

During account registration and KYC verification, we collect:

• Full legal name as stated on your Indonesian national identity card (KTP) or passport.
• Date of birth (to verify that you meet the 21+ age requirement).
• Residential address in Indonesia (street, city, province, postal code).
• Valid email address and Indonesian mobile phone number.
• Scanned or photographed copies of government-issued identity documents.
• Selfie photographs taken with your identity document for liveness verification.

3.2 Financial and Payment Data

To facilitate deposits and withdrawals, we collect:

• Indonesian bank account details (bank name, account number, account holder name) for banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, and BSI.
• E-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Transaction history, including deposit amounts, withdrawal requests, and timestamps.
• Bonus redemption records and wagering activity linked to promotional offers.

asu138 does not store full card numbers, CVV codes, or banking passwords. All payment processing is handled via encrypted channels directly with our licensed payment partners.

3.3 Gameplay and Behavioral Data

As you interact with asu138 Services, we automatically record:

• Betting history, including markets selected, stake amounts, odds accepted, and settlement results.
• Games accessed, session durations, and wagering patterns across all product categories.
• Bonus activation events, wagering requirement progress, and promotion claim history.
• Responsible gaming tool activations such as deposit limit changes, session time settings, and self-exclusion requests.

3.4 Technical and Device Data

When you access the Platform, our systems automatically collect:

• IP address and approximate geographic location derived from IP geolocation.
• Device type, operating system, and browser version.
• Screen resolution and language preference settings.
• Pages visited, navigation paths, and time spent on each section.
• Error logs and crash reports to support platform stability.

3.5 Customer Support Communications

We retain records of all communications between you and our customer support team, including live chat transcripts, email correspondence, and any documents you submit in connection with a support request or dispute.

4. How We Collect Your Data

asu138 collects personal data through the following channels:

• Direct input: Information you provide during registration, KYC submission, deposit/withdrawal requests, and customer support interactions.
• Automated technologies: Cookies, web beacons, pixel tags, and server logs that record your interactions with the Platform.
• Third-party verification services: Identity verification providers and sanctions screening databases used to fulfil KYC and anti-money laundering obligations.
• Payment processors: Transaction confirmation and status data received from Indonesian banks and e-wallet operators.
• Analytics providers: Aggregated behavioral data from analytics platforms we deploy to understand and improve user experience on asu138.

5. Legal Basis for Processing

We rely on the following legal bases when processing your personal data:

• Contractual necessity: Processing required to perform the contract between you and asu138, including account management, payment processing, and provision of gaming services.
• Legal obligation: Processing required to comply with anti-money laundering laws, age verification requirements, and regulatory reporting obligations applicable to online gaming operators.
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your fundamental rights.
• Consent: Processing based on your explicit consent for marketing communications and non-essential cookies, which you may withdraw at any time.

6. How We Use Your Data

asu138 uses collected personal data strictly for the following purposes:

1. Account creation and management: Verifying your identity, maintaining your account profile, and enabling secure login.
2. Age and eligibility verification: Confirming you are at least 21 years of age and legally eligible to use asu138 Services in Indonesia.
3. Payment processing: Executing deposit transactions from your nominated Indonesian bank accounts or e-wallets, and processing withdrawal requests to your registered payment methods.
4. Game and betting services: Recording, settling, and displaying your gaming activity, bet history, and account balance in real-time.
5. Anti-money laundering compliance: Screening transactions against sanctions lists, monitoring for unusual activity, and reporting as required by applicable law.
6. Responsible gaming oversight: Monitoring gameplay patterns for signs of problematic behavior, enforcing self-imposed limits, and facilitating self-exclusion requests.
7. Customer support: Responding to your inquiries, resolving disputes, and providing technical assistance.
8. Marketing and promotions: Sending bonus offers, promotional communications, and platform announcements to Players who have provided consent. You may opt out at any time.
9. Platform improvement: Analyzing aggregated behavioral data to enhance game selection, user interface design, and payment processing efficiency on asu138.
10. Security and fraud prevention: Detecting, investigating, and preventing unauthorized access, fraudulent activity, and collusion among Players.

7. Data Sharing and Disclosure

asu138 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data only in the following strictly controlled circumstances:

7.1 Service Providers and Data Processors

We engage vetted third-party processors to support platform operations, including KYC and identity verification providers, payment gateway operators, cloud hosting providers, and customer support platform vendors. All processors are contractually bound to process your data only on our documented instructions and under confidentiality obligations equivalent to those set out in this Policy.

7.2 Legal and Regulatory Compliance

We may disclose personal data to government authorities, law enforcement agencies, or regulatory bodies when required to do so by applicable law, court order, or regulatory direction. In such cases, we will disclose only the minimum data necessary to satisfy the legal obligation.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of asu138 assets, player data may be transferred to the successor entity, subject to that entity being bound by equivalent privacy protections. We will notify you of any such transfer via email or prominent notice on the Platform.

7.4 Aggregated A nonymized Data

We may share aggregated, anonymized, and de-identified statistical data with industry research partners and analytics providers. This data cannot be used to identify any individual player and does not constitute a disclosure of personal data.

8. Cookies and Tracking Technologies

asu138 uses cookies and similar tracking technologies to operate the Platform effectively, personalize your experience, and gather analytical insights that help us improve our Services. The categories of cookies we deploy are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. You cannot opt out of these without losing access to core Platform features.
• Functional Cookies: Store your preferences such as language settings, display options, and last-visited game category to personalize your sessions on asu138.
• Analytical Cookies: Collect aggregated data about how Players navigate the Platform, which pages are visited most frequently, and where technical errors occur. This data is used exclusively to improve Platform performance.
• Marketing Cookies: Track your interactions with promotional content and help us deliver bonus offers and campaign messaging relevant to your activity profile. These cookies are only deployed with your prior consent.

You may manage your cookie preferences through your browser settings at any time. Disabling functional or analytical cookies may affect certain Platform features but will not prevent you from accessing core gaming and betting Services.

9. Data Retention

asu138 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction and payment records: Retained for a minimum of five years from the date of each transaction in accordance with financial record-keeping regulations.
• Gameplay and betting history: Retained for three years from the date of each session or bet, then archived in anonymized form for statistical reporting purposes.
• Customer support communications: Retained for three years from the date of the last interaction, unless the communication relates to an ongoing dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your active marketing subscription and for two years following withdrawal of consent, as evidence of compliance.

Upon expiration of the applicable retention period, personal data is securely deleted or anonymized using industry-standard data erasure methods. Where data is retained in anonymized form, it no longer constitutes personal data and is not subject to this Privacy Policy.

10. Data Security

asu138 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Encryption in transit: All data transmitted between your device and the asu138 Platform is encrypted using TLS 1.3 (Transport Layer Security), the industry-standard protocol for secure web communications.
• Encryption at rest: Personal and financial data stored on our servers is encrypted using AES-256 encryption. Database access is controlled through role-based permissions with multi-factor authentication required for all administrative accounts.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. Our internal systems require 2FA for all staff accessing player data.
• Penetration testing: Our Platform undergoes regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Access controls: Access to personal data is granted on a strict need-to-know basis. All staff with data access privileges are bound by confidentiality agreements and receive regular data protection training.
• Incident response: We maintain a documented data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players without undue delay and, where required, report the incident to the relevant regulatory authority.

11. Your Rights

As a player whose personal data is processed by asu138, you hold the following rights with respect to your information. To exercise any of these rights, please contact us at the details provided in Section 16.

• Right of Access: You have the right to request a copy of the personal data we hold about you and to receive information about how it is being processed.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request that we correct or update it promptly.
• Right to Erasure: In certain circumstances — such as where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent — you may request that we delete your personal data. This right is subject to overriding legal retention obligations, particularly those related to anti-money laundering compliance.
• Right to Restrict Processing: You may request that we temporarily suspend processing of your data, for example while a rectification request is being assessed or where you contest the lawfulness of processing.
• Right to Data Portability: Where processing is based on your consent or a contractual necessity, you have the right to receive a structured, machine-readable copy of your personal data to transfer to another service provider.
• Right to Object: You may object at any time to processing of your data for direct marketing purposes. You also have the right to object to processing carried out on the basis of legitimate interests, where your particular circumstances justify such an objection.
• Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to all verified data rights requests within 30 days of receipt. In complex or high-volume cases, we may extend this period by an additional 30 days, in which case we will notify you of the extension and the reason for the delay.

12. International Data Transfers

asu138 operates server infrastructure and engages service providers located in multiple countries. As a result, your personal data may be transferred to and processed in countries outside of Indonesia. Where such international transfers occur, we ensure that appropriate safeguards are in place to maintain a level of data protection equivalent to that required under Indonesian law, including:

• Standard contractual clauses binding recipient entities to equivalent data protection obligations.
• Data processing agreements that restrict the use of transferred data to specified, documented purposes only.
• Transfers only to jurisdictions or entities that meet recognized international data protection adequacy standards.

By using asu138, you acknowledge that your personal data may be transferred internationally under these safeguards. If you wish to obtain more information about the specific mechanisms we use for any particular transfer, please contact us at the details in Section 16.

13. Third-Party Links

The asu138 Platform may contain references to game content or promotional material produced by third-party studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. While these providers supply content accessible through our Platform, any data processing they conduct through their own servers or SDK integrations is governed by their own privacy policies. asu138 is not responsible for the privacy practices of third-party game studios, and we encourage you to review their policies independently. Our contractual agreements with all game providers require them to limit any data collection to what is strictly necessary for game operation and performance analytics.

14. Children's Privacy

asu138 does not knowingly collect, process, or retain personal data from individuals under the age of 21. Our Services are strictly intended for adults aged 21 and over, and we enforce this restriction through mandatory age verification during account registration and ongoing KYC procedures.

If we become aware that personal data has been collected from an individual under the age of 21 without verifiable parental or guardian consent, we will immediately suspend the associated account, delete all related personal data, and reverse any financial transactions associated with that account. If you believe that a minor has gained unauthorized access to asu138, please contact us immediately at [email protected] so that we can take prompt remedial action.

15. Changes to This Policy

asu138 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this document.
• Display a prominent notice on the Platform homepage for a period of at least 14 days following the change.
• Send a notification to your registered email address summarizing the key changes, where technically feasible.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with material changes to this Policy, you should discontinue use of the Platform and may request account closure by contacting our support team.

16. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by asu138, please contact our Data Protection team through the following channels:

• Email: [email protected]
• Subject Line: "Privacy Request – [Your Registered Username]"
• Live Chat: Available 24/7 through the asu138 Platform
• Response Target: We aim to acknowledge all privacy-related requests within 48 hours and provide a full response within 30 calendar days.

When submitting a data rights request, please include your registered email address and a clear description of your request so that we can verify your identity and process your inquiry efficiently. We may request additional identity verification before actioning any request that involves disclosing or deleting personal data.