Privacy Policy — top88

top88 ("the Platform", "we", "us", "our") operates the online betting and gaming website accessible at https://top88.cam. In the course of providing our services to Members and visitors — primarily English-preference players across Indonesia — we collect and process certain categories of personal data. This Privacy Policy governs all such data processing activities.

We are committed to handling your personal data with the highest standards of care, transparency, and security. We collect only the minimum data necessary for each stated purpose, retain it for no longer than required, and never sell it to third parties for commercial marketing purposes.

This policy applies to all personal data collected through: the top88 website at https://top88.cam; our customer support channels (email); our KYC verification process; and any other interaction between you and top88 as an individual data subject.

The following terms carry specific meanings throughout this Privacy Policy:

top88 collects personal data across several categories depending on your level of interaction with the Platform:

top88 collects personal data through the following mechanisms:

1. Direct Submission. Data you actively provide to us — such as during account registration, KYC document upload, deposit or withdrawal requests, support email submissions, and responsible gaming tool configuration.
2. Automated Technical Collection. Data gathered automatically as you interact with the Platform, including IP addresses, device fingerprints, browser identifiers, and session activity logs. This collection occurs regardless of whether you are a registered Member or an unregistered Visitor.
3. Cookies and Similar Technologies. First-party cookies and session storage mechanisms used to maintain your login state, remember platform preferences, and analyze aggregate usage patterns. See Clause 11 for full details.
4. Third-Party KYC Providers. Identity verification data cross-checked against government databases or third-party identity verification platforms as part of the KYC process. top88 does not store raw biometric data beyond what is required for identity matching.
5. Payment Processors. Transaction confirmation data returned by our partner banks and e-wallet providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) following deposit or withdrawal processing. top88 does not store full bank account numbers; only masked account references are retained.

top88 processes your personal data only for the specific, explicit, and legitimate purposes listed below. We do not use your data for any purpose incompatible with those originally stated at the time of collection.

top88 processes personal data under one or more of the following legal bases:

1. Contractual Necessity. Processing required to register your account, verify your identity, and deliver the betting and gaming services you have requested — without which we cannot provide the service at all.
2. Legal Obligation. Processing required to comply with applicable AML regulations, financial reporting requirements, and any lawful order from a competent authority.
3. Legitimate Interests. Processing carried out to protect the Platform's security, detect and prevent fraud and abuse, conduct anonymized analytics, and improve service quality — provided such interests are not overridden by your fundamental privacy rights.
4. Consent. Where we rely on your consent — specifically for optional marketing communications — we will obtain explicit opt-in consent, and you may withdraw that consent at any time without affecting the lawfulness of prior processing. Note: top88 does not currently operate any email marketing program. If this changes, affected Members will be notified and given a clear opt-out mechanism before any marketing processing begins.

top88 does not sell, rent, or trade your personal data to any third party. We share your data only in the following limited, controlled circumstances:

1. KYC and Identity Verification Providers. Licensed third-party identity verification services engaged to perform automated document and identity checks. These providers process data solely on our instructions and are contractually prohibited from using it for their own purposes.
2. Payment Processors and Banking Partners. Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the transactional data necessary to execute and confirm deposit or withdrawal instructions.
3. Game Software Providers. Third-party gaming studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft (PG Soft), and Spribe may receive a session token and minimal technical identifiers to deliver their games within the Platform. These providers do not receive your full identity data or financial account details.
4. Legal and Regulatory Authorities. top88 will disclose personal data to competent legal authorities, law enforcement agencies, or financial intelligence units where required by law, pursuant to a valid court order, or where disclosure is necessary to prevent imminent harm or financial crime.
5. Business Transfers. In the event of a merger, acquisition, restructuring, or sale of substantially all of top88's assets, Member data may be transferred to the successor entity. Affected Members will be notified by email prior to any such transfer and given the opportunity to close their accounts.

top88 is an internationally operated platform and some of our third-party service providers — particularly KYC technology vendors and game studios — may be located outside of Indonesia. Where personal data is transferred to a country that does not provide an equivalent level of data protection to Indonesia, top88 will implement appropriate safeguards, including:

• Standard contractual clauses approved by the relevant supervisory authority.
• Data processing agreements that require the recipient to apply security and confidentiality standards consistent with this policy.
• Transfer only to vendors who maintain internationally recognized certifications (e.g., ISO/IEC 27001) and publish their own GDPR-compliant privacy documentation.

By using the Platform, you acknowledge that your personal data may be processed in jurisdictions outside Indonesia. top88 will always take commercially reasonable steps to ensure that any cross-border transfer is subject to an adequate level of protection.

top88 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

At the end of each applicable retention period, personal data is securely deleted or irreversibly anonymized. Anonymized, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and research purposes.

top88 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

1. Encryption in Transit. All data transmitted between your browser and the top88 servers is encrypted using TLS 1.2 or TLS 1.3 (256-bit SSL). Our website enforces HTTPS across all pages with HTTP Strict Transport Security (HSTS) headers.
2. Encryption at Rest. Sensitive personal data — including identity documents, national identity numbers, and financial account references — is encrypted at rest using AES-256 encryption on our database servers.
3. Access Controls. Access to personal data systems is restricted to authorized personnel on a strict need-to-know basis. All internal access is subject to role-based access controls, multi-factor authentication, and audit logging.
4. Intrusion Detection. top88 operates 24/7 network monitoring, web application firewall (WAF) protection, and automated anomaly detection systems to identify and respond to potential security incidents in real time.
5. Vendor Security Assessment. All third-party processors are assessed for security compliance before onboarding and are subject to periodic re-assessment. Processors must demonstrate equivalent or superior data security standards to those applied by top88.
6. Incident Response. In the event of a data breach that poses a material risk to your rights and freedoms, top88 will notify affected Members by email within 72 hours of becoming aware of the breach, detailing the nature of the incident and the steps taken to mitigate its effects.

top88 uses cookies and similar browser-based technologies to operate the Platform, maintain your session, and understand how the site is used. We use only first-party cookies — we do not deploy third-party advertising tracking cookies or retargeting pixels.

You may manage cookie preferences through your browser settings. Disabling functional and analytics cookies will not affect your ability to access the Platform, but may reduce the quality of your personalized experience. Disabling strictly necessary cookies will prevent you from logging in.

As a data subject, you hold the following rights with respect to your personal data held by top88. To exercise any of these rights, please contact us at the email address in Clause 16. We will respond to all valid requests within 30 days of receipt.

1. Right of Access. You have the right to request a copy of all personal data we hold about you, together with information about how it is processed and on what legal basis.
2. Right to Rectification. You may request correction of any inaccurate or incomplete personal data held about you. For account-level data (name, contact details), you may also update these directly within your account settings.
3. Right to Erasure. You may request deletion of your personal data where it is no longer necessary for the original purpose, where you withdraw consent (if consent was the basis), or where processing is unlawful. Note: we cannot erase data where retention is required by law (e.g., KYC and transaction records under AML regulations).
4. Right to Restriction. You may request that we restrict processing of your data — for example, while a rectification request is under review or where you contest the legal basis for processing.
5. Right to Data Portability. Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
6. Right to Object. You may object to processing carried out on the basis of legitimate interests, including profiling for fraud detection purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
7. Rights Related to Automated Decision-Making. top88 does not make decisions that produce legal or similarly significant effects on Members solely through automated means without human review. Where automated systems flag an account for review, a qualified compliance officer will conduct a manual assessment before any action is taken.

top88 is strictly an adults-only platform. We do not knowingly collect personal data from any individual under the age of 21. Our registration process requires all applicants to confirm they are at least 21 years of age, and KYC verification is used to validate this declaration against government-issued identity documents.

If we become aware that personal data has been collected from an individual under 21 — whether through a misrepresentation of age during registration or any other means — we will immediately suspend the account, void all transactions, and permanently delete the associated personal data within 72 hours of confirmation, subject to any legal obligation to retain evidence of the fraudulent registration.

If you are a parent or legal guardian and believe that a minor in your care has registered an account on top88, please contact us immediately at the support email in Clause 16. We will treat all such reports with the utmost urgency and in strict confidence.

The top88 Platform integrates third-party game content delivered by licensed studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft (PG Soft). While these games are delivered within the top88 interface, each studio operates under its own privacy and data-handling framework. top88 contractually limits the data these studios may receive to the minimum session-level technical identifiers required to render their games.

top88 does not maintain links to external websites, social media profiles, or third-party platforms within our core navigation or content. If you independently navigate to any third-party website — including a payment provider's own portal — that site's privacy policy governs its own data practices, and top88 accepts no responsibility for those practices.

top88 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, or regulatory guidance. Material changes — defined as changes that expand the categories of data we collect, introduce new processing purposes, or reduce your rights — will be communicated to active Members via a notice on the Platform and by email to each Member's registered address at least 14 days before the change takes effect.

Non-material changes (such as clarifications of existing language, corrections of typographical errors, or additions of defined terms) may be made without advance notice. The "Last Updated" date at the top of this page will be revised with every published amendment. We encourage Members to review this page periodically.

Your continued use of the top88 Platform after the effective date of any revised policy constitutes your acceptance of the updated terms. If you do not agree to the revised policy, you must close your account prior to the effective date in accordance with the account-closure procedure described in the Terms & Conditions.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by top88, please contact our Data Protection team using the details below. All communications must be in English or Bahasa Indonesia. We aim to respond to all enquiries within 2 business hours during WIB business hours, and within 48 hours for formal data rights requests.

top88 does not operate a dedicated data protection telephone line. All formal data subject requests — including access, rectification, erasure, and portability requests — must be submitted in writing to the email address above with the subject line clearly stating the nature of the request.