Privacy Policy
idn89 Member Data Statement

idn89 operates an online sports betting and casino platform designed primarily for players in Indonesia. As a platform that handles real-money transactions, idn89 is required to collect and process certain categories of personal data in order to verify member identities, process payments, prevent fraud and money laundering, and deliver a personalised gaming experience.

idn89 takes its obligations as a data controller seriously. We apply internationally recognised data-protection principles — including data minimisation, purpose limitation, storage limitation, and integrity and confidentiality — across every aspect of our data-handling operations. We do not sell your personal data to third parties, and we do not use it for purposes beyond those set out in this Policy without first obtaining your explicit consent.

This Policy should be read alongside the idn89 Terms & Conditions, which form the broader contractual framework governing your use of the platform. In the event of any conflict between this Policy and the Terms & Conditions on a privacy-related matter, this Privacy Policy shall take precedence.

The following terms have the meanings set out below when used in this Privacy Policy:

idn89 collects personal data in three broad categories: data you provide directly, data generated automatically through your use of the platform, and data received from trusted third-party sources.

Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, Indonesian mobile number, and chosen username.
• Identity verification documents: Scanned or photographed copy of Indonesian National Identity Card (KTP) or passport; in some cases a selfie or a utility bill for address verification.
• Financial data: Bank account number and account name for Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI); e-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja; deposit and withdrawal transaction records.
• Support communications: Messages, emails, chat transcripts, and any attachments you send to the idn89 support team.
• Bonus and promotion responses: Your opt-in selections, promotional code redemptions, and survey responses.

Data Generated Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and time zone.
• Session and behavioural data: Pages visited, features accessed, games played, wagers placed, session start and end times, clickstream data, and navigation paths within the platform.
• Transaction logs: Timestamped records of all deposits, withdrawals, bonus claims, bet placements, and game results linked to your account.
• Cookie and tracking data: See Section 10 (Cookies & Tracking) for full details of what is collected through these technologies.

Data Received from Third Parties

• Payment processors: Transaction status confirmations and fraud-screening scores returned by Indonesian banking partners and e-wallet providers.
• Identity verification services: Results of automated document authenticity checks and watchlist screenings conducted by idn89's KYC technology partners.
• AML screening providers: Politically Exposed Person (PEP) status flags and sanctions-list match results.

idn89 collects personal data through the following channels and mechanisms:

• Account registration form: Data entered when you create your idn89 account at /idn89-login.
• KYC submission portal: Documents and photographs uploaded during the identity verification workflow.
• Deposit and withdrawal forms: Financial account details entered when initiating transactions via the idn89 cashier.
• Live chat and email: Communications initiated by you through the idn89 support channels.
• Cookies, local storage, and similar technologies: Automatically captured as you browse and interact with the idn89 platform. See Section 10 for details.
• Server and application logs: Automatically generated records of platform access events, including successful and failed login attempts.
• Third-party API responses: Data returned by payment gateways, KYC providers, and AML screening services in response to queries initiated by idn89 on your behalf.

idn89 processes personal data only for the specific, legitimate purposes listed below. We do not use personal data for any purpose that is incompatible with the purpose for which it was originally collected without first obtaining your explicit consent or establishing a separate legal basis.

idn89 relies on one or more of the following legal bases when processing your personal data:

• Contractual necessity: Processing that is required to perform our contract with you as a Member — including account management, payment processing, and platform delivery. Without this processing, idn89 cannot provide its services to you.
• Legal obligation: Processing required to comply with applicable anti-money-laundering regulations, international sanctions screening obligations, and age-verification requirements. idn89 strictly enforces a 21+ minimum age policy across its entire platform.
• Legitimate interests: Processing carried out in furtherance of idn89's legitimate business interests — such as fraud detection, platform security, and aggregate analytics — where those interests are not overridden by your fundamental privacy rights.
• Consent: Processing for purposes beyond the above — principally personalised marketing communications and optional promotional profiling — where idn89 has obtained your clear, freely given, and specific consent. You may withdraw consent at any time by contacting [email protected].

idn89 does not sell, rent, or trade your personal data to any third party for their independent marketing or commercial purposes. We share personal data only in the circumstances and with the categories of recipient described below:

• Payment service providers: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial and identity data necessary to process your requested transaction.
• KYC and identity-verification partners: Third-party technology providers that perform automated document verification and biometric matching on behalf of idn89 to satisfy KYC obligations.
• AML and fraud-screening services: Providers that cross-reference Member data against global watchlists, PEP databases, and sanctions lists.
• Game content providers: Studios such as Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Spribe, and Pocket Games Soft may receive anonymised session identifiers to deliver and log game results. These studios do not receive your name, address, or financial data.
• Cloud infrastructure and IT service providers: Hosting, content delivery, and security service providers engaged to operate the idn89 platform infrastructure. All such providers are bound by data-processing agreements that restrict their use of your data.
• Legal and regulatory authorities: idn89 will disclose personal data to courts, law enforcement agencies, financial intelligence units, or other regulatory bodies where required to do so by law, court order, or in response to a lawful request.
• In the event of a merger, acquisition, or sale of all or substantially all of idn89's assets, Member personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy terms applicable to your data following the transaction.

idn89 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or regulatory obligation.

When the applicable retention period expires, idn89 will securely delete or anonymise the relevant personal data so that it can no longer be associated with any individual Member. Data that has been anonymised and aggregated for statistical or analytical purposes may be retained indefinitely.

idn89 implements a layered, defence-in-depth security architecture to protect Member personal data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures include:

• Transport encryption: All data exchanged between your device and idn89 servers is encrypted using TLS 1.3 with 256-bit AES cipher suites — the same encryption standard applied by BCA and Mandiri for their online banking portals.
• At-rest encryption: Sensitive data fields (including payment account details and KYC document images) are stored using AES-256 encryption in idn89's database infrastructure.
• Two-factor authentication (2FA): All Member accounts are protected by SMS OTP verification, which is enabled by default. Members are strongly advised to keep their registered Indonesian mobile number current.
• Access controls: Access to production systems containing Member personal data is restricted to authorised idn89 personnel on a strict need-to-know basis. All internal access is logged and audited.
• Penetration testing and vulnerability scanning: idn89 conducts regular third-party security assessments to identify and remediate vulnerabilities in its platform infrastructure before they can be exploited.
• Incident response: idn89 maintains a documented incident response plan. In the event of a data breach that is likely to result in a risk to Member rights and freedoms, idn89 will notify affected Members without undue delay.
• While idn89 implements industry-standard security measures, no internet-based platform can guarantee absolute security. Members are responsible for maintaining the confidentiality of their own account credentials and for notifying idn89 immediately at [email protected] if they suspect any unauthorised access to their account.

idn89 uses cookies and similar technologies (including local storage and session storage) to operate the platform efficiently, remember your preferences, maintain your login session, and analyse platform usage patterns. The following categories of cookie are in use:

You can manage your cookie preferences at any time through your browser settings. Disabling Strictly Necessary cookies will impair your ability to log in and use the idn89 platform. Disabling Analytics or Marketing cookies will not affect your core gaming experience.

As a Member of the idn89 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact idn89 at [email protected] with the subject line "Data Rights Request — [Your Username]". idn89 will respond within 30 calendar days of receiving a valid, verifiable request.

• Right of Access: You may request a copy of all personal data idn89 holds about you, together with information about how it is processed and on what legal basis.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held in your idn89 account. Many data fields can be updated directly from within the account settings panel.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to idn89's legal retention obligations — in particular, AML regulations require that financial transaction records and KYC documents be retained for five years after account closure.
• Right to Restrict Processing: You may request that idn89 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being investigated.
• Right to Data Portability: You may request a machine-readable export of personal data you have provided to idn89 (such as your account profile and transaction history in CSV format).
• Right to Object: You may object to processing carried out on the basis of legitimate interests or for direct marketing purposes. Objections to direct marketing will always be honoured immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

idn89 does not knowingly collect personal data from any individual under the age of 21. The idn89 platform is strictly intended for adults aged 21 and over. Age verification is a mandatory step in the account registration and KYC processes, and idn89 employs both automated document checks and manual review to enforce this requirement.

• If idn89 discovers or has reasonable grounds to believe that personal data has been collected from an individual under the age of 21, the relevant account will be immediately suspended, all associated funds withheld pending investigation, and the data deleted or anonymised as soon as practicable.
• Parents and guardians who believe that a minor may have registered an idn89 account are urged to contact the idn89 support team immediately at [email protected] so that appropriate action can be taken without delay.

idn89 is an internationally operated platform. In order to deliver its services to Members in Indonesia, certain personal data may be transferred to and stored or processed in jurisdictions outside Indonesia — for example, on cloud-infrastructure servers located in Singapore, Hong Kong, or the European Union, or by KYC and AML service providers operating in multiple countries.

• All international data transfers are subject to appropriate safeguards, including contractual clauses that require the recipient to protect Member data to a standard equivalent to or greater than that applied by idn89 itself.
• Where data is transferred to cloud infrastructure providers, idn89 selects providers that hold recognised security certifications (such as ISO 27001 or SOC 2 Type II) and that offer data-residency options in the Asia-Pacific region to minimise unnecessary cross-border transfers.
• idn89 does not transfer Member personal data to jurisdictions that do not provide an adequate level of data protection without putting in place appropriate safeguards and, where required, obtaining your explicit consent.

idn89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or idn89's internal data-handling practices. When material changes are made, idn89 will:

• Update the "Last Updated" date displayed at the top of this Privacy Policy page.
• Display a prominent notice on the idn89 platform for a period of at least 14 days following the change, drawing Members' attention to the updated Policy.
• For material changes that significantly affect Member rights, send a direct notification to the email address registered on your idn89 account.

Your continued use of the idn89 platform after the effective date of any amended Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with the changes, you must discontinue use of the platform and may request account closure by contacting [email protected].

If you have any questions, concerns, or complaints about this Privacy Policy or the way in which idn89 handles your personal data, please contact the idn89 Data Protection team using the details below. All privacy-related communications are handled confidentially and will receive a substantive response within 30 calendar days.

• Email (plain text only — not a clickable link): [email protected] — subject line: "Privacy Policy Enquiry"
• Live Chat: Available 24/7 via the idn89 platform. Indonesian-speaking agents are available throughout WIB (Western Indonesia Time, UTC+7) business hours.
• Response time: idn89 aims to acknowledge all privacy-related enquiries within 3 business days (WIB) and to provide a full substantive response within 30 calendar days of receiving a verifiable request.