Privacy Policy

1. Introduction and Scope

Buy138 ("Company," "we," "us," "our") is committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with the buy138 Platform at buy138.cam. This Privacy Policy ("Policy") explains what personal data we collect from you, how we process and protect that data, with whom we may share it, and what rights you have in relation to your personal information.

This Policy applies to all current and prospective users ("User," "you," "your") of the buy138 website, mobile-optimized pages, and any related services offered through the Platform. It covers personal data collected when you register an Account, make deposits or withdrawals, place bets, communicate with our customer support team, or simply browse the Platform without registering.

By accessing the buy138 Platform or creating an Account, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should refrain from using our services. For players based in Indonesia, this Policy is designed to reflect the requirements of applicable Indonesian data protection regulations as well as internationally recognised data privacy standards.

2. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, whether directly (e.g., full name, national ID number) or indirectly (e.g., device fingerprint, IP address).
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, or transmission.
• "Controller" means buy138 in its capacity as the entity that determines the purposes and means of processing your personal data.
• "Processor" means any third party that processes personal data on buy138's behalf pursuant to a written data-processing agreement.
• "KYC" means Know Your Customer — the identity and age-verification procedures required by anti-money-laundering regulations and responsible gaming standards.
• "Cookies" means small text files placed on your device by the Platform to enable certain features and collect usage data.
• "Platform" means the buy138 website (buy138.cam), its sub-pages, and all associated gaming and support services.

3. Information We Collect

3.1 Information You Provide Directly

When you register an Account, use our services, or contact support, we collect the following categories of personal data:

• Identity data: Full legal name, date of birth, gender, and nationality.
• Contact data: Email address, Indonesian mobile phone number (used for OTP verification and support communication), and residential address.
• Identity verification documents: Copy of Indonesian KTP (national identity card), passport, or driver's licence; proof of address; proof of payment method ownership (bank statement or e-wallet screenshot).
• Financial data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history, deposit and withdrawal amounts denominated in Indonesian Rupiah (IDR).
• Communications data: Records of your interactions with our customer support team, including live chat transcripts, email correspondence, and WhatsApp message content.
• Responsible Gaming data: Self-imposed deposit limits, loss limits, session time limits, cooling-off periods, and self-exclusion requests.

3.2 Information Collected Automatically

When you access the Platform, we automatically collect certain technical and behavioural data:

• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, and language settings.
• Usage data: Pages visited, games played (including bet amounts, game results, and session durations), features used, links clicked, and the referring URL.
• Geolocation data: Approximate location derived from your IP address to verify eligibility and comply with geographic restrictions. We do not collect precise GPS coordinates unless you explicitly grant device location permission.
• Cookie and tracking data: Session cookies, persistent cookies, and similar technologies as described in Section 10.

3.3 Information from Third Parties

We may receive personal data about you from third-party sources, including:

• Identity verification service providers that cross-reference the documents you submit against government databases.
• Payment processors and Indonesian banks that provide transaction confirmation and fraud screening results.
• Fraud prevention agencies and sanctions screening databases used to meet our anti-money-laundering obligations.
• Publicly available sources, where relevant to verifying your identity or assessing responsible gaming risk.

4. How We Use Your Information

Buy138 processes your personal data only for clearly defined and legitimate purposes. The table below summarises the primary purposes and the categories of data involved.

We will never use your personal data in ways that are incompatible with the purposes listed above. If we intend to process your data for a new purpose that is not listed here, we will notify you and, where required, obtain your consent before doing so.

5. Legal Basis for Processing

Buy138 relies on the following legal bases to process your personal data:

• Performance of a contract: Processing is necessary to create and manage your Account, execute bets, process payments in IDR via Indonesian banks and e-wallets, and fulfil the obligations described in our Terms and Conditions.
• Legal obligation: We are required by applicable anti-money-laundering (AML) regulations, responsible gaming obligations, and international licensing conditions to verify your identity, screen transactions, and retain certain records for defined periods.
• Legitimate interest: We process certain data to detect fraud, prevent abuse of our Platform, maintain the security and integrity of our systems, and improve the quality of our services. We balance our interests against your privacy rights before relying on this basis.
• Consent: Where we send you marketing communications, use non-essential cookies, or process your data for any purpose not covered by the bases above, we will obtain your explicit consent first. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Disclosure to Third Parties

Buy138 does not sell, rent, or trade your personal data. We may share your data with the following categories of third parti es under strictly controlled conditions:

6.1 Service Providers and Processors

We engage carefully selected third-party processors who act solely on our documented instructions and are bound by data-processing agreements that meet applicable data protection standards:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate deposits and withdrawals in IDR.
• Identity verification providers: Third-party KYC services that verify the authenticity of identity documents and cross-reference submitted data against regulatory databases.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive anonymised session tokens necessary to serve game content; they do not receive your full personal profile.
• IT and hosting providers: Cloud infrastructure and server hosting companies that store Platform data under strict confidentiality obligations and security standards.
• Analytics providers: Aggregated and anonymised usage data may be shared with analytics platforms to help us improve the Platform experience.
• Fraud prevention agencies: Third-party fraud screening and sanctions-list checking services used to meet our AML obligations.

6.2 Legal and Regulatory Disclosure

We may be required to disclose your personal data to competent authorities, regulators, law enforcement agencies, or courts where we are legally compelled to do so. Examples include responses to valid court orders, regulatory audits, AML investigations, or requests under applicable data-sharing frameworks. We will inform you of any such disclosure to the extent permitted by law.

6.3 Business Transfers

In the event that buy138 undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the successor entity as part of that transaction. We will notify you via email and/or a prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.

7. International Data Transfers

Buy138 primarily stores and processes your personal data within data centres serving the Asia-Pacific region. However, some of our third-party service providers — particularly game studios and IT infrastructure providers — may process data in jurisdictions outside Indonesia, including within the European Economic Area (EEA), the United Kingdom, Malta, Curacao, and other international locations.

Whenever personal data is transferred outside Indonesia to a country that may not provide an equivalent level of data protection, buy138 implements appropriate safeguards, which may include:

• Standard contractual clauses approved by recognised data protection authorities.
• Binding corporate rules where the recipient belongs to the same corporate group.
• Transfers to countries recognised as providing adequate data protection by applicable regulators.

You may request details of the specific safeguards applied to any international transfer of your personal data by contacting our Data Protection contact as described in Section 14.

8. Data Retention

Buy138 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. The following general retention periods apply:

When retention periods expire, data is securely deleted or irreversibly anonymised so that it can no longer be linked to you as an individual. Where we are required by law to retain data beyond these periods, we will do so and notify you accordingly.

9. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by buy138. To exercise any of these rights, please contact us as described in Section 14. We will respond within 30 calendar days of receiving a verifiable request.

9.1 Right of Access

You have the right to request a copy of the personal data buy138 holds about you, along with information about how it is being used, with whom it has been shared, and how long it will be retained.

9.2 Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request that we correct or update it. Please notify us promptly if your contact details, bank account information, or any other registered data changes.

9.3 Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been processed unlawfully. Note that this right is subject to our legal obligation to retain certain records (e.g., AML and KYC data) for statutory periods. Erasure requests that conflict with these obligations will be partially fulfilled to the extent permissible.

9.4 Right to Restrict Processing

In certain circumstances — for example, where you contest the accuracy of your data or object to our processing — you may request that we restrict how we use your personal data while the matter is being resolved.

9.5 Right to Data Portability

Where processing is based on your consent or contract performance and carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another data controller where technically feasible.

9.6 Right to Object

You have the right to object to processing based on our legitimate interests, including profiling for fraud prevention or personalisation. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment or defence of legal claims.

9.7 Right to Withdraw Consent

Where processing relies on your consent — such as marketing communications or non-essential cookies — you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal. To unsubscribe from marketing emails, click the "unsubscribe" link in any email we send you, or contact our support team.

10. Cookies and Tracking Technologies

Buy138 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and deliver a personalised gaming experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences such as language settings, preferred game categories, and display options. Disabling these cookies will reduce the quality of your experience but will not prevent access to the Platform.
• Analytics cookies: Collect anonymised data about how users navigate the Platform — pages visited, time on page, error messages encountered — to help us improve performance and user experience.
• Fraud-prevention cookies: Detect unusual activity patterns, repeated failed login attempts, and device fingerprints associated with previously suspended accounts.

Non-essential cookies (functional and analytics) are activated only with your consent. You can manage your cookie preferences at any time through the cookie settings panel accessible from the Platform footer. Note that clearing browser cookies will reset your preferences and may require you to log in again.

11. Security Measures

Buy138 implements a comprehensive, layered security framework designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and buy138 servers — the same standard used by major Indonesian banks such as BCA and BRI.
• Encryption at rest for sensitive stored data, including KYC documents, financial records, and passwords (stored as salted cryptographic hashes, never in plain text).
• Two-factor authentication (2FA) available for all Accounts, adding an additional verification step via OTP sent to your registered Indonesian mobile number or email.
• Access controls: Strict role-based access controls limit which staff members can view sensitive personal data, and all access is logged and audited.
• Intrusion detection and monitoring: Real-time monitoring systems alert our security team to suspicious activity, attempted breaches, or abnormal data access patterns.
• Regular security audits: Third-party penetration testing and vulnerability assessments are conducted at regular intervals to identify and remediate potential weaknesses.

Despite these measures, no online platform can guarantee absolute security. In the unlikely event of a data breach that poses a high risk to your rights and freedoms, buy138 will notify you and relevant regulatory authorities within the timeframe required by applicable law, and will take all reasonable steps to contain and mitigate the breach.

12. Children's Privacy

The buy138 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect personal data from individuals under 21 years of age. All Account registrations are subject to age verification as part of our KYC process, and we reserve the right to request proof of age at any stage.

If we become aware that personal data has been submitted by or on behalf of a person under 21, we will immediately suspend the Account, delete all associated personal data, and void any transactions conducted. If you believe a minor has registered on the buy138 Platform, please contact us immediately at [email protected] so that we can take prompt action.

13. Changes to This Privacy Policy

Buy138 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When material changes are made, we will notify registered users via email to their registered address and/or by posting a prominent notice on the Platform homepage for at least 30 days prior to the changes taking effect.

The "Effective Date" shown at the top of this Policy indicates when the current version came into force. We encourage you to review this Policy periodically. Your continued use of the buy138 Platform after the effective date of any revised Policy constitutes your acceptance of those changes. If you do not agree with the revised Policy, you should close your Account and cease using our services before the changes take effect.

14. Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how buy138 handles your personal data, please contact us through any of the following channels:

• General Privacy Enquiries: [email protected]
• Customer Support (24/7): [email protected]
• Formal Complaints: [email protected]
• WhatsApp Support (08:00 – 00:00 WIB): +62 812-3456-7890
• Live Chat: Available on every page of the Platform, 24 hours a day, 7 days a week.

We will acknowledge your request within 3 business days and aim to provide a full response within 30 calendar days. Where a request is particularly complex or involves a high volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. Indonesian residents may also seek guidance from the Kementerian Komunikasi dan Digital (Ministry of Communication and Digital Affairs) regarding personal data protection matters.