Privacy Policy — vi288

vi288 ("we", "us", "our") operates the online gaming platform accessible at https://vi288.net, providing sports betting, live casino, slot games, Bandar Q, Bola Tangkas, and related services to players in Indonesia and other permitted markets. As the data controller responsible for your personal information, vi288 takes its privacy obligations seriously.

This Privacy Policy applies to all personal data that vi288 processes in connection with your use of the Platform, whether you are a registered Member, a visitor browsing without an account, or a former Member whose account has been closed. It should be read in conjunction with the vi288 Terms & amp; Conditions and Responsible Gaming Policy, both of which are available on the Platform.

By creating a vi288 account or continuing to use the Platform after this policy's effective date, you acknowledge that you have read and understood how vi288 processes your personal data as described herein. If you do not agree with any part of this policy, you must cease using the Platform and contact support to close your account.

The following terms carry specific meanings throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, information that can directly or indirectly identify you, such as your name, national identity number, email address, IP address, or payment details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means vi288, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of vi288 under a written data processing agreement (e.g., payment providers, identity verification services, cloud hosting providers).
• "Member" means any individual who holds a registered vi288 account.
• "Sensitive Data" means a subset of Personal Data warranting heightened protection, including financial account details, government-issued identification numbers, and data related to health or vulnerability status (e.g., responsible gaming flags).
• "Cookie" means a small text file placed on your device by the Platform for purposes including session management, analytics, and personalisation.

vi288 collects the following categories of Personal Data about you, depending on your relationship with the Platform:

vi288 does not knowingly collect special-category sensitive data beyond what is strictly required for identity verification and responsible gaming compliance (e.g., flagging accounts as self-excluded). We do not collect biometric data beyond liveness-check photographs used solely for KYC, and we do not collect data relating to race, religion, political opinion, or sexual orientation.

vi288 collects Personal Data through the following channels:

1. Direct submission: Data you actively provide during account registration, the KYC verification process, deposit and withdrawal requests, contact form submissions, or live chat sessions.
2. Automated technical collection: Data collected automatically as you interact with the Platform, including IP addresses, browser fingerprinting signals, session cookies, and in-game event logs generated by our gaming engine.
3. Third-party sources: Identity verification data returned by our KYC partners; fraud-risk signals from our payment processing partners; publicly available information used for enhanced due diligence on high-value accounts.
4. Referral data: Where you arrive at vi288 via an affiliate marketing link, we record the referral source to attribute the registration correctly. The affiliate partner does not receive your Personal Data in return.

vi288 processes your Personal Data only where a valid legal basis exists. The table below outlines each processing purpose and its corresponding legal basis:

Where vi288 relies on legitimate interests as a legal basis, we have conducted a balancing assessment confirming that our interests do not override your fundamental rights and freedoms. You may request a summary of any such assessment by contacting [email protected].

vi288 does not sell, rent, or trade your Personal Data to unrelated third parties for their own commercial purposes. We share your data only in the following limited circumstances:

• Payment processors and banking partners: To facilitate deposits and withdrawals, we share necessary financial data with BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja. These institutions are subject to their own data protection obligations under applicable banking regulations.
• KYC and identity verification providers: To complete mandatory identity verification, we share KYC documents with contracted third-party verification services. These providers act as Data Processors under written agreements and may not use your data for any purpose other than identity verification on behalf of vi288.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive session tokens and anonymised player identifiers to deliver game content and calculate outcomes. They do not receive your full identity data.
• Cloud infrastructure and hosting providers: vi288's Platform is hosted on secure international cloud infrastructure. Our hosting providers act as Data Processors and are contractually bound to process data only on vi288's instructions.
• Fraud prevention and risk management services: Anonymised or pseudonymised technical data (e.g., IP addresses, device fingerprints) may be shared with fraud-prevention consortiums to protect the Platform and its Members from malicious activity.
• Legal and regulatory authorities: Where required by law, court order, or a valid request from a competent regulatory authority, vi288 may disclose Personal Data. We will notify affected Members of such disclosures to the extent permitted by law.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of vi288's assets, Member data may be transferred to the successor entity subject to equivalent privacy protections. vi288 will notify Members of any such transfer via email or Platform notification prior to the transfer becoming effective.

vi288 operates as an internationally licensed platform. Your Personal Data may be stored and processed in countries outside Indonesia, including but not limited to the jurisdiction in which vi288 holds its gaming licence and the countries in which our cloud infrastructure is located.

Wherever your data is transferred internationally, vi288 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses or equivalent data transfer agreements with all Data Processors operating outside Indonesia.
• Encryption of data in transit and at rest, ensuring that Personal Data cannot be intercepted or accessed by unauthorised parties during cross-border transfers.
• Contractual obligations on recipient parties to provide a level of data protection materially equivalent to the protections described in this Privacy Policy.

By using the vi288 Platform, you acknowledge and consent to the transfer of your Personal Data to these international locations for the purposes described in this Privacy Policy.

vi288 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for the duration of your active account plus a minimum of 5 years following account closure, to comply with AML/CTF regulatory obligations and to resolve any post-closure disputes.
• Financial transaction records: Retained for a minimum of 7 years following each transaction, in line with internationally recognised financial record-keeping standards.
• KYC documents: Retained for the duration of your account plus 5 years following account closure. Copies are stored in encrypted form and access is restricted to authorised compliance personnel.
• Support and communications data: Retained for 3 years following the resolution of the relevant enquiry or complaint.
• Technical and analytics data: Aggregated analytics data is retained indefinitely in anonymised form. Individual-level technical logs (e.g., IP address logs) are retained for up to 12 months.
• Marketing preference data: Retained until you withdraw consent or close your account, whichever is earlier.

Upon the expiry of applicable retention periods, vi288 securely deletes or anonymises your Personal Data using industry-standard data destruction methods.

vi288 uses cookies and similar tracking technologies to operate core Platform functions and to improve the Member experience. The following categories of cookies are in use:

• Strictly necessary cookies: These cookies are essential for the Platform to function correctly. They maintain your login session, remember your responsible gaming settings, and prevent cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without disrupting Platform functionality.
• Performance and analytics cookies: These cookies collect anonymised data about how Members navigate the Platform — for example, which game categories are visited most frequently, how long sessions last, and which deposit methods are most commonly used. This data helps vi288 optimise the Platform experience. No personally identifiable information is transmitted via these cookies.
• Functional cookies: These cookies remember your preferences, such as your preferred language display and currency format (IDR), to provide a more personalised experience on subsequent visits.
• Marketing and attribution cookies: If you arrive at vi288 via an affiliate or referral link, a cookie records the referral source. This cookie does not transmit your Personal Data to the referring affiliate. Its sole purpose is to attribute the registration to the correct marketing channel within vi288's internal systems.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features. vi288 does not use third-party advertising network cookies or behavioural retargeting pixels that serve ads on external websites.

vi288 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our key technical and organisational measures include:

• TLS/SSL encryption: All data transmitted between your device and the vi288 Platform is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed continuously to prevent lapses in encryption coverage.
• Encryption at rest: Sensitive data — including KYC documents, financial account details, and password hashes — is encrypted at rest using AES-256 encryption standards.
• Password hashing: Member passwords are never stored in plain text. We use a modern adaptive hashing algorithm (bcrypt or equivalent) with per-account salts to ensure that even a database breach would not expose readable passwords.
• Two-factor authentication (2FA): Members are strongly encouraged to enable 2FA on their accounts. The 2FA feature is available at no charge via the Account security settings panel.
• Access controls: Access to Member Personal Data within vi288's internal systems is strictly limited on a need-to-know basis. All staff with data access are subject to confidentiality obligations and undergo regular data protection training.
• Intrusion detection and monitoring: vi288's infrastructure is continuously monitored by automated intrusion detection systems. Security events are reviewed by a 24/7 risk and operations team.
• Vulnerability management: vi288 conducts regular penetration testing and code-level security reviews on the Platform. Critical vulnerabilities are patched within 24 hours of discovery.

Despite these measures, no data transmission over the internet or storage system is fully immune from risk. If you suspect that your vi288 account has been compromised, contact support immediately at [email protected] or via live chat.

As a vi288 Member, you have the following rights with respect to your Personal Data. vi288 will respond to all valid rights requests within 30 calendar days of receipt:

1. Right of Access: You may request a copy of all Personal Data that vi288 holds about you, along with information about how it is processed. We will provide this in a structured, machine-readable format where technically feasible.
2. Right to Rectification: You may request that inaccurate or incomplete Personal Data be corrected. For routine corrections (e.g., updating your phone number), you can make changes directly in your Account settings. For identity-linked corrections (e.g., name changes), you must submit supporting documentation via [email protected].
3. Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that vi288 may be required to retain certain data for AML/CTF compliance purposes even following an erasure request — in such cases, vi288 will retain only the minimum data required and will inform you of this limitation.
4. Right to Restriction: You may request that vi288 restrict the processing of your data while a rectification or objection request is under review, or where you dispute the lawfulness of processing but do not wish your data deleted.
5. Right to Data Portability: You may request that vi288 provide your account and transaction data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) that you can transfer to another service.
6. Right to Object: You may object to processing based on legitimate interests (including profiling for personalised offers). vi288 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
7. Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". vi288 may require you to verify your identity before processing the request. There is no charge for exercising these rights unless requests are manifestly unfounded or excessive, in which case vi288 reserves the right to charge a reasonable administrative fee.

vi288 operates a strict 21+ only policy across all products, markets, and services. The Platform is not intended for, and does not knowingly collect Personal Data from, persons under the age of 21.

If vi288 discovers or receives credible notification that a Member account is held by a person under the age of 21, we will immediately:

• Suspend the account and halt all active transactions.
• Delete or return all funds to the source payment method following identity verification.
• Permanently close the account and delete all associated Personal Data, subject to any minimum retention obligations under applicable AML/CTF regulations.

If you believe that a minor under 21 may have registered a vi288 account, please notify us immediately at [email protected]. We will treat all such notifications with the highest priority and investigate within 24 hours.

With your consent, vi288 may send you promotional communications relating to bonuses, seasonal campaigns (such as Idul Fitri, Ramadhan, and Imlek offers), new game releases, and exclusive member rewards via email, SMS, or WhatsApp. You control the following marketing preferences from your Account settings:

• Email marketing opt-in / opt-out
• SMS promotional messages opt-in / opt-out
• WhatsApp promotional messages opt-in / opt-out (separate from transactional WhatsApp support, which is not affected by this toggle)

You may withdraw your marketing consent at any time by updating your preferences in Account settings or by emailing [email protected] with the subject line "Unsubscribe from Marketing". Opt-out requests are processed within 5 business days. Withdrawing marketing consent does not affect your ability to use the Platform or receive essential transactional communications (e.g., deposit confirmations, withdrawal notifications, KYC requests, and security alerts).

vi288 does not use Personal Data to serve targeted advertisements on third-party websites, social media platforms, or mobile applications.

The vi288 Platform integrates with third-party game content providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to deliver its gaming products. These third-party studios operate under their own privacy policies with respect to any data they independently collect through their game engines. vi288 does not control these third-party data practices and recommends that you review the privacy policies of any game studio whose content you play.

The Platform may contain links to third-party websites for informational purposes (for example, links to responsible gaming organisations or licensing authority pages). vi288 is not responsible for the privacy practices of those external websites and accepts no liability for data processing carried out by those sites after you leave the vi288 Platform.

vi288 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. Where a material amendment is made, vi288 will notify registered Members by email or by a prominent on-screen notification at least 7 days before the amendment takes effect.

The "Effective Date" at the top of this policy indicates when the current version entered into force. We recommend that you review this Privacy Policy periodically. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of and agreement to the revised policy.

Previous versions of the Privacy Policy are archived and available upon written request to [email protected].

For any questions, concerns, or formal requests relating to this Privacy Policy or vi288's data processing practices, please reach out through the following channels:

• Email: [email protected] — for privacy rights requests, use subject line "Privacy Rights Request"
• Live Chat: Available 24/7 directly within the Platform after login
• WhatsApp: Available to logged-in Members between 09:00 and 23:00 WIB (Western Indonesia Time, UTC+7)

vi288 acknowledges all privacy-related enquiries within 24 hours and provides a substantive response within 30 calendar days. Complex requests (such as full data subject access requests requiring data compilation across multiple systems) may take up to 30 days, and vi288 will notify you if an extension is required. There is no charge for submitting a standard privacy rights request.