tugu88 Privacy Policy

tugu88 is Indonesia's premier English-language online betting platform, serving adult Members aged 21 and above across Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and throughout the Indonesian archipelago. We offer sportsbook, live casino, slot games, poker tournaments, virtual sports, and togel (Indonesia's traditional numbers lottery) products — all in a single, integrated platform denominated in Indonesian Rupiah (IDR).

As part of operating this Platform, tugu88 necessarily collects and processes certain personal data about you. We take that responsibility seriously. This Privacy Policy sets out, in full and in plain English, every category of data we collect, the precise purposes for which we use it, the legal bases that authorize our processing, how long we keep it, and who — if anyone — we share it with. We do not sell your data. We do not rent it. We do not pass it to marketers. We use it to run a secure, fair, and legally compliant online betting service for Indonesian adults.

This Policy should be read alongside the tugu88 Terms & Conditions. Defined terms used but not defined here carry the meanings given in the Terms & Conditions.

For the purposes of this Privacy Policy, the data controller — that is, the entity that determines the purposes and means of processing your personal data — is the tugu88 operating entity behind the Platform at https://tugu88.app. tugu88 operates as an internationally licensed and regulated online betting platform. All data processing activities are conducted in accordance with the platform's international operating license and applicable data protection standards recognized in the jurisdictions in which tugu88 is licensed.

If you have any questions about how tugu88 handles your personal data, or wish to exercise any of the rights described in Section 10, please contact us at the address provided in Section 14. Enquiries relating to privacy are handled by our dedicated data protection team and are treated as a priority category of support request.

tugu88 collects personal data across several categories depending on how you interact with the Platform. The table below summarizes each category, the specific data points within it, and whether collection is mandatory or optional:

tugu88 collects personal data through the following channels:

• Direct provision by you: When you register an Account, complete KYC verification, make a deposit or withdrawal, place a bet, opt in to a promotion, or contact customer support, you directly provide us with personal data.
• Automated collection: When you browse the Platform, our servers automatically record technical and usage data, including your IP address, device identifiers, session timestamps, and the pages and products you interact with.
• Cookies and similar technologies: The Platform uses cookies and comparable tracking technologies to maintain your session, remember your preferences, and analyze aggregate Platform usage patterns. Full details are in Section 7.
• Third-party identity verification providers: Where tugu88 engages a third-party KYC or fraud-prevention service to verify your identity documents, that provider may return verification results and associated data to tugu88. This is carried out under strict contractual data protection obligations.
• Payment processors: When you make a deposit or request a withdrawal via a local Indonesian bank or e-wallet, the relevant payment provider may share transaction confirmation data with tugu88 for reconciliation and fraud monitoring purposes.

tugu88 processes your personal data only where a valid legal basis exists. The following table maps each processing purpose to its legal basis:

tugu88 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following strictly limited circumstances:

• Identity verification and KYC providers: Third-party service providers engaged by tugu88 to perform document verification and age checks. These providers act as data processors under written contracts that prohibit any use of your data beyond the specific verification service.
• Payment processors and Indonesian banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja receive only the minimum financial data required to process your deposit or withdrawal transaction.
• Fraud and AML screening services: Specialist providers that assist tugu88 in identifying potentially fraudulent activity or patterns consistent with money laundering. These providers receive only the data necessary to perform their screening function.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a session token and anonymized player identifier in order to deliver their games to you through the Platform. They do not receive your full identity or financial data.
• Licensing authority: tugu88's international licensing authority may require access to certain Member records for regulatory audit or compliance review purposes. Such disclosures are made strictly in accordance with the requirements of the applicable license.
• Legal process and law enforcement: Where tugu88 is under a legal obligation to disclose personal data — for example, in response to a court order, subpoena, or formal government request — we will comply with that obligation. Where permitted by law, we will notify the affected Member before making such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of tugu88's assets, Member personal data may be transferred to the acquiring entity. In such an event, tugu88 will provide advance notice to Members and ensure that the acquiring entity is bound by data protection obligations no less protective than those in this Policy.

tugu88 uses cookies and comparable client-side tracking technologies to operate the Platform effectively and to understand how Members use it. The following categories of cookies are in use:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your authenticated session after login, remember your language and currency preferences within a session, and ensure that security tokens are correctly applied. You cannot opt out of strictly necessary cookies while using the Platform.
• Functional Cookies: These cookies remember choices you make — such as your preferred deposit method or notification settings — so that you do not need to re-enter them on each visit. They are set only with your consent.
• Analytics Cookies: tugu88 uses aggregated analytics to understand which pages and products attract the most engagement, how Members navigate the Platform, and where technical errors occur. Analytics data is processed in aggregate and is not used to build individual Member profiles for marketing purposes.
• Security and Fraud-Detection Cookies: Certain cookies and device fingerprinting techniques are used to detect suspicious login attempts, identify the use of automated bots, and enforce the one-account-per-Member rule. These are classified as strictly necessary for platform integrity purposes.

You may manage cookie preferences through your browser settings. Disabling certain cookie categories may impair Platform functionality — for example, disabling session cookies will prevent you from remaining logged in. tugu88 does not use third-party advertising or retargeting cookies.

tugu88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and in any event for no longer than the periods set out below:

• Active Account data: Retained for the entire duration of your Account's existence on the Platform plus a minimum of five (5) years following Account closure, to comply with our international licensing obligations and anti-money laundering record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or from Account closure, whichever is later, in line with standard AML compliance requirements.
• Transaction and betting records: Retained for five (5) years following the date of the transaction or bet settlement, consistent with financial record-keeping obligations applicable to internationally licensed gaming operators.
• Customer support communications: Retained for three (3) years from the date of the final communication in a support thread, to facilitate dispute resolution and quality assurance reviews.
• Marketing consent records: Retained for the duration of your Account plus two (2) years following Account closure, to demonstrate compliance with consent requirements.
• Technical and usage data (server logs): Retained for twelve (12) months from the date of collection, after which they are anonymized or deleted.

When a retention period expires, tugu88 will securely delete or irreversibly anonymize the relevant data. Where data is anonymized rather than deleted, the anonymized data set may be retained indefinitely for aggregate analytical purposes, as it no longer constitutes personal data.

tugu88 implements a layered set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security architecture includes:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the tugu88 Platform is encrypted using 256-bit SSL/TLS protocols. This ensures that your login credentials, financial data, and personal information cannot be intercepted during transit.
• Encrypted Data Storage: Sensitive data fields — including password hashes, financial account identifiers, and identity document references — are stored in encrypted form at rest. Raw payment credentials are never stored on tugu88 servers.
• Two-Step Verification: tugu88 strongly recommends that all Members enable two-step verification (2SV) on their Accounts. 2SV adds a second authentication layer that significantly reduces the risk of unauthorized Account access, even where login credentials have been compromised.
• Access Controls: Access to Member personal data within tugu88's internal systems is restricted on a strict need-to-know basis. Customer support agents, fraud analysts, and KYC reviewers are granted access only to the data categories required to perform their specific role. All internal data access is logged and audited.
• Automated Fraud Detection: tugu88's Platform is monitored continuously by automated systems that flag anomalous login patterns, unusual transaction sequences, and other indicators of Account compromise or abuse. Flagged events trigger manual review by our security team.
• Regular Security Testing: tugu88 conducts periodic penetration testing and vulnerability assessments of its Platform infrastructure. Identified vulnerabilities are remediated on a priority schedule based on their severity.

As a Member or visitor of the tugu88 Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact tugu88 at the details in Section 14. We will respond to all valid requests within 30 days of receipt.

Please note that some rights are subject to limitations under applicable law and gaming regulation. For example, the right to erasure cannot override tugu88's obligation to retain KYC and transaction records for the minimum periods required by its international operating license. Where a right cannot be exercised in full, tugu88 will explain the reason clearly in its response.

The tugu88 Platform is strictly intended for adults aged 21 years and above. tugu88 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the Account registration process, and tugu88 reserves the right to request KYC identity documentation to confirm age at any point during the account lifecycle.

If tugu88 discovers or is notified that personal data has been collected from a person who was under the age of 21 at the time of collection, tugu88 will take immediate action to close the relevant Account and delete or securely destroy all personal data associated with that Account, except where retention is required to report the matter to the relevant licensing authority.

tugu88 is an internationally operated platform. In the course of providing its services to Indonesian Members, personal data may be transferred to and processed in countries other than Indonesia. This occurs primarily in the following contexts:

• Infrastructure and hosting services maintained in data centers located outside Indonesia, selected for their security certifications and geographic redundancy.
• KYC and identity verification providers whose processing infrastructure is located in jurisdictions with recognized data protection frameworks.
• Game content providers (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) whose servers may be located in jurisdictions within and outside Southeast Asia.
• The tugu88 licensing authority's compliance and audit systems, which may be located in the jurisdiction in which tugu88 holds its operating license.

Where personal data is transferred internationally, tugu88 ensures that appropriate safeguards are in place — including contractual data protection clauses, binding corporate rules, or transfers to jurisdictions that maintain data protection standards equivalent to or exceeding those applicable in tugu88's licensing jurisdiction. By using the tugu88 Platform, you acknowledge and consent to the international transfer of your personal data in accordance with this Section.

tugu88 reserves the right to amend, update, or replace this Privacy Policy at any time. Changes may be made to reflect updates in applicable law or regulatory guidance, changes in tugu88's data processing practices, the introduction of new Platform features or products, or feedback from Members and regulators.

When a material change is made to this Privacy Policy, tugu88 will notify all registered Members via email at the address associated with their Account, and will post a prominent notice on the Platform for a minimum of 30 days following the change. The "Effective Date" at the top of this Policy will be updated to reflect the date on which the revised version comes into force.

Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you must cease using the Platform and may request Account closure by contacting customer support. Material changes that would substantially alter how tugu88 uses your existing personal data will not be applied retroactively without your explicit consent.

If you have any questions, concerns, or requests relating to this Privacy Policy or to tugu88's handling of your personal data, please contact our data protection team using the details below. We aim to respond to all privacy-related enquiries within 5 business days (WIB, UTC+7), and to complete substantive requests — such as data access or erasure requests — within 30 calendar days of receipt.

tugu88 does not accept privacy enquiries submitted by telephone. All formal data subject requests must be submitted in writing (email or support ticket) so that we can maintain an accurate record of the request and our response.