1. Introduction
palu88 is committed to handling the personal data of its users with the highest standards of care, transparency, and integrity. This Privacy Policy describes our data practices in plain, professional language so that every user — particularly those based in Indonesia — can make informed decisions about their relationship with our Platform.
We are the data controller in respect of all personal data you provide to us or that we collect in connection with your use of the Platform. We take this responsibility seriously. We collect only the personal data we genuinely need, we store it securely, and we never sell it to third parties for commercial gain.
This Policy is to be read alongside our Terms & Conditions, which govern the overall contractual relationship between you and palu88. If you have any questions about this Policy or our data practices, please contact us using the details provided in Section 15.
2. Definitions
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably identify a living individual, including name, national ID number, email address, IP address, and financial account details. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, alteration, and deletion. |
| "Data Controller" | The entity that determines the purposes and means of Processing Personal Data — in this context, palu88. |
| "Data Processor" | A third party that Processes Personal Data on behalf of palu88, subject to binding contractual instructions. |
| "User" / "You" | Any natural person who accesses or registers on the palu88 Platform. |
| "Cookies" | Small text files placed on your device by the Platform to enable functionality, security, and analytics. |
| "KYC" | Know Your Customer — the identity and address verification process mandated for account security and anti-money-laundering compliance. |
| "Platform" | The palu88 website and all associated services accessible at palu88.cam. |
3. Personal Data We Collect
palu88 collects the following categories of personal data in the course of providing its services:
3.1 Identity Data
- Full legal name as it appears on official Indonesian government-issued identification
- Date of birth (to verify the 21+ age requirement)
- Indonesian National Identity Card (KTP) number, or passport number if applicable
- Selfie photograph taken alongside your identity document for facial verification
3.2 Contact Data
- Email address (primary communication channel)
- Mobile telephone number (used for account verification and security alerts)
- Residential address, including city and province (Jakarta, Surabaya, Bandung, Bali, Medan, and other Indonesian cities are typical)
3.3 Financial Data
- Indonesian bank account details, including account holder name, bank name (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata), and account number
- E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja accounts used for deposits and withdrawals
- Transaction history: deposit amounts, withdrawal requests, and processing timestamps, all denominated in IDR
3.4 Gaming & Behavioral Data
- Betting history, including markets wagered on, stake amounts, outcomes, and session duration
- Game preferences and activity logs (slots, live casino, sports betting markets)
- Responsible gaming data: deposit limit settings, self-exclusion records, cooling-off periods activated
- Bonus and promotional credit usage records
3.5 Technical Data
- IP address and approximate geolocation (used for fraud prevention and access control)
- Device type, operating system, browser type and version
- Session timestamps, login history, and failed authentication attempts
- Cookie identifiers and similar tracking technologies (see Section 8)
3.6 Communication Data
- Records of live chat, email, and support ticket communications between you and palu88's customer service team
- Feedback, complaints, and dispute records
- Marketing preference settings and email communication engagement data
4. How We Collect Your Data
palu88 collects personal data through the following channels:
- Direct submission: When you register an Account, complete a KYC form, submit a withdrawal request, contact support, or respond to a survey, you provide data directly to us.
- Automated collection: When you browse or use the Platform, our servers automatically collect technical data such as your IP address, device identifiers, and browsing behavior via cookies and server logs.
- Third-party verification providers: Where we use accredited identity verification or payment processing partners to assist with KYC or transaction processing, these partners may share verification results and data with us in accordance with their own privacy terms.
- Game providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, and Spribe may share anonymized or aggregated gameplay data with us under data-processing agreements to support platform integrity and responsible gaming obligations.
5. Purposes of Processing
We process your personal data only for the following clearly defined purposes:
| Purpose | Data Categories Used |
|---|---|
| Account registration and management | Identity, Contact |
| Age and identity verification (KYC) | Identity, Contact, Financial |
| Processing deposits and withdrawals in IDR | Financial, Ide ntity |
| Fraud detection and prevention | Technical, Financial, Gaming |
| Anti-money-laundering (AML) compliance | Identity, Financial, Transaction history |
| Delivering and improving gaming services | Gaming, Technical, Behavioral |
| Customer support and dispute resolution | Identity, Contact, Communication |
| Responsible gaming monitoring and intervention | Gaming, Behavioral, Communication |
| Sending transactional notifications (deposits, withdrawals, security alerts) | Contact, Financial |
| Sending promotional communications (where consent is given) | Contact, Gaming preferences |
| Platform security and access control | Technical, Identity |
| Legal and regulatory compliance | All categories as required |
6. Legal Basis for Processing
palu88 processes personal data on one or more of the following lawful bases:
- Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you have accepted — such as operating your Account, processing transactions, and settling bets.
- Legal obligation: Processing required to comply with applicable anti-money-laundering regulations, age verification requirements, and other mandatory legal duties — including KYC verification and transaction record-keeping.
- Legitimate interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, improving service quality, and responsible gaming monitoring — provided such interests are not overridden by your rights and freedoms.
- Consent: For non-essential purposes such as marketing communications and certain cookie categories, we process your data on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time by contacting us or updating your communication preferences within your Account settings.
7. Data Sharing & Disclosure
7.1 We do not sell your personal data. palu88 will never sell, rent, or trade your personal information to any third party for commercial or marketing purposes. Full stop.
7.2 Service Providers (Data Processors). We engage carefully selected third-party service providers who process data on our behalf under binding contractual instructions. These include:
- Identity verification and KYC solution providers
- Payment processing partners facilitating IDR bank transfers and e-wallet transactions
- Cloud hosting and infrastructure providers operating secure, access-controlled data centers
- Customer support platform vendors (live chat and ticketing systems)
- Analytics providers — operating under strict data minimization and anonymization obligations
- Game studios (Pragmatic Play, Evolution Gaming, Spribe, and others) — limited to game-integrity and session data only
7.3 Legal Disclosures. We may disclose personal data to law enforcement authorities, regulators, or other governmental bodies where we are legally compelled to do so, or where we believe in good faith that disclosure is necessary to protect the safety of any person, prevent fraud, or respond to a valid legal process.
7.4 Business Transfers. In the event of a merger, acquisition, or sale of substantially all of palu88's assets, your personal data may be transferred to the acquiring entity, subject to the acquiring party's commitment to uphold data protection standards at least equivalent to those described in this Policy. You will be notified of any such transfer via your registered email address.
7.5 Aggregated Data. We may share aggregated, anonymized data that cannot reasonably be used to identify any individual — for example, platform-wide gaming statistics or regional deposit trend data — with business partners or for industry research purposes.
8. Cookies & Tracking Technologies
palu88 uses cookies and similar tracking technologies to provide a secure, functional, and personalized experience on the Platform. The following cookie categories are in use:
| Cookie Type | Purpose | Required? |
|---|---|---|
| Essential | Session management, authentication, security token validation, fraud detection signals | Yes — cannot be disabled |
| Functional | Remembering user preferences such as language, display settings, and last-visited game category | Optional |
| Analytics | Aggregated Platform usage statistics to improve navigation, game discovery, and support quality | Optional — consent-based |
| Marketing | Tracking promotional campaign effectiveness and personalizing bonus offers where consent is given | Optional — consent-based |
You may manage your cookie preferences through your browser settings. Please note that disabling essential cookies will impair core Platform functionality, including login and payment processing. Disabling analytics or marketing cookies will not affect your ability to play or transact on the Platform.
9. Data Retention
palu88 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:
- Account and identity data: Retained for the duration of the active Account relationship, plus a minimum of 5 years following account closure to satisfy AML and legal compliance obligations.
- Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with standard financial record-keeping requirements.
- KYC documentation: Retained for the duration of your Account relationship plus 5 years following closure. Physical copies (if any) are securely destroyed; digital copies are encrypted and access-restricted.
- Customer support communications: Retained for 3 years from the date of the last interaction, to support dispute resolution and service quality improvement.
- Marketing data: Retained until you withdraw consent or request deletion, whichever occurs first.
- Gaming and behavioral logs: Retained for 2 years from the date of each session for responsible gaming monitoring and fraud detection purposes.
- Technical / server logs: Retained for 12 months and then automatically purged, unless required for an ongoing security investigation.
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. If you request early deletion of your data, we will action your request to the extent that we are not prevented from doing so by legal or regulatory obligations.
10. Security Measures
palu88 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:
- Encryption in transit: 256-bit SSL/TLS encryption on all data transmitted between your device and our servers, including login credentials, payment details, and personal information.
- Encryption at rest: Sensitive stored data — including KYC documents, financial records, and identity information — is encrypted at rest using AES-256 encryption.
- Access controls: Strict role-based access controls ensure that only authorized personnel with a genuine operational need can access your personal data. All internal access is logged and audited.
- Firewall and intrusion detection: Our infrastructure is protected by enterprise-grade firewalls and real-time intrusion detection systems that flag and respond to anomalous activity.
- Two-factor authentication (2FA): palu88 supports 2FA for user accounts to provide an additional layer of protection against unauthorized login attempts.
- Regular security audits: Our systems and data-handling practices are subject to periodic independent security reviews and penetration testing.
- Staff training: All palu88 personnel with access to personal data undergo regular training on data protection obligations and security best practices.
- Data breach response: In the event of a data breach that is likely to result in a risk to your rights, palu88 will notify affected users via their registered email address without undue delay, and will take all reasonable steps to contain and remediate the breach.
11. Your Data Protection Rights
As a user of palu88, you hold the following rights with respect to your personal data. You may exercise any of these rights at any time by contacting us at the details provided in Section 15:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your data where we no longer have a lawful basis to retain it.
Right to Restriction
Request that we limit Processing of your data in certain circumstances.
Right to Portability
Request your data in a structured, machine-readable format for transfer to another provider.
Right to Object
Object to Processing based on legitimate interests, including direct marketing.
Withdraw Consent
Withdraw previously given consent for optional Processing at any time.
Automated Decisions
Request human review of any decision made about you solely by automated means.
We will respond to all valid data subject requests within 30 days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.
Please note that certain rights are subject to limitations — for example, we cannot delete data that we are legally required to retain for AML compliance, or data that is necessary to resolve an outstanding dispute with you.
12. Minors & Age Restriction
palu88 employs age verification at the point of registration and through our KYC process to prevent minors from accessing the Platform. If you believe a minor has accessed or registered on our Platform, please contact us immediately at [email protected] so that we may take appropriate action.
Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gaming sites. palu88 fully supports third-party parental control tools as part of our broader responsible gaming commitment.
13. International Data Transfers
palu88 is primarily operated to serve users based in Indonesia. However, some of our service providers and infrastructure partners — including cloud hosting providers and game studios — may store or process data in data centers located outside Indonesia. Where such international transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard consistent with this Policy, including:
- Standard contractual clauses with data processors, requiring them to uphold equivalent data protection standards
- Transfers only to jurisdictions or entities that provide an adequate level of data protection
- Binding corporate rules where applicable within multi-entity service provider groups
By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia. We take all reasonable steps to ensure that any such transfers are conducted securely and lawfully.
14. Changes to This Privacy Policy
palu88 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. All amendments will be published on this page with a revised "Last Updated" date at the top of the document.
Where changes are material — meaning they significantly affect your rights or the way we use your data — we will notify you directly via your registered email address at least 14 days before the changes take effect. Minor or clarificatory changes may be made without advance notice.
Your continued use of the Platform following the effective date of any update constitutes acceptance of the revised Privacy Policy. If you do not agree with any material change, you may close your Account by contacting our support team.
15. Contact & Data Protection Queries
If you have any questions, concerns, or requests regarding this Privacy Policy or how palu88 handles your personal data, please contact our support team using the following details:
- Email: [email protected]
- Live Chat: Available 24/7 through the Platform interface
- Response Time: We aim to acknowledge all privacy-related enquiries within 2 hours and provide a substantive response within 30 days
When submitting a data subject rights request, please include your registered email address, Account username, and a clear description of your request so that we may process it efficiently and securely verify your identity before releasing any personal data.