Privacy Policy for pg389

pg389 ("we", "us", "our") operates the online casino and sportsbook platform accessible at https://pg389.org (the "Platform"). We are committed to handling your personal data responsibly, transparently, and in full compliance with applicable international data protection standards.

This Privacy Policy applies to all visitors, registered Members, and former Members of the pg389 Platform. It covers all personal information collected through your use of the website, our customer support channels, email communications, and any other interaction you have with pg389. It applies regardless of whether you are accessing the Platform from Jakarta, Surabaya, Bandung, Bali, Yogyakarta, or any other location across Indonesia.

This Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference. Where those documents address privacy-related matters, this Policy takes precedence.

We review and update this Policy periodically to reflect changes in our practices, technology, and applicable law. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to revisit this page regularly.

pg389 collects personal data through several channels: directly from you when you register or interact with us, automatically as you use the Platform, and in limited cases from trusted third-party sources. The categories of data we collect include:

Every piece of data that pg389 collects serves a defined, documented purpose. We do not collect data speculatively or beyond what is genuinely necessary to operate the Platform safely and legally. The primary purposes for which we process your personal data are set out below:

• Account Management: To create, maintain, and administer your pg389 Account, including authentication, password resets, account-level communications, and the delivery of account statements.
• Identity Verification (KYC): To verify your identity and age in compliance with our international gaming licence obligations and anti-money-laundering (AML) requirements. This is a legal obligation we cannot waive.
• Service Delivery: To process deposits, credit winnings, execute withdrawals to your registered Indonesian bank account or e-wallet, and to deliver the full range of casino games, live dealer tables, and sportsbook markets available on the Platform.
• Responsible Gaming: To monitor your gaming activity for indicators of problem gambling behaviour, to enforce deposit limits and self-exclusion requests you have set, and to deliver reality check notifications and session time reminders.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, multiple-account abuse, collusion, bonus abuse, money laundering, and other activities that violate our Terms & Conditions or applicable law.
• Regulatory Compliance: To comply with our obligations under international gaming regulations, AML directives, and any lawful request from a competent authority. In limited circumstances, this may require us to share data with regulatory or law-enforcement bodies.
• Customer Support: To respond to your support queries, resolve complaints, process formal dispute submissions, and improve the quality of our support interactions.
• Platform Improvement: To analyse aggregated and anonymised usage data in order to improve Platform performance, fix bugs, enhance game offerings, and optimise the user experience — including for players accessing the Platform from cities across Indonesia such as Medan, Semarang, Palembang, and Makassar.
• Marketing & Promotions: Subject to your marketing preferences, to send you promotional communications about bonuses, seasonal offers (including those tied to Ramadhan, Idul Fitri, and Indonesian Independence Day), and new game launches via email. You may opt out of marketing communications at any time.

pg389 processes your personal data only where a valid legal basis exists under applicable international data protection principles. The legal bases we rely upon are as follows:

• Contractual Necessity: Processing your Identity Data, Contact Data, Financial Data, and Account Data is necessary to perform the contract established when you accept our Terms & Conditions and register an Account. Without this processing, we cannot provide the Platform services to you.
• Legal Obligation: Certain processing — particularly KYC identity verification, AML transaction monitoring, and regulatory reporting — is required by the gaming licence and financial regulations under which pg389 operates. We have no discretion to omit this processing.
• Legitimate Interests: We process Technical Data and Usage Data on the basis of our legitimate interest in maintaining platform security, preventing fraud, and improving our services. We have assessed that our legitimate interests are not overridden by your data protection rights in these contexts, given the limited intrusiveness of the data involved and the clear benefit to all users.
• Consent: Where we send you direct marketing communications or deploy non-essential cookies, we do so on the basis of your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

pg389 does not sell your personal data to any third party under any circumstances. We share your data only in the limited, specific circumstances described below, and always under contractual data-protection obligations that require the recipient to handle your data securely and only for the stated purpose.

• Payment Processors: We share your Financial Data with Indonesian payment processors and gateway providers — including those facilitating transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja — solely to process deposits and withdrawals on your behalf.
• KYC & Identity Verification Providers: We use specialist third-party identity verification platforms to perform KYC checks. Your Identity Data and Verification Data are transmitted to these providers over encrypted connections and retained by them only as long as necessary to complete the verification.
• Game Content Providers: Game studios integrated into the Platform (including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive your Account identifier and session token to authenticate gameplay. They do not receive your full identity or financial data.
• Fraud Prevention & AML Services: We may share transaction data and risk signals with specialist fraud-prevention and AML screening services to protect the integrity of the Platform and comply with our regulatory obligations.
• Regulatory & Law Enforcement Authorities: We will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where we are legally compelled to do so by a valid legal order or where disclosure is necessary to prevent or report a serious crime.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of the pg389 business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and the identity of the new data controller.

The pg389 Platform uses cookies and similar tracking technologies to operate correctly, maintain your session, and understand how players interact with the site. The following types of cookies may be present on the Platform:

Most modern browsers allow you to manage cookie preferences via their built-in settings. Blocking strictly necessary cookies will prevent the Platform from functioning correctly and may prevent you from logging in to your Account. For more information on managing cookies in your browser, refer to your browser's help documentation.

pg389 does not use cookies to build profiles on behalf of third-party advertising networks, and we do not use cross-site tracking technologies that follow you to other websites after you leave pg389.org.

pg389 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and our regulatory obligations. Our standard retention periods are as follows:

• Active Account Data: Retained for the full duration of your Account's active life, plus a minimum of five years following Account closure, as required by our AML obligations and gaming licence conditions.
• KYC & Verification Documents: Retained for a minimum of five years from the date of verification or from the date of Account closure, whichever is later, in accordance with international AML standards.
• Financial Transaction Records: All deposit, withdrawal, and wagering records are retained for a minimum of five years from the date of the transaction, consistent with standard financial record-keeping obligations.
• Support Communications: Transcripts of live chat, email, and ticket-based support interactions are retained for up to three years following resolution of the relevant query.
• Marketing Data: Where you have opted in to marketing communications, your marketing preferences and interaction history are retained until you withdraw consent or request deletion, subject to a maximum of three years of inactivity.
• Technical & Usage Logs: Server logs and aggregated usage analytics are retained for up to 12 months, after which they are anonymised or deleted.

At the end of the applicable retention period, your data is securely deleted or irreversibly anonymised using industry-standard data destruction methods. Anonymised data — where no individual can be identified — may be retained indefinitely for statistical and research purposes.

pg389 employs a layered, defence-in-depth security architecture to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our key security measures include:

• TLS Encryption in Transit: All data transmitted between your browser or device and the pg389 Platform is encrypted using industry-standard TLS 1.2 or TLS 1.3 protocols. You will always see the padlock icon in your browser's address bar when connected to pg389.org.
• Encryption at Rest: Sensitive data stored in our databases — including identity documents, financial account details, and encrypted passwords — is stored using AES-256 encryption. Passwords are hashed using a salted one-way hashing algorithm; we never store plaintext passwords.
• Access Controls: Access to production systems containing personal data is restricted to authorised personnel only, on a strict need-to-know basis, and is governed by role-based access control (RBAC) policies. All administrative access is logged and audited.
• Two-Factor Authentication (2FA): We strongly encourage all pg389 Members to enable 2FA on their Accounts. All internal pg389 staff with access to Member data are required to use 2FA for system access.
• Penetration Testing: Our Platform and infrastructure undergo regular independent penetration testing and vulnerability assessments. Critical findings are remediated within defined SLA windows.
• Data Breach Response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, pg389 will notify affected Members promptly and take all necessary steps to contain and remediate the breach.

pg389 respects your rights over your personal data. Depending on the applicable data protection framework, you may have some or all of the following rights with respect to the personal data we hold about you:

To exercise any of these rights, submit a written request to [email protected] from the email address registered on your pg389 Account. We will acknowledge your request within 48 hours and provide a full response within 30 calendar days. In complex cases requiring additional review, we may extend this period by a further 30 days, of which we will notify you in advance.

We may need to verify your identity before processing a data rights request. This is to ensure that we do not disclose your personal data to an unauthorised third party. Identity verification will be conducted via the standard KYC process.

The pg389 Platform is strictly intended for adults who are 21 years of age or older. 21+ Only We do not knowingly collect, process, or retain personal data belonging to individuals under the age of 21.

Age verification is a mandatory step in the pg389 registration process, and we employ both technical controls and documentary KYC checks to enforce the 21+ requirement. If we become aware that an Account has been registered by a person under the age of 21, we will immediately suspend the Account, conduct a full review, void any transactions, return any net real-money deposits to the originating payment method, and permanently close the Account.

If you are a parent or guardian and have reason to believe that a minor in your care has registered a pg389 Account, please contact us immediately at [email protected]. We will treat such reports with the highest priority and act swiftly to investigate and close the Account if confirmed.

We also strongly recommend that parents and guardians install reputable parental control software on shared devices to prevent minors from accessing online gambling platforms. Parental controls are available from most major operating system providers and are free to use.

pg389 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, the services we offer, or applicable law. When we make material changes — changes that significantly affect your rights or our data-processing activities — we will notify registered Members via email to the address on their Account, and we will update the "Last Updated" date at the top of this page.

For minor, non-material changes (such as clarifications of existing practices or corrections of typographical errors), we will update the Policy without individual notification but will always update the "Last Updated" date. It is your responsibility to review this Policy periodically.

Your continued use of the pg389 Platform following notification of any material change will be taken as your acceptance of the revised Policy. If you do not accept the revised Policy, you must contact us to request Account closure before the effective date of the change.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way pg389 handles your personal data, please do not hesitate to get in touch. Our dedicated privacy and support team is available around the clock, including during Indonesian public holidays such as Idul Fitri, Ramadhan, and Nyepi.

• Privacy & Data Enquiries: [email protected] — please include "Privacy Request" in your subject line and send from your registered Account email address.
• Live Chat: Available within the Platform after login. Average first response time is under two minutes. Our native Indonesian-speaking agents are on hand 24/7.
• Response Time: Privacy-related requests are acknowledged within 48 hours. Full responses are provided within 30 calendar days, as required by applicable data protection standards.
• Support Hours: 24 hours a day, 7 days a week, 365 days a year. All response times are referenced in WIB (Western Indonesia Time, UTC+7).