Privacy Policy — bir118

Unless context requires otherwise, the following terms in this Policy carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably identify a natural person, directly or indirectly, including name, email address, device identifiers, IP address, and financial account details.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this case, bir118.
• "Data Processor" means any third party that processes Personal Data on behalf of bir118 and under bir118's documented instructions.
• "Cookie" means a small text file placed on a Player's device by the Platform for the purpose of session management, analytics, or preference retention.
• "KYC" (Know Your Customer) means the identity verification process required before a Player may withdraw funds, in compliance with international anti-money-laundering (AML) standards.
• "Sensitive Data" means a subset of Personal Data including financial account details, government-issued identity document data, and transaction records, which require a higher standard of protection.
• "Third Party" means any individual or organization that is not bir118 or the Player.

bir118 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, bir118 is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently in accordance with applicable international data protection principles and the provisions of this Policy.

bir118 operates the Platform on an international basis, primarily serving players residing in Indonesia. All data collection and processing practices described in this Policy apply to players across all regions of Indonesia, including those accessing the Platform from Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and other cities.

For questions, data access requests, or complaints relating to this Policy, players may contact the bir118 Data Protection team directly at [email protected] (plain text — not a clickable link). bir118 aims to respond to all data-related inquiries within 10 business days.

bir118 collects only the Personal Data that is necessary for the purposes described in this Policy. The categories of Personal Data we collect are as follows:

3.1 Registration & Identity Data

• Full legal name as it appears on a government-issued identity document.
• Date of birth (to verify the 21+ age requirement).
• Email address and mobile phone number.
• Country and city of residence (Indonesia).
• Username and encrypted account password.

3.2 KYC & Verification Documents

• Copies of government-issued identity documents (national identity card / KTP, passport, or driver's license).
• Proof of address documents (utility bills, bank statements dated within 3 months).
• Bank account or e-wallet details for the registered payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja).
• Source of funds declarations where required for large or unusual transactions.

3.3 Financial & Transaction Data

• Deposit amounts, dates, methods, and transaction reference numbers.
• Withdrawal amounts, dates, methods, and processing outcomes.
• Bonus credits, wagering activity, and balance history.
• All bets placed, including market type, stake, odds, and settlement outcome.

3.4 Technical & Device Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, and browser version.
• Session duration, pages visited, and navigation paths within the Platform.
• Mobile network operator and connection type (Wi-Fi / mobile data).

3.5 Communications Data

• Content of live chat conversations with customer support agents.
• Email correspondence initiated by the Player or sent by bir118.
• Responses to surveys, promotions, or feedback forms completed by the Player.

bir118 collects Personal Data through the following mechanisms:

• Directly from you: When you register an Account, complete the KYC process, make a deposit or withdrawal, place a wager, contact support, or respond to a promotion.
• Automatically: Through Cookies, web beacons, and server logs that record your device information, IP address, session behavior, and navigation patterns each time you access the Platform.
• From third-party payment processors: When a deposit or withdrawal is processed via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja, the relevant payment processor shares transaction confirmation data with bir118.
• From identity verification providers: Where bir118 engages a specialist KYC or AML screening service to verify identity documents, that provider may return verified data attributes (e.g., name match confirmed, document valid) to bir118.
• From fraud and security services: bir118 may receive risk signals or device fingerprint data from anti-fraud technology partners to protect the Platform and its Players from unauthorized access.

bir118 processes Personal Data on one or more of the following lawful bases, depending on the specific purpose:

bir118 uses the Personal Data we collect for the following specific purposes:

• Account Services: Creating, managing, and securing your Account, verifying your identity, and processing login sessions.
• Financial Transactions: Processing deposits (via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja) and withdrawals to your registered Indonesian bank account, denominated in Indonesian Rupiah (IDR / Rp).
• KYC & AML Compliance: Verifying your identity and source of funds as required under our international gaming license and AML obligations.
• Customer Support: Responding to your queries, resolving account disputes, and providing 24/7 bilingual (English and Indonesian-speaking) support.
• Responsible G aming: Administering player protection tools including deposit limits, session time limits, reality checks, cooling-off periods, and self-exclusion requests in accordance with our Responsible Gaming policy.
• Fraud Prevention & Security: Detecting and preventing unauthorized access, bonus abuse, multi-accounting, money laundering, and other prohibited conduct described in our Terms & Conditions.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve the Platform's performance, navigation, and game offering.
• Marketing Communications: Sending promotional offers, bonus notifications, and seasonal campaign communications (e.g., BRI Liga 1 promotions, Idul Fitri special offers, Ramadhan cashback events) to Players who have opted in to receive such communications. You may unsubscribe at any time by contacting support.
• Legal & Regulatory Obligations: Retaining records as required by our international gaming license, responding to lawful requests from regulatory or law enforcement authorities, and enforcing our Terms & Conditions.

bir118 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share Personal Data only in the following limited circumstances:

• Payment Processors: We share the minimum transaction data necessary with BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable Indonesian financial regulations.
• KYC & Identity Verification Providers: We share identity document data with specialist third-party KYC providers solely for the purpose of verifying your identity and fulfilling our AML obligations. These providers act as Data Processors under a written data processing agreement with bir118.
• Game Studios: When you access games from Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, or Spribe, technical session data (e.g., Player ID, bet amount, game round ID) is shared with the relevant studio to enable game play and settle results. No personally identifiable information beyond a pseudonymous Player ID is shared.
• Fraud & Security Partners: We may share device fingerprint data, IP addresses, and risk signals with anti-fraud technology providers to protect the Platform from fraudulent activity. These providers act as Data Processors and are contractually prohibited from using this data for any other purpose.
• Legal & Regulatory Authorities: We may disclose Personal Data where required by a lawful court order, regulatory instruction, or mandatory reporting obligation under applicable AML laws. We will notify you of such disclosures where permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of the Platform's business assets, Personal Data held by bir118 may be transferred to the acquiring entity, subject to equivalent privacy protections. Players will be notified in advance of any such transfer.

bir118 uses Cookies and similar tracking technologies to operate the Platform efficiently, maintain your session security, and improve your overall experience. The types of Cookies we use are described below:

You may manage Cookie preferences through your browser settings. Disabling strictly necessary Cookies will prevent you from logging in or using core Platform features. Disabling analytics or functional Cookies will not prevent you from accessing the Platform but may reduce the quality of your experience.

bir118 does not use third-party advertising Cookies or serve behavioral advertising to Players based on their browsing history outside the Platform.

bir118 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods imposed by our international gaming license and AML compliance obligations:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. Data that has been anonymized is no longer Personal Data and may be retained indefinitely for statistical and analytical purposes.

bir118 implements a comprehensive suite of technical and organizational security measures designed to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the bir118 Platform is encrypted using bank-grade 256-bit SSL/TLS protocols. This applies to all login sessions, deposit and withdrawal transactions, and KYC document uploads.
• Data Encryption at Rest: Sensitive Data stored in bir118's database infrastructure — including identity documents, bank account details, and account passwords — is encrypted at rest using AES-256 encryption.
• Password Security: Account passwords are never stored in plain text. bir118 uses a one-way cryptographic hashing algorithm with salting to store password credentials. Staff members do not have access to your plain-text password.
• Access Controls: Access to Personal Data within bir118's internal systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum access permissions required to perform their role, and all access is logged and audited.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their Account. Internal bir118 staff who access player data systems are required to use 2FA without exception.
• Regular Security Audits: bir118's Platform and data infrastructure are subject to regular third-party penetration testing and security audits. Critical vulnerabilities are remediated on a priority basis.
• Segregated Fund Accounts: Player funds are held in accounts segregated from bir118's operational capital, ensuring that your Rp balance is not exposed to bir118's business liabilities.

As a Player on bir118, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our Data Protection team at [email protected]. We will respond within 10 business days of receiving your request and any identity verification information we may require.

bir118 does not knowingly collect Personal Data from individuals under the age of 21. Age is verified during the Account registration process and again during KYC. If bir118 discovers that Personal Data has been collected from an individual who is under 21 — whether through misrepresentation during registration or any other means — the following steps will be taken immediately:

1. The Account will be permanently closed without prior notice.
2. Any balance held in the Account will be reviewed. If the funds were deposited by the minor or on behalf of the minor, they will be returned to the payment method used, subject to the completion of any applicable AML checks.
3. All Personal Data associated with the underage Account will be deleted from bir118's systems as soon as legally permissible, subject to any retention obligations triggered by the financial transactions involved.

If you have reason to believe that a minor has registered on bir118 using false information, please notify us immediately at [email protected] so that we can investigate and take appropriate action.

bir118 operates as an internationally licensed platform. As a result, some Personal Data collected from Indonesian players may be transferred to, stored in, or processed in countries outside Indonesia as part of our Platform operations — for example, when engaging KYC verification providers, cloud infrastructure partners, or game studio integrations.

Where Personal Data is transferred internationally, bir118 ensures that an equivalent level of protection applies through one or more of the following safeguards:

• Binding contractual obligations imposed on the receiving party that are equivalent to the standards described in this Policy.
• Transfers only to organizations that are independently certified under a recognized international data security standard (e.g., ISO/IEC 27001).
• Standard contractual clauses or data processing agreements that legally obligate the recipient to protect the data to bir118's required standard.

Players may request information about the specific safeguards applicable to any international transfer of their Personal Data by contacting [email protected].

bir118 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or Platform features. The version number and "Last Updated" date displayed at the top of this page identify the current operative version of the Policy.

Where changes to this Policy are material — for example, where we introduce a new category of data collection or a new purpose for processing — we will notify Players via email to their registered Account address no less than 14 days before the changes take effect. Non-material clarifications or corrections may be made without advance notice.

Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not accept the revised Policy, you must cease using the Platform and may request Account closure in accordance with the Terms & Conditions.

For any privacy-related queries, data rights requests, or complaints regarding how bir118 handles your Personal Data, please reach out to our Data Protection team using the contact details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Request – [Your Account Username]" for faster routing to the Data Protection team.
• Response Time: We aim to acknowledge all privacy-related requests within 2 business days (WIB) and to provide a substantive response within 10 business days.
• Support Hours: 24/7, including Indonesian public holidays. Live chat and email support are available in both English and Indonesian.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to bir118's Compliance Department by requesting a formal review. Compliance reviews are completed within 15 business days of receipt of all relevant information.