ids38 Privacy Policy

1 Introduction

ids38 ("ids38", "we", "us", "our") is the operator of the online betting and gaming platform accessible at ids38.app, which serves registered Members primarily based in Indonesia. We are committed to protecting the personal information of every Member and prospective Member who interacts with our platform.

This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and protection of your personal data. It also describes the rights available to you in relation to that data and the mechanisms through which you may exercise those rights. This policy should be read alongside our Terms & Conditions.

ids38 acts as the data controller in respect of the personal data described in this policy. Where we engage third-party service providers who process personal data on our behalf, those providers act as data processors subject to contractual obligations that ensure an equivalent standard of data protection.

2 Data We Collect

We collect the following categories of personal data from or about you when you use the ids38 platform:

2.1 Identity Data

• Full legal name as it appears on your Indonesian government-issued identity document (KTP or passport).
• Date of birth (used to verify you meet our 21+ age eligibility requirement).
• Nationality and country of residence.
• Scanned or photographed copies of your KTP or passport submitted during KYC.
• Selfie photograph taken alongside your identity document and a handwritten ids38 verification note.

2.2 Contact Data

• Email address registered to your ids38 account.
• Indonesian mobile phone number used for account registration and two-factor authentication.
• Residential address in Indonesia, as submitted during KYC.

2.3 Financial Data

• Bank account numbers and account holder names for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, and BSI accounts used for deposits and withdrawals.
• E-wallet registered account details for OVO, DANA, GoPay, ShopeePay, and LinkAja.
• USDT wallet addresses (TRC-20 or ERC-20) where cryptocurrency is used.
• Transaction records including deposit amounts, withdrawal amounts, dates, and processing statuses — all denominated in IDR (Indonesian Rupiah).

2.4 Betting & Gaming Activity Data

• All bets placed on the ids38 sportsbook, live casino, slots, virtual sports, Domino QQ, and togel (Indonesia's traditional numbers lottery) games.
• Game session logs, bet amounts, outcomes, and account balance changes.
• Bonus and promotion claims, wagering requirement progress, and bonus expiry records.

2.5 Technical & Device Data

• IP address at the time of registration and at each login.
• Device type, operating system, browser type and version.
• Session timestamps, pages visited within the ids38 platform, and click-path data.
• Cookie identifiers and similar tracking technology data (see Section 7).

2.6 Communications Data

• Records of live chat transcripts, email correspondence, and support ticket content between you and the ids38 customer support team.
• Survey responses and feedback submissions where you have voluntarily participated.

3 How Data Is Collected

ids38 collects your personal data through the following means:

• Directly from you — when you register an account, complete KYC, make a deposit or withdrawal request, contact customer support, or respond to a promotional survey.
• Automatically — through cookies, server logs, and analytics tools that record your interactions with the ids38 platform (see Section 7 for full cookie details).
• From third-party payment providers — BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and similar providers may confirm transaction reference numbers and account holder names as part of deposit or withdrawal processing.
• From KYC and fraud prevention partners — identity verification providers may cross-reference the documents you submit with their own databases to confirm authenticity and flag potential fraud signals. These providers operate under strict data processor agreements with ids38.
• From publicly available sources — where required for fraud investigation, ids38 may consult publicly available records. No social media profiling is conducted as part of standard onboarding.

4 How We Use Your Data

The table below summarizes the purposes for which ids38 processes your personal data and the corresponding data categories involved:

5 Legal Basis for Processing

ids38 processes your personal data on one or more of the following legal bases, depending on the specific purpose:

• Contractual necessity — processing is required to perform the contract between you and ids38 (i.e., the Terms & Conditions). This covers account registration, KYC, payment processing, bet administration, and customer support.
• Legitimate interests — processing is necessary for ids38's legitimate interests in operating a secure, fair, and commercially sustainable platform. This includes fraud prevention, responsible gaming monitoring, technical analytics, and security incident investigation, provided those interests are not overridden by your privacy rights.
• Legal obligation — processing is required to comply with applicable international gaming regulations, anti-money laundering obligations, and financial crime reporting requirements.
• Consent — where you have explicitly opted in to receive marketing communications. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing & Disclosure

ids38 does not sell your personal data. We share data only in the following limited circumstances, and only to the minimum extent necessary for the stated purpose:

6.1 Payment Processors

To process deposits and withdrawals, ids38 shares necessary transaction reference data with your selected payment provider — including Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers are independent data controllers subject to their own privacy policies and applicable Indonesian financial regulation.

6.2 KYC & Fraud Prevention Providers

Identity documents and verification data submitted during KYC are shared with our contracted identity verification partner. This provider processes your data solely on ids38's instructions, under a data processing agreement that prohibits use of your data for any independent purpose.

6.3 Technology & Infrastructure Providers

ids38 uses cloud hosting, cybersecurity monitoring, and platform analytics providers. These vendors may access technical and anonymized usage data solely to maintain and improve the ids38 platform under strict confidentiality obligations.

6.4 Game Content Providers

Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe may receive anonymized session data (e.g., game ID, session length, RTP data) to facilitate game delivery and performance monitoring. No personally identifiable information is shared with game studios.

6.5 Regulatory and Law Enforcement Authorities

ids38 may disclose personal data to international regulatory bodies, financial intelligence units, or law enforcement agencies where required by law, pursuant to a court order, or where ids38 has a reasonable good-faith belief that disclosure is necessary to prevent fraud, money laundering, or serious harm to another person.

7 Cookies & Tracking Technologies

ids38 uses cookies and similar browser-based storage technologies to operate and improve the platform. Cookies are small text files stored on your device by your browser. The following categories of cookies are used on ids38.app:

ids38 does not use third-party advertising cookies, retargeting pixels, or social media tracking tags. You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies will prevent you from logging in and using the platform.

8 Data Retention

ids38 retains your personal data for as long as your account is active and for the periods specified below following account closure:

• Identity and KYC documents: Retained for a minimum of five (5) years from the date of account closure, as required by international anti-money laundering (AML) standards.
• Financial transaction records (deposits, withdrawals, bet history): Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the last interaction, unless the communication is subject to an ongoing dispute or legal proceeding.
• Technical logs (IP addresses, session data): Retained for twelve (12) months from the date of collection, unless required to be retained longer for fraud investigation purposes.
• Marketing consent records: Retained for the duration of your consent and for three (3) years thereafter as evidence of your consent decision.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where data must be retained beyond these periods due to a specific legal obligation or ongoing investigation, ids38 will restrict its use to the minimum necessary for that purpose.

9 Data Security

ids38 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security controls include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser and ids38 servers is encrypted using TLS 1.3, the current industry standard for secure web communications.
• Data Encryption at Rest: Sensitive data fields — including identity document scans, financial account numbers, and password hashes — are encrypted in our database using AES-256 encryption.
• Access Controls: Access to personal data within ids38's internal systems is restricted to personnel with a legitimate operational need. Access is logged, monitored, and reviewed on a regular basis.
• Two-Factor Authentication (2FA): All internal ids38 staff with access to Member data are required to use 2FA. Members are also strongly encouraged to enable 2FA on their ids38 accounts.
• Penetration Testing: The ids38 platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: ids38 maintains a documented security incident response plan. In the event of a data breach that is likely to result in a high risk to your rights, we will notify affected Members without undue delay.

10 Your Privacy Rights

Depending on applicable law, you may have the following rights in relation to the personal data ids38 holds about you:

• Right of Access: You may request a copy of all personal data ids38 holds about you. We will respond within thirty (30) calendar days of receiving a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. For KYC-verified data fields, correction may require re-submission of identity documents.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data. This right is subject to legal retention obligations — we cannot delete data that we are required by law to retain (e.g., AML transaction records). Where deletion is not possible, we will restrict processing to the minimum legally required.
• Right to Restriction of Processing: You may request that we limit the processing of your personal data while a dispute about its accuracy or the lawfulness of our processing is resolved.
• Right to Data Portability: Where processing is carried out on the basis of consent or contractual necessity and by automated means, you may request a structured, machine-readable export of the data you provided to ids38.
• Right to Object: You may object at any time to processing based on legitimate interests, including the profiling of your gaming activity for responsible gaming monitoring purposes, unless ids38 can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time through your account notification settings or by contacting support, without affecting the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the above rights, contact our support team via live chat from your account dashboard or by email. We may ask you to verify your identity before processing a data rights request to protect against unauthorized disclosure.

11 Protection of Minors

The ids38 platform is strictly intended for adults aged 21 and over. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the ids38 KYC process, and we employ automated age-gate checks at the point of registration.

If ids38 discovers or is notified that a Member is under the age of 21, the account will be immediately suspended, all personal data associated with that account will be deleted or anonymized beyond the minimum legally required retention period, and any real-money balance will be returned to the originating payment method to the extent operationally feasible.

If you are a parent or guardian and believe your child has registered an account on ids38, please contact our support team immediately via live chat or by emailing [email protected] (this is a plain text address — not a clickable link) for prompt resolution.

12 International Data Transfers

ids38 may transfer your personal data to servers and service providers located outside of Indonesia, including cloud infrastructure providers and KYC verification partners. Where such transfers occur, ids38 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required within Indonesia, including through the use of contractual clauses that impose equivalent data protection obligations on the recipient.

By registering and using the ids38 platform, you acknowledge and consent to the transfer of your personal data to servers outside of Indonesia where operationally necessary, subject to the safeguards described in this section.

13 Third-Party Links

The ids38 platform does not contain links to external third-party websites for general browsing. Where payment or game providers are referenced within the platform, those interactions occur within the ids38 interface. ids38 is not responsible for the privacy practices of third-party payment providers (such as BCA, BRI, OVO, and DANA) or game studios (such as Pragmatic Play and Evolution Gaming). We encourage you to review the privacy policies of those providers independently when using their services.

14 Changes to This Policy

ids38 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. When material changes are made, we will notify active Members via their registered email address and display a notification upon next login.

The updated policy will be published on this page with a revised "Last Updated" date. Your continued use of the ids38 platform after the effective date of any update constitutes your acknowledgment of the revised policy. If you do not agree with any material change, you may request account closure by contacting our support team before the effective date.

15 Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the personal data ids38 holds about you, please contact our support team through one of the following channels:

• Live Chat: Available 24/7 directly from your ids38 account dashboard. This is the fastest channel for data rights requests, account closures, and urgent privacy concerns. Our Indonesian-speaking agents are available at all hours.
• Email: [email protected] — plain text address, not a clickable link. Data rights requests submitted by email will be acknowledged within two (2) business days (WIB) and resolved within thirty (30) calendar days.

When submitting a data rights request, please include your full registered name, your ids38 account username, and a brief description of your request. We will verify your identity before actioning any request that involves accessing, correcting, or deleting personal data.

For responsible gaming concerns, self-exclusion, or deposit limit requests, please visit our dedicated Responsible Gaming page where these tools are available directly from your account without requiring a support ticket.