on688 Privacy Policy

This Privacy Policy ("Policy") is published by on688, the operator of the online gambling platform at https://on688.bet ("Platform"). It explains how on688 collects, uses, stores, discloses, and protects the personal information of individuals who visit, register with, or interact with the on688 Platform. This Policy applies to all on688 Members and visitors, with particular relevance to users located in Indonesia. By registering an Account or continuing to use the on688 Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not register an Account or use the Platform.

Introduction

on688 is committed to protecting the privacy and personal data of every individual who interacts with our Platform. We recognise that trust is the foundation of any long-term relationship between a gambling operator and its members, and that trust begins with transparent, responsible data stewardship.

This Policy has been written in plain English to ensure that every on688 Member — regardless of their technical or legal background — can clearly understand how their data is handled. We have deliberately avoided legal jargon where plain language serves equally well, while maintaining the precision required by applicable international data protection standards.

on688 operates as an internationally licensed online gambling platform. While our primary audience consists of English-preference players located across Indonesia — including major cities such as Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and Semarang — this Policy applies equally to all users of the Platform regardless of their location.

This Policy should be read alongside the on688 Terms & Conditions and the on688 Responsible Gaming policy, both of which form part of the contractual framework governing your use of the Platform.

Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Account" means a registered Member account on the on688 Platform.
• "Controller" means on688 in its capacity as the entity that determines the purposes and means of processing your personal data.
• "Cookie" means a small text file placed on your device by the on688 Platform for the purposes described in Section 8.
• "Member" means any individual who has successfully registered an Account on the on688 Platform.
• "Personal Data" means any information that identifies or could reasonably be used to identify a living natural person, including but not limited to name, email address, mobile phone number, device identifiers, IP address, financial account details, and KYC documentation.
• "Platform" means the on688 website at https://on688.bet, all associated subdomains, and any mobile-optimised interfaces through which on688 services are accessed.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Processor" means any third-party service provider that processes Personal Data on behalf of on688 under a written data processing agreement.
• "Sensitive Data" means a subset of Personal Data requiring heightened protection, including financial account credentials, government-issued identification numbers, and any data revealing religious beliefs (relevant where payment timing may suggest observance of Ramadhan or other religious practice).
• "Visitor" means any individual who accesses the on688 Platform without having registered or logged in to an Account.

Personal Data We Collect

on688 collects only the Personal Data that is necessary, proportionate, and relevant to the purposes described in this Policy. The categories of Personal Data we collect are set out in the table below.

How We Collect Your Data

on688 collects Personal Data through the following channels:

4.1 Data You Provide Directly

When you register an Account, complete the KYC verification process, make a deposit or withdrawal, contact on688 support via live chat or email, or update your Account settings, you directly provide us with Personal Data. The accuracy and completeness of this data is your responsibility, and you warrant that all information provided is truthful and current.

4.2 Data Collected Automatically

When you visit or use the on688 Platform, our servers and analytics systems automatically record Technical Data and Usage Data. This includes your IP address (which may indicate that you are connecting from a location in Indonesia, such as Jakarta or Bali), browser fingerprint, session timestamps, and interaction patterns with Platform content. This data is collected through server logs, first-party cookies, and session tracking technologies described in Section 8.

4.3 Data Received from Third Parties

on688 may receive Personal Data about you from the following third-party sources:

• Payment processors: Transaction confirmation data, including the name registered to your bank account or e-wallet, to verify payment account ownership.
• Identity verification providers: Results of automated identity document checks or database cross-referencing conducted during the KYC process.
• Fraud detection services: Risk scores, device reputation data, and IP intelligence used to identify and prevent fraudulent account activity.
• Affiliate partners: If you accessed on688 via an affiliate referral link, the referring affiliate may share a referral identifier with on688 for commission tracking purposes. No sensitive personal data is received from affiliates.

Purposes of Processing

on688 processes your Personal Data for the following specific, legitimate purposes:

• Account registration and management: To create, maintain, and administer your on688 Account, including processing login sessions, password resets, and Account security settings.
• Identity verification (KYC): To verify that you are who you claim to be, that you are at least 21 years of age, and that you are not subject to any self-exclusion or regulatory restriction that would prevent you from using the Platform.
• Payment processing: To process deposits and withdrawals in Indonesian Rupiah (IDR) via your nominated bank account or e-wallet, and to maintain accurate transaction records.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent registrations, unauthorised account access, money laundering, bonus abuse, and other prohibited conduct described in the on688 Terms & Conditions.
• Customer support: To respond to your support queries, resolve disputes, and provide assistance with technical issues, account questions, and responsible gaming requests.
• Personalisation: To tailor the on688 Platform experience to your preferences, including displaying relevant game recommendations, promotional offers, and content relevant to your activity and location in Indonesia.
• Regulatory compliance: To comply with applicable international gaming licence obligations, anti-money laundering (AML) requirements, and any lawful request from a competent regulatory or law enforcement authority.
• Responsible gaming: To administer and enforce deposit limits, cool-off periods, session reminders, and self-exclusion requests, and to identify Members who may be displaying signs of problem gambling based on their activity patterns.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates by email or SMS, where you have opted in to receive such communications. You may opt out at any time via your Account settings or by contacting support.
• Platform improvement: To analyse aggregated, anonymised usage data for the purpose of improving Platform performance, game offering, user interface design, and customer service quality.

Legal Basis for Processing

on688 processes your Personal Data on one or more of the following legal bases, depending on the category of data and the purpose of processing:

• Contractual necessity: Processing that is necessary to perform the contract between on688 and you as a Member — including Account registration, payment processing, KYC verification, and customer support — is carried out on the basis that it is required to deliver the service you have contracted for.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics is carried out on the basis of on688's legitimate interest in operating a secure, fair, and sustainable gambling platform, where such interests are not overridden by your fundamental privacy rights.
• Legal obligation: Processing required to comply with applicable gaming licence conditions, AML legislation, or a lawful order from a competent regulatory or law enforcement authority is carried out on the basis of legal obligation.
• Consent: Processing for marketing communications and non-essential cookies is carried out on the basis of your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Disclosure

on688 does not sell, rent, or otherwise commercially exploit your Personal Data. We share your data only in the limited circumstances described below, and only with recipients who are contractually bound to handle it with the same standard of care that on688 itself applies.

7.1 Service Providers and Processors

on688 engages carefully selected third-party service providers to perform specific functions on our behalf. These Processors may access Personal Data only to the extent necessary to perform their contracted function and are strictly prohibited from using it for any other purpose. Current categories of Processor include:

• Payment processors and banking gateways: Indonesian payment infrastructure providers that facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC and identity verification providers: Specialist third-party platforms that perform automated document verification and database cross-referencing during the Member onboarding process.
• Game content providers: Licensed studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised session data for game performance monitoring. These providers do not receive personally identifiable Member data.
• Cloud infrastructure and hosting providers: on688's Platform infrastructure is hosted on secure, enterprise-grade cloud servers. Our hosting provider processes Technical Data incidentally in the course of providing infrastructure services.
• Fraud detection and cybersecurity providers: Specialist services that analyse device fingerprints, IP reputation, and behavioural signals to protect the Platform from fraudulent activity.

7.2 Regulatory and Law Enforcement Authorities

on688 will disclose Personal Data to regulatory bodies, law enforcement agencies, or competent courts where required to do so by applicable law, or where on688 reasonably believes that disclosure is necessary to prevent or detect crime, protect the safety of a person, or comply with a lawful order. on688 will, where legally permissible, notify the affected Member of any such disclosure.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring involving on688 or its parent entity, Member Personal Data may be transferred to the acquiring entity as part of the transaction. on688 will notify affected Members of any such transfer and will ensure that the acquiring entity is bound by data protection obligations at least equivalent to those in this Policy.

7.4 International Transfers

on688's operations, infrastructure, and Processor network involve the transfer of Personal Data across international borders. Where such transfers occur, on688 implements appropriate safeguards — including standard contractual clauses and due diligence on the data protection standards of receiving jurisdictions — to ensure that your Personal Data is afforded a level of protection consistent with applicable international standards, regardless of where it is processed.

Cookies & Tracking Technologies

on688 uses cookies and similar tracking technologies on the Platform to deliver core functionality, improve performance, and — where you have consented — personalise your experience and analyse usage patterns. The categories of cookies in use are described below.

You may manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to block or delete cookies; however, disabling Strictly Necessary cookies may impair core Platform functionality, including the ability to log in to your Account. on688 does not use cross-site tracking cookies or share cookie data with advertising networks.

Data Retention

on688 retains Personal Data only for as long as it is necessary for the purposes for which it was collected, or for as long as required by applicable law or our gaming licence obligations. The key retention periods applied by on688 are set out below:

• Active Account data: Retained for the full duration of your Membership and for a period of five (5) years following Account closure, to meet gaming licence and AML record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification, as required by applicable AML and know-your-customer regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with standard financial record-keeping requirements.
• Customer support records: Retained for three (3) years from the date of the interaction, to enable on688 to investigate any re-opened dispute or regulatory enquiry relating to the support interaction.
• Marketing preference records: Retained for the duration of your Membership, and for one (1) year after Account closure, to evidence your consent status and honour opt-out requests.
• Technical and usage data (server logs): Retained for twelve (12) months from the date of collection, after which they are deleted or anonymised for aggregated analytics purposes.
• Self-exclusion records: Retained indefinitely to ensure that permanently self-excluded individuals cannot re-register on the on688 Platform.

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with on688's internal data destruction procedures.

Data Security

on688 implements a comprehensive, multi-layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to, the following:

• 256-bit SSL/TLS encryption: All data transmitted between your device and on688 servers is encrypted using industry-standard 256-bit SSL/TLS protocols. The on688 Platform enforces HTTPS across all pages with HTTP Strict Transport Security (HSTS) headers.
• Encryption at rest: Sensitive Personal Data stored in on688 databases — including KYC documentation, financial account details, and Member identity records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to Member Personal Data within on688's internal systems is restricted on a strict need-to-know basis. All internal access events are logged and subject to periodic access review.
• Two-factor authentication (2FA): on688 supports and strongly recommends 2FA for all Member Accounts. All privileged internal administrator accounts are required to use 2FA.
• Penetration testing: on688's Platform infrastructure undergoes regular security assessments and penetration testing by qualified independent security professionals.
• Incident response: on688 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to the rights and freedoms of affected Members, on688 will notify affected Members without undue delay.
• Staff training: All on688 staff with access to Member Personal Data receive mandatory data protection and information security training at the time of onboarding and on a recurring annual basis.

While on688 takes every reasonable technical and organisational measure to protect your data, no system is completely immune to all threats. You also play a role in keeping your Account secure — see Section 4 of the on688 Terms & Conditions for your Account security obligations.

Your Data Rights

As an on688 Member, you hold the following rights in respect of your Personal Data. on688 is committed to honouring these rights in full and will respond to any verified rights request within 30 days of receipt.

Children & Minors

If during our KYC verification process, or at any other point, on688 discovers or has reasonable grounds to believe that a Member is under the age of 21, we will immediately suspend that Account, void all associated bets and bonuses, and initiate the return of any deposited funds to the originating payment source. The relevant Personal Data will be retained only for the minimum period required to process the Account closure and comply with our regulatory obligations, after which it will be securely deleted.

If you are a parent or guardian and believe that a person under 21 in your care has registered an on688 Account or submitted Personal Data to the Platform, please contact our support team immediately at support@on688.bet. We will investigate and act on any such notification as a matter of urgency.

Changes to This Policy

on688 reviews this Privacy Policy periodically and reserves the right to update it at any time to reflect changes in our data practices, applicable law, or the scope of services offered on the Platform. The effective date displayed at the top of this document will be updated whenever a material change is made.

Where a change is material — meaning it meaningfully alters the way on688 collects, uses, or shares your Personal Data — on688 will provide advance notice to affected Members via email or a prominent notice on the Platform at least 14 days prior to the change taking effect. Your continued use of the Platform after the updated Policy takes effect constitutes acceptance of the revised terms. If you do not agree to the revised Policy, you must close your Account and cease using the Platform before the effective date of the change.

We encourage all Members to review this Policy periodically, particularly following any promotional communications or Platform updates that may signal a change in our service offering. Previous versions of this Policy are available on request from our Data Protection Officer.

Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the way on688 handles your Personal Data, you may contact our dedicated Data Protection Officer (DPO) using the details below. All privacy-related correspondence will be acknowledged within 5 business days (WIB, UTC+7) and resolved within 30 calendar days where possible.

When submitting a rights request, please include your registered on688 username, the email address associated with your Account, a clear description of the right you wish to exercise or the concern you wish to raise, and — where identity verification is required — a copy of a government-issued photo ID (KTP or passport). on688 will not process a rights request that cannot be verified as originating from the Account holder.

on688 is committed to resolving all privacy concerns directly and promptly. If, however, you feel that on688 has not adequately addressed your concern, you retain the right to escalate the matter to the relevant supervisory authority or the dispute resolution body designated under our international gaming licence.