Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or can reasonably be used to identify you as a natural person, including your full name, KTP number, date of birth, mobile number, email address, residential address, IP address, and financial account details.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, alteration, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Controller" — sins88, the entity that determines the purposes and means of Processing Personal Data.
• "User" / "Player" / "You" — any natural person who registers for, accesses, or uses sins88 services.
• "Third Party" — any natural or legal person other than you and sins88, including our game providers, payment processors, fraud-prevention partners, and regulatory authorities.
• "KYC Documents" — identity verification materials submitted under our Know Your Customer process, including KTP (Kartu Tanda Penduduk / Indonesian National Identity Card), selfie photos, proof of address, and source-of-funds documentation.
• "Cookie" — a small data file placed on your device by a web server to identify your browser across sessions and support platform functionality.

sins88 collects only the Personal Data necessary to deliver our services, comply with legal obligations, and maintain platform security. We collect data through three primary channels: information you provide directly, data generated automatically by your use of the platform, and information received from third parties such as payment processors and identity-verification providers.

2.1 Information You Provide Directly

• Account Registration: Full legal name, date of birth, mobile phone number, email address, and residential address in Indonesia (city, province, postal code).
• KYC Verification: Copy of KTP (both sides), selfie photo holding your KTP, proof of address document (utility bill, bank statement, or government letter dated within 3 months), and where required, source-of-wealth documentation.
• Financial Transactions: Bank account name, bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata, or others), account number, e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction amounts in Indonesian Rupiah (IDR).
• Support Communications: Content of chat transcripts, email messages, WhatsApp conversations, and any screenshots or attachments you submit to our support team.
• Responsible Gaming Submissions: Self-assessment quiz responses, self-exclusion requests, and limit-setting preferences.

2.2 Automatically Collected Data

• Technical Data: IP address, device type, operating system version, browser type and version, screen resolution, and device language settings.
• Usage Data: Pages visited, features accessed, time and duration of sessions, betting and gaming history (games played, stakes, outcomes, withdrawal requests), and navigation paths through the platform.
• Cookie and Tracking Data: Session identifiers, authentication tokens, and analytics identifiers as detailed in Section 8 (Cookie Policy) below.
• Geolocation Data: Approximate geographic location derived from your IP address for fraud prevention and geographic restriction enforcement. We do not collect precise GPS coordinates.

2.3 Data Received from Third Parties

• Payment Processors: Transaction confirmation references, timestamps, and status codes from Indonesian banks and e-wallet providers.
• Identity Verification Providers: Automated document-authenticity scores and facial-match confidence levels from our KYC technology partners.
• Fraud Prevention Services: Risk scores, device reputation data, and flagged behavioral patterns from our anti-fraud technology providers.
• Game Content Providers: Session logs and game result data from Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, Pocket Games Soft, and other licensed studios integrated into sins88.

sins88 processes Personal Data on the following legal bases. Each purpose is matched to the data categories it relies upon:

sins88 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share data only in the circumstances described below:

4.1 Service Providers: We engage carefully selected third-party vendors who process data on our behalf and are contractually bound to handle it securely and only for specified purposes. These include: Indonesian banking partners (BCA, BRI, BNI, Mandiri, and others) for payment processing; e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja); KYC technology providers for identity verification; cloud hosting providers for server infrastructure; cybersecurity firms for DDoS protection and SSL certification; and customer support software providers.

4.2 Game Content Providers: When you play games on sins88, the relevant game provider (e.g., Pragmatic Play, Evolution Gaming, Spribe) receives session identifiers and bet data necessary to deliver the game and verify outcomes. These providers operate under their own privacy frameworks and are licensed by international gaming regulators.

4.3 Legal and Regulatory Authorities: We may disclose Personal Data to law enforcement agencies, courts, or regulatory bodies when required by applicable law, court order, or legitimate governmental request. We will notify you of such disclosure where legally permitted to do so.

4.4 Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your Personal Data may be transferred to the successor entity. We will provide reasonable notice before your data becomes subject to a different privacy policy.

4.5 With Your Explicit Consent: For any disclosure not covered above, we will seek your express consent prior to sharing your data.

4.6 Aggregated and Anonymized Data: We may share statistical or analytical data in aggregated, anonymized form (from which no individual can be identified) with business partners, industry analysts, or for research purposes.

sins88 retains Pe rsonal Data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

• Account and Registration Data: Retained for the lifetime of your account plus 5 years after account closure, to satisfy AML record-keeping obligations.
• KYC Documents: Retained for 5 years following account closure or the last transaction date, whichever is later, in accordance with international anti-money laundering standards.
• Transaction Records: Retained for 5 years from the date of each transaction to satisfy financial reporting and audit requirements.
• Customer Support Records: Retained for 3 years from the date of the final communication in each support case.
• Marketing Consent Records: Retained for the duration of your account plus 2 years, as evidence of consent given or withdrawn.
• Technical and Usage Logs: Retained for 12 months in raw form, then aggregated and anonymized for longer-term analytics.
• Cookie Data: Session cookies expire when you close your browser. Persistent cookies expire within 12 months of placement unless you clear them earlier.

When Personal Data is no longer required, we securely delete or irreversibly anonymize it using industry-standard methods. Physical documents are shredded; digital records are overwritten using cryptographic erasure protocols.

sins88 implements a layered security architecture designed to protect your Personal Data against unauthorized access, accidental loss, destruction, or alteration. Our key security measures include:

• Encryption in Transit: All data transmitted between your device and sins88 servers is encrypted using TLS 1.3 with 256-bit AES cipher suites. Our SSL certificate is renewed continuously and verified by a trusted Certificate Authority.
• Encryption at Rest: Sensitive Personal Data stored on our servers — including KYC documents, financial account numbers, and KTP data — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to production systems and Personal Data is restricted to authorized personnel on a strict need-to-know basis. Administrative access requires multi-factor authentication (MFA) and is logged comprehensively.
• Regular Security Audits: We commission independent third-party penetration tests and vulnerability assessments at least annually, with critical findings remediated within defined SLA timelines.
• Fraud Detection: Automated systems monitor account activity, login patterns, transaction behavior, and device fingerprints in real time to detect and respond to suspicious activity.
• Incident Response: We maintain a documented data breach response plan. In the event of a breach that is likely to result in a high risk to your rights, we will notify affected users without undue delay and take immediate containment action.
• Employee Training: All sins88 personnel who handle Personal Data receive mandatory data protection training at onboarding and annually thereafter.

While we employ rigorous security measures, no system is entirely immune to attack. You are responsible for keeping your account password confidential and for notifying us immediately at [email protected] if you suspect unauthorized access to your account.

As a sins88 user based in Indonesia, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request" and your registered account details.

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information on how it is processed, the legal basis for processing, retention periods, and any third parties with whom it has been shared. We will respond within 30 days.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you have the right to request correction. Minor details such as phone numbers and email addresses can be updated directly in your Account Settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose collected, you withdraw consent (where consent was the legal basis), or you object to processing and we have no overriding legitimate grounds. Note that we may be required to retain certain data to comply with legal obligations (e.g., AML record-keeping) even following an erasure request.
• Right to Restrict Processing: You may request that we pause processing of your data in specific circumstances — for example, while you contest its accuracy or while we assess your objection to processing.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that we provide your Personal Data in a structured, machine-readable format (JSON or CSV) for transfer to another service.
• Right to Object: You may object to processing based on our legitimate interests at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent for marketing communications can be done instantly via Account Settings.

We will respond to all data rights requests within 30 calendar days. In complex cases, we may extend this period by a further 60 days and will inform you of the extension with reasons.

sins88 uses cookies and similar tracking technologies (web beacons, pixel tags, local storage) to operate our platform, remember your preferences, and analyze usage patterns. Below is a summary of the cookie categories we deploy:

You can control non-essential cookies through your Account Settings under "Privacy Preferences". You may also configure your browser to block or delete cookies; however, doing so may impair certain platform features, including automatic login and game-preference retention.

sins88 services are strictly intended for adults who are 21 years of age or older, in accordance with Indonesian adulthood laws and international gaming license conditions. We do not knowingly collect Personal Data from individuals under the age of 21.

All registrations require date-of-birth confirmation at sign-up, and our KYC process independently verifies age via KTP document review. If we discover that an account has been created by a person under 21, we will immediately close the account, void all associated transactions, and securely delete the minor's data to the extent legally permissible.

If you are a parent or guardian and believe your child has registered on sins88, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and act within 24 hours.

sins88 operates servers and engages service providers in multiple jurisdictions. As a result, your Personal Data may be transferred to and processed in countries outside Indonesia, including countries whose data protection laws differ from Indonesian standards.

Whenever we transfer Personal Data internationally, we implement appropriate safeguards to ensure that your data receives protection equivalent to that provided within Indonesia. These safeguards include: Standard Contractual Clauses (SCCs) binding our service providers to data protection obligations; data processing agreements with all third-party processors; and technical controls ensuring encrypted transmission across borders.

All cloud infrastructure used by sins88 for storing Indonesian player data is hosted in data centers certified to ISO 27001 (Information Security Management) and SOC 2 Type II standards.

sins88 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

• Post the revised policy on this page with an updated "Last Updated" date.
• Send an email notification to your registered address at least 14 days before the changes take effect.
• Display a prominent in-platform notice upon your next login following the update.

Your continued use of sins88 services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you object to the changes, you must stop using our services and may request account closure and data deletion by contacting our support team.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please reach our Data Protection team using the contact details below. We are committed to responding to all privacy-related enquiries within 5 business days.

• Email: [email protected] — subject line: "Privacy Enquiry"
• Live Chat: Available 24/7 on the sins88 platform — ask to be transferred to the Data Protection team
• Response SLA: Acknowledgment within 24 hours; full resolution within 30 calendar days
• Support Hours: 24/7, with Indonesian-speaking agents available. Default time zone: WIB (UTC+7)