Privacy Policy — poi888

In this Privacy Policy, the following terms carry the meanings set out below:

This Privacy Policy applies to all Personal Data collected by poi888 in connection with your use of the Platform, whether you access it via a desktop browser, mobile browser, or any other interface. It applies to registered Members as well as unregistered visitors who browse the Platform.

This Policy should be read together with poi888's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any inconsistency between this Policy and the Terms & Conditions with respect to privacy-specific matters, this Privacy Policy shall prevail.

poi888's primary target market is Indonesia. Members and visitors accessing the Platform from Indonesia benefit from the protections described in this Policy. This Policy is consistent with internationally recognised data protection principles, including those reflected in Indonesia's Personal Data Protection Law (UU PDP).

poi888 collects the following categories of Personal Data:

poi888 collects Personal Data through the following c hannels and mechanisms:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting support, or submitting a complaint.
• Automated technical collection: Technical and usage data collected automatically when you access the Platform, via server logs, cookies, pixel tags, and similar tracking technologies (see Clause 8).
• Payment processors: Transaction confirmation data shared with us by your bank or e-wallet provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• Identity verification partners: Results and risk scores returned by our third-party KYC and AML screening vendors when we submit your identity documents for verification.
• Fraud and security tools: Device fingerprint data, behavioural analytics signals, and IP reputation scores generated by our fraud-detection systems as you interact with the Platform.
• Publicly available sources: In limited circumstances and where permitted by law, we may verify information you have provided against publicly available records, such as official government ID registries or sanctions screening lists.

poi888 processes your Personal Data for the following specific purposes:

• Account creation and management: To register your account, verify your identity, maintain your profile, and communicate account-related information.
• Service delivery: To provide access to betting markets, casino games, lottery products, and all other features of the Platform.
• Payment processing: To facilitate deposits and withdrawals via your chosen local bank or e-wallet, including verifying that the payment method belongs to you.
• KYC and AML compliance: To verify your identity and residential address, screen your transactions against sanctions lists, and fulfil our anti-money laundering and counter-terrorist financing obligations under applicable law.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: To monitor betting patterns for signs of problem gambling, enforce self-exclusion or deposit limit restrictions you have set, and proactively reach out where our systems flag a potential issue.
• Customer support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality assurance and training.
• Platform improvement and analytics: To analyse usage patterns, improve the performance and design of the Platform, develop new features, and conduct internal research.
• Marketing communications: To send you promotional offers, bonus notifications, and relevant news — only where you have provided valid consent and have not subsequently withdrawn it.
• Legal compliance: To fulfil our obligations under applicable law, respond to lawful requests from competent authorities, and enforce our contractual rights.

poi888 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. To withdraw consent, adjust your notification preferences in your account settings or contact our support team.

poi888 does not sell your Personal Data. We share it only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment service providers: We share transaction data with the bank or e-wallet you select (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit or withdrawal. These providers operate under their own privacy policies and regulatory obligations.
• Identity verification vendors: We transmit your identity documents and personal details to our KYC and AML screening partners to verify your identity and screen against international sanctions lists. These vendors are bound by strict data processing agreements.
• Cloud infrastructure and hosting providers: Our platform data is hosted on secure cloud infrastructure. Our hosting providers process data on our behalf and are prohibited from using it for any purpose other than providing the contracted hosting services.
• Fraud detection and cybersecurity partners: Technical and behavioural data is processed by our security partners to identify and prevent fraudulent activity. These partners are contractually bound to handle your data with equivalent protections to those described in this Policy.
• Legal authorities: We may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where we are required to do so by law, a valid court order, or a competent authority's lawful direction. Where permitted by law, we will notify you of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of poi888's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and ensure the acquiring entity is bound by equivalent privacy commitments.

poi888 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and support our security systems. The categories of cookies we use are as follows:

You may control optional cookies through your browser settings. Please note that disabling functional or analytics cookies may affect your experience on the Platform but will not prevent you from placing bets or managing your account. poi888 does not use cookies to serve third-party advertising.

poi888 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active account data (identity, contact, financial, and account data): Retained for the full duration of your membership and for a minimum of five (5) years following account closure, to comply with AML record-keeping obligations.
• KYC documents (ID copies, selfies, proof of address): Retained for a minimum of five (5) years from the date of verification, in line with applicable financial crime prevention legislation.
• Transaction records: Retained for a minimum of five (5) years following the date of each transaction.
• Support communications: Retained for three (3) years from the date of the last interaction, or longer where the communication relates to an unresolved dispute or legal claim.
• Analytics and usage data: Aggregated and anonymised analytics data may be retained indefinitely. Individually identifiable usage data is retained for up to twenty-four (24) months.
• Marketing consent records: Retained for the duration of your membership plus three (3) years, to demonstrate compliance with consent requirements.

When the applicable retention period expires and no legal obligation requires further storage, poi888 will securely delete or irreversibly anonymise your Personal Data.

poi888 implements a layered, defence-in-depth approach to data security. Our technical and organisational measures include:

• Encryption in transit: All data exchanged between your device and our servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Stored Personal Data, including financial records and KYC documents, is encrypted at rest using AES-256 encryption.
• Password hashing: Account passwords are never stored in plain text. We use industry-standard bcrypt hashing with salting to protect your credentials.
• Access controls: Access to Personal Data within our organisation is restricted on a strict need-to-know basis. All staff with access to member data undergo privacy and security training and are bound by confidentiality obligations.
• Intrusion detection: Our infrastructure is monitored continuously by automated intrusion detection systems (IDS) that flag and escalate anomalous access patterns in real time.
• Regular security audits: poi888 commissions independent security assessments and penetration tests on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Data breach response: In the event of a data breach that poses a risk to your rights and freedoms, poi888 will notify affected Members without undue delay and will take all reasonable steps to contain and remediate the breach.

As a poi888 member, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team using the details in Clause 14. poi888 will respond to all verified requests within thirty (30) calendar days.

• Right of Access: You have the right to request a copy of all Personal Data we hold about you, along with information about how it is being processed.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent and no other legal basis exists for continued processing. Note that we may be unable to delete data we are legally required to retain (e.g., AML records).
• Right to Restrict Processing: You may request that we restrict processing of your Personal Data while a rectification request is being resolved, or where you have objected to processing and we are assessing your objection.
• Right to Data Portability: Where processing is based on your consent or our contract with you, you may request a machine-readable copy of your Personal Data that you can transfer to another service provider.
• Right to Object: You may object at any time to processing of your Personal Data based on our legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

The poi888 platform is strictly intended for adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. Registration by minors is expressly prohibited under our Terms & Conditions.

If poi888 discovers or is notified that Personal Data has been collected from an individual under the age of 21, we will immediately close the associated account, delete all related Personal Data, and return any deposited funds to the originating payment method pending identity verification of the account holder.

If you believe a minor has registered an account on the Platform, please notify us immediately at the contact details provided in Clause 14. We take underage gambling extremely seriously and will act on all such reports without delay.

poi888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will notify registered Members via a prominent notice on the Platform and/or by email to your registered email address, with a minimum of seven (7) calendar days' advance notice before the revised Policy takes effect.

The "Last Updated" date at the top of this page will be revised whenever the Policy is amended. We encourage you to review this page periodically to stay informed about how poi888 protects your data. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

The current version of this Privacy Policy is always accessible at https://poi888.cam/privacy-policy. If you do not accept any changes, you should close your account before the revised Policy takes effect.

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or wish to make a complaint about how poi888 handles your Personal Data, please contact our Data Protection team using the following details:

If you are not satisfied with poi888's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. For Members in Indonesia, this is the Ministry of Communication and Information Technology (Kominfo) or such other authority as may be designated under Indonesia's Personal Data Protection Law (UU PDP).

poi888 treats all privacy complaints seriously and is committed to resolving them fairly, transparently, and in a timely manner. We view every complaint as an opportunity to improve our data practices and strengthen member trust.