Privacy Policy

pg138 ("we", "us", "our", or "the Platform") is committed to protecting the privacy and personal data of every individual who interacts with pg138.one. This Privacy Policy sets out in clear, transparent terms the personal information we collect from Members and visitors, the lawful basis on which we process it, the parties with whom we may share it, and the controls you have over your own data.

This policy applies to all data processing activities carried out by pg138 in connection with the operation of its online casino, sportsbook, and associated services. It covers data collected through the pg138.one website, any mobile-optim ized interface, and any direct communications between you and the pg138 support team.

By registering a pg138 account, making a deposit, placing a wager, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this policy, you should discontinue use of the Platform immediately and contact our support team to request account closure.

2.1 Identity of the Controller. pg138 is the data controller responsible for the personal data collected and processed in connection with the Platform. As data controller, pg138 determines the purposes for which personal data is processed and the means by which that processing is carried out.

2.2 Contact Details. All data-related queries, requests, and complaints should be directed to the pg138 Data Privacy team. You can reach us at [email protected] (plain text — not a clickable link). Please include "Data Privacy" in the subject line of your message to ensure it is routed to the correct team promptly.

2.3 Regulatory Framework. pg138 processes personal data in accordance with applicable data protection legislation and the requirements of its international gaming licence. While pg138 primarily serves Indonesian players — residents of Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, and across the archipelago — the Platform operates under an internationally recognised regulatory framework that mandates robust data protection standards.

pg138 collects personal data in the following categories. We collect only the minimum data necessary for the stated purpose — a principle known as data minimisation.

3.1 Sensitive Data. pg138 does not intentionally collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless this is strictly required for a specific responsible gaming assessment or legal compliance purpose, in which case your explicit consent will be obtained separately.

pg138 collects personal data through the following channels:

• Direct submission — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact support, or update your account profile.
• Automated technical collection — through server logs, session tracking, and cookies placed on your device when you access pg138.one. See Section 9 (Cookies & Tracking) for full details.
• Payment providers — when your bank (BCA, BRI, BNI, Mandiri, etc.) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) confirms a transaction, basic transaction metadata is relayed to pg138 for reconciliation purposes.
• Identity verification partners — third-party KYC service providers may return verification status, document authenticity scores, and fraud-risk signals to pg138 as part of the account verification workflow.
• Fraud and risk management tools — automated systems may collect device fingerprinting data, behavioural patterns, and network characteristics to identify potentially fraudulent activity.

pg138 processes your personal data only where a lawful basis exists. The table below maps each processing purpose to its corresponding legal basis.

5.1 Legitimate Interests Assessment. Where pg138 relies on legitimate interests as the legal basis for processing, we have carried out a balancing assessment to confirm that our interests are not overridden by your fundamental rights and freedoms. You may request a summary of any such assessment by contacting [email protected].

6.1 General Principle. pg138 does not sell, rent, or trade your personal data to any third party for that party's own marketing or commercial purposes. Data sharing is limited strictly to the categories and recipients described below.

6.2 Payment Service Providers. Your financial data is shared with the payment processors and banking partners required to execute your transactions — including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. These providers act as independent data controllers for the data they receive and are subject to their own privacy policies and applicable Indonesian banking regulations.

6.3 Identity Verification Partners. pg138 engages certified third-party KYC providers to carry out document authentication and identity checks. These providers process your identity data on pg138's behalf, under strict data processing agreements, solely for the purpose of verifying your identity and age.

6.4 Game Studio Providers. When you play a game hosted by a third-party studio — such as Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, or NetEnt — limited technical and session data may be shared with that studio to facilitate gameplay, settle outcomes, and resolve technical disputes. Game studios do not receive your full identity data or financial account details.

6.5 Fraud Prevention and Risk Partners. pg138 works with third-party fraud detection services that analyse technical signals (IP address, device fingerprint, behavioural patterns) to identify suspicious activity. These partners process data as data processors under pg138's instruction.

6.6 Legal Authorities. pg138 will disclose personal data to law enforcement agencies, regulatory bodies, or judicial authorities when required to do so by applicable law, a valid court order, or in response to a lawful request from a competent authority. pg138 will notify affected Members of such disclosures where legally permitted to do so.

6.7 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of pg138's business, your personal data may be transferred to the acquiring or successor entity. You will be notified in advance of any such transfer that materially affects the processing of your personal data.

7.1 Cross-Border Processing. As an internationally licensed platform serving Indonesian players, pg138's data processing infrastructure may involve servers and service providers located outside Indonesia. When your personal data is transferred to a jurisdiction outside your home country, pg138 ensures that appropriate safeguards are in place.

7.2 Safeguards Applied. International transfers of personal data by pg138 are governed by one or more of the following mechanisms:

• Contractual clauses requiring the recipient to maintain data protection standards equivalent to those applied by pg138.
• Transfers to jurisdictions that maintain adequately recognised data protection frameworks.
• Binding corporate rules or equivalent intra-group data transfer mechanisms where applicable.

7.3 Enquiries. Members may request information about the specific safeguards applied to any international transfer of their personal data by contacting [email protected] with the subject line "International Transfer Enquiry".

8.1 Retention Periods. pg138 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following general retention periods apply:

8.2 Secure Deletion. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with industry-standard data destruction procedures. Anonymised, non-identifiable data may be retained indefinitely for aggregate analytics purposes.

8.3 Retention Exceptions. pg138 may retain data beyond the standard periods listed above where required by a pending legal proceeding, regulatory investigation, or dispute resolution process. In such cases, data is retained only for the duration of that process and deleted promptly upon its conclusion.

9.1 What Are Cookies. Cookies are small text files placed on your device when you visit pg138.one. They allow the Platform to recognise your device across sessions, maintain your logged-in state, remember your preferences, and collect aggregate usage statistics.

9.2 Categories of Cookies Used.

9.3 Managing Cookies. You can control non-essential cookies through your browser settings. Most modern browsers allow you to block, restrict, or delete cookies at any time. Note that disabling functional cookies may affect the quality of your experience on pg138.one — for example, your game preferences may not be saved between sessions. Disabling analytics cookies does not affect your ability to play or transact.

9.4 No Third-Party Advertising Cookies. pg138 does not use third-party advertising or retargeting cookies. No data collected on pg138.one is shared with advertising networks for the purpose of serving targeted advertisements on other websites.

As a Member of pg138, you hold the following rights with respect to your personal data. pg138 is committed to honouring these rights promptly and without charge, subject to identity verification and applicable legal limitations.

10.1 How to Exercise Your Rights. To exercise any of the rights listed above, contact the pg138 Data Privacy team at [email protected] with the subject line "Privacy Rights Request". Include your registered email address and a brief description of the right you wish to exercise. pg138 will respond within 30 calendar days. Where a request is complex or involves a large volume of data, this period may be extended by a further 60 days, in which case you will be notified of the extension.

10.2 Identity Verification. For the protection of all Members, pg138 will verify your identity before processing any data rights request. This is to ensure that personal data is never disclosed to, or deleted at the request of, an unauthorised third party.

10.3 Limitations. Certain rights are subject to exceptions. For example, the right to erasure does not apply where pg138 is required by law to retain your data (such as AML transaction records). Where a limitation applies, pg138 will explain the reason in its response to your request.

11.1 Technical Safeguards. pg138 employs a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• TLS/SSL Encryption: All data transmitted between your browser or device and pg138.one is encrypted using Transport Layer Security (TLS 1.2 or higher). The padlock icon in your browser confirms an active encrypted connection.
• Encrypted Data Storage: Sensitive personal and financial data stored on pg138 servers is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Access to personal data within pg138's systems is restricted to authorised personnel with a legitimate operational need. Access rights are reviewed regularly and revoked immediately upon role change or departure.
• Two-Factor Authentication: pg138 supports two-factor authentication (2FA) on Member accounts as an additional layer of login security. Members are strongly encouraged to enable 2FA in their account settings.
• Intrusion Detection & Monitoring: pg138's infrastructure is continuously monitored for suspicious activity, intrusion attempts, and anomalous data access patterns.
• Penetration Testing: pg138 commissions regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.

11.2 Member Responsibility. While pg138 applies robust technical safeguards, the security of your account also depends on the strength and confidentiality of your login credentials. You are responsible for choosing a strong, unique password for your pg138 account and for not sharing your credentials with any third party. If you suspect unauthorised access to your account, contact pg138 support immediately at [email protected].

11.3 Data Breach Notification. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, pg138 will notify affected Members without undue delay and in accordance with applicable notification obligations.

12.1 Strict 21+ Enforcement. pg138 does not knowingly collect personal data from any person under the age of 21. Registration on the Platform is strictly limited to adults aged 21 and above. Any account found to be operated by a person under the age of 21 will be immediately closed, all winnings will be voided, and deposited funds will be returned to the originating payment method where legally required.

12.2 Parental Controls. Parents and guardians are encouraged to use parental control software and browser-level content filtering to prevent minors from accessing online gambling websites. pg138 recommends widely used household internet filtering tools such as Net Nanny, Cyber Patrol, and built-in parental controls available on most modern operating systems and mobile devices.

12.3 Data Collected From Minors. If pg138 discovers that personal data has been collected from a person under the age of 21 without verifiable parental consent, all such data will be deleted immediately and the associated account closed. If you believe a minor has registered on pg138, please contact [email protected] immediately with the subject line "Underage Account Report".

13.1 Consent-Based Marketing. pg138 sends promotional emails, bonus offers, and platform update communications only to Members who have opted in to receive them during registration or via the account settings panel. Marketing communications are never sent on the basis of a pre-ticked box or assumed consent.

13.2 Content of Marketing. pg138 marketing communications may include information about new games from studios such as Pragmatic Play, Evolution Gaming, and PG Soft; upcoming sportsbook events including BRI Liga 1 fixtures, EPL matchdays, Champions League rounds, and Timnas Indonesia international fixtures; seasonal bonus offers during periods such as Idul Fitri, Ramadhan, and Indonesian Independence Day (17 August); and platform updates including new payment method availability.

13.3 Opt-Out. You may withdraw consent for marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email from pg138.
• Updating your communication preferences in the account settings panel.
• Contacting support at [email protected] and requesting removal from the marketing list.

Opt-out requests will be processed within 5 business days. You will continue to receive essential transactional communications (deposit confirmations, withdrawal notifications, security alerts) regardless of your marketing preference setting, as these are necessary for the performance of the Member Agreement.

13.4 No Third-Party Marketing Sharing. pg138 does not share your personal data with third-party marketers or affiliate partners for the purpose of sending you unsolicited marketing communications from those parties.

14.1 Game Providers. pg138 hosts games developed and operated by third-party studios including Pragmatic Play, Evolution Gaming, PG Soft (Pocket Games Soft), Microgaming, NetEnt, Spribe, and others. When you launch a game, a connection is established with that studio's game server. Each studio maintains its own privacy and data security practices, which are governed by their respective data processing agreements with pg138 rather than by this Privacy Policy.

14.2 No Responsibility for External Sites. pg138.one does not contain links to external third-party websites. In the event that any third-party content embedded within the Platform (for example, a game lobby widget) contains a reference to an external site, pg138 accepts no responsibility for the privacy practices, content, or security of that external site. You access any external site entirely at your own risk.

14.3 Payment Gateways. When you initiate a deposit or withdrawal, you may interact with a payment gateway interface operated by a third-party provider such as your bank (BCA, BRI, BNI, Mandiri) or e-wallet service (OVO, DANA, GoPay, ShopeePay, LinkAja). The data you enter within those interfaces is processed by those providers under their own privacy policies. pg138 receives only the transaction outcome and a reference identifier — not your full banking credentials or e-wallet PIN.

15.1 Right to Update. pg138 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or data processing practices. The "Last updated" date at the top of this page will be revised whenever a material change is made.

15.2 Notification of Material Changes. Where a change to this Privacy Policy materially affects the way pg138 processes your personal data — particularly where it affects your rights or the legal basis for processing — pg138 will notify active Members by email to their registered address at least 14 days prior to the change taking effect. Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the updated terms.

15.3 Version Archive. Previous versions of this Privacy Policy are retained in our records and are available upon request. Contact [email protected] with the subject line "Privacy Policy Version Request" to obtain a copy of a prior version.

16.1 Data Privacy Team. For any questions, requests, or concerns relating to this Privacy Policy or the handling of your personal data by pg138, please contact our dedicated Data Privacy team:

• Email: [email protected] (subject line: "Data Privacy Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week via the pg138.one platform
• Response Commitment: All privacy-related enquiries are acknowledged within 24 hours (WIB, UTC+7) and resolved within 30 calendar days

16.2 Complaint Procedure. If you are dissatisfied with pg138's response to a privacy concern or believe that your personal data is being processed in a manner inconsistent with applicable data protection law, you have the right to escalate your complaint to the relevant supervisory authority in your jurisdiction. pg138 will cooperate fully with any such investigation and will not take any adverse action against a Member for exercising their right to complain.

16.3 Resolution Commitment. pg138 is committed to resolving all privacy complaints fairly and transparently. Where a complaint reveals a deficiency in our data protection practices, we will take prompt corrective action and, where appropriate, notify other affected Members. Your feedback directly contributes to continuous improvement of pg138's privacy and security standards.