Privacy Policy

1. Introduction

Welcome to apo138's Privacy Policy. This document describes how apo138 ("we," "us," "our") collects, uses, stores, and protects personal information from users ("you," "your") of our online gaming platform accessible at https://apo138.cam and through associated mobile applications.

apo138 is committed to protecting your privacy and handling your personal data responsibly and transparently. As an online gaming platform serving Indonesian players and operating under international licensing, we adhere to strict data protection standards including principles derived from the EU General Data Protection Regulation (GDPR), industry best practices, and applicable Indonesian data protection laws.

By creating an account with apo138, using our Services, or providing personal information to us, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein. If you do not agree with this Privacy Policy, you must not use apo138 Services.

2. Information We Collect

apo138 collects several types of information to provide and improve our Services. The categories of personal information we collect include:

2.1 Information You Provide Directly

When you register for an account, verify your identity, make deposits, request withdrawals, or communicate with our customer support, you provide information including:

• Personal Identification Information: Full legal name, date of birth, gender, nationality, Indonesian National ID number (KTP) or passport number, residential address, email address, and mobile phone number.
• Account Credentials: Username and encrypted password for accessing your apo138 account.
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet account information (OVO, DANA, GoPay, ShopeePay, LinkAja identifiers), payment card information (processed through secure third-party payment gateways—apo138 does not store full card numbers), transaction history, deposit amounts, withdrawal amounts, and account balance information.
• Verification Documents: Copies of government-issued identification documents (KTP, passport, driver's license), proof of address documents (utility bills, bank statements), and selfie photographs submitted for KYC (Know Your Customer) verification purposes.
• Communication Records: Content of emails, live chat messages, WhatsApp conversations, phone calls (with your consent where legally required), and any other communications between you and apo138 customer support or management.
• Responsible Gaming Preferences: Self-imposed deposit limits, loss limits, session time limits, self-exclusion requests, and reality check settings you configure.

2.2 Information Collected Automatically

When you access and use apo138 Services, we automatically collect certain technical and usage information including:

• Device Information: Device type (smartphone, tablet, desktop computer), operating system and version (Android, iOS, Windows, macOS), browser type and version, screen resolution, device identifiers (IMEI, advertising ID where permitted), and device settings.
• Connection Information: IP address, internet service provider (ISP), approximate geographic location (city and country level based on IP address—we do not track precise GPS location), connection timestamps, and network quality metrics.
• Usage and Activity Data: Pages visited, features used, games played, bet history (sports events bet on, bet amounts, bet outcomes, odds accepted), time spent on platform, click patterns, navigation paths, search queries, and interaction with promotional content.
• Cookies and Similar Technologies: Information collected through cookies, web beacons, local storage, and similar tracking technologies—see Section 8 for detailed information.
• Anti-Fraud Data: Information used to detect and prevent fraudulent activity including device fingerprints, behavioral biometrics (typing patterns, mouse movements where technically feasible and legally permitted), risk scores, and fraud detection flags.

2.3 Information from Third Parties

In certain circumstances, we may receive information about you from third-party sources including:

• Payment Processors: Transaction confirmation, payment success/failure status, and basic payment method information from Indonesian banks and e-wallet providers we partner with.
• Identity Verification Services: Verification results from third-party KYC/AML (Anti-Money Laundering) service providers we use to confirm identity documents and prevent fraudulent accounts.
• Game Providers: Game session data, bet outcomes, and RNG (Random Number Generator) results from third-party game studios like Pragmatic Play, Evolution Gaming, and others whose games are integrated into our platform.
• Affiliate and Marketing Partners: Referral source information if you access apo138 through an affiliate link or promotional campaign.

3. How We Use Your Information

apo138 uses your personal information for the following purposes, all of which are necessary for operating a secure, legally compliant, and high-quality online gaming platform:

3.1 Account Management and Service Delivery

• Creating and maintaining your apo138 account
• Verifying your identity and age (21+ requirement) through KYC procedures
• Processing deposits, withdrawals, and other financial transactions
• Maintaining your account balance and transaction history
• Enabling you to place bets and play games
• Calculating and crediting winnings to your account
• Processing bonus claims and tracking wagering requirement progress

3.2 Customer Support and Communication

• Responding to your inquiries, complaints, and support requests via live chat, email, WhatsApp, or phone
• Sending transactional notifications (deposit confirmations, withdrawal approvals, bet settlements, bonus credits)
• Providing account-related communications (verification status updates, responsible gaming reminders, terms changes)
• Conducting customer satisfaction surveys (with your consent)
• Sending promotional offers, bonuses, and marketing communications (you may opt out at any time—see Section 7)

3.3 Security and Fraud Prevention

• Detecting and preventing fraudulent account registrations, payment fraud, bonus abuse, collusion, and other prohibited activities
• Monitoring betting patterns for signs of match-fixing, arbitrage, or professional advantage play
• Protecting against unauthorized account access, identity theft, and hacking attempts
• Investigating suspected Terms and Conditions violations
• Maintaining platform security and protecting against cyber attacks, malware, and technical vulnerabilities

3.4 Legal and Regulatory Compliance

• Complying with international anti-money-laundering (AML) regulations and reporting obligations
• Fulfilling Know Your Customer (KYC) requirements mandated by our gaming license
• Responding to lawful requests from government authorities, regulatory bodies, and law enforcement
• Enforcing our Terms and Conditions and other legal agreements
• Maintaining records as required by applicable gaming regulations
• Verifying compliance with age restrictions (21+ for Indonesian players)

3.5 Platform Improvement and Analytics

• Analyzing usage patterns to improve user experience, navigation, and platform performance
• Conducting A/B testing of features, layouts, and promotional campaigns
• Optimizing game loading speeds, mobile responsiveness, and technical performance
• Understanding player preferences to curate relevant game recommendations
• Identifying bugs, technical issues, and areas for platform enhancement
• Developing new features and services based on user behavior insights

3.6 Responsible Gaming

• Implementing and monitoring deposit limits, loss limits, and session time limits you set
• Enforcing self-exclusion periods you request
• Identifying players exhibiting potential problem gambling behavior and offering intervention resources
• Providing reality check reminders and responsible gaming tools
• Maintaining records of responsible gaming interactions for regulatory compliance and player protection

4. Data Sharing and Disclosure

apo138 does not sell your personal information to third parties. We share your information only in the limited circumstances described below, and only to the extent necessary:

4.1 Service Providers and Business Partners

We share information with trusted third-party service providers who perform services on our behalf, including:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) process deposits and withdrawals. We share necessary financial information to complete transactions.
• Game Providers: Third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Spribe, etc.) receive your username, bet amounts, and session data to deliver game content and track game outcomes.
• Identity Verification Services: KYC/AML verification providers receive copies of identification documents and personal information to verify your identity and prevent fraud.
• Customer Support Tools: Live chat and customer relationship management (CRM) software providers process communication records to enable efficient support delivery.
• Data Analytics Providers: Analytics platforms receive anonymized or pseudonymized usage data to help us understand player behavior and improve our platform (we do not share personally identifiable information for pure marketing analytics).
• Cloud Hosting and Infrastructure: Cloud service providers host our platform, databases, and backup systems—all data is encrypted both in transit and at rest.

All service providers are bound by strict confidentiality agreements and are contractually prohibited from using your information for any purpose other than providing services to apo138. We conduct due diligence to ensure service providers maintain adequate data security standards.

4.2 Legal and Regulatory Authorities

We may disclose your information to government authorities, regulators, and law enforcement when legally required or necessary to:

• Comply with court orders, subpoenas, or other legal processes
• Report suspicious activity to financial intelligence units as required by AML regulations
• Respond to lawful requests from gaming regulators or licensing authorities
• Cooperate with criminal investigations involving fraud, money laundering, or other illegal activity
• Protect the legal rights, safety, or property of apo138, our users, or the public

4.3 Business Transfers

In the event of a merger, acquisition, sale of assets, bankruptcy, or other business transfer involving apo138, your personal information may be transferred to the acquiring entity or successor. We will notify you via email and/or prominent notice on our platform before your information is transferred and becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information with third parties for purposes not described in this Privacy Policy if we obtain your explicit consent at the time of collection or sharing.

5. Data Security Measures

apo138 implements comprehensive technical, administrative, and physical security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. Our security framework includes:

5.1 Technical Safeguards

• Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption—the same standard used by Indonesian banks. Sensitive data stored in our databases (passwords, financial information, identification documents) is encrypted at rest using AES-256 encryption.
• Secure Payment Processing: We do not store full credit card numbers or CVV codes on our servers. All payment card transactions are processed through PCI-DSS compliant payment gateways that handle card data securely.
• Firewall Protection: Our servers are protected by enterprise-grade firewalls and intrusion detection/prevention systems that monitor and block malicious traffic.
• Access Controls: Internal access to personal data is restricted to authorized personnel only, on a need-to-know basis, and all access is logged for audit purposes.
• Two-Factor Authentication: Available for user accounts and mandatory for all apo138 staff accessing sensitive systems.
• Regular Security Audits: We conduct quarterly vulnerability assessments and annual penetration testing performed by independent third-party security firms.

5.2 Administrative Safeguards

• All apo138 employees and contractors sign confidentiality agreements and undergo data protection training
• We maintain written information security policies and incident response procedures
• Background checks are conducted for personnel with access to sensitive systems
• Regular security awareness training is provided to all staff to prevent social engineering attacks

5.3 Physical Safeguards

• Our data centers employ 24/7 physical security including access control systems, surveillance cameras, and security personnel
• Server rooms have environmental controls (fire suppression, climate control) to protect hardware
• Backup data is stored in geographically separate locations to ensure business continuity

5.4 Data Breach Response

While we implement robust security measures, no system is 100% secure. In the unlikely event of a data breach affecting your personal information, we will:

• Notify affected users via email to their registered address within 72 hours of breach discovery
• Provide details about what information was compromised and what actions we are taking
• Offer guidance on steps you can take to protect yourself (e.g., changing passwords, monitoring financial accounts)
• Report the breach to relevant regulatory authorities as required by law
• Conduct a thorough investigation to prevent future incidents

6. Data Retention

apo138 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements.

Specific Retention Periods

• Active Accounts: Personal information is retained for the duration of your account being active plus any period required by law after account closure.
• Financial Records: Transaction data, deposit/withdrawal records, and bet history are retained for a minimum of 7 years to comply with AML regulations and financial record-keeping requirements.
• KYC Documents: Identity verification documents are retained for 7 years after account closure as required by international AML standards and gaming licensing regulations.
• Communication Records: Customer support interactions are retained for 3 years for quality assurance and dispute resolution purposes.
• Marketing Data: If you opt out of marketing communications, we retain a suppression record indefinitely to ensure we do not contact you again.
• Responsible Gaming Records: Self-exclusion requests and related documentation are retained permanently to honor your self-exclusion even if you attempt to reopen an account in the future.

After the applicable retention period expires, we securely delete or anonymize your personal information so it can no longer be associated with you.

7. Your Privacy Rights

Under international data protection principles and applicable Indonesian privacy laws, you have the following rights regarding your personal information:

7.1 Right to Access

You have the right to request a copy of the personal information we hold about you. To request access, contact our customer support team. We will provide the information in a commonly used electronic format within 30 days of verification of your identity. There is no charge for your first request each year; we may charge a reasonable administrative fee for subsequent requests.

7.2 Right to Rectification

If your personal information is inaccurate or incomplete, you have the right to request corrections. You can update most information directly through your account settings (email address, phone number, residential address). For changes to name, date of birth, or other verified identity information, contact customer support with supporting documentation.

7.3 Right to Deletion ("Right to Be Forgotten")

You may request deletion of your personal information in certain circumstances. However, this right is not absolute—we must retain certain information to comply with legal obligations (e.g., AML record-keeping requirements mandate retaining financial records for 7 years). We will delete what we legally can and inform you if retention is required by law.

7.4 Right to Restrict Processing

You may request that we limit how we use your personal information in certain situations (e.g., if you contest the accuracy of the data or object to processing). During the restriction period, we will store your information but not use it for other purposes without your consent.

7.5 Right to Data Portability

You have the right to receive personal information you provided to us in a structured, machine-readable format and to transmit that data to another service provider where technically feasible.

7.6 Right to Object

You may object to processing of your personal information for direct marketing purposes at any time. To opt out of promotional emails, click the "unsubscribe" link in any marketing email or adjust your communication preferences in your account settings. You may also object to processing based on legitimate interests—we will cease processing unless we have compelling legitimate grounds that override your interests.

7.7 Right to Withdraw Consent

Where we process your information based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Note that if you withdraw consent for essential processing (e.g., identity verification), we may be unable to provide Services and may need to close your account.

7.8 Right to Lodge a Complaint

If you believe we have mishandled your personal information, you have the right to lodge a complaint with a data protection supervisory authority in your jurisdiction.

Exercising Your Rights: To exercise any of these rights, contact us via email at [email protected] or through customer support. We will verify your identity (to prevent fraudulent requests) and respond within 30 days.

8. Cookies and Tracking Technologies

apo138 uses cookies and similar tracking technologies to enhance your experience, improve platform functionality, and gather usage analytics. This section explains what cookies are, how we use them, and how you can control them.

8.1 What Are Cookies

Cookies are small text files stored on your device by your web browser when you visit a website. Cookies allow websites to recognize your device, remember your preferences, and track your activity across sessions.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for platform operation. These cookies enable core functionality like account login, secure session management, payment processing, and fraud prevention. You cannot disable these cookies without impacting platform functionality.
• Functional Cookies: Remember your preferences (language selection, display settings, bet slip preferences) to personalize your experience. These improve usability but are not strictly necessary.
• Performance and Analytics Cookies: Collect anonymous information about how visitors use apo138 (most visited pages, most played games, average session duration, bounce rates). This helps us optimize platform performance and user experience. We use first-party analytics and do not share this data with advertising networks.
• Security Cookies: Help detect fraudulent activity, prevent unauthorized access, and enforce security policies. These cookies track device fingerprints and suspicious behavior patterns.

8.3 Third-Party Cookies

Some cookies are placed by third-party service providers integrated into our platform:

• Game providers (Evolution Gaming, Pragmatic Play, etc.) use cookies to deliver game content and track game sessions
• Payment processors may use cookies during the checkout process
• Customer support tools (live chat) use cookies to maintain conversation context

8.4 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to block all cookies, accept only first-party cookies, or delete existing cookies. However, disabling necessary cookies will prevent you from using essential apo138 features including logging in, placing bets, and processing payments. Instructions for managing cookies in common browsers:

• Chrome: Settings > Privacy and security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Privacy, search, and services > Cookies and site permissions

8.5 Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) signal. Currently, there is no industry consensus on how to respond to DNT signals. apo138 does not currently respond to DNT signals, but we limit tracking to what is necessary for platform operation and do not share personal browsing data with advertising networks.

9. Third-Party Services

apo138 integrates third-party services including game providers, payment processors, and customer support tools. While we carefully vet all partners, we are not responsible for the privacy practices of third parties. Third-party services are governed by their own privacy policies, not this apo138 Privacy Policy.

We encourage you to review the privacy policies of third-party services you interact with, particularly payment providers and game studios. We do not share more information with third parties than is necessary to deliver their services.

10. International Data Transfers

apo138 operates an international online gaming platform. Your personal information may be transferred to and processed in countries outside Indonesia where our servers, service providers, or business partners are located. These countries may have data protection laws different from Indonesian law.

When we transfer personal information internationally, we implement appropriate safeguards to protect your data including:

• Ensuring service providers in foreign jurisdictions have adequate data protection measures in place
• Using standard contractual clauses approved by data protection authorities
• Encrypting data during transfer and storage
• Limiting data transfers to what is necessary for service delivery

By using apo138 Services, you consent to the international transfer of your personal information as described in this Privacy Policy.

11. Children's Privacy

apo138 Services are intended exclusively for adults aged 21 years or older. We do not knowingly collect personal information from individuals under 21. Our Terms and Conditions explicitly prohibit underage gambling.

During the KYC verification process, we verify all users' ages through government-issued identification documents. If we discover that a user is under 21, we will immediately suspend the account, void all bets, and refund deposited funds (winnings will be forfeited). Personal information of underage individuals discovered on our platform will be deleted promptly.

If you are a parent or guardian and believe your child has provided personal information to apo138, please contact us immediately at [email protected] so we can take appropriate action.

12. Changes to This Privacy Policy

apo138 reserves the right to update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Send notification to your registered email address at least 30 days before changes take effect
• Display a prominent notice on our platform
• For significant changes affecting how we use personal information, request your renewed consent where legally required

We encourage you to review this Privacy Policy periodically. Continued use of apo138 Services after changes take effect constitutes your acceptance of the updated Privacy Policy.

13. Contact Us About Privacy

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through the following channels:

• Privacy Inquiries Email: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 through the website
• WhatsApp: +62 812 3456 7890 (08:00-24:00 WIB)

For formal data subject access requests, deletion requests, or complaints, please use the dedicated privacy email address to ensure your request is routed to our data protection team. We will respond to all privacy inquiries within 30 days.