Privacy Policy — bes808

Definitions

The following terms carry specific meanings throughout this Privacy Policy:

Data Controller Identity

bes808 acts as the Data Controller for all Personal Data collected through the Platform. bes808 is an internationally licensed online betting and casino operator. For all privacy-related enquiries, Data Subject requests, or complaints, Members should contact bes808 using the details provided in Section 13 of this Policy.

bes808 has appointed an internal Privacy Contact responsible for overseeing data protection compliance, handling Data Subject requests, and liaising with regulatory authorities where required. Contact details for the Privacy Contact are provided in Section 13.

Personal Data We Collect

3.1 Data You Provide Directly

bes808 collects the following categories of Personal Data when you register, transact, or communicate with us:

3.2 Data Collected Automatically

When you access the Platform, bes808 automatically collects technical and behavioural data, including:

• IP address and approximate geographic location;
• Device type, operating system, browser type, and version;
• Pages visited, time spent on each page, and click-path data;
• Session duration, login timestamps, and logout events;
• Wagering activity, game preferences, and deposit/withdrawal patterns;
• Cookies and similar tracking technologies (see Section 8).

3.3 Data from Third Parties

bes808 may receive Personal Data from third parties in limited circumstances, including: identity verification agencies confirming KTP authenticity, payment processors confirming transaction details, and fraud-detection partners flagging suspicious activity. All third-party data sources are bound by their own privacy obligations and by contractual terms with bes808.

Purposes & Legal Basis for Processing

bes808 processes Personal Data only for specified, explicit, and legitimate purposes. The table below summarises the primary processing activities and the legal basis for each:

Sharing Your Personal Data

bes808 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. Personal Data is shared only in the following limited, controlled circumstances:

5.1 Service Providers (Data Processors)

bes808 engages trusted third-party service providers to assist in delivering the Platform, including payment processors (such as bank API partners for BCA, BRI, BNI, and Mandiri transfers), identity verification services, fraud detection vendors, cloud infrastructure providers, and customer support software vendors. All Data Processors operate under binding data processing agreements that restrict their use of your data to the specific purpose for which it was shared.

5.2 Regulatory & Legal Disclosures

bes808 may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts when required to do so by applicable law, valid legal process, or to protect the rights, property, or safety of bes808, its Members, or the public. Such disclosures are made only to the extent strictly necessary.

5.3 Corporate Transactions

In the event of a merger, acquisition, asset sale, or similar corporate restructuring, Personal Data held by bes808 may be transferred to the successor entity. Affected Members will be notified of any such transfer via registered email no later than 30 days prior to the completion of the transaction.

Data Retention

bes808 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and identity data: retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements;
• Transaction and financial records: retained for a minimum of seven (7) years from the date of the transaction;
• Customer support records: retained for three (3) years from the date of the last interaction;
• Technical and analytical data: retained in anonymised or aggregated form indefinitely for platform improvement purposes; identifiable technical logs retained for a maximum of twelve (12) months;
• Marketing consent records: retained for the duration of the marketing relationship plus two (2) years following opt-out, to demonstrate compliance.

At the end of any applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Members may request early deletion of certain data categories subject to the limitations described in Section 10.

Security Measures

bes808 implements a layered security architecture to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. Key measures include:

• 256-bit TLS encryption on all data in transit between your device and bes808 servers;
• AES-256 encryption for sensitive data at rest, including identity documents and financial records;
• Two-factor authentication (2FA) available on all Member accounts;
• Role-based access controls ensuring that only authorised personnel with a demonstrated need can access specific categories of Personal Data;
• Regular penetration testing and vulnerability assessments conducted by independent third-party security firms;
• Intrusion detection systems monitoring platform activity in real time for anomalous behaviour;
• Annual independent data security audits aligned with international security standards.

Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device by a web server. bes808 uses cookies and similar technologies (e.g., local storage, session tokens) to operate the Platform, remember your preferences, and understand how Members interact with bes808 content.

8.2 Categories of Cookies Used

bes808 does not use third-party advertising cookies or cross-site behavioural tracking cookies. You may manage or delete cookies via your browser settings; however, disabling strictly necessary cookies will impair Platform functionality.

International Data Transfers

bes808 operates on globally distributed infrastructure. As a result, your Personal Data may be transferred to and stored on servers located outside of Indonesia. Where such transfers occur, bes808 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules governing intra-group data transfers;
• Transfers to jurisdictions assessed as providing an adequate level of data protection.

By using bes808, you acknowledge that your Personal Data may be processed in jurisdictions outside Indonesia. bes808 will always take reasonable steps to ensure that such transfers maintain the same standard of protection described in this Privacy Policy.

Your Data Rights

As a Member of bes808, you have the following rights in relation to your Personal Data. Requests may be submitted to the Privacy Contact detailed in Section 13. bes808 will respond within 30 calendar days of receiving a valid, verified request.

• Right of Access: You may request a copy of the Personal Data bes808 holds about you, along with information about how it is being processed.
• Right of Rectification: You may request correction of inaccurate or incomplete Personal Data. Many account details can be updated directly via your account settings.
• Right of Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. This right is subject to overriding legal obligations (e.g., AML record-keeping requirements).
• Right to Restrict Processing: You may request that bes808 restricts processing of your Personal Data in certain circumstances, such as while the accuracy of the data is contested.
• Right to Data Portability: You may request that bes808 provides your Personal Data in a structured, commonly used, machine-readable format for transfer to another controller.
• Right to Object: You may object to processing carried out on the basis of legitimate interest. Marketing processing will be stopped immediately upon objection.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.

Minors

bes808 strictly prohibits access to and use of the Platform by any individual under the age of 21. bes808 does not knowingly collect Personal Data from persons under 21. If bes808 discovers that Personal Data has been collected from an individual who is, or appears to be, under 21, all associated data will be immediately deleted and the account closed without refund beyond the return of original deposit funds.

If you believe that bes808 may have inadvertently collected data from a minor, please contact our Privacy Contact immediately at the address in Section 13.

Amendments to This Privacy Policy

bes808 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. Where amendments are material, bes808 will notify registered Members via in-platform notification or to the email address on the account, no less than seven (7) days before the revised Policy takes effect.

The "Last Updated" date at the top of this page reflects when the current version came into effect. Continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you do not accept the updated terms, you must cease using the Platform and contact support to close your account.

Contact & Complaints

For all privacy-related enquiries, Data Subject requests, or complaints, please contact the bes808 Privacy Contact through the following channels:

• Email (Privacy): [email protected] — subject line: "Privacy Request" (plain text — not a clickable link)
• Live Chat: Available 24/7 via the Platform interface — ask to be connected to the Privacy team
• FAQ: Common privacy questions are addressed in our FAQ page

bes808 aims to acknowledge all privacy-related enquiries within two (2) WIB business days and to resolve them fully within thirty (30) calendar days. Where a request is particularly complex or where we receive a high volume of requests, we may extend this period by up to a further sixty (60) days, with prior notification to you.

If you are not satisfied with bes808's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. bes808 will cooperate fully with any such supervisory authority.