Privacy Policy

1. Definitions

The following terms carry specific meanings throughout this Privacy Policy:

2. Data Controller

2.1 big228 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, big228 is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently in accordance with applicable data protection principles.

2.2 If you have any questions about how big228 handles your Personal Data, you may contact our dedicated privacy team at [email protected] with the subject line "Privacy Enquiry". We will acknowledge your enquiry within 48 hours and provide a substantive response within 10 business days.

3. Data We Collect

big228 collects the following categories of Personal Data from Members:

3.1 Identity and Registration Data

• Full legal name as it appears on your Indonesian National Identity Card (KTP);
• Date of birth and age verification information;
• Indonesian national identity number (NIK);
• Residential address (province, city, postal code);
• Username chosen at registration.

3.2 Contact Data

• Email address;
• Indonesian mobile phone number (WhatsApp-registered numbers may be used for account verification);
• Preferred communication channel (email, live chat).

3.3 Financial Data

• Bank account details (account name, account number, and bank name — BCA, BRI, BNI, Bank Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, or other accepted banks);
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja account numbers associated with the Member's registered phone number);
• Transaction history including deposit amounts, withdrawal requests, timestamps, and payment method used;
• Source-of-funds documentation where requested as part of enhanced due diligence.

3.4 KYC Verification Data

• Photographic copy of your KTP (front and back);
• Selfie photograph holding your KTP;
• Proof of address documents (utility bills, bank statements, or official correspondence);
• Any additional documents submitted in response to an enhanced verification request.

3.5 Technical and Usage Data

• IP address and approximate geographic location derived from IP;
• Device type, operating system, and browser type/version;
• Session timestamps, pages visited, and features accessed within the Platform;
• Game history, betting patterns, and wagering behaviour;
• Login timestamps, session duration, and logout records.

3.6 Communications Data

• Records of live chat conversations and email correspondence with our support team;
• Feedback, complaints, and dispute records;
• Marketing preference settings (opt-in / opt-out records for promotional emails and notifications).

4. How We Collect Data

big228 collects Personal Data through the following means:

• Directly from you: Information you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting customer support, or submitting a complaint;
• Automatically from your device: Technical data collected via cookies, server logs, and similar tracking technologies as you browse and use the Platform (see Clause 9);
• From third-party service providers: Identity verification agencies, payment processors, and fraud-prevention services may supply data to us as part of our compliance obligations;
• From publicly available sources: Where permitted by applicable law, big228 may supplement Member records with information from public databases for the purpose of fraud prevention and anti-money-laundering compliance.

5. Purpose & Legal Basis

big228 processes your Personal Data only where a valid legal basis exists. The table below sets out the primary purposes for which we process your data and the corresponding legal basis for each:

6. Data Sharing

6.1 Principle of Minimum Disclosure. big228 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share Personal Data only to the extent strictly necessary to operate the Platform and meet our legal obligations.

6.2 Categories of Recipients. Your Personal Data may be shared with the following categories of third parties:

• Payment processors and banking partners: BCA, BRI, BNI, Bank Mandiri, and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the account and transaction data necessary to process your deposits and withdrawals;
• Identity verification providers: Third-party KYC service agencies that assist in verifying Member identity documents and cross-referencing against fraud and sanctions databases;
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft receive pseudonymised Member identifiers necessary to deliver game content and record game outcomes;
• Technology and infrastructure providers: Cloud hosting, content delivery, and cybersecurity vendors that process data on big228's behalf under strict data-processing agreements;
• Legal and regulatory authorities: Government bodies, law enforcement agencies, or courts where big228 is required by law to disclose information — for example, in response to a lawful court order or regulatory investigation;
• Professional advisers: Lawyers, auditors, and accountants acting under professional confidentiality obligations who require access to Member data in the course of providing advice to big228.

6.3 Data-Processing Agreements. All third-party Data Processors engaged by big228 are required to enter into a written data-processing agreement that obliges them to process Personal Data only on big228's documented instructions and to maintain appropriate technical and organisational security measures.

7. Data Retention

7.1 Retention Periods. big228 retains your Personal Data only for as long as necessary to fulfil the purposes described in this Policy or as required by applicable law. The following standard retention periods apply:

7.2 Deletion. Upon expiry of the applicable retention period, big228 will securely delete or irreversibly anonymise your Personal Data so that it can no longer be associated with you as an individual.

8. Data Security

8.1 Technical Safeguards. big228 employs industry-standard technical measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• AES-256 encryption for sensitive Personal Data stored in our databases;
• Multi-factor authentication options for Member account access;
• Intrusion detection systems and real-time security monitoring;
• Regular third-party penetration testing and security audits.

8.2 Organisational Safeguards. Access to Member Personal Data within big228 is restricted on a strict need-to-know basis. All staff with access to Personal Data receive mandatory data-protection training. Access privileges are reviewed quarterly and revoked promptly upon changes in employment status.

8.3 Breach Notification. In the event of a data breach that is likely to result in a risk to your rights and freedoms, big228 will notify affected Members without undue delay and take all reasonable steps to contain the breach, assess its impact, and prevent recurrence.

9. Cookies & Tracking Technologies

9.1 What Are Cookies? Cookies are small text files placed on your device by the Platform when you visit. They allow big228 to recognise your device on return visits, remember your preferences, and gather analytics data about how you interact with the Platform.

9.2 Types of Cookies We Use. big228 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function correctly — these include session authentication tokens, security cookies, and load-balancing cookies. These cookies cannot be disabled without impairing your use of the Platform.
• Functional Cookies: Remember your preferences such as language settings, display options, and last-visited game categories. Disabling these cookies may reduce your personalised experience.
• Analytics Cookies: Collect aggregated, anonymised data about how Members navigate the Platform, which pages are most visited, and where technical errors occur. This data is used exclusively to improve Platform performance.
• Marketing Cookies: Used only where you have consented to receive personalised promotional content. These cookies help big228 deliver relevant bonus offers and game recommendations.

9.3 Managing Cookies. You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies will prevent you from logging into your big228 account. Disabling analytics or marketing cookies will not affect your ability to place bets or access games.

10. Your Data Rights

As a Member of big228, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request".

Response Timeline. big228 will respond to all data rights requests within 10 business days (WIB). Where a request is complex or voluminous, we may extend this period by a further 10 business days, in which case we will notify you of the extension and the reason for it.

11. Minors & Age Policy

11.1 The Platform is strictly for adults aged 21 years or older. big228 does not knowingly collect Personal Data from individuals under the age of 21. If we discover that a Member has provided false age information during registration, the account will be immediately suspended, any balances will be frozen pending investigation, and all Personal Data associated with that account will be securely deleted once the investigation is complete.

11.2 If you are a parent or guardian and believe that a minor in your care has registered an account with big228, please contact us immediately at [email protected]. We will investigate and take prompt action to close the account and remove all associated data.

12. Third-Party Services

12.1 The Platform integrates with third-party game providers, payment processors, and analytics tools. Each of these third parties operates under its own privacy policy and data-protection framework. big228 is not responsible for the privacy practices of third-party providers, and we encourage you to review their policies where relevant.

12.2 Game content providers such as Pragmatic Play, Evolution Gaming, Microgaming, and NetEnt may collect game-play data directly within their game clients. This data is subject to each provider's own data-processing terms. big228 contractually requires that all providers treat Member data in accordance with applicable data protection standards.

13. International Data Transfers

13.1 big228's primary operations serve Indonesian Members, and the majority of Personal Data is processed within data centres located in the Asia-Pacific region. However, certain third-party service providers — including cloud infrastructure providers and game content studios — may process data in jurisdictions outside Indonesia.

13.2 Where Personal Data is transferred internationally, big228 ensures that appropriate safeguards are in place, including contractual data-protection clauses equivalent in effect to recognised international standards, to ensure your Personal Data receives a level of protection consistent with this Policy.

14. Policy Amendments

14.1 big228 reserves the right to update this Privacy Policy at any time. When we make material changes, we will publish the revised Policy on this page with an updated "Last Updated" date and, where the changes are significant, notify Members by email at least 7 days before the changes take effect.

14.2 Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. We recommend reviewing this page at the start of each month to stay informed of any changes.

15. Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way big228 handles your Personal Data, please contact our privacy team using the details below:

• Email: [email protected] — subject line: "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 via the Platform
• Response Time: Email within 48 hours acknowledgement; substantive response within 10 business days (WIB)

We take all privacy complaints seriously and will work with you to reach a fair and timely resolution. If you remain unsatisfied with our response, you may have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.