idn678 Privacy Policy

This Privacy Policy applies to all personal data collected, processed, and stored by idn678 in connection with the operation of the platform accessible at https://idn678.pro and any related mobile or desktop applications. It applies to all registered members, prospective members who submit data during a partial registration, and visitors who browse the platform without registering.

For the purposes of this Privacy Policy, idn678 acts as the data controller — meaning idn678 determines the purposes and means by which your personal data is processed. Where idn678 engages third-party processors (such as payment service providers or KYC verification vendors), those processors act strictly under written data processing agreements that bind them to handle your data only on idn678's instructions and in accordance with applicable data protection standards.

idn678 collects personal data through several channels: directly from you when you register or interact with the platform, automatically through your use of the platform, and from third parties where permitted by law.

When you create an idn678 account, you are required to provide:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (to verify you are 21 or older)
• Indonesian National Identity Number (NIK — Nomor Induk Kependudukan) or passport number for non-citizen residents
• Residential address in Indonesia
• Mobile phone number
• Email address
• Chosen username and a password (passwords are stored as salted cryptographic hashes — idn678 never stores plaintext passwords)

Before processing your first withdrawal, or at any other point idn678 reasonably requires identity verification, you may be asked to provide:

• A clear photograph or scanned copy of your KTP (Kartu Tanda Penduduk) or valid passport
• A selfie holding your ID document alongside a handwritten note bearing the current date and "idn678", if requested
• Proof of your payment method (e.g., a screenshot showing your name, bank account number, or e-wallet account registered with BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja)
• In higher-risk cases, proof of source of funds (e.g., salary slip, bank statement)

Every deposit, withdrawal, bonus claim, bet placement, game round, and balance adjustment on your idn678 account generates a transaction record. This includes:

• Transaction amount in Indonesian Rupiah (IDR / Rp)
• Payment method used (bank name and masked account number, or e-wallet name)
• Timestamps (logged in WIB, UTC+7)
• Game identifiers, market identifiers, bet odds, and settlement outcomes

When you access idn678, our servers and analytics systems automatically record the following data:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Session duration, pages visited, buttons clicked, and navigation flow
• Referral URL (the page from which you arrived at idn678, if any)
• Error logs and crash reports

If you contact idn678 via live chat or email, we retain a record of that correspondence — including the content of messages, timestamps, and the agent who handled your enquiry — for quality assurance, training, and dispute resolution purposes.

idn678 does not collect, and has no legitimate use for, the following categories of data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, or data concerning health (beyond age verification). If you share any such information voluntarily through a chat or support message, idn678 will not process it for any secondary purpose.

idn678 processes your personal data for specific, documented purposes only. The table below maps each data category to its primary processing purpose:

idn678 may send you promotional communications — such as bonus offers, seasonal campaign notifications (e.g., Ramadhan promotions, Idul Fitri cashback events, Indonesian Independence Day specials), and new product announcements — by email or platform notification. You may opt out of non-essential marketing communications at any time by updating your notification preferences in your account settings or by contacting support. Opting out of marketing does not affect your receipt of transactional or account-essential communications.

idn678 analyses gameplay patterns, deposit frequency, and session duration data to identify early indicators of problem gambling behaviour. Where our responsible gaming algorithms flag a concern, a trained idn678 agent — including Indonesian-speaking staff — may reach out to check on the wellbeing of the affected member. This is a player-protection measure, not marketing. For more information, visit the idn678 Responsible Gaming page.

idn678 relies on one or more of the following legal bases when processing your personal data, consistent with internationally recognised data protection principles:

• Contractual necessity: Processing your registration data, transaction data, and KYC data is necessary to perform the contract between you and idn678 (i.e., to operate your account, accept your bets, process your deposits and withdrawals, and provide the gaming services you have signed up to receive).
• Legal obligation: idn678 is required to retain certain personal data — including identity documents and financial transaction records — to comply with AML regulations and international gaming compliance standards.
• Legitimate interests: idn678 processes technical and usage data on the basis of its legitimate interest in maintaining platform security, preventing fraud, improving service quality, and detecting responsible gaming concerns. idn678 has assessed that these legitimate interests do not override your fundamental privacy rights, given the measures in place to limit data access and retention.
• Consent: Where idn678 sends optional marketing communications, it does so on the basis of your consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

idn678 uses cookies and similar tracking technologies to operate the platform, remember your session, and measure platform performance. The categories of cookies used are as follows:

You can manage or delete cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to idn678. Disabling analytics or marketing cookies does not affect platform functionality.

idn678 does not sell or rent your personal data. We may share your data with the following categories of third parties, strictly for the purposes described:

• Payment processors: When you make a deposit or withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja, your transaction data is necessarily shared with the relevant payment service provider to complete the transfer. These providers operate under their own privacy policies and applicable financial regulations.
• KYC and identity verification vendors: idn678 may use regulated third-party identity verification services to authenticate identity documents submitted during KYC. These vendors receive only the minimum data necessary for verification and are bound by data processing agreements.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised session identifiers to deliver their game content to your browser. They do not receive your name, ID documents, or financial data.
• Platform infrastructure providers: Cloud hosting, CDN, and database services that underpin idn678's technical infrastructure. All such providers operate under strict data processing agreements and are selected on the basis of their security certifications.
• Law enforcement and regulatory bodies: idn678 will disclose personal data to competent authorities where required by a lawful order, court order, or where idn678 reasonably determines that disclosure is necessary to prevent imminent harm, investigate fraud, or fulfil AML reporting obligations.

idn678 retains personal data for no longer than is necessary for the purpose for which it was collected, taking into account legal, regulatory, and operational requirements. The following retention periods apply:

Once a retention period expires, idn678 securely deletes or anonymises the relevant data so that it can no longer be attributed to an identifiable individual.

As a member of idn678, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact idn678 support via live chat or email as described in Section 13.

• Right of access: You may request a copy of all personal data that idn678 holds about you. We will provide this within 30 days of a verified request, in a structured, machine-readable format where practicable.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. This includes updating your contact details, correcting a date-of-birth entry error, or updating your payment method records.
• Right to erasure ("right to be forgotten"): You may request that idn678 delete your personal data. This right applies where the data is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. The right to erasure does not apply where idn678 is required to retain data by law (e.g., AML retention requirements).
• Right to restriction of processing: You may request that idn678 temporarily suspend processing of your data — for example, while a dispute is being investigated — without requesting full deletion.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that idn678 provide your personal data in a portable, structured format so that you can transfer it to another service provider.
• Right to object: You may object to processing carried out on the basis of idn678's legitimate interests (see Section 4). idn678 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where idn678 processes data based on your consent (e.g., marketing emails), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.

idn678 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Security measures in place include:

• Encryption in transit: All data exchanged between your device and idn678's servers is encrypted using TLS 1.3. Our platform enforces HTTPS at all times; plain HTTP connections are automatically redirected.
• Encryption at rest: Sensitive data fields — including identity document copies, payment method details, and password hashes — are encrypted at rest using AES-256.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. idn678 staff are granted the minimum level of access required to perform their role. All access to personal data systems is logged and audited.
• Two-factor authentication (2FA): idn678 supports two-factor authentication for player accounts to reduce the risk of unauthorised logins. Members are strongly encouraged to enable 2FA in their account security settings.
• Penetration testing: idn678 conducts periodic third-party penetration testing of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed personal data breach that poses a risk to affected members, idn678 will notify affected users promptly and take immediate steps to contain the breach, investigate its cause, and prevent recurrence.

idn678 is strictly an adults-only platform. The minimum age requirement is 21 years. idn678 does not knowingly collect, process, or store personal data belonging to individuals under the age of 21.

If idn678 discovers, through KYC verification or any other means, that an account has been registered by a person under 21, the account will be immediately suspended, all pending bets voided, and any deposited funds returned to the verified payment method associated with the account — subject to identity verification of the true account holder.

If you are a parent or guardian and believe that a minor in your care has registered an account on idn678, please contact our support team immediately. We will prioritise the investigation and closure of any such account.

idn678 operates globally and may store or process your personal data on servers located outside Indonesia. When personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to the standards described in this policy, idn678 takes appropriate safeguards to ensure your data remains protected, including:

• Entering into data processing agreements with receiving parties that incorporate standard contractual clauses equivalent to international best practice
• Selecting hosting and infrastructure providers that hold internationally recognised security certifications (such as ISO 27001 and SOC 2 Type II)
• Applying technical controls (encryption, access restrictions) that remain in force regardless of where data is physically stored

By registering an idn678 account, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Indonesia, subject to the safeguards described above.

idn678 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform services. The "Last Updated" date at the top of this page indicates when the current version entered into effect.

When changes are material — meaning they significantly affect how your personal data is collected, used, or shared — idn678 will notify registered members via a platform notification or email at least 7 days before the revised policy takes effect. For minor or non-material changes (such as typographic corrections or clarifications that do not alter the substance of the policy), idn678 may update this page without a formal advance notice.

Your continued use of the idn678 platform after a revised Privacy Policy takes effect constitutes your acceptance of the revised terms. If you do not agree to a revised policy, you must cease using the platform and request account closure before the revised policy's effective date.

For any questions, concerns, or requests relating to this Privacy Policy or idn678's data practices, please contact us through the following channels:

• Live Chat: Available 24/7 via the idn678 platform after logging in. Our live chat team includes Indonesian-speaking agents on all shifts (WIB / WITA / WIT).
• Email: [email protected] — for written data rights requests and privacy complaints. We aim to respond within 24 hours and will resolve data rights requests within 30 days.

When submitting a data rights request by email, please include your registered idn678 username and the email address associated with your account so that we can verify your identity before processing the request. We may ask for additional verification if the nature of the request requires it.