Privacy Policy

For the purposes of this Privacy Policy, the following definitions apply throughout this document:

• "big138" / "we" / "us" / "our" — the online gaming platform accessible at https://big138.cam and its operating entity.
• "Member" / "User" / "you" — any natural person who has registered or is in the process of registering an account on big138.
• "Personal Data" — any information that identifies or can reasonably identify a natural person, directly or indirectly, including name, email address, national identity number, IP address, and payment details.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, transmission, and deletion.
• "KYC" — Know Your Customer; the mandatory identity verification process required before withdrawal privileges are activated.
• "Cookies" — small text files placed on your device by the big138 platform to maintain session state and collect usage analytics.
• "Third-Party Processors" — external service providers that process personal data on behalf of big138 under strict data processing agreements, including payment gateway operators and fraud detection providers.
• "Policy" — this Privacy Policy document in its current and any future amended versions.

big138 collects personal data in the following categories, depending on the nature of your interaction with the platform:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, beyond what is strictly necessary for responsible gaming assessments.

big138 collects personal data through the following channels:

• Direct Submission: Data you actively provide during registration, KYC document upload, deposit or withdrawal requests, and customer support interactions.
• Automated Collection: Technical and usage data collected automatically via cookies, server logs, and analytics tools when you access and navigate the big138 platform.
• Third-Party Sources: Identity verification results from KYC processing partners; fraud risk scores from anti-fraud service providers; payment confirmation data from local bank gateway operators (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others).
• Responsible Gaming Assessments: Self-reported information you provide when setting deposit limits, requesting time-outs, or initiating self-exclusion through our responsible gaming tools.

big138 processes personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your Member account, including authentication and access control.
• Identity Verification (KYC): Confirming your age (21+), identity, and Indonesian residency in compliance with our anti-money laundering obligations.
• Payment Processing: Facilitating IDR deposits and withdrawals through your nominated Indonesian bank account or e-wallet, and maintaining an accurate transaction history.
• Fraud Prevention & Security: Detecting, investigating, and preventing unauthorized account access, fraudulent transactions, bonus abuse, and other prohibited activities.
• Regulatory Compliance: Meeting our obligations under applicable international anti-money laundering (AML) and know-your-customer (KYC) regulations.
• Responsible Gaming: Monitoring play patterns to identify potential problem gambling behavior; enforcing deposit limits, time-outs, and self-exclusion requests.
• Customer Support: Responding to your inquiries, complaints, and account requests through live chat, WhatsApp, and email.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve platform performance, game selection, and user experience.
• Promotional Communications: Sending you relevant bonus offers, promotions, and platform updates, where you have opted in to receive such communications.

big138 processes personal data on the following legal bases, depending on the specific purpose:

• Contractual Necessity: Processing required to perform our contract with you — including account creation, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable AML, KYC, and data retention laws under the international licensing framework governing big138's operations.
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregated analytics, where our legitimate interests are not overridden by your data protection rights.
• Consent: Processing for promotional communications and non-essential cookies, where you have provided explicit, freely given consent. You may withdraw consent at any time by contacting our support team or adjusting your communication preferences in your account settings.

big138 does not sell or rent your personal data to any third party. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and under contractual data protection obligations:

• KYC & Identity Verification Providers: Specialist third-party providers that process identity documents and verify Member eligibility on our behalf.
• Payment Gateway Partners: Indonesian local bank gateway operators and e-wallet intermediaries (including those connected to BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) that process your deposit and withdrawal transactions.
• Fraud Detection Services: Third-party fraud risk assessment providers that analyze transaction and behavioral data to identify suspicious activity.
• IT & Hosting Infrastructure Providers: Secure cloud hosting and infrastructure partners that store and process platform data under strict confidentiality agreements.
• Regulatory Authorities: Competent regulatory or law enforcement authorities, where big138 is legally required to disclose personal data in connection with a lawful investigation or compliance audit.

All third-party processors engaged by big138 are bound by data processing agreements that prohibit them from using your data for any purpose other than the specific service they provide to us.

big138 uses the following categories of cookies and similar technologies on the platform:

big138 does not use third-party advertising or retargeting cookies. No cross-site tracking of your browsing activity is performed by or on behalf of big138.

Most web browsers allow you to control cookie settings through your browser preferences. Disabling essential or security cookies may impair your ability to log in and use the platform.

big138 retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, or for as long as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your membership and for a period of 5 years following account closure, to comply with AML and financial record-keeping obligations.
• KYC Documents: Retained for 5 years from the date of submission or from the date of account closure, whichever is later.
• Transaction Records: Retained for 5 years from the date of each transaction, in compliance with anti-money laundering record-keeping requirements.
• Customer Support Records: Retained for 2 years from the date of the interaction, to support quality assurance and dispute resolution.
• Analytics Data: Anonymized and aggregated after 13 months from collection; the anonymized data may be retained indefinitely for statistical analysis.
• Promotional Consent Records: Retained for the duration of your consent and for 1 year after withdrawal of consent, as evidence of compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized using industry-standard data destruction methods.

big138 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted in transit.
• At-Rest Encryption: Databases containing personal and financial data are encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to personal data is restricted to authorized personnel on a strict need-to-know basis, with role-based access controls and multi-factor authentication enforced for all internal systems.
• Penetration Testing: Our infrastructure undergoes regular third-party security assessments and penetration tests to identify and remediate vulnerabilities.
• Incident Response: big138 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant authority within the timeframe required by applicable law.
• Staff Training: All personnel with access to personal data undergo regular data protection training and are bound by confidentiality obligations.

As a big138 Member, you hold the following rights regarding your personal data. To exercise any of these rights, please contact our support team — contact details are provided in Clause 15:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations under AML law.
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling, at any time. You may also withdraw consent for promotional communications at any time.
• Right Not to Be Subject to Automated Decisions: You have the right to request human review of any decision made about you solely through automated processing that significantly affects you.

We will respond to all valid data rights requests within 30 days of receipt. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it.

The big138 platform is strictly intended for adults aged 21 years and over. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process, and accounts found to belong to underage individuals are immediately closed.

If you believe that a minor has registered an account on big138 or that we have inadvertently collected personal data from a person under 21, please contact our support team immediately. We will investigate the matter promptly and delete any such data without undue delay.

big138 operates within an international technology infrastructure. As a result, your personal data may be processed on servers or by service providers located outside of Indonesia. Where such international transfers occur, big138 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual data processing agreements with all third-party processors that impose data protection obligations equivalent to those described in this Policy.
• Transfers to jurisdictions that provide an adequate level of data protection as recognized by internationally accepted standards.
• Implementation of standard contractual clauses or equivalent mechanisms where transfers to less-regulated jurisdictions are necessary for service delivery.

By registering on big138, you acknowledge and consent to the transfer of your personal data to our international infrastructure, subject to the safeguards described in this clause.

The big138 platform may contain references to or integrations with third-party services, such as game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others), payment providers, and sports data providers. These third-party services operate under their own privacy policies, which are independent of this Policy.

big138 is not responsible for the privacy practices or content of third-party services. We encourage you to review the privacy policies of any third-party service with which you interact in connection with the big138 platform.

big138 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will update the "Last Updated" date at the top of this page and, where practical, notify active Members via the email address associated with their account.

Your continued use of the big138 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you must cease using the platform and request account closure as described in our Terms & Conditions.

We recommend reviewing this Policy periodically — at a minimum, each time you provide new personal data to the platform or notice the "Last Updated" date has changed.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the big138 data protection team through any of the following channels:

• Live Chat: Available 24/7 directly through the big138 platform — the fastest channel for urgent data security concerns.
• WhatsApp: Contact details available on the platform's support page.
• Email: [email protected] — please include "Privacy Request" in the subject line for faster routing to our data protection team.

For formal data rights requests (access, rectification, erasure, portability, or objection), please submit your request in writing via email with your registered account email address and a clear description of your request. We will acknowledge receipt within 5 business days and provide a full response within 30 days.