Privacy Policy

1 Definitions

The following defined terms are used throughout this Policy. Terms not defined here carry the meanings given to them in the cer138 Terms & Conditions.

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including name, identification number, location data, online identifier, or factors specific to the physical, economic, cultural, or social identity of that person.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" means cer138, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of cer138, in accordance with the instructions of cer138.
• "Player" / "You" means any natural person who registers or uses an Account on the cer138 Platform.
• "Sensitive Data" means a special category of Personal Data including financial account details, identity document numbers, and any data that could facilitate unauthorised access to your funds or identity.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, analytics, and personalisation, as further described in Section 10.

2 Data Controller

cer138 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, cer138 is responsible for ensuring that your Personal Data is processed lawfully, fairly, and transparently, and that it is used only for the purposes described in this Policy.

Where cer138 engages third-party Data Processors — such as payment gateway operators, identity verification service providers, and cloud infrastructure partners — cer138 ensures that appropriate data processing agreements are in place that bind those processors to equivalent standards of data protection.

For all privacy-related inquiries, requests, or complaints, the designated contact is our Data Protection team, reachable at: [email protected] (plain text — please copy this address into your email client; it is not a clickable link).

3 Personal Data We Collect

cer138 collects Personal Data across several categories depending on the nature of your interaction with the Platform. The table below summarises the categories of data we may collect:

cer138 collects only the minimum Personal Data necessary to fulfil the stated purposes. We do not collect sensitive data categories such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond those required for identity verification as described above.

4 How We Collect Your Data

cer138 collects Personal Data through the following mechanisms:

• Direct Submission: When you register an Account, complete profile sections, update payment methods, or submit identity documents for KYC verification, you voluntarily provide Personal Data to cer138.
• Automated Collection: Technical Data (IP address, device fingerprint, browser information) is collected automatically through server logs and analytics tools whenever you access the Platform.
• Cookies & Similar Technologies: We use cookies, web beacons, and local storage to track session data, user preferences, and behavioural patterns for functionality and security purposes (detailed in Section 10).
• Third-Party Verification Services: When conducting KYC checks, cer138 may receive verification data from specialised identity verification providers or from your financial institution to confirm ownership of payment methods.
• Customer Support Channels: Any information you provide via live chat, email, or support ticket forms is collected and stored for service quality, dispute resolution, and regulatory record-keeping purposes.

5 Purposes & Legal Basis for Processing

cer138 processes your Personal Data for the following purposes, each of which is supported by one or more lawful bases under applicable data protection law:

cer138 will not use your Personal Data for purposes that are incompatible with those stated here without first obtaining your explicit consent or ensuring that a new lawful basis exists.

6 Data Retention

cer138 retains Personal Data only for as long as necessary to fulfil the purposes described in Section 5 or to comply with applicable legal and regulatory obligations. Our standard retention periods are as follows:

• Active Accounts: While your Account remains active, cer138 retains all associated Personal Data to enable ongoing service provision.
• Closed Accounts: After voluntary account closure or termination by cer138, identity and transaction data are retained for a minimum of 7 years to comply with anti-money laundering (AML) regulations and financial audit requirements applicable in Indonesia and internationally licensed gaming jurisdictions.
• Marketing Data: If you opt out of marketing communications, your contact details are moved to a suppression list (retained indefinitely to honour your opt-out preference) but are no longer used for promotional purposes.
• Technical & Behavioural Data: Aggregated, anonymised analytics data may be retained indefinitely for statistical and research purposes. Such data cannot be used to identify you personally.
• Support Communications: Chat transcripts and email correspondence are retained for 3 years from the date of the last interaction or until resolution of any related dispute, whichever is longer.

At the end of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with cer138's data destruction procedures.

7 Sharing & Disclosure

cer138 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share Personal Data only in the following limited circumstances:

• Service Providers (Data Processors): cer138 engages trusted third-party service providers to perform functions on our behalf, including payment processing (local bank integrations with BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Danamon; e-wallet integrations with OVO, DANA, GoPay, ShopeePay, LinkAja), identity verification (KYC providers), cloud hosting infrastructure, customer support software, and email delivery services. These providers are contractually bound to process your data only as instructed by cer138 and to maintain equivalent security standards.
• Game & Content Providers: When you play games from third-party studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, or others, limited technical data (session ID, bet amounts, game outcomes) may be shared with those providers to enable game functionality and ensure fairness. These providers do not have access to your identity or financial details beyond what is necessary for gameplay.
• Legal & Regulatory Authorities: cer138 may disclose Personal Data to law enforcement, regulatory bodies, or courts where required by law, court order, or in response to valid legal process, including investigations into suspected fraud, money laundering, or other criminal activity.
• Business Transfers: In the event of a merger, acquisition, reorganisation, or sale of assets, your Personal Data may be transferred to the acquiring entity, subject to the same protections outlined in this Policy.
• With Your Consent: In any other scenario not covered above, cer138 will seek your explicit consent before sharing your Personal Data with third parties.

8 International Data Transfers

cer138 operates as an internationally licensed platform serving Indonesian players. To provide efficient and secure services, some of your Personal Data may be transferred to, stored in, or processed in countries outside Indonesia — including jurisdictions where our cloud infrastructure providers, payment processors, or game studio partners are located.

Where data is transferred to countries that do not provide an equivalent level of data protection to Indonesia or European Economic Area (EEA) standards, cer138 ensures that appropriate safeguards are in place, including:

• Contractual data protection clauses equivalent to European Commission-approved Standard Contractual Clauses (SCCs);
• Engagement of processors certified under internationally recognised frameworks such as ISO 27001 for information security management;
• Technical measures including end-to-end encryption and pseudonymisation of sensitive data during transit and at rest.

You have the right to request further details about international data transfers, including copies of the safeguards we have implemented. Contact our Data Protection team at [email protected] (plain text address) for such requests.

9 Security Measures

cer138 takes the security of your Personal Data extremely seriously. We implement a comprehensive suite of technical and organisational measures designed to protect your data from unauthorised access, disclosure, alteration, or destruction:

• Encryption: All data transmitted between your device and our servers is encrypted using industry-standard TLS/SSL protocols (Transport Layer Security). Sensitive data at rest, including financial records and identity documents, is encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted to authorised personnel only, on a need-to-know basis. All staff members with data access undergo security training and are bound by strict confidentiality obligations.
• Network Security: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection systems (IDS), and real-time threat monitoring. Automated systems detect and block suspicious access patterns.
• Regular Audits: cer138 conducts regular internal security audits and engages independent third-party penetration testers to identify and remediate vulnerabilities.
• Secure Data Centres: Personal Data is stored in certified data centres that maintain physical security controls, including 24/7 surveillance, biometric access control, and environmental safeguards.
• Incident Response: In the unlikely event of a data breach that poses a risk to your rights and freedoms, cer138 will notify affected Players and relevant authorities in accordance with applicable breach notification laws, typically within 72 hours of detection.

While cer138 employs best-practice security measures, no internet-based platform can guarantee absolute security. You also play a critical role in protecting your data by maintaining the confidentiality of your login credentials, using strong and unique passwords, and notifying us immediately if you suspect unauthorised access to your Account.

10 Cookies & Tracking Technologies

cer138 uses cookies and similar technologies to enhance your experience on the Platform, maintain security, and analyse usage patterns. Cookies are small text files stored on your device that allow the Platform to remember your preferences and track session activity.

The types of cookies we use include:

• Strictly Necessary Cookies: Essential for Platform functionality, including authentication, session management, and security. These cookies cannot be disabled without severely impairing your ability to use the Platform.
• Performance Cookies: Collect anonymous data about how visitors use the Platform, including page views, time spent on pages, and navigation paths. This helps us optimise the user experience.
• Functional Cookies: Remember your preferences such as language selection, currency display, and game favourites to provide a more personalised experience.
• Targeting Cookies: Used to deliver relevant promotional content and track the effectiveness of marketing campaigns. These cookies may be set by third-party advertising partners, subject to your consent.

Most browsers allow you to manage cookie preferences through their settings. You can choose to block or delete cookies; however, doing so may limit your ability to use certain features of the Platform. Strictly necessary cookies will continue to function even if you block non-essential cookies.

11 Your Privacy Rights

Under applicable data protection laws — including Indonesia's data protection framework and principles derived from international best practices — you hold the following rights with respect to your Personal Data:

To exercise any of these rights, please contact our Data Protection team at [email protected] (plain text address — copy into your email client). We will respond to verified requests within 30 days. Certain requests may require identity verification to protect your data from unauthorised access.

12 Minors & Age Restriction

cer138 operates a strict 21+ policy. The Platform is intended exclusively for adults aged 21 years or older. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21.

During the registration and KYC verification process, cer138 requires Players to provide proof of age through government-issued identity documents. Any Account found to have been opened by a person under 21 will be immediately suspended, all gameplay will be voided, winnings will be forfeited, and the Account will be permanently closed.

If you are a parent or guardian and believe that your child has provided Personal Data to cer138, please contact us immediately at [email protected] so that we can take appropriate action to remove such data from our systems.

13 Third-Party Services

The cer138 Platform may contain links to third-party websites, services, or content providers (such as game studios or payment gateways). This Privacy Policy applies solely to cer138.cam and does not extend to any third-party service.

When you click through to a third-party website or interact with a third-party service (for example, when depositing via your bank's online portal or e-wallet app), that service's own privacy policy will govern the handling of your Personal Data. cer138 is not responsible for the privacy practices of third parties.

We encourage you to review the privacy policies of any third-party services you use in connection with the Platform, particularly payment providers and game studios.

14 Amendments to This Policy

cer138 reserves the right to update, modify, or replace any part of this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When material changes are made, the "Last Updated" date at the top of this page will be revised.

Where changes significantly affect your rights or how we process your Personal Data, cer138 will notify registered Players via email or through a prominent notice on the Platform. Your continued use of the Platform following notification of changes constitutes acceptance of the updated Policy.

We recommend that you review this Privacy Policy periodically to stay informed about how cer138 protects your data.

15 Contact & Data Requests

If you have any questions, concerns, or complaints about this Privacy Policy or about how cer138 processes your Personal Data, or if you wish to exercise any of your privacy rights described in Section 11, please contact our Data Protection team:

• Email: [email protected] (plain text — not a clickable link; please copy this address into your email client)
• Subject Line for Data Requests: Use "Privacy Request - [Your Account Username]" to ensure your inquiry is routed to the correct team.
• Response Time: Privacy-related inquiries and data subject requests are typically responded to within 30 days. Complex requests may require an extension, in which case we will notify you and provide an estimated completion date.

When submitting a data request, please include sufficient information to allow us to verify your identity and locate your Account records. This protects your Personal Data from unauthorised disclosure.