Privacy Policy — bo188

1.1   bo188 (referred to in this policy as "bo188", "we", "us", or "our") operates the online betting and gaming platform accessible at bo188.vip. We are committed to protecting the privacy and personal data of all individuals who interact with our platform, including registered players, prospective players who browse without registering, and individuals who contact our support team.

1.2   This Privacy Policy applies to all personal data processed by bo188 in connection with the operation of the bo188 platform and its associated services, including the sportsbook, live casino, slot games, togel (Indonesia's traditional numbers lottery), and all other products offered under the bo188 brand.

1.3   This policy applies to all players and users accessing the bo188 platform from Indonesia, including those in Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Makassar, and all other cities and regions across the Indonesian archipelago. Players accessing from other locations are subject to the same policy.

1.4   This policy does not apply to third-party websites or services that may be referenced on the bo188 platform. bo188 is not responsible for the privacy practices of third parties. If you follow a link to an external site, you should review that site's own privacy notice before providing any personal data.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

3.1   bo188 collects the following categories of personal data, depending on how you interact with the platform:

3.2   bo188 does not collect or store full payment card numbers. Where card-based payment options are offered, all card data is handled directly by the relevant payment processor under their own PCI-DSS compliant environment. bo188 receives only a transaction confirmation token and masked card details (last four digits) for record-keeping purposes.

3.3   You are not obligated to provide all categories of data listed above. However, certain data — particularly registration data, KYC data, and financial data — is mandatory for access to specific platform features. Failure to provide mandatory data will limit or prevent access to those features.

4.1   bo188 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide voluntarily during registration, KYC verification, payment setup, support interactions, or when completing any form on the platform.
• Automated collection: Technical and behavioural data collected automatically when you access the platform, via server logs, cookies, and similar tracking technologies (see Section 10 for full cookie details).
• Transaction processing: Financial data received from payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and others) as part of the deposit and withdrawal process.
• Third-party verification: Where bo188 engages a third-party identity verification provider to cross-check KYC documents, that provider may supply additional verification signals (e.g., document authenticity score) to bo188.
• Responsible gaming tools: Settings and preferences you configure within bo188's responsible gaming features, including deposit limits and self-exclusion requests.

4.2   bo188 does not purchase or obtain personal data from data brokers or independent marketing list providers. All personal data processed by bo188 is either provided directly by you or generated through your use of the platform.

5.1   bo188 uses personal data for the following purposes:

5.2   bo188 does not use personal data for automated decision-making that produces legal or similarly significant effects on players, except where such processing is required for fraud prevention or regulatory compliance — in which case you have the right to request human review of any automated decision that affects your account. Contact bo188 support to exercise this right.

6.1   bo188 processes personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to deliver the services you have signed up for, including account management, payment processing, and game delivery. Without this processing, bo188 cannot provide its services.
• Legal obligation: Processing necessary to comply with applicable legal requirements, including anti-money laundering obligations, age verification requirements, and responses to valid legal orders from competent authorities.
• Legitimate interests: Processing carried out to pursue bo188's legitimate business interests — including fraud prevention, platform security, and platform improvement — where those interests are not overridden by your rights and interests.
• Consent: Processing for purposes that go beyond what is strictly necessary to deliver the services, including the sending of personalised promotional communications. You may withdraw consent at any time by contacting bo188 support, without affecting the lawfulness of any prior processing.

6.2   Where bo188 relies on consent as the basis for a specific processing activity, you will be asked to provide that consent clearly and separately before the relevant processing begins. Consent is never bundled into the general acceptance of these Terms & Conditions.

7.1   bo188 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Personal data is shared only in the following limited circumstances:

• Payment processors: Financial data is shared with the relevant bank or e-wallet provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) to the extent necessary to process your deposit or withdrawal transaction.
• Identity verification providers: KYC data may be shared with a third-party verification service engaged by bo188 to authenticate your identity documents. That provider operates under a data processing agreement with bo188 and is prohibited from using your data for any other purpose.
• Game content providers: Your account identifier and relevant session data may be shared with licensed game studios (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe, and others) to the extent necessary to deliver and record game sessions. These studios do not receive your full identity or financial data.
• Cloud infrastructure providers: bo188's platform is hosted on secure cloud infrastructure. The hosting provider processes data on bo188's behalf under a contractual data processing agreement and has no independent right to access or use your data.
• Legal and regulatory authorities: bo188 will disclose personal data to competent authorities where required to do so by a valid legal order, court order, or regulatory requirement. bo188 will notify you of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of bo188's business or assets, personal data held by bo188 may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the identity of the new data controller before the transfer takes effect.

7.2   All third-party data processors engaged by bo188 are required to implement appropriate technical and organisational security measures and to process personal data only in accordance with bo188's written instructions.

8.1   bo188 may transfer personal data to servers or data processors located outside Indonesia. Where such transfers occur, bo188 ensures that appropriate safeguards are in place to protect the transferred data, including contractual clauses that impose equivalent data protection obligations on the recipient.

8.2   By registering an account with bo188, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Indonesia where bo188's infrastructure or processing partners are located, subject to the safeguards described in this section.

9.1   bo188 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following general retention periods apply:

9.2   On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (from which no individual can be identified) may be retained indefinitely for statistical and platform improvement purposes.

10.1   bo188 uses cookies and similar technologies (including local storage and session tokens) on its platform. Cookies are small data files placed on your device that help bo188 operate the platform efficiently and analyse how it is used.

10.2   bo188 uses the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language selection and responsible gaming settings. These persist across sessions to improve your experience.
• Analytics cookies: Collect anonymised data about how players navigate the platform — including pages visited, session duration, and feature usage — to help bo188 improve its products. No personally identifiable information is collected by analytics cookies.
• Security cookies: Used by bo188's fraud and risk management systems to detect unusual access patterns and protect your account from unauthorised access.

10.3   bo188 does not use third-party advertising cookies or behavioural retargeting technologies that track your activity across other websites.

10.4   You may configure your browser to block or delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to your bo188 account. Blocking functional cookies may result in your preferences not being saved between sessions. Blocking analytics cookies has no impact on your ability to use the platform.

11.1   bo188 implements the following technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, or disclosure:

• 256-bit SSL/TLS encryption applied to all pages and all data in transit between your device and bo188's servers.
• AES-256 encryption for sensitive data at rest, including KYC documents, identity numbers, and financial account details.
• Bcrypt password hashing — passwords are never stored in plain text and cannot be recovered by bo188 staff. If you forget your password, a reset process is initiated rather than a recovery of the original credential.
• Role-based access controls — bo188 staff access to player data is restricted on a strict need-to-know basis. Access logs are maintained and reviewed regularly.
• Intrusion detection and DDoS mitigation systems monitor the platform continuously for anomalous traffic and access patterns.
• Regular security audits conducted by qualified independent security professionals to identify and remediate vulnerabilities.
• Secure data centre facilities with physical access controls, CCTV monitoring, and environmental protections for hardware infrastructure.

11.2   While bo188 maintains robust security practices, no system can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and interests, bo188 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

12.1   As a bo188 player whose personal data we process, you hold the following rights with respect to your data. To exercise any of these rights, contact bo188's support team via live chat or at [email protected] (plain text — not a clickable link):

• Right of access: You may request a copy of the personal data bo188 holds about you. bo188 will respond within 30 days of a valid request.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some data (e.g., KTP information) can only be corrected following re-submission of valid identity documents.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to bo188's legal retention obligations. Note that financial transaction records must be retained for regulatory compliance periods regardless of erasure requests.
• Right to restrict processing: You may request that bo188 restricts the processing of your data in certain circumstances, such as while a rectification request is being resolved.
• Right to data portability: You may request that bo188 provides your personal data in a structured, machine-readable format so that it can be transferred to another service provider.
• Right to object: You may object to the processing of your personal data where bo188 relies on legitimate interests as the legal basis. bo188 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

12.2   bo188 will respond to all valid data rights requests within 30 calendar days. In cases of complexity or high volume, this period may be extended by a further 30 days, in which case you will be notified of the extension and the reason for it.

12.3   bo188 will not charge a fee for exercising any data rights, except where requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may be applied.

13.1   bo188's platform and services are strictly intended for adults aged 21 and over. bo188 does not knowingly collect personal data from any individual under the age of 21. The minimum age requirement of 21 applies to all players regardless of the laws of the jurisdiction from which they access the platform.

13.2   If bo188 discovers or is notified that an account has been registered by an individual under the age of 21, that account will be immediately closed, all pending transactions will be reversed where possible, and all data associated with that account will be deleted from bo188's systems as promptly as practicable, subject only to any legal obligations that require retention.

13.3   If you are a parent or guardian and believe that your child has registered an account with bo188, please contact us immediately via live chat or at [email protected]. We will investigate and act without delay.

14.1   bo188 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. Material changes — those that significantly affect how your data is collected, used, or shared — will be communicated to registered players via the mobile number or email address on file at least 7 days before the change takes effect.

14.2   Minor amendments, such as clarifications of existing provisions or corrections of typographical errors, may be made without advance notice. The "Last Updated" date displayed at the top of this page will always reflect the date of the most recent revision.

14.3   Your continued use of the bo188 platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes, you must close your account and cease using the platform before the effective date of the revision.

15.1   For any questions, concerns, or requests relating to this Privacy Policy or to the personal data bo188 holds about you, please contact bo188's support team through any of the following channels:

• Live Chat: Available 24/7 on the bo188 platform — fastest response channel, average reply time under 60 seconds.
• Email: [email protected] — responses within 24 hours. For formal data rights requests, please use the subject line "Privacy Request" to ensure correct routing.
• Coverage: Our support team is staffed 24 hours a day, 7 days a week, serving players across WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones.

15.2   If you are not satisfied with bo188's response to a privacy concern or data rights request, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction in which you are based or in which the alleged breach occurred.