Privacy Policy

1. Definitions

The following definitions apply throughout this Privacy Policy:

• "bui138", "we", "us", or "our" refers to the bui138 online gaming platform and the entity operating it under international gaming license.
• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, email address, date of birth, phone number, bank account details, and IP address.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, or deletion.
• "User", "you", or "your" refers to any individual who registers or uses the bui138 platform.
• "Platform" refers to the bui138 website, mobile site, and all related services including sports betting, live casino, slots, and togel (Indonesia's traditional numbers lottery) products.
• "Third-Party Service Provider" means any company or individual employed by bui138 to perform services on our behalf, such as payment processors, identity verification providers, and game software studios.
• "Cookies" refers to small text files stored on your device by our platform to enable certain functionalities and collect analytics data.

2. Data We Collect

2.1 Data You Provide Directly

When you register an account, verify your identity, make a deposit or withdrawal, or contact our support team, you provide us with personal data. This includes:

• Identity data: Full legal name, date of birth, gender, nationality, and government-issued ID number (KTP or passport number)
• Contact data: Email address, phone number, and residential address (including city, province, and postal code within Indonesia)
• Financial data: Bank account details (bank name, account number, account holder name) for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, or e-wallet details for OVO, DANA, GoPay, ShopeePay, or LinkAja
• Verification documents: Copies of ID documents, proof of address, and proof of payment method submitted during KYC verification
• Communications data: Records of your correspondence with our customer support team via live chat, email, or WhatsApp

2.2 Data Collected Automatically

When you access and use the bui138 platform, we automatically collect certain technical and behavioral data:

• Device and technical data: IP address, device type, operating system version, browser type and version, screen resolution, and device identifiers
• Usage data: Pages visited, features used, time spent on pages, games played, bet amounts and frequencies, and navigation patterns within the platform
• Transaction data: Records of all deposits, withdrawals, bets placed, bonuses claimed, and game results associated with your account
• Location data: Approximate geographic location derived from your IP address, used to apply appropriate jurisdictional rules and detect potential fraud
• Session data: Login timestamps, session durations, and logout events for security monitoring purposes

2.3 Data from Third Parties

We may receive additional data about you from third-party sources to supplement the information held in your account:

• Identity verification providers: Results of automated document verification checks and biometric matching performed during KYC
• Fraud prevention services: Risk scores and flags from third-party fraud detection platforms that cross-reference your data against known fraud patterns
• Payment processors: Transaction confirmation data, chargeback alerts, and payment method validation results
• Responsible gaming databases: Where required by license conditions, we may check if you have self-excluded from other licensed platforms

3. How We Use Your Data

bui138 uses your personal data for the following purposes:

Purpose	Data Used	Legal Basis
Account registration and management	Identity data, contact data	Contract performance
Identity verification (KYC)	Identity data, verification documents	Legal obligation
Processing deposits and withdrawals	Financial data, transaction data	Contract performance
Fraud prevention and AML compliance	All categories	Legal obligation, legitimate interest
Customer support	Identity data, communications data	Contract performance
Responsible gaming monitoring	Usage data, transaction data	Legal obligation, legitimate interest
Promotional communications	Contact data, usage data	Consent
Platform analytics and improvement	Usage data, device data	Legitimate interest
Legal compliance and regulatory reporting	All categories	Legal obligation

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract performance: Processing necessary to register your account, execute bets, process payments, and deliver the services you have requested from bui138.
• Legal obligation: Processing required to comply with anti-money laundering (AML) regulations, Know Your Customer (KYC) obligations, responsible gaming requirements, and tax reporting duties imposed by our licensing jurisdiction.
• Legitimate interest: Processing for fraud detection, platform security, business analytics, and responsible gaming monitoring, where our interests do not override your fundamental rights.
• Consent: Processing for marketing communications and optional data sharing (e.g., receiving promotional emails or SMS about bonuses and events). You may withdraw consent at any time by contacting support or using account preference settings.

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

bui138 shares your personal data with trusted third-party service providers who assist in operating our platform. These include:

• Payment processors: BCA, BRI, BNI, Mandiri, and e-wallet operators (OVO, DANA, GoPay) receive transacti on details necessary to process your deposits and withdrawals.
• Identity verification providers: Specialist KYC platforms receive copies of your identity documents and biometric data solely for the purpose of verifying your identity.
• Game software providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and other licensed studios receive your account identifier (not your full personal profile) to enable gameplay and record game results.
• Fraud prevention platforms: Risk management and anti-fraud service providers receive limited data (IP address, device fingerprint, transaction patterns) to assess fraud risk.
• Customer support tools: Live chat and ticketing platform providers process your communications data to facilitate support interactions.
• Cloud infrastructure providers: Our hosting and database providers store encrypted versions of your data on secure servers in accordance with industry-standard data protection practices.

All third-party service providers are bound by data processing agreements that restrict their use of your data to the specific purpose for which it was shared, and require them to implement appropriate security measures.

5.2 Legal and Regulatory Disclosure

We may disclose your personal data to law enforcement agencies, regulatory authorities, or other government bodies if we are legally required to do so, or if we have a good-faith belief that disclosure is necessary to:

• Comply with a legal obligation or court order
• Investigate or report suspected money laundering or terrorist financing
• Protect the rights, property, or safety of bui138, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring involving bui138, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified via email and/or a prominent notice on the platform before your data becomes subject to a different privacy policy. The acquiring entity will be required to honor the commitments made in this policy.

5.4 What We Do Not Do

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy, and in accordance with applicable legal requirements. Our standard retention periods are as follows:

• Account data: Retained for the duration of your account, plus 5 years after account closure to comply with AML record-keeping requirements.
• Transaction data: Retained for 7 years from the date of each transaction in accordance with financial record-keeping obligations.
• KYC verification documents: Retained for 5 years after account closure or the last transaction, whichever is later.
• Customer support records: Retained for 3 years from the date of the last interaction.
• Marketing and communications data: Retained until you withdraw consent or for 2 years of inactivity, whichever comes first.
• Technical and usage logs: Typically retained for 12 months, after which they are anonymized or deleted.

When data is no longer required, it is securely deleted or anonymized so that it can no longer be associated with you as an individual. In some cases, we may retain anonymized aggregate data indefinitely for analytical purposes.

7. Security Measures

bui138 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, or disclosure:

7.1 Technical Safeguards

• SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.3 protocols. The padlock icon in your browser confirms an active encrypted connection.
• Data-at-rest encryption: Personal data and financial information stored in our databases is encrypted using AES-256 encryption.
• Two-factor authentication (2FA): We offer optional 2FA for account login, and require 2FA for withdrawal requests above specified thresholds.
• Firewall and intrusion detection: Our infrastructure is protected by enterprise-grade firewalls, web application firewalls (WAF), and real-time intrusion detection and prevention systems.
• DDoS protection: Distributed denial-of-service attack mitigation is in place to ensure platform availability and prevent disruption of security systems.

7.2 Organizational Safeguards

• Access controls: Access to personal data is restricted to employees and contractors who genuinely need it for their job functions. Role-based access controls and least-privilege principles are strictly enforced.
• Employee training: All staff who handle personal data receive regular training on data protection obligations, phishing awareness, and secure data handling procedures.
• Security audits: We conduct periodic internal and third-party security audits of our infrastructure, code, and data handling practices.
• Incident response: We maintain a documented data breach response plan. In the event of a breach affecting your personal data, we will notify you and relevant authorities within the timeframes required by our licensing obligations.

8. Cookies and Tracking Technologies

8.1 What Cookies We Use

The bui138 platform uses the following categories of cookies and similar tracking technologies:

• Essential cookies: Required for the platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing core functionality.
• Analytics cookies: Used to understand how users navigate and interact with the platform. Data collected is aggregated and anonymized. We use this information to improve platform performance and user experience.
• Preference cookies: Store your platform settings such as language preferences, display options, and odds format (decimal, fractional, or Hong Kong) so you do not have to reconfigure them on each visit.
• Fraud prevention cookies: Help us detect and prevent fraudulent activity by identifying unusual patterns in how the platform is accessed from your device.

8.2 Managing Cookies

You can control cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Please note that blocking essential cookies may prevent you from logging in or using core platform features. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.

9. Your Privacy Rights

As a user of the bui138 platform, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request – [Your Username]":

• Right of access: You may request a copy of all personal data we hold about you. We will provide this within 30 days of receiving your verified request.
• Right to rectification: If any of your personal data is inaccurate or incomplete, you may request that we correct or update it.
• Right to erasure: You may request deletion of your personal data. Note that this right is subject to exceptions — we may be required to retain certain data for legal or regulatory compliance reasons, as described in Section 6.
• Right to restrict processing: In certain circumstances, you may request that we limit how we use your data while a dispute or correction request is being resolved.
• Right to data portability: You may request a machine-readable copy of the personal data you have provided to us, which you can then transfer to another service provider.
• Right to object: You may object to processing of your data based on our legitimate interests, including for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

We will respond to all valid requests within 30 calendar days. In complex cases, we may extend this period by a further 60 days, and will notify you of any extension with an explanation.

10. Protection of Minors

The bui138 platform is strictly intended for adults aged 21 years or older. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you are not permitted to register an account or use our services.

If we become aware that we have collected personal data from a person under 21, we will immediately close the associated account, void any bets or transactions, and delete the data as required by law. If you believe a minor has registered on our platform, please contact us immediately at [email protected] so we can take prompt action.

Parents and guardians are encouraged to use parental control software and supervise their children's internet usage to prevent unauthorized access to online gambling platforms.

11. Cross-Border Data Transfers

bui138 operates with infrastructure and service providers across multiple countries. As a result, your personal data may be transferred to and processed in countries outside Indonesia. These countries may have different data protection laws than those applicable in your jurisdiction.

When we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Contractual clauses that bind the receiving entity to data protection standards equivalent to those described in this policy
• Transfers only to service providers that maintain internationally recognized security certifications (ISO 27001, SOC 2 Type II)
• Regular assessment of the data protection frameworks in destination countries

By using the bui138 platform, you acknowledge and consent to these international transfers of your personal data as described in this policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will:

• Update the "Effective Date" at the top of this document
• Notify registered users via email to the address on file
• Display a prominent notice on the platform for at least 14 days after the change takes effect

Your continued use of the bui138 platform after the effective date of the updated policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you should cease using the platform and may request account closure.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection team using the details below:

• Email: [email protected] (subject line: "Privacy Inquiry")
• Live Chat: Available 24/7 on the bui138 platform — ask to be connected to the Data Protection team
• Response time: We aim to acknowledge all privacy-related inquiries within 3 business days and provide a substantive response within 30 calendar days