gan98 Privacy Policy

1 Introduction

gan98 ("we", "us", "our", "the Platform") is an internationally licensed online sports betting and casino platform serving English-preference players across Indonesia. We are committed to protecting the privacy and personal data of every individual who interacts with our platform — whether as a registered Member, a visitor browsing our website, or a person who contacts our support team.

This Privacy Policy sets out, in plain and formal terms, what personal data we collect from you, the purposes for which that data is processed, the legal basis on which we rely, how long we retain your data, and what rights you hold in relation to that data. It applies to all data processing activities carried out by gan98 in connection with the website at https://gan98.cam and any associated services.

This policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. Where this Privacy Policy conflicts with any other document, this policy governs in respect of data protection matters.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that relates to an identified or identifiable natural person. This includes, but is not limited to, names, email addresses, identification document numbers, financial data, IP addresses, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, gan98.
• "Data Processor" means any third party that processes Personal Data on behalf of gan98 under a binding contractual agreement.
• "Member" means any individual who has completed the gan98 account registration process and holds an active account on the Platform.
• "KYC Data" means identity and age verification documents and associated data collected as part of the Know Your Customer process, including copies of national identity cards (KTP), passports, and proof of payment method.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including government-issued identification numbers and financial account details.

3 Data We Collect

gan98 collects the following categories of personal data:

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued ID.
• Date of birth (to verify you are at least 21 years of age).
• Email address and mobile telephone number.
• Username and encrypted password.
• City and province of residence within Indonesia (e.g., Jakarta, Surabaya, Bandung, Bali, Medan).
• Preferred language (English or Indonesian).

3.2 Identity Verification (KYC) Data

• Copy of Indonesian national identity card (KTP) or passport.
• Copy of driver's licence (SIM) where used as supplementary identification.
• Selfie photograph taken during the verification process, where required.
• Proof of ownership of the payment method used (e.g., bank account screenshot for BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI; or e-wallet account screenshot for OVO, DANA, GoPay, Sho peePay, LinkAja).

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and methods.
• Bank account numbers or e-wallet identifiers linked to your Account.
• Transaction reference numbers and processing timestamps (WIB, UTC+7).
• Wallet balance history and bonus credit records.

3.4 Betting & Gaming Activity Data

• Wager history including game type, market, stake, odds, and outcome.
• Session duration, login frequency, and active hours.
• Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status).
• Bonus claims, wagering requirement progress, and promotional redemptions.

3.5 Technical & Device Data

• IP address and approximate geographic location derived from IP.
• Device type, operating system, and browser version.
• Cookie identifiers and session tokens (see Section 7).
• Platform access logs including login timestamps and pages visited.

3.6 Communications Data

• Support tickets, live chat transcripts, and email correspondence with the gan98 support team.
• Survey responses and feedback submissions, where voluntarily provided.

4 How We Collect Data

gan98 collects personal data through the following channels:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact support, or respond to a survey.
• Automatically: When you browse or use the Platform, our servers and analytics tools automatically collect technical and device data, including IP address, session data, and cookie-based identifiers.
• From payment providers: When you initiate a deposit or withdrawal, our payment gateway partners (including local Indonesian bank transfer processors and e-wallet providers) share transaction confirmation data with us.
• From identity verification providers: Where we use a third-party KYC service to assist with document verification, that provider shares the verification outcome and associated metadata with us.
• From fraud prevention services: Our anti-fraud and AML screening tools may return data points about a transaction or account that we use in our risk assessment processes.

5 Purposes & Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. The table below summarises our primary processing purposes and the corresponding legal basis for each:

Where we rely on consent as the legal basis (primarily for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw marketing consent, contact us at [email protected].

6 Data Sharing

gan98 does not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process data on our behalf under written data-processing agreements. Categories of processors include:

• Payment processors: Indonesian bank transfer gateways and e-wallet processors (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate IDR deposits and withdrawals.
• KYC and identity verification providers: To assist with document authentication and age verification.
• Cloud hosting and infrastructure providers: To store and serve Platform data securely.
• Analytics providers: To analyse aggregated, pseudonymised Platform usage data for performance improvements.
• Fraud prevention and AML screening services: To identify and mitigate financial crime risk.
• Game content studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive session tokens and game-round data necessary to operate the games you play.

6.2 Legal and Regulatory Disclosure

We may disclose personal data to competent authorities, law enforcement agencies, or regulatory bodies where we are legally required to do so, including in connection with AML investigations, court orders, or regulatory audits. We will notify you of any such disclosure to the extent permitted by law.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of gan98's assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide reasonable notice of such a transfer and ensure the acquiring entity is bound by data protection obligations at least as stringent as those set out in this policy.

7 Cookies & Tracking Technologies

gan98 uses cookies and similar tracking technologies to operate the Platform, maintain session security, and understand aggregate usage patterns. We do not use third-party advertising cookies or retargeting pixels.

Strictly necessary cookies cannot be disabled as they are required for the Platform to function correctly. You may disable functional and analytics cookies via your browser settings; however, doing so may impair certain Platform features. Most modern browsers allow you to view, manage, and delete cookies through their privacy or settings menu.

8 International Data Transfers

As an internationally licensed platform, gan98 may transfer personal data to service providers located outside Indonesia. Where such transfers occur, we take the following safeguards to ensure your data receives an equivalent level of protection:

• We enter into standard contractual clauses or equivalent transfer mechanisms with all recipients of personal data outside Indonesia.
• We assess the data protection laws of the recipient country prior to any transfer and apply additional technical safeguards (such as encryption) where the recipient country's legal framework is assessed as offering lower protection than the standards set out in this policy.
• All international transfers of KYC Data and financial data are encrypted in transit using TLS 1.3 or higher.

9 Data Retention

gan98 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, or for as long as required by applicable law, whichever is longer. Our standard retention periods are:

• Active Account Data: Retained for the duration of the account's active life plus five (5) years following account closure, to satisfy AML record-keeping obligations.
• KYC Documents: Retained for five (5) years from the date of verification, or from the date of account closure, whichever is later.
• Transaction Records: Retained for five (5) years from the date of each transaction.
• Support Communications: Retained for three (3) years from the date of the last interaction in a support ticket.
• Analytics Data: Pseudonymised analytics data is retained for a maximum of thirteen (13) months on a rolling basis, after which it is aggregated or deleted.
• Marketing Consent Records: Retained for the duration of the consent period plus three (3) years for audit purposes.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

10 Security Measures

gan98 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our measures include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3.
• Encryption at rest: Sensitive data stored on our servers — including KYC documents and financial records — is encrypted using AES-256.
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All staff with access to personal data undergo background screening and regular data protection training.
• Two-factor authentication (2FA): Available for all Member accounts and mandatory for all internal administrative access.
• Penetration testing: Our infrastructure undergoes regular independent security assessments to identify and remediate vulnerabilities.
• Incident response: In the event of a confirmed personal data breach that poses a risk to affected individuals, we will notify relevant parties within 72 hours of becoming aware of the breach, to the extent required by applicable law.

11 Your Rights

As a data subject, you have the following rights in relation to your personal data held by gan98. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) calendar days.

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that AML and KYC data must be retained for a minimum period and cannot be deleted on request during that period.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful.
• Right to Data Portability: You may request a structured, machine-readable copy of personal data that you provided to us, where processing is based on consent or contract.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming risk assessment. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting prior lawful processing.

12 Minors

The gan98 Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that your child under the age of 21 has provided personal data to gan98, please contact us immediately at [email protected]. We will investigate and respond within five (5) business days.

13 Third-Party Links

The gan98 Platform does not contain links to third-party websites. All navigation on this site remains within the gan98 domain (https://gan98.cam). Should any third-party content be introduced in the future, this policy will be updated accordingly. gan98 accepts no responsibility for the privacy practices of any third-party platform or service that you access independently.

14 Policy Changes

gan98 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our data processing activities, or platform functionality. When material changes are made, we will post a prominent notice on the Platform for a minimum of fourteen (14) calendar days before the changes take effect, and send a notification to the email address registered on your Account.

The version date shown in the "Last Updated" notice at the top of this page is the definitive reference for the currency of this policy. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised policy. If you do not accept the revised policy, you must discontinue use of the Platform and close your Account.

15 Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the way gan98 handles your personal data, please contact our Data Protection team through the following channel:

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. We will cooperate fully with any such authority in the resolution of your complaint.