Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

id678 operates as the Data Controller for all Personal Data collected through the Platform. As Data Controller, id678 determines what Personal Data is collected, how it is used, who it is shared with, and how long it is retained. id678 is committed to Processing your Personal Data in accordance with internationally recognised privacy principles and in a manner that respects your rights as a Data Subject.

If you have any questions or concerns regarding the Processing of your Personal Data, or if you wish to exercise any of the rights described in this Privacy Policy, you may contact id678 at any time using the contact details provided in Clause 15.

id678 collects the following categories of Personal Data in order to provide you with a secure, personalised, and compliant gaming experience:

• Identity Data: Your full legal name as it appears on your government-issued identification, date of birth, nationality, and gender. This data is required to satisfy id678's regulatory obligations, including age verification (you must be 21 years of age or older) and to prevent duplicate account registration.
• Contact Data: Your email address, mobile phone number (Indonesian format), and residential address in Indonesia. Contact data is used to communicate with you regarding your account, respond to support requests, and send promotional materials where you have opted in to receive them.
• Account Credentials: Your chosen username, password (stored in hashed form only), and any security questions or answers you have configured. id678 does not store your password in plaintext and cannot retrieve it for you — only password resets are supported.
• Financial Data: Payment method details including your bank account number (for BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, or other Indonesian banks), e-wallet identifiers (for OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction history in Indonesian Rupiah (IDR / Rp). Financial data is encrypted at rest and in transit, and is used solely to process deposits and withdrawals.
• Verification Documents (KYC): Copies of government-issued photo identification (Indonesian National Identity Card / KTP, passport), proof of address documents (utility bills, bank statements, or government correspondence), and in some cases photographs or video recordings captured during identity verification procedures. KYC documents are collected to comply with anti-money laundering standards and to prevent fraud.
• Transaction & Betting Data: A complete record of your account activity including deposits, withdrawals, wagers placed on sporting events (football leagues such as BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, Champions League, AFF Cup; badminton tournaments; MotoGP; E-sports titles including Mobile Legends MPL, PUBG Mobile, Free Fire), togel (Indonesia's traditional numbers lottery) markets, live casino games, slot games, and bonus redemptions. Betting data is retained for audit purposes and to support responsible gaming initiatives.
• Technical & Usage Data: Your IP address, device type, operating system, browser type and version, screen resolution, referral source, pages visited on the Platform, time spent on each page, links clicked, and session duration. Technical data is collected automatically through cookies and server logs and is used to analyse Platform performance, detect fraud, and improve user experience.
• Communication Data: The content of any correspondence you send to id678 through email, live chat, or contact forms, including support tickets, feedback submissions, and complaint records. Communication data is retained to provide evidence of our interactions and to improve customer service quality.
• Marketing & Preferences Data: Your communication preferences (whether you have opted in to receive promotional emails, SMS messages, or push notifications), preferred language (English), time zone (WIB by default, but also WITA or WIT where applicable), and favourite game categories.

id678 collects your Personal Data through the following channels:

• Directly from you: When you register an account, complete your profile, submit KYC verification documents, make a deposit or withdrawal request, place a wager, contact customer support, or update your account settings.
• Automatically through technology: When you visit the Platform, certain data is collected automatically by cookies, web beacons, server logs, and similar tracking technologies. This includes your IP address, device identifiers, browsing behaviour, and session metadata. See Clause 8 for detailed information on cookies.
• From third-party sources: id678 may receive Personal Data about you from payment processors (when you make a deposit via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja), identity verification service providers (during KYC review), and game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) where such data is necessary to deliver the service you have requested.
• From publicly available sources: In limited circumstances, id678 may verify information you have provided by cross-referencing it against publicly available databases, social media profiles (where you have made your profile public), or government registries — for example, to confirm that a submitted KTP number is valid and matches the name you have provided.

You are under no statutory obligation to provide id678 with your Personal Data. However, failure to provide certain categories of data (particularly Identity Data, Contact Data, and Financial Data) will prevent id678 from being able to register your account, process transactions, or provide you with access to the Platform's features.

id678 Processes your Personal Data on the following legal bases:

• Performance of a Contract: The majority of data Processing carried out by id678 is necessary to fulfil the contractual relationship between you and id678 as set out in the Terms & Conditions. This includes account registration, identity verification, processing deposits and withdrawals in IDR, settling wagers, and providing customer support.
• Compliance with Legal Obligations: id678 is required by applicable anti-money laundering laws, financial crime regulations, and gaming industry standards to collect and retain certain Personal Data, including KYC verification documents and transaction records. Where Processing is necessary to comply with a legal obligation, id678 cannot offer you the option to opt out.
• Legitimate Interests: id678 has a legitimate interest in Processing your data to prevent fraud, detect suspicious account activity, improve Platform security, analyse usage patterns to enhance user experience, and market id678 services to existing Members. Where Processing is based on legitimate interests, id678 has conducted a balancing test to ensure that such interests do not override your fundamental rights and freedoms.
• Consent: In certain cases — particularly for marketing communications and optional data collection such as satisfaction surveys — id678 relies on your explicit consent. Where consent is the legal basis for Processing, you have the right to withdraw that consent at any time without penalty by contacting support or updating your preferences in your Account settings.

id678 uses your Personal Data for the following purposes:

• To register and maintain your account on the Platform;
• To verify your identity and age (you must be at least 21 years old) and to complete KYC checks as required by applicable regulations;
• To process deposits and withdrawals in Indonesian Rupiah (IDR) via local payment methods including BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja;
• To manage your wagers on sporting events, togel markets, live casino games, and slot games, and to calculate and pay out winnings in accordance with the applicable game rules;
• To administer bonuses, promotions, cashback offers, and loyalty rewards, and to verify compliance with the associated terms and conditions;
• To provide customer support through email at [email protected], and to respond to your queries, complaints, and feedback;
• To send you transactional communications such as deposit confirmations, withdrawal notifications, account security alerts, and updates to the Terms & Conditions or this Privacy Policy;
• To send you promotional communications (where you have opted in) including bonus offers, new game announcements, and exclusive promotions tailored to Indonesian Members;
• To monitor and analyse Platform usage patterns, identify popular games and betting markets, and improve the overall user experience;
• To detect, prevent, and investigate fraudulent activity, money laundering, match-fixing, collusion, bonus abuse, and other Prohibited Conduct as defined in the Terms & Conditions;
• To enforce id678's Responsible Gaming policies, including monitoring deposit and loss limits, session time limits, and self-exclusion arrangements;
• To comply with legal and regulatory obligations, including responding to lawful requests from government authorities, law enforcement agencies, and regulatory bodies;
• To resolve disputes, enforce id678's rights under the Terms & Conditions, and pursue legal remedies where necessary.

id678 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. However, id678 may share your Personal Data with the following categories of recipients where such sharing is necessary to provide the services you have requested or to comply with legal obligations:

• Payment Processors: When you make a deposit or request a withdrawal, id678 shares the necessary financial data with our authorised payment service providers to process the transaction. This includes sharing your bank account details with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or e-wallet identifiers with digital payment platforms (OVO, DANA, GoPay, ShopeePay, LinkAja). Payment processors are contractually obligated to use your data only for the purpose of processing your transaction and to maintain appropriate security measures.
• Identity Verification Providers: id678 works with specialist KYC and identity verification service providers to validate the government-issued identification documents you submit during the verification process. These providers may use automated facial recognition technology and cross-reference your details against government databases. All KYC partners are bound by strict confidentiality obligations and data protection standards.
• Game Content Providers: When you play games supplied by third-party studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft), certain data — such as your username, wager amounts, and game outcomes — is shared with those providers to enable gameplay. Game providers are prohibited from using your data for any purpose other than delivering the game service and complying with their own regulatory obligations.
• Fraud Prevention & Security Services: id678 may share your IP address, device fingerprint, and transaction history with specialist fraud detection services to identify suspicious activity, prevent account takeover attacks, and protect the integrity of the Platform.
• Legal & Regulatory Authorities: id678 will disclose your Personal Data to law enforcement agencies, courts, regulators, or other government bodies where required to do so by applicable law, court order, or subpoena. This includes disclosures necessary to investigate suspected criminal activity, comply with anti-money laundering reporting obligations, or respond to lawful data access requests.
• Professional Advisors: id678 may share your Personal Data with lawyers, accountants, auditors, and other professional advisors where necessary to obtain advice on legal, financial, or regulatory matters.
• Corporate Transactions: In the event of a merger, acquisition, corporate reorganisation, sale of assets, or bankruptcy, your Personal Data may be transferred to the successor entity or acquiring party. id678 will notify you of any such transfer and ensure that the receiving party is bound by privacy obligations no less protective than those set out in this Privacy Policy.

id678 uses cookies and similar tracking technologies to distinguish you from other users of the Platform, to remember your preferences, and to improve your browsing experience. A cookie is a small file of letters and numbers that is stored on your browser or the hard drive of your device. Cookies contain information that is transferred to your device's hard drive.

id678 uses the following types of cookies:

• Strictly Necessary Cookies: These cookies are essential for you to navigate the Platform and use its features, such as accessing secure areas and maintaining your login session. Without these cookies, services you have requested (such as placing a wager or viewing your account balance) cannot be provided. Strictly necessary cookies do not require your consent and cannot be disabled.
• Performance Cookies: These cookies collect information about how you use the Platform, including which pages you visit most often, how long you spend on each page, and whether you encounter any error messages. Performance cookies are aggregated and anonymised, and are used solely to improve the way the Platform works. id678 uses Google Analytics and similar tools for this purpose.
• Functionality Cookies: These cookies allow the Platform to remember choices you make (such as your preferred language, time zone, or favourite games) and provide enhanced, more personalised features. Functionality cookies may also be used to remember changes you have made to text size, fonts, and other customisable elements of the Platform.

id678 does not use third-party advertising cookies, cross-site tracking cookies, or any cookies that share your data with advertisers or social media networks. All cookies deployed on the Platform are first-party cookies controlled by id678 or cookies from trusted service providers (such as Google Analytics) operating under strict data Processing agreements.

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. However, if you disable strictly necessary cookies, you will not be able to use certain features of the Platform, and your user experience may be degraded. For more information on managing cookies, please consult your browser's help documentation.

id678 retains your Personal Data for only as long as is necessary to fulfil the purposes for which it was collected, or to comply with legal, regulatory, accounting, or reporting requirements. The retention period for different categories of Personal Data is as follows:

At the end of the applicable retention period, id678 will securely delete or anonymise your Personal Data such that it can no longer be associated with you. In some cases, it may not be technically feasible to delete all copies of your data (for example, where data has been backed up to offline storage for disaster recovery purposes). In such cases, id678 will securely isolate your data and prevent any further Processing until secure deletion is possible.

id678 takes the security of your Personal Data extremely seriously and has implemented a range of technical and organisational measures designed to protect your data from unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your device and id678's servers is encrypted using 256-bit SSL/TLS encryption. Sensitive data stored in id678's databases (including passwords and financial information) is encrypted at rest using AES-256 encryption.
• Access Controls: Access to your Personal Data is restricted to id678 employees and contractors who have a legitimate business need to view that data. All personnel with access to Personal Data are subject to confidentiality obligations and receive regular data protection training.
• Multi-Factor Authentication: id678's internal systems require multi-factor authentication (MFA) for access, and Members are strongly encouraged to enable MFA on their own accounts for an additional layer of security.
• Intrusion Detection & Prevention: id678's infrastructure is monitored 24/7 by automated intrusion detection systems, firewalls, and anti-malware software. Suspicious activity triggers immediate alerts to id678's security team.
• Regular Security Audits: id678 conducts regular internal security audits and engages independent third-party security firms to perform penetration testing and vulnerability assessments. Any identified vulnerabilities are remediated promptly in accordance with industry best practices.
• Data Minimisation: id678 collects only the Personal Data that is strictly necessary to provide the services you have requested. Unnecessary data is not collected, and collected data is deleted or anonymised as soon as it is no longer needed.

Despite id678's best efforts, no method of data transmission over the internet or method of electronic storage is 100% secure. While id678 strives to use commercially acceptable means to protect your Personal Data, id678 cannot guarantee its absolute security. In the unlikely event of a data breach that poses a risk to your rights and freedoms, id678 will notify you and any applicable regulatory authorities within 72 hours of becoming aware of the breach, as required by applicable law.

Under applicable data protection laws, you have a number of rights in relation to your Personal Data. These rights are not absolute and may be subject to certain exceptions or limitations, but id678 is committed to honouring them wherever possible. Your rights include:

• Right of Access: You have the right to request a copy of the Personal Data id678 holds about you. id678 will provide you with a copy of your data in a commonly used electronic format within 30 days of your request, free of charge for the first copy. Subsequent copies may be subject to a reasonable administrative fee.
• Right to Rectification: If you believe that any Personal Data id678 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. You can update most of your account information directly through your Account settings; for other corrections, please contact support.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you have the right to request that id678 delete your Personal Data. This right applies where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for Processing; (c) you object to Processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully Processed. This right is not absolute — id678 may be required to retain certain data to comply with legal obligations or to establish, exercise, or defend legal claims.
• Right to Restriction of Processing: You have the right to request that id678 restrict the Processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data, where Processing is unlawful but you do not want the data erased, or where you need the data to establish, exercise, or defend legal claims even though id678 no longer needs it.
• Right to Data Portability: Where Processing is based on consent or performance of a contract, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance from id678.
• Right to Object: You have the right to object to Processing of your Personal Data where such Processing is based on legitimate interests. id678 will cease Processing unless it can demonstrate compelling legitimate grounds for continuing to Process the data that override your interests, rights, and freedoms, or where the Processing is necessary for the establishment, exercise, or defence of legal claims. You have an absolute right to object to Processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where Processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of Processing carried out before the withdrawal.
• Right to Lodge a Complaint: If you believe that id678 has breached your data protection rights, you have the right to lodge a complaint with id678's internal complaints process (see Clause 15) or with a relevant data protection supervisory authority.

To exercise any of these rights, please contact id678 at [email protected] with the subject line "Data Subject Rights Request" and provide sufficient detail for id678 to verify your identity and understand the nature of your request. id678 will respond to all requests within 30 days of receipt, or within a shorter timeframe where required by applicable law. Where id678 is unable to comply with your request, id678 will explain the reasons for this decision.

id678 operates an online platform accessible to Members in Indonesia. Your Personal Data may be transferred to, stored in, and Processed in jurisdictions outside Indonesia where id678's servers, third-party service providers, or business partners are located. These jurisdictions may have data protection laws that differ from the laws of Indonesia.

Where id678 transfers your Personal Data outside Indonesia, id678 ensures that appropriate safeguards are in place to protect your data and to ensure that it is treated in a manner consistent with this Privacy Policy and applicable data protection laws. These safeguards may include:

• Entering into Standard Contractual Clauses (SCCs) with third-party processors, as approved by relevant data protection authorities;
• Verifying that the recipient country has been deemed to provide an adequate level of data protection;
• Relying on approved certification mechanisms or codes of conduct;
• Obtaining your explicit consent for the specific transfer where other safeguards are not available.

You may request further information about the specific safeguards id678 has implemented for international transfers by contacting support at [email protected].

id678 is an adults-only platform. The Platform is not intended for, and id678 does not knowingly collect Personal Data from, individuals under the age of 21 years. Registration on the Platform requires you to confirm that you are at least 21 years old, and id678 conducts age verification checks through its KYC process.

If id678 becomes aware that it has inadvertently collected Personal Data from a person under the age of 21, id678 will take immediate steps to delete that data, close the associated account, void any wagers placed, and return any deposited funds to the verified payment method on file.

Parents and guardians are encouraged to monitor their children's internet usage and to use parental control tools to prevent minors from accessing age-restricted websites such as id678. If you believe that id678 has collected Personal Data from a minor, please contact support immediately at [email protected] so that appropriate action can be taken.

id678 reserves the right to update or amend this Privacy Policy at any time to reflect changes in id678's data Processing practices, legal obligations, or business operations. Where a proposed amendment is material — that is, where it would significantly affect how your Personal Data is Processed or would diminish your rights as a Data Subject — id678 will provide at least 14 days' advance notice by publishing a prominent announcement on the Platform and, where practicable, by sending a notification to the email address registered to your Account.

For minor amendments (such as typographical corrections, clarifications that do not change substantive rights, or updates to contact details), id678 may publish the amended Privacy Policy without advance notice. The effective date of each version is displayed at the top of this page and in the page hero section.

Your continued use of the Platform after the published effective date of any amended version constitutes your acceptance of the revised Privacy Policy. If you do not agree with an amendment, you should cease using the Platform and contact id678 to request account closure and deletion of your Personal Data, subject to id678's legal retention obligations.

id678 encourages all Members to review this Privacy Policy periodically to stay informed about how their Personal Data is being Processed and protected.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the Processing of your Personal Data by id678, please contact our Data Protection team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Privacy Queries: "Privacy Policy Inquiry" or "Data Subject Rights Request"

id678's support team is available 24 hours a day, seven days a week (24/7), with Indonesian-speaking agents available on request. All privacy-related inquiries are treated with the highest priority and will be acknowledged within 24 hours. id678 aims to provide a substantive response to all data subject rights requests within 30 days of receipt, or within a shorter timeframe where required by applicable law.

For formal complaints regarding data protection matters, id678 operates a two-stage internal review process as described in the Terms & Conditions. If you are not satisfied with id678's response to your complaint, you may have the right to escalate the matter to a relevant data protection supervisory authority in your jurisdiction.