stk88 Privacy Policy

stk88 ("we", "us", "our") operates the online betting and casino platform accessible at stk88.app. As a platform primarily serving Members based in Indonesia, we recognize the importance of transparent and responsible data handling practices. This Privacy Policy is designed to inform you — whether you are a registered Member, a prospective registrant, or a casual visitor — about our data practices in plain, professional language.

This policy covers all data processing activities conducted by stk88 in connection with the Platform, including account management, deposits and withdrawals processed through Indonesian banking channels (BCA, BRI, BNI, Mandiri, and others), customer support interactions, marketing communications , and the use of third-party game and payment services integrated within the Platform.

stk88 acts as the data controller for all personal information collected through the Platform. Where we engage third-party processors (such as payment gateway providers, KYC verification services, or game studios), those processors act strictly under our instruction and are contractually bound to maintain equivalent data protection standards.

stk88 collects several categories of personal data depending on how you interact with the Platform. The categories below outline what we collect and why each category is necessary.

stk88 collects personal data through the following channels and mechanisms:

• Direct registration: Information you provide when creating a Member account, completing KYC verification, or updating your account profile.
• Transaction processing: Financial data submitted or retrieved during deposit and withdrawal requests via supported Indonesian banks and e-wallets.
• Automated technologies: Technical and usage data collected automatically via server logs, cookies, web beacons, and similar tracking technologies when you access any page of the Platform.
• Customer support interactions: Information you provide when contacting our support team via live chat, email, or any future support channel.
• Third-party KYC providers: Identity verification data returned by our licensed KYC service partners, who cross-reference the documents you submit against authoritative databases.
• Game and sports data providers: Aggregated betting activity data fed back to stk88 by integrated third-party game studios (such as Pragmatic Play, Evolution Gaming, and Spribe) for settlement and responsible gaming monitoring purposes.
• Device and browser signals: Browser fingerprint data, geolocation (country/city level), and device identifiers used to detect suspicious login activity and enforce geographic access controls.

stk88 uses the personal data it collects strictly for the following purposes. We do not use your data for any purpose that conflicts with what is stated here.

• Account creation and management: To register and maintain your Member account, authenticate your identity at login, and deliver the core betting and gaming services of the Platform.
• KYC and fraud prevention: To verify your identity, confirm your age (21+), detect and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions.
• Transaction processing: To process deposits and withdrawals via your nominated Indonesian bank account or e-wallet, reconcile balances, and maintain accurate financial records in IDR.
• Responsible gaming compliance: To monitor betting patterns, identify at-risk behavior, enforce deposit limits, session time-outs, and self-exclusion requests activated by Members.
• Customer support: To respond to your queries, resolve disputes, process complaints, and provide account assistance through our 24/7 support team.
• Platform improvement: To analyze aggregated usage data, identify usability issues, test new features, and optimize the Platform's performance for Members across Jakarta, Surabaya, Bandung, Bali, Medan, and other regions of Indonesia.
• Marketing communications: To send promotional offers, bonus notifications, and seasonal campaigns (such as Idul Fitri and BRI Liga 1 promotions) to Members who have opted in to marketing communications. You may withdraw this consent at any time.
• Legal and regulatory compliance: To maintain records required by our international licensing authority, respond to lawful requests from regulatory bodies, and enforce our Terms & Conditions.

stk88 processes your personal data on the following legal bases, which vary depending on the nature of the processing activity:

• Contractual necessity: Processing required to perform our obligations under the Member Account Agreement — including account operation, bet settlement, and transaction processing — is carried out on the basis that it is necessary to fulfill our contract with you.
• Legitimate interests: Fraud detection, security monitoring, platform analytics, and responsible gaming oversight are conducted on the basis of stk88's legitimate interest in operating a secure, fair, and sustainable gaming environment. We have assessed that these interests do not override your fundamental privacy rights.
• Legal obligation: KYC verification, anti-money-laundering record keeping, and compliance with our licensing authority's requirements are carried out because they are legally mandated under the terms of our operating licence.
• Consent: Marketing communications via email or SMS are sent only where you have given explicit, informed consent during registration or at a later point through your account preferences. Consent can be withdrawn at any time without affecting the services you receive.

stk88 does not sell your personal data. We share your data only in the limited circumstances described below, and only with parties who are contractually required to protect it to the same standard we apply.

• Payment processors: Your bank account details and transaction amounts are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, Bank Permata, or BSI) or e-wallet operator (OVO, DANA, GoPay, ShopeePay, or LinkAja) solely for the purpose of executing your deposit or withdrawal request.
• KYC verification partners: Identity documents and personal details are shared with our licensed KYC verification service provider to perform identity and age checks. This provider operates under a strict data processing agreement and is prohibited from using your data for any other purpose.
• Game studios and platform providers: Minimal technical data (session token, account identifier) is shared with integrated game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft to authenticate your session and record game outcomes.
• Licensing and regulatory authorities: We may disclose account and transaction data to our international licensing authority in response to a lawful regulatory inquiry or audit.
• Law enforcement: stk88 will disclose personal data to law enforcement or government agencies when required by a lawful court order, warrant, or equivalent legal instrument, or where necessary to prevent imminent harm.
• Business successors: In the event of a merger, acquisition, or transfer of assets, your data may be transferred to the successor entity, subject to equivalent privacy protections. Members will be notified of any such transfer in advance.

stk88 operates as an offshore platform. Your personal data may be stored and processed on servers located outside Indonesia, in the jurisdiction where stk88's data infrastructure and licensing authority are based. Where such international transfers occur, stk88 takes the following steps to ensure your data remains protected:

• We implement standard contractual clauses with all third-party processors operating outside Indonesia to ensure a consistent baseline of data protection.
• Server infrastructure is maintained within data centers that hold internationally recognized security certifications, including ISO/IEC 27001 where applicable.
• All data transmitted between Indonesia-based Members and stk88's servers is encrypted in transit using TLS 1.2 or higher, regardless of geographic routing.
• Payment data relating to Indonesian bank channels (BCA, BRI, BNI, Mandiri, and others) is processed in compliance with the rules of the respective payment network and does not leave the relevant financial system unnecessarily.

stk88 retains personal data only for as long as it is necessary to fulfill the purposes described in this policy, or as required by our legal and regulatory obligations. The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your membership and for a period of five (5) years following account closure, to satisfy our licensing authority's record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years after the transaction date, in accordance with anti-money-laundering regulatory requirements.
• KYC documents: Retained for five (5) years from the date of submission or from the date of account closure, whichever is later.
• Customer support records: Retained for three (3) years from the date of the interaction, to support dispute resolution and quality assurance.
• Marketing consent records: Retained for as long as you remain subscribed to marketing communications, plus two (2) years thereafter as proof of consent.
• Technical and usage data: Aggregated and anonymized after thirteen (13) months; raw session logs are retained for ninety (90) days for security monitoring purposes.

Upon expiry of the applicable retention period, your personal data is securely deleted or irreversibly anonymized in accordance with our data disposal procedures.

stk88 implements a multi-layered security architecture to protect your personal data against unauthorized access, accidental loss, destruction, or alteration. Our technical and organizational security measures include:

• Encryption at rest and in transit: All databases containing personal data are encrypted at rest. All data transmissions use TLS/SSL encryption to prevent interception.
• Access controls: Access to personal data is restricted to stk88 personnel and authorized processors on a strict need-to-know basis. All internal access is logged and audited.
• Password security: Member passwords are stored as salted cryptographic hashes. stk88 staff cannot retrieve your plain-text password; if lost, it must be reset via the verified recovery process.
• Two-factor authentication (2FA): stk88 supports and encourages the use of 2FA on Member accounts to add an additional layer of protection beyond the username/password combination.
• Intrusion detection: The Platform employs automated intrusion detection systems that flag and quarantine suspicious activity in real time.
• Regular security audits: stk88 conducts periodic security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited.

stk88 uses cookies and similar tracking technologies to operate core platform functions, analyze usage patterns, and enhance your experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential to platform operation. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without disrupting core Platform functionality.
• Functional cookies: Remember your account preferences, language settings, and game display options between sessions. Disabling these will reset your preferences on each visit.
• Analytics cookies: Collect anonymized data on page views, session duration, traffic sources, and feature engagement to help us improve the Platform. These cookies do not identify you personally.
• Marketing cookies: Used to track the effectiveness of promotional campaigns and to deliver relevant bonus offers. Marketing cookies are only set where you have given explicit consent.

You may manage cookie preferences through your browser settings at any time. Blocking all cookies may impair your ability to log in and use certain Platform features. For detailed cookie management instructions, refer to the help documentation for your specific browser.

As a Member or visitor of stk88, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our support team via live chat or email at [email protected] with the subject line "Privacy Rights Request". We will acknowledge your request within 5 business days and aim to resolve it within 14 business days.

• Right to access: You may request a copy of the personal data stk88 holds about you, along with information on how it is used and with whom it has been shared.
• Right to rectification: You may request correction of any personal data that is inaccurate or incomplete. Minor profile details can be updated directly in your account settings.
• Right to erasure: You may request deletion of your personal data. This right is subject to our legal retention obligations; we cannot delete data that we are required to retain for regulatory compliance purposes.
• Right to restrict processing: You may request that stk88 limits how it uses your data while a dispute is being investigated or while you await a rectification response.
• Right to data portability: You may request a structured, machine-readable export of the personal data you provided to stk88 for account registration and transactional purposes.
• Right to object: You may object to processing based on legitimate interests, including profiling for responsible gaming monitoring. We will review each objection on its merits and respond in writing.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without penalty. Withdrawal does not affect processing that occurred prior to withdrawal.

stk88 operates a strict 21+ policy. The Platform is not intended for, and must not be used by, any individual under the age of 21. We do not knowingly collect personal data from minors. During the registration process, all applicants are required to confirm their date of birth, and KYC verification independently validates age eligibility before full account access is granted.

If stk88 becomes aware that personal data has been collected from an individual who is under 21 years of age, that account will be immediately suspended, all associated data will be reviewed, and any remaining balance will be subject to a responsible gaming investigation before any refund is considered. The account will be permanently closed and the relevant data deleted from our active systems.

Parents or guardians who believe that a minor has registered on the Platform are encouraged to contact us immediately at [email protected]. We will prioritize such cases and take action within 24 hours of a verified report.

The stk88 Platform integrates services from third-party providers, including game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) and payment network partners. While these services are embedded within the stk88 Platform experience, they are governed by their own privacy practices.

stk88 is not responsible for the data practices of third-party providers operating within their own systems. The data shared with these providers is limited to what is strictly necessary for platform integration (session tokens, game identifiers, and transaction references). We encourage Members to review the privacy policies of third-party studios and payment providers if they have concerns about how those parties handle data independently of stk88.

The stk88 Platform does not contain outbound hyperlinks to external websites. Any reference to external brands (BCA, BRI, OVO, DANA, Pragmatic Play, etc.) is made for informational purposes only and does not constitute an endorsement or imply a formal data-sharing arrangement beyond the limited integration described above.

stk88 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. When we make material changes — such as introducing a new category of data collection, a new purpose for processing, or a new data-sharing arrangement — we will notify registered Members by email to their registered address and by a prominent notice on the Platform at least seven (7) days before the changes take effect.

Minor, non-material updates (such as corrections to formatting or clarifications of existing practices that do not change their substance) may be made without advance notice. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage Members to review this page periodically.

Continued use of the stk88 Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised policy, you should cease using the Platform and may request account closure with balance return in accordance with the Terms & Conditions.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to raise a data-related concern, please contact the stk88 privacy team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the stk88 Platform. This is the fastest route for urgent privacy or account security concerns. Average response time is under two minutes during peak hours (20:00–02:00 WIB).
• Email: [email protected] — please use the subject line "Privacy Rights Request" or "Data Concern" so that your message is routed directly to our compliance team. Allow up to 14 business days for a full response on rights requests.

Our customer support team includes Indonesian-speaking agents available around the clock, ensuring that Members across Jakarta, Surabaya, Bandung, Bali, and the wider Indonesia archipelago can communicate their privacy concerns clearly and confidently, even though the Platform itself is presented in English.