Privacy Policy

Section 1

Information We Collect

box138 collects various types of information to provide, improve, and protect our services. The categories of data we collect include:

1.1 Personal Identification Information: When you register an account with box138, we collect your full legal name (as it appears on your Indonesian National ID/KTP), date of birth, gender, nationality, residential address (street address, city, postal code, province), valid email address, and mobile phone number. This information is necessary to create your account, verify your identity, comply with age restrictions (21+), and communicate with you regarding your account and our services.

1.2 Identity Verification Documents (KYC): To comply with anti-money laundering (AML) regulations and ensure platform security, we require government-issued identification documents for verification purposes. This includes scanned or photographed copies of your Indonesian National ID (KTP), proof of address (utility bill, bank statement, or government correspondence dated within the last three months), and selfie verification (a photograph of you holding your ID next to your face). These documents are stored securely and accessed only by authorized compliance personnel for verification purposes.

1.3 Financial & Transaction Data: We collect information related to your financial transactions on box138, including deposit amounts and sources (bank account details, e-wallet information), withdrawal amounts and destinations, transaction dates and times, payment method details (last four digits of bank account numbers, e-wallet identifiers), and transaction history including deposits, withdrawals, bets placed, wins, and losses. This data is essential for processing your financial transactions, maintaining accurate account records, detecting fraudulent activity, and complying with financial regulations.

1.4 Gameplay & Betting Data: box138 automatically collects information about your gaming activity to improve services, ensure fair play, and comply with responsible gaming obligations. This includes games played (slots, live casino, sports betting, togel draws), bets placed (amounts, types, outcomes, timestamps), winnings and losses, session duration and frequency, favorite games and betting patterns, and bonus claims and wagering progress. This data helps us understand player preferences, detect problem gambling behaviors, identify bonus abuse or fraud, and personalize your gaming experience.

1.5 Technical & Device Information: When you access box138, we automatically collect technical data about your device and connection, including IP address and geolocation (to verify you're accessing from Indonesia), device type and operating system (desktop, mobile, Android, iOS, Windows, macOS), browser type and version (Chrome, Firefox, Safari, Edge), screen resolution and device identifiers, referring website or app, pages visited and time spent on each page, and clickstream data (navigation patterns). This information helps us optimize our platform for different devices, detect unauthorized access or suspicious activity, troubleshoot technical issues, and analyze user behavior to improve our website and services.

1.6 Cookies & Tracking Technologies: box138 uses cookies (small text files stored on your device), web beacons, pixels, and similar tracking technologies to collect information about your browsing behavior and preferences. This includes session cookies (expire when you close your browser, used for login authentication and navigation), persistent cookies (remain on your device for a set period, used to remember your preferences and login status), analytics cookies (track site usage patterns to help us improve), and marketing cookies (track your interaction with promotional campaigns). You can control cookie preferences through your browser settings, though disabling certain cookies may affect site functionality.

Section 2

How We Use Your Information

box138 uses the collected information for the following purposes, all designed to provide, protect, and improve our services:

• Account Management: Creating and maintaining your player account, verifying your identity and age (21+ requirement), authenticating logins and preventing unauthorized access, processing your preferences and settings, and communicating important account updates.
• Transaction Processing: Processing deposits from Indonesian banks (BCA, BRI, BNI, Mandiri, etc.) and e-wallets (OVO, DANA, GoPay), executing withdrawal requests to your registered payment methods, maintaining accurate transaction records and account balances, generating receipts and transaction confirmations, and reconciling financial discrepancies.
• Service Delivery: Providing access to our gaming platform including sports betting, casino games, live dealer tables, and togel lottery draws, processing bets and determining outcomes, crediting winnings to your account, displaying game history and statistics, and delivering a personalized gaming experience based on your preferences.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, and terms violations, identifying duplicate accounts and bonus abuse, monitoring for suspicious betting patterns or collusion, protecting against unauthorized access and cyberattacks, and complying with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
• Responsible Gaming: Monitoring play patterns for signs of problem gambling, enforcing deposit limits, loss limits, and session time limits you've set, implementing self-exclusion periods when requested, providing reality-check reminders during extended sessions, and offering resources and support for players who may have gambling problems.
• Marketing & Promotions: Sending promotional emails, SMS messages, and push notifications about bonuses, special offers, and new games (with your consent), personalizing promotional offers based on your gaming preferences, tracking the effectiveness of marketing campaigns, and administering bonus programs and loyalty rewards. You may opt out of marketing communications at any time through your account settings.
• Legal Compliance: Complying with Indonesian laws and international gaming regulations, responding to legal requests from law enforcement or regulatory authorities, maintaining records required by licensing jurisdictions, resolving disputes and enforcing our Terms & Conditions, and protecting box138's legal rights and interests.
• Platform Improvement: Analyzing user behavior to identify usability issues and opportunities for improvement, conducting A/B testing on new features and designs, optimizing site performance and load times, developing new games and betting markets based on player demand, and enhancing mobile compatibility and responsiveness.

Section 3

Data Sharing & Disclosure

box138 does not sell your personal information to third parties. However, we may share your data with trusted partners and service providers in the following limited circumstances:

3.1 Service Providers: We engage third-party companies to perform services on our behalf, including payment processors (banks, e-wallet providers, payment gateways handling deposits and withdrawals), game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and other software suppliers providing casino games and sports betting platforms), identity verification services (KYC/AML compliance providers that verify your documents), hosting and infrastructure providers (cloud servers, content delivery networks ensuring platform availability), customer support platforms (live chat, email ticketing, CRM systems), and analytics services (tools that help us understand site usage and player behavior). These service providers are contractually obligated to protect your data and use it only for the specific purposes we authorize.

3.2 Legal & Regulatory Authorities: We may disclose your information when required by law or in response to valid legal requests, including court orders, subpoenas, or search warrants from Indonesian or international authorities, regulatory inquiries from gaming licensing bodies, anti-money laundering investigations by financial intelligence units, tax authorities requiring transaction records, and law enforcement investigating suspected criminal activity. We will verify the legitimacy of such requests before disclosure and will only provide information that is legally required.

3.3 Business Transfers: In the event box138 undergoes a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy. You will have the opportunity to close your account and request data deletion before any such transfer if you do not wish your data to be transferred.

3.4 Aggregated & Anonymized Data: box138 may share aggregated, anonymized data that cannot identify individual users with partners for research, analytics, or marketing purposes. For example, we might share statistics like "30% of Indonesian players prefer football betting over casino games" or "average session duration is 45 minutes." This aggregated data provides valuable insights without compromising individual privacy.

Section 4

Data Security Measures

box138 implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction:

• Encryption: All data transmitted between your device and box138 servers is encrypted using industry-standard SSL/TLS protocols (256-bit encryption). Sensitive data stored in our databases, including passwords and financial information, is encrypted at rest using advanced encryption algorithms.
• Access Controls: Access to personal data is restricted to authorized personnel only, based on the principle of least privilege. Employees and contractors must authenticate using multi-factor authentication and are granted access only to data necessary for their specific roles. All data access is logged and audited regularly.
• Secure Infrastructure: Our servers and databases are hosted in secure, professionally managed data centers with physical security measures including 24/7 surveillance, restricted entry, and environmental controls. We employ firewalls, intrusion detection systems, and DDoS protection to defend against cyberattacks.
• Regular Security Audits: box138 conducts regular internal and third-party security audits to identify vulnerabilities and ensure compliance with security best practices. We perform penetration testing, vulnerability scanning, and code reviews to maintain the highest security standards.
• Employee Training: All box138 employees receive regular training on data protection, privacy regulations, and security protocols. Employees sign confidentiality agreements and are subject to disciplinary action for privacy violations.
• Incident Response: We maintain a documented incident response plan to quickly identify, contain, and remediate any security breaches. In the event of a data breach affecting your personal information, we will notify you and relevant authorities in accordance with applicable laws.

While we employ robust security measures, no method of transmission over the internet or electronic storage is 100% secure. You also play a role in protecting your account by keeping your password confidential, not sharing your login credentials, logging out after each session on shared devices, and reporting suspicious activity immediately to [email protected].

Section 5

Your Privacy Rights

As a box138 user, you have the following rights regarding your personal data. To exercise any of these rights, please contact our Data Protection Officer at [email protected]:

Right	Description	How to Exercise
Right to Access	Request a copy of the personal data we hold about you, including account information, transaction history, and gameplay records.	Submit a written request to [email protected]. We will provide your data within 30 days in a structured, commonly used format (e.g., PDF, CSV).
Right to Rectification	Correct inaccurate or incomplete personal information in your account.	Most personal details can be updated directly in your account settings. For information requiring verification (e.g., name, date of birth), contact support with appropriate documentation.
Right to Erasure	Request deletion of your personal data (also known as "right to be forgotten").	Contact [email protected] to request account deletion. Note: we may retain certain data to comply with legal obligations (e.g., transaction records for tax and AML purposes) typically for 5-7 years.
Right to Restrict Processing	Limit how we use your personal data in certain circumstances (e.g., while disputing data accuracy).	Contact support explaining why you wish to restrict processing. We will comply unless we have compelling legal grounds to continue processing.
Right to Data Portability	Receive your personal data in a portable format to transfer to another service provider.	Request a data export from [email protected]. We will provide your data in a machine-readable format within 30 days.
Right to Object	Object to processing of your personal data for marketing purposes or based on legitimate interests.	Opt out of marketing emails using the unsubscribe link, adjust settings in your account dashboard, or contact support to object to specific processing activities.
Right to Withdraw Consent	Withdraw consent for processing activities that require your consent (e.g., marketing communications).	Update your communication preferences in account settings or contact support. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Response Time: box138 will respond to your privacy rights requests within 30 days. If your request is complex or we receive multiple requests, we may extend this period by an additional 30 days and will inform you of the extension. There is no charge for exercising your privacy rights unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee.

Section 6

Data Retention

box138 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal, regulatory, accounting, or reporting requirements. Specific retention periods vary by data type:

• Active Account Data: We retain your personal information and account details for the duration of your active account. If your account remains inactive (no login or transactions) for 12 consecutive months, we may archive or anonymize certain data while retaining essential records.
• Transaction Records: Financial transaction data including deposits, withdrawals, bets, and winnings are retained for a minimum of 7 years from the transaction date to comply with Indonesian tax laws, anti-money laundering regulations, and international gaming compliance requirements.
• Identity Verification Documents: KYC documents (ID scans, proof of address, selfie verification) are retained for 7 years after account closure to comply with AML regulations and to defend against potential disputes or legal claims.
• Gameplay History: Detailed gameplay records are retained for 12 months for customer support purposes, dispute resolution, and responsible gaming monitoring. Aggregated, anonymized gameplay data may be retained indefinitely for analytics.
• Marketing Communications: If you opt out of marketing communications, your email/phone number is retained on a suppression list to ensure we don't contact you again, even if you're no longer an active player.
• Legal Disputes: If you're involved in a dispute with box138 or legal proceedings, relevant data is retained until the matter is fully resolved and any appeal periods have expired.

After the applicable retention period expires, your personal data will be securely deleted or anonymized so that it can no longer identify you. Deletion is performed using industry-standard data destruction methods to prevent data recovery.

Section 7

Cookies & Tracking Technologies

box138 uses cookies and similar tracking technologies to enhance your browsing experience, analyze site usage, and deliver personalized content. Here's how we use them:

7.1 Essential Cookies: These cookies are necessary for the website to function properly. They enable core features such as user authentication (keeping you logged in as you navigate between pages), security measures (preventing fraudulent activity and unauthorized access), load balancing (distributing traffic across servers for optimal performance), and session management (remembering your preferences during a single browsing session). Essential cookies cannot be disabled without affecting site functionality.

7.2 Analytics Cookies: We use analytics services (such as Google Analytics or similar tools) to understand how visitors use box138. These cookies collect information about page views, time spent on site, bounce rates, traffic sources, user navigation patterns, and device/browser information. This helps us identify popular content, optimize user experience, troubleshoot technical issues, and make data-driven decisions about platform improvements. Analytics data is aggregated and anonymized wherever possible.

7.3 Preference Cookies: These cookies remember your choices and settings to personalize your experience, including language preference (English or Bahasa Indonesia support), display preferences (theme, layout, grid vs. list view), game favorites and recently played games, notification settings, and currency display format. Preference cookies make your visits more convenient by eliminating the need to re-enter information each time.

7.4 Marketing Cookies: With your consent, we use marketing cookies to deliver relevant promotional content and measure campaign effectiveness. These track which ads you've seen and clicked, your interaction with promotional emails, conversion tracking (whether you claimed a bonus after seeing an ad), and retargeting (showing box138 ads on other websites you visit). You can opt out of marketing cookies through your browser settings or our cookie preference center.

Managing Cookies: Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies or alert you when a cookie is being set. You can also delete cookies already stored on your device. However, please note that disabling essential cookies will prevent you from using certain features of box138, and disabling analytics or preference cookies may result in a less personalized experience. To manage cookies, consult your browser's help documentation or visit youronlinechoices.com for opt-out tools.

Section 8

Children's Privacy

box138 services are intended exclusively for adults aged 21 years and older, in compliance with Indonesian gambling age restrictions. We do not knowingly collect personal information from individuals under 21 years of age. Our registration process includes age verification measures, and we require government-issued identification during KYC verification to confirm age eligibility.

If we become aware that we have inadvertently collected personal data from an individual under 21 years of age, we will take immediate steps to delete that information from our systems and permanently close the account. No deposits or winnings will be returned if an account is closed due to underage registration, as this constitutes a serious violation of our Terms & Conditions.

Parents and guardians are encouraged to monitor their children's internet usage and employ parental control software to prevent minors from accessing gambling websites. If you believe a minor has provided personal information to box138, please contact us immediately at [email protected] so we can investigate and take appropriate action.

Section 9

International Data Transfers

box138 primarily serves Indonesian players and stores data on servers located in secure jurisdictions with strong data protection laws. However, as an international online gaming platform, your personal information may be transferred to, stored in, or processed by service providers located outside Indonesia, including in jurisdictions that may have different data protection standards than those in Indonesia.

When we transfer your personal data internationally, we ensure appropriate safeguards are in place to protect your information, including using standard contractual clauses approved by data protection authorities, partnering only with service providers that maintain adequate data protection measures, implementing encryption for data in transit and at rest, and conducting due diligence on third-party data handling practices. By using box138 services, you consent to the transfer of your information to countries outside Indonesia where necessary to provide our services.

Section 10

Changes to This Privacy Policy

box138 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or business operations. When we make changes, we will update the "Last Updated" date at the bottom of this page. Material changes that significantly affect your rights or how we handle your data will be communicated via email to your registered email address and/or through a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of box138 services after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you should cease using our services and close your account.

Section 11

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how box138 handles your personal data, please contact our Data Protection Officer:

• Email: [email protected] (Subject: Privacy Inquiry)
• Customer Support: Available 24/7 via live chat on box138.cam
• Response Time: We aim to respond to all privacy inquiries within 7 business days
• Language Support: English and Bahasa Indonesia

When contacting us about privacy matters, please include your account username, a detailed description of your request or concern, and any relevant documentation. For data access requests or deletion requests, we may ask you to verify your identity to protect your personal information from unauthorized access.

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the relevant data protection authority in Indonesia or your country of residence.