Privacy Policy — at788

The following definitions apply throughout this Privacy Policy. Terms not defined here carry the same meaning as those defined in the at788 Terms & Conditions.

2.1 at788 operates the online casino and sportsbook platform accessible at https://at788.net. The at788 operating entity is the Data Controller responsible for your Personal Data collected through the Platform.

2.2 at788 is licensed and regulated internationally. For the purposes of this Privacy Policy, "at788", "we", "us", and "our" refer collectively to the Platform operator and its affiliated entities involved in delivering the Services to players in Indonesia and other markets.

2.3 Questions, requests, and complaints relating to this Privacy Policy should be directed to the at788 Data Protection contact detailed in Section 15 of this document.

at788 collects and processes the following categories of Personal Data, depending on how you interact with the Platform:

3.1 Identity & Contact Data. Full legal name, date of birth, residential address in Indonesia (city, province, postal code), email address, and mobile phone number. This data is collected during Account registration and KYC verification.

3.2 Identity Verification Data. Copies or images of government-issued identification documents (Indonesian KTP, passport, or driving licence), selfie photographs taken for facial-match verification, and proof-of-address documents such as recent bank statements or utility bills dated within 90 days. This data is processed solely for KYC compliance purposes.

3.3 Financial Data. Bank account details (bank name, account number, account holder name) for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, or Bank Permata; e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja; transaction history including deposit amounts, withdrawal amounts, dates, and payment method references. at788 does not store full card numbers or CVV codes.

3.4 Account & Gaming Data. Username, hashed password, account creation date, session history, game activity logs (games played, stakes wagered, wins, losses), bonus claims, and responsible gaming preference settings such as deposit limits and self-exclusion elections.

3.5 Technical & Device Data. IP address, device type and operating system, browser type and version, screen resolution, referring URL, pages visited within the Platform, session duration, clickstream data, and geolocation data derived from your IP address.

3.6 Communications Data. Records of all correspondence between you and at788 support staff, including live chat transcripts, email exchanges, and WhatsApp message logs. We retain these records to resolve disputes, improve service quality, and comply with our regulatory obligations.

3.7 Marketing Preferences. Your opt-in or opt-out status for promotional email communications, push notifications, and SMS messages, together with data about how you interact with marketing materials we have sent to you (open rates, click-through rates).

4.1 Directly from You. The majority of Personal Data at788 holds about you is provided directly by you during account registration, the KYC verification process, deposits and withdrawal requests, participation in promotions, and communications with our support team.

4.2 Automatically. When you visit or use the at788 Platform, our servers and analytics systems automatically record Technical & Device Data. This includes your IP address, browser fingerprint, and session behaviour. This collection occurs regardless of whether you are logged in to an Account.

4.3 From Third-Party Verification Providers. When you submit KYC documents, at788 engages third-party identity verification services to cross-check your information against authoritative data sources. These providers return a verification result and, where applicable, a risk score to at788. The underlying data remains with the verification provider under their own privacy policy.

4.4 From Payment Processors. When you initiate a deposit or withdrawal via a local Indonesian bank or e-wallet, the payment provider may share transaction confirmation data with at788, including masked account identifiers and transaction reference numbers, to facilitate reconciliation and fraud detection.

4.5 From Cookies and Similar Technologies. at788 uses first-party and third-party cookies, web beacons, and local storage objects to maintain your session, remember preferences, deliver relevant promotional content, and support Platform analytics. See Section 9 for full details.

at788 processes your Personal Data on one or more of the following lawful bases:

• Contractual Necessity. Processing your identity, financial, and account data is necessary to perform our contract with you — specifically, to open and maintain your Account, process deposits and withdrawals, settle bets and game outcomes, and provide customer support.
• Legal Obligation. Certain processing activities — particularly KYC identity verification, AML transaction monitoring, and the retention of financial records — are required to comply with applicable international anti-money laundering regulations, know-your-customer standards, and our international operating licence conditions.
• Legitimate Interests. at788 processes Technical & Device Data, gaming activity logs, and communications records on the basis of its legitimate interests in operating a secure and fair platform, detecting and preventing fraud, resolving disputes, and improving the quality of its services. We have assessed that these interests are not outweighed by your privacy rights.
• Consent. Where at788 processes your Personal Data for direct marketing purposes — such as sending promotional emails, SMS messages, or push notifications about bonuses, new games, or upcoming events — this processing is based on your freely given consent. You may withdraw consent at any time by updating your marketing preferences in your Account dashboard or by emailing [email protected].

at788 uses your Personal Data for the following specific purposes:

6.1 Account Management. Creating, maintaining, and securing your Account; processing login and authentication; facilitating password resets and two-factor authentication; and enforcing Account policies including the 21+ age restriction and the single-account rule.

6.2 Payment Processing. Verifying the ownership of your nominated payment methods, processing deposits from and withdrawals to Indonesian bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); reconciling transactions; and resolving payment disputes.

6.3 Identity & Age Verification. Confirming that you meet the minimum age requirement of 21 years; verifying that your identity documents are genuine; and screening your name against applicable sanctions and politically-exposed-person (PEP) lists as required by international AML standards.

6.4 Fraud Prevention & Security. Detecting and investigating suspicious account activity, bonus abuse, chip dumping, coordinated betting strategies, money laundering patterns, and unauthorised access attempts. Where confirmed fraud is detected, at788 may share relevant data with law enforcement agencies or other gaming operators under applicable inter-operator fraud-prevention frameworks.

6.5 Regulatory Compliance. Generating and retaining records required under our international operating licence conditions, including transaction logs, KYC documentation, and AML monitoring reports. These records may be provided to licensing authorities or regulators upon lawful request.

6.6 Responsible Gaming. Monitoring gaming patterns to identify indicators of potential problem gambling behaviour; delivering self-exclusion, deposit limit, and session time-out features; and, where at788 has reasonable cause for concern, proactively contacting players to offer access to responsible gaming resources.

6.7 Customer Support. Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance and training purposes.

6.8 Platform Improvement. Analysing aggregated and anonymised gaming and session data to identify technical issues, improve game loading performance, refine user experience design, and develop new features and game categories — including slots, Keno, Blackjack, live casino, and sportsbook markets covering BRI Liga 1, EPL, La Liga, and international tournaments.

6.9 Marketing Communications. Where you have provided consent, sending you personalised promotional offers, bonus notifications, tournament invitations, and platform news via email, SMS, or push notification. You may opt out of all marketing communications at any time.

7.1 Principle of Minimum Sharing. at788 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. Data is shared externally only where necessary to deliver the Services, comply with legal obligations, or protect the Platform from fraud.

7.2 Data Processors. at788 engages the following categories of third-party Data Processors under contractual data-processing agreements that impose confidentiality and security obligations at least as stringent as those in this Privacy Policy:

• KYC & Identity Verification Providers — to perform automated document and biometric checks on registration and prior to first withdrawal.
• Payment Processing Partners — Indonesian bank APIs and e-wallet gateways (OVO, DANA, GoPay, ShopeePay, LinkAja) used to facilitate deposits and withdrawals.
• Cloud Infrastructure Providers — server hosting, database services, and content delivery network (CDN) providers that store and transmit Platform data under strict data residency and encryption requirements.
• Game Software Providers — studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive anonymised session identifiers necessary to deliver game content. They do not receive your full Personal Data.
• Customer Support Platform — our live chat and email ticketing system provider, which processes communications data on our behalf.
• Analytics Providers — providers of aggregated, pseudonymised usage analytics that help us understand Platform performance. These providers are prohibited from using the data for their own commercial purposes.

7.3 Legal Disclosures. at788 will disclose Personal Data to competent authorities, regulators, or courts when required to do so by law, by court order, or by lawful request from a licensing or regulatory body. at788 will, where legally permitted, notify you of any such request.

7.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of at788's business, Personal Data held by at788 may be transferred to the acquiring entity as part of that transaction. You will be notified by prominent notice on the Platform or by email at least 14 days before any such transfer takes effect, and you will have the right to close your Account before the transfer is completed.

7.5 Fraud Prevention Networks. at788 participates in inter-operator fraud-prevention initiatives under which confirmed fraud cases may be disclosed to other licensed gaming operators on a need-to-know basis. Participation in such networks is governed by strict data-sharing agreements and operates solely for the purpose of preventing harm to consumers and the gaming industry.

8.1 at788 retains Personal Data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by applicable law and regulatory obligations.

8.2 The table below sets out at788's standard retention periods by data category:

8.3 At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Anonymised data (from which no individual can be identified) may be retained indefinitely for statistical and research purposes.

8.4 Where you exercise your right to erasure (see Section 11), at788 will assess the request against its legal retention obligations. Data that must be retained for regulatory purposes cannot be deleted until the applicable retention period expires, even following an erasure request.

9.1 at788 uses cookies and similar technologies to operate the Platform, remember your preferences, support security features, and gather analytics data that helps us improve the user experience. By continuing to use the at788 Platform, you consent to the use of cookies as described in this section.

9.2 Types of Cookies Used:

9.3 at788 does not use third-party advertising cookies or place cookies on behalf of external advertisers. No data collected via at788 cookies is sold to, or shared with, advertising networks or data brokers.

9.4 Managing Cookies. You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, restrict their use to specific sites, or receive a notification when a cookie is set. Please be aware that disabling strictly necessary cookies will impair your ability to log in and use the Platform.

10.1 at788 applies comprehensive technical and organisational security measures to protect your Personal Data against accidental loss, unauthorised access, alteration, or disclosure. Key security controls currently in place include:

• Transport Encryption: All data transmitted between your device and the at788 Platform is encrypted using TLS 1.3 with 256-bit AES ciphers. Connections using older, less secure protocol versions are refused.
• Data Encryption at Rest: Sensitive Personal Data stored in at788 databases — including identity document images, financial records, and hashed credentials — is encrypted at rest using AES-256.
• Password Security: Account passwords are stored exclusively as salted cryptographic hashes. at788 staff cannot view or recover your password in plain text.
• Two-Factor Authentication (2FA): All Account Holders may enable TOTP-based 2FA at no charge from the Account security settings page. at788 strongly recommends enabling 2FA.
• Access Controls: Access to Personal Data held by at788 is restricted to authorised personnel on a strict need-to-know basis. All staff with access to Personal Data complete mandatory data protection training.
• Penetration Testing: at788's Platform undergoes regular independent security assessments including penetration testing and vulnerability scanning. Critical findings are remediated within 24 hours of discovery.
• Incident Response: at788 maintains a documented data breach response plan. In the event of a breach likely to result in high risk to your rights, at788 will notify affected individuals without undue delay and within 72 hours of becoming aware of the incident.

10.2 No security system is completely impenetrable. You are responsible for keeping your Account credentials — including your password and any 2FA codes — confidential and for logging out of shared devices after each session. at788 is not responsible for losses arising from credential theft or sharing on your part.

Depending on your jurisdiction and the legal basis for processing, you may hold some or all of the following rights with respect to your Personal Data held by at788. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request".

11.1 Right of Access. You have the right to request confirmation of whether at788 processes Personal Data about you, and to receive a copy of that data along with supplementary information about how it is used. at788 will respond to access requests within 30 days of receipt.

11.2 Right to Rectification. If any Personal Data at788 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. You may update certain information directly in your Account settings without contacting support.

11.3 Right to Erasure. You have the right to request deletion of your Personal Data where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you have withdrawn consent and no other lawful basis applies; or (c) the data has been processed unlawfully. Erasure requests are subject to at788's legal retention obligations set out in Section 8. We will inform you of any data that cannot be deleted and the reason why.

11.4 Right to Restriction of Processing. You may request that at788 suspend the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed. Restricted data will be stored but not otherwise processed.

11.5 Right to Data Portability. Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format (such as JSON or CSV) and to request that it be transmitted to another data controller where technically feasible.

11.6 Right to Object. You have the right to object at any time to the processing of your Personal Data where that processing is based on at788's legitimate interests. at788 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise, or defence of legal claims. You have an unconditional right to object to processing for direct marketing purposes.

11.7 Right to Withdraw Consent. Where processing is based solely on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. You can withdraw marketing consent via your Account dashboard or by emailing [email protected].

11.8 Right to Lodge a Complaint. If you believe that at788 has processed your Personal Data in breach of applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. at788 encourages you to contact us directly first so that we have the opportunity to resolve your concern.

12.1 at788 operates internationally, and your Personal Data may be transferred to and processed in countries other than Indonesia. This includes transfers to countries where our cloud infrastructure, KYC verification, and game software providers are based.

12.2 Where Personal Data is transferred outside Indonesia to countries that do not provide an equivalent level of data protection, at788 implements appropriate safeguards to ensure that your data remains protected. These safeguards include: contractual clauses in data-processing agreements with all Data Processors that impose data protection standards equivalent to those in this Privacy Policy; and technical measures such as end-to-end encryption that protect data in transit and at rest regardless of the processing location.

12.3 By registering an Account on at788, you acknowledge that your Personal Data may be processed in jurisdictions outside Indonesia for the purposes described in this Privacy Policy, subject to the safeguards described above.

13.1 The at788 Platform is strictly restricted to individuals aged 21 years or over. at788 does not knowingly collect or process Personal Data from individuals under the age of 21.

13.2 If at788 discovers or is notified that Personal Data has been collected from an individual under 21, it will take immediate steps to: (a) suspend the associated Account; (b) securely delete all Personal Data associated with the underage individual; and (c) reverse any financial transactions to the greatest extent possible.

13.3 If you are a parent or guardian and you believe your child under the age of 21 has registered an Account on at788, please contact us immediately at [email protected] with the subject line "Underage Account Report". We treat all such reports as urgent and will act within 24 hours of receiving a credible report.

14.1 at788 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our Services. The "Last updated" date at the top of this document will be revised whenever a material change is made.

14.2 Where a change is material — meaning it affects the type of data collected, the purpose of processing, the categories of third parties with whom data is shared, or your rights — at788 will notify you by displaying a prominent notice on the Platform and, where your email address is on file, by sending an email notification at least seven (7) days before the change takes effect.

14.3 Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Privacy Policy. If you do not accept a material change, you may close your Account before the amendment takes effect by contacting support.

14.4 Non-material updates — such as clarifications of existing language, corrections of typographical errors, or the addition of explanatory examples — may be made without notice and take effect immediately upon publication.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 11, or wish to raise a complaint about at788's data handling practices, please contact the at788 Data Protection team through any of the following channels:

• Email (preferred for data rights requests): [email protected] — use subject line "Privacy Policy Enquiry" or "Data Rights Request" as appropriate. Responses within 24 hours for general enquiries; within 5 business days for formal data rights requests.
• Live Chat: Available 24 hours a day, 7 days a week via the at788 Platform. Suitable for general privacy questions; formal data rights requests should be submitted by email to create a documented record.
• WhatsApp: +62 811 0000 788 (available 08:00–22:00 WIB). For general enquiries only.

at788 is committed to resolving all privacy-related enquiries and complaints promptly and in good faith. If you are not satisfied with our response to a complaint, you retain the right to escalate the matter to the relevant supervisory authority in your jurisdiction.