Privacy Policy

1 Introduction

duit8 is committed to handling personal data with the highest standards of care, transparency, and accountability. We understand that the players who trust us with their information — across Jakarta, Surabaya, Medan, Bandung, Bali, and throughout Indonesia — deserve to know precisely how that information is managed. This policy is written in plain, accessible English so that every Member can understand their rights and our obligations, without having to wade through impenetrable legal jargon.

This Privacy Policy should be read alongside the duit8 Terms & Conditions and our Responsible Gaming policy, both of which contain additional provisions that relate to the processing of Member data in specific contexts such as KYC verification and self-exclusion management.

If you have any questions about how duit8 uses your personal data at any time, you are encouraged to contact us before registering an account. Our support team is available around the clock and can be reached at the address provided in Clause 14 of this policy.

2 Data We Collect

duit8 collects personal data that falls into two broad categories: data you provide to us directly, and data generated automatically as a result of your interactions with the platform. The specific types of data collected are set out in the table below.

duit8 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly required for identity verification purposes. Where identity document photographs are collected as part of KYC, they are processed solely for verification and stored in accordance with the retention schedule described in Clause 8.

3 How We Collect Data

duit8 collects personal data through the following means:

• Direct submission: You provide data to us when you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team, participate in a promotion, or update your account profile.
• Automated collection: When you access duit8.asia, our servers automatically record technical data including your IP address, device identifiers, browser characteristics, and session activity. This data is collected via server logs, cookies, and similar tracking technologies as described in Clause 7.
• Third-party sources: duit8 may receive data about you from payment processors (e.g., when a BCA, BRI, BNI, or Mandiri bank transfer is initiated), identity verification service providers used during KYC, fraud detection and anti-money laundering screening services, and publicly available sources where permitted by applicable law.
• Platform activity: Your gameplay activity — including every wager placed, game session initiated, and bonus claimed — is recorded automatically as part of normal platform operations. This data is essential for account integrity, dispute resolution, and regulatory compliance.

4 Purpose of Processing

duit8 processes personal data only for specific, documented purposes. We do not use your data in ways that are incompatible with the reasons for which it was originally collected. The primary purposes for which we process Member data are as follows.

• Account management: Creating, maintaining, and operating your duit8 Member account, including processing login credentials, managing account preferences, and communicating account-related notifications.
• Identity verification (KYC): Verifying that you are who you claim to be, that you meet the minimum age requirement of 21 years, and that your payment methods are registered in your own name — all mandatory requirements before withdrawal privileges are activated.
• Payment processing: Facilitating deposits and withdrawals in Indonesian Rupiah (IDR) via local bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet services (OVO, DANA, GoPay, ShopeePay, LinkAja), and maintaining accurate financial records of all transactions.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, bonus abuse, and other forms of platform misuse. This includes automated risk-scoring of transactions and gameplay patterns.
• Legal and regulatory compliance: Meeting our obligations under applicable anti-money laundering (AML), know-your-customer (KYC), and data protection laws and regulations, including record-keeping requirements imposed by our operating licence.
• Customer support: Responding to your queries, processing complaints, and resolving disputes in a timely and documented manner.
• Responsible gaming: Monitoring gameplay patterns for signs of problem gambling, administering self-exclusion and deposit limit tools, and communicating with Members who request responsible gaming interventions.
• Service improvement: Analyzing aggregated, anonymized usage data to improve platform performance, game selection, payment processing speeds, and overall Member experience.
• Marketing communications: Sending promotional offers, bonus notifications, and seasonal promotions (such as Idul Fitri, Ramadhan, and Indonesian Independence Day campaigns) to Members who have opted in to receive marketing communications. You may opt out at any time by contacting support.

5 Legal Basis for Processing

duit8 relies on the following legal bases when processing your personal data:

• Contractual necessity: Processing required to enter into and perform our agreement with you as a Member — including account creation, KYC, payment processing, and gameplay services.
• Legal obligation: Processing necessary to comply with applicable laws, including AML obligations, tax record-keeping, and regulatory reporting requirements imposed by our licensing authority.
• Legitimate interests: Processing carried out for the legitimate interests of duit8 or our Members, where those interests are not overridden by your privacy rights — including fraud prevention, platform security, and service improvement through anonymized analytics.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of optional marketing communications. Where consent is the basis for processing, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing & Third Parties

duit8 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

• Payment processors and banking partners: Your name, account number, and transaction details are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing your deposit or withdrawal instruction.
• KYC and identity verification providers: Where duit8 uses a third-party identity verification service to cross-check your submitted KTP and supporting documents, that provider receives only the data necessary to perform the verification check. Such providers are contractually bound to process the data solely for verification purposes and to apply equivalent data security standards.
• Fraud prevention and AML screening services: Transaction data and account identifiers may be shared with licensed fraud detection and AML compliance service providers to screen for suspicious activity. These providers act as data processors under strict contractual instructions from duit8.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized session identifiers or game-specific player tokens required for game functionality. These providers do not receive your name, contact information, or financial data.
• Legal and regulatory authorities: duit8 will disclose personal data to law enforcement agencies, regulators, or courts where required to do so by applicable law, by court order, or where disclosure is necessary to protect the rights, property, or safety of duit8, its Members, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of duit8's assets, Member data may be transferred to the acquiring entity. Affected Members will be notified in advance and given the opportunity to close their accounts if they do not wish their data to be transferred.

All third parties with whom duit8 shares personal data are required to maintain appropriate technical and organizational security measures and to process data only in accordance with duit8's documented instructions.

7 Cookies & Tracking Technologies

duit8.asia uses cookies and similar technologies to deliver a secure, functional, and personalized experience. Cookies are small text files stored on your device when you visit a website. They allow us to recognize your browser, maintain your session, and remember your preferences.

• Essential cookies: Required for the platform to function correctly. These include session authentication tokens, security tokens, and load-balancing identifiers. The platform cannot operate without these cookies, and they cannot be disabled.
• Functional cookies: Used to remember your preferences such as language settings, odds display format, and last-visited game category. These cookies improve your browsing experience but are not strictly required for core functionality.
• Analytics cookies: Used to collect anonymized data about how Members use duit8.asia — which pages are visited most frequently, where users enter and exit the site, and how long sessions last. This data is used solely to improve the platform and is never linked back to individual identifiable Members.
• Security cookies: Used to detect and prevent fraudulent login attempts, CSRF attacks, and other security threats. These cookies record signals such as mouse movement patterns and typing cadence to distinguish legitimate users from automated bots.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging into your duit8 account and using the platform's core features. For all other cookie types, you may opt out via your browser without affecting your ability to access the platform.

8 Data Retention

duit8 retains personal data for as long as is necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The following general retention periods apply.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be linked to an identifiable individual. Anonymized data may be retained indefinitely for statistical and analytical purposes.

9 Data Security

duit8 implements comprehensive technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security infrastructure includes the following controls.

• 256-bit SSL/TLS encryption: All data transmitted between your device and duit8.asia is encrypted using industry-standard TLS protocols, preventing interception during transit.
• Encryption at rest: Sensitive personal data — including KYC documents, payment account details, and account credentials — is encrypted at rest using AES-256 encryption on our database servers.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. duit8 staff are granted only the minimum level of data access required to perform their specific role, and all access events are logged and audited.
• Two-factor authentication (2FA): Administrative access to systems holding personal data requires multi-factor authentication. Members are strongly encouraged to enable 2FA on their own duit8 accounts for additional protection.
• Regular security assessments: duit8 conducts periodic vulnerability assessments and penetration testing of its platform infrastructure to identify and remediate security weaknesses proactively.
• Incident response: In the event of a data breach that poses a risk to the rights and freedoms of affected Members, duit8 will notify impacted individuals and relevant regulatory authorities within the timeframes required by applicable law. Notification will be sent to the email address registered on the affected account.

While duit8 takes all reasonable steps to protect your data, no internet-based service can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account password and for logging out of your account when using a shared or public device.

10 Your Rights

As a data subject, you hold a set of rights over your personal data held by duit8. We are committed to facilitating the exercise of these rights promptly and without undue burden. The rights available to you are described below.

To exercise any of the above rights, please contact duit8 at the email address provided in Clause 14. We will acknowledge your request within 5 business days and aim to fulfill all valid requests within 30 calendar days. In complex cases, this period may be extended by a further 60 days, and you will be informed of any such extension in writing.

Please note that certain rights are subject to limitations. For example, duit8 cannot delete data that is required to be retained for AML/KYC compliance or that is necessary to resolve an open dispute. Where a request cannot be fulfilled in full, we will explain the specific legal basis for any limitation applied.

11 Children's Privacy

duit8 is strictly an adults-only platform. You must be at least 21 years of age to register an account and use any of duit8's services. We do not knowingly collect personal data from any individual under the age of 21.

If duit8 discovers, through KYC verification or any other means, that an account has been registered by a person under the age of 21, the account will be immediately suspended and all associated funds returned to the verified payment method on file. Any Bonus Funds credited to the account will be forfeited.

If you are a parent or guardian and believe that a minor has registered a duit8 account using false age information, please contact us immediately at [email protected]. We will investigate the matter promptly and take all appropriate action.

12 International Data Transfers

duit8 operates as an internationally licensed platform. In the course of providing our services, personal data may be processed on servers or by service providers located outside Indonesia. Where such international transfers occur, duit8 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required in the jurisdiction of our operating licence.

Safeguards used for international data transfers include contractual clauses requiring recipient organizations to apply data protection standards consistent with those described in this policy, technical encryption measures ensuring data remains protected in transit and at rest regardless of geographic location, and vendor due diligence processes that assess the data protection and security practices of all third-party processors before engagement.

By using duit8, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Indonesia. Such transfers are carried out only to the extent necessary to provide the services described in this policy and are always subject to the safeguards described above.

13 Changes to This Policy

duit8 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. When material changes are made, we will update the "Last updated" date at the top of this page and, where practical, notify active Members by sending a notification to their registered email address.

Your continued use of duit8.asia and its services after the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms. If the revised policy is not acceptable to you, you should stop using the platform and request account closure in accordance with the account termination provisions in our Terms & Conditions.

We recommend that you review this page periodically to stay informed of how duit8 protects your personal data. The most current version of this Privacy Policy is always available at duit8.asia/privacy-policy.

14 Contact Us

If you wish to exercise any of your data rights, have a question about this Privacy Policy, or wish to raise a concern about how duit8 has handled your personal data, please contact our support team using the details below. All privacy-related inquiries are treated with priority and handled by trained staff.

For matters relating to responsible gaming or account self-exclusion, please also refer to our Responsible Gaming page. For general questions about your account, deposits, or bonuses, our FAQ page covers the most common topics.