Privacy Policy

Introduction

top138 operates as an online gaming platform primarily serving Indonesian players. We understand that your personal data is valuable and that you have a right to know how it is handled. This Policy sets out our commitment to transparency and to handling your data with the care, integrity, and discretion you deserve.

We process personal data only to the extent necessary to provide you with a secure, personalised, and compliant gaming experience. We do not sell your personal data to third parties for advertising or marketing purposes, and we do not use your data in ways that are inconsistent with the purposes described in this Policy.

This Policy applies to all personal data collected through the top138 website, mobile-optimised site, any associated applications, customer support interactions, and communications sent to or from top138. It does not apply to third-party websites that may be linked from our Platform; those sites operate under their own separate privacy policies.

Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, identification numbers, location data, online identifiers, and data specific to physical, economic, or social identity.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" means top138, the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of top138 under a written data-processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of your Personal Data.
• "Cookie" means a small text file placed on your device by the Platform to facilitate session management, analytics, and personalisation.
• "KYC" means Know Your Customer — the identity and document-verification process required by top138 prior to processing withdrawals or upon request.
• "Sensitive Data" means Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric or genetic data, health data, or data concerning sexual orientation.

Data We Collect

top138 collects the following categories of Personal Data, depending on how you interact with the Platform:

top138 does not intentionally collect Sensitive Data. If any Sensitive Data is incidentally disclosed during a support interaction, it will be handled with the strictest confidentiality and deleted as soon as it is no longer needed for the relevant support purpose.

How We Collect Data

We collect Personal Data through the following means:

• Direct interactions: Data you provide when creating an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or updating your profile settings.
• Automated technologies: Technical and Usage Data collected automatically via cookies, web beacons, server logs, and similar tracking technologies when you access and navigate the Platform.
• Third-party service providers: Identity and financial verification data received from our KYC verification partners, payment processors, and fraud-detection providers when they process information on our behalf.
• Third-party game studios: Aggregated gameplay statistics and RNG audit logs received from certified game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft.

Purposes of Processing

top138 processes your Personal Data for the following specific purposes:

• Account management: Creating, verifying, maintaining, and closing your Account; authenticating your identity at login; communicating account-related notifications.
• KYC & compliance: Verifying your identity and age (21+ requirement) in accordance with our Terms & Conditions and applicable anti-money-laundering obligations.
• Payment processing: Facilitating deposits and withdrawals via Indonesian bank transfers (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); maintaining accurate financial records.
• Game delivery: Providing access to sports betting markets (including BRI Liga 1, EPL, Champions League), live casino games, slot machines, togel lottery draws, and all other Platform games.
• Fraud prevention & security: Detecting and preventing fraudulent activity, money laundering, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: Administering player-protection tools (deposit limits, self-exclusion, session limits, reality checks) and monitoring for indicators of problem gambling behaviour.
• Customer support: Responding to your inquiries, resolving complaints, and improving the quality of our 24/7 Indonesian-speaking support service.
• Platform improvement: Analysing Usage Data and Technical Data (in anonymised or aggregated form where possible) to improve Platform performance, user experience, and game offerings.
• Marketing communications: Sending you promotional offers, bonus notifications, and tournament announcements — only where you have provided explicit consent or where permitted by applicable law. You may opt out at any time.
• Legal compliance: Meeting our obligations under applicable law, responding to lawful requests from regulatory or law-enforcement authorities, and enforcing our Terms & Conditions.

Legal Basis for Processing

top138 relies on the following legal bases for processing your Personal Data:

• Contractual necessity: Processing required to perform the contract between you and top138 — specifically, operating your Account, processing payments, and providing access to games. Without this processing, we cannot provide the Platform services.
• Legal obligation: Processing necessary to comply with applicable legal requirements, including identity verification (KYC), anti-money-laundering checks, record-keeping obligations, and responses to lawful regulatory inquiries.
• Legitimate interests: Processing carried out for top138's legitimate business interests — fraud detection, security monitoring, Platform analytics, and customer support quality assurance — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing of your data for optional marketing communications, non-essential cookies, and personalised promotional content, where you have given us clear and specific consent. You may withdraw consent at any time by contacting our support team or adjusting your Account preferences.

Data Sharing

top138 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We may share your data only in the following limited circumstances:

• KYC and identity verification providers: We share Identity Data and Financial Data with certified third-party verification services to fulfil our age-verification (21+) and anti-money-laundering obligations. These providers act as Data Processors under binding agreements that restrict their use of your data solely to verification purposes.
• Payment processors and banking partners: We share Financial Data with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) strictly to process your deposits and withdrawals. These entities operate under their own regulatory frameworks and privacy obligations.
• Game studio providers: Aggregated, non-personally-identifiable gameplay data may be shared with certified game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) for game-integrity auditing and RNG certification purposes.
• Fraud prevention and security partners: Technical Data and Transaction Data may be shared with specialist fraud-detection and cybersecurity providers to identify and prevent prohibited conduct on the Platform.
• Professional advisers: We may disclose Personal Data to our legal counsel, auditors, or insurers on a strictly confidential, need-to-know basis where required for the provision of professional services to top138.
• Law enforcement and regulatory authorities: We will disclose Personal Data to government bodies, law-enforcement agencies, or regulators where we are legally obligated to do so, or where disclosure is necessary to protect the rights, property, or safety of top138, our Players, or the public.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of top138's business, your Personal Data may be transferred to the acquiring entity. We will notify you via email prior to such a transfer and ensure that your data continues to be protected under terms at least as protective as this Policy.

International Data Transfers

8.1 top138 primarily processes and stores Personal Data within data centres located in Asia-Pacific jurisdictions. However, some of our third-party service providers — including game studios and KYC verification partners — may process data in jurisdictions outside Indonesia.

8.2 Where Personal Data is transferred internationally, top138 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses (data-processing agreements) that impose data-protection obligations equivalent to those described in this Policy;
• Transfers only to providers operating in jurisdictions recognised as providing an adequate level of data protection;
• Regular due-diligence reviews of all international Data Processors to confirm ongoing compliance.

8.3 By using the Platform, you acknowledge that your Personal Data may be processed in jurisdictions whose data-protection laws may differ from those of Indonesia. top138 takes all reasonable steps to ensure your data is treated securely regardless of where it is processed.

Data Retention

9.1 top138 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

9.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with any individual. Where anonymisation is not technically feasible, data is securely destroyed in accordance with industry-standard data-disposal procedures.

Your Rights

10.1 Subject to applicable law and certain limited exceptions, you have the following rights in relation to your Personal Data held by top138:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. For certain data fields (e.g., name, date of birth), correction will require re-submission of supporting KYC documents.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to legal retention obligations that may require us to retain certain data notwithstanding your request.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances, such as where you contest its accuracy or where processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or carried out for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

10.2 To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days of receiving a valid request. In complex cases, we may extend this period by a further 30 days, with prior notice to you.

10.3 We may need to verify your identity before processing a data-rights request. This is a security measure to ensure Personal Data is not disclosed to any person who does not have the right to receive it.

Cookies & Tracking Technologies

11.1 top138 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. They enable core features such as Account login sessions, security, and transaction processing. These cookies cannot be disabled without rendering the Platform non-functional.
• Performance & Analytics Cookies: Collect anonymised information about how users interact with the Platform — pages visited, error messages encountered, session durations — to help us improve performance and user experience. No personally identifiable information is stored by these cookies.
• Functional Cookies: Remember your preferences (e.g., preferred language, last visited game category, currency display) to provide a more personalised experience on return visits.
• Marketing & Targeting Cookies: Used only with your explicit consent to deliver relevant promotional content and to measure the effectiveness of our marketing campaigns. You may opt out of these cookies at any time via your browser settings or by contacting our support team.

11.2 Most web browsers allow you to manage your cookie preferences through the browser's settings menu. Please note that disabling cookies beyond strictly necessary ones may affect the functionality and personalisation features of the Platform.

11.3 top138 does not use any cross-site tracking technologies to follow your activity on third-party websites beyond the top138 Platform.

Data Security

12.1 top138 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• At-rest encryption for all Personal Data stored in our databases;
• Multi-factor authentication (MFA) options for Account login;
• Role-based access controls ensuring that only authorised top138 personnel can access Personal Data, and only to the extent required for their specific role;
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists;
• 24/7 security monitoring of network infrastructure for anomalous access patterns and potential breaches;
• Documented incident-response procedures to contain, investigate, and report any data breach within required timeframes.

12.2 While top138 takes every reasonable precaution to protect your data, no internet-based system is completely immune to security risks. You are responsible for maintaining the confidentiality of your Account password and for ensuring that your device is protected by up-to-date security software.

12.3 In the event of a data breach that is likely to result in a high risk to your rights and freedoms, top138 will notify affected Players without undue delay via the email address registered to their Account.

Minors

13.1 The top138 Platform is strictly restricted to persons who are at least 21 years of age. We do not knowingly collect, process, or store Personal Data from individuals under the age of 21.

13.2 If top138 discovers or is notified that Personal Data has been collected from a person under 21, we will immediately close the associated Account, void all transactions, and delete the relevant Personal Data as quickly as reasonably practicable, subject to any overriding legal retention obligations.

13.3 If you are a parent or guardian and believe that a person under your care has provided Personal Data to top138 without your knowledge, please contact our support team immediately at [email protected] with the subject line "Minor Account Report".

Policy Updates

14.1 top138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or Platform operations. The "Effective Date" displayed at the top of this page will be updated accordingly whenever a new version is published.

14.2 Where changes are material — meaning they substantively affect how we process your Personal Data or the rights available to you — we will notify you via email to your registered address at least seven (7) days before the changes take effect.

14.3 Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and contact our support team to close your Account.

14.4 We encourage you to review this page periodically to stay informed about how top138 protects your Personal Data. The current version is always available at https://top138.cam/privacy-policy.

Contact Us

15.1 If you have any questions, concerns, or complaints regarding this Privacy Policy or the way top138 handles your Personal Data, please contact our dedicated privacy team through the following channels:

• Email: [email protected] — use the subject line "Privacy Inquiry" for fastest routing
• Live Chat: Available 24 hours a day, 7 days a week via the Platform
• Response Time: Privacy-related inquiries are typically handled within 5 business days; data-rights requests within 30 calendar days
• Support Hours: 24/7, including Indonesian public holidays such as Idul Fitri, Independence Day (17 August), Nyepi, and Waisak

15.2 For data-rights requests (access, rectification, erasure, portability), please include your full registered name, Account email address, and a clear description of your request. We may ask you to verify your identity before processing the request.