Privacy Policy

Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "ayu138" / "we" / "us" / "our" — the ayu138 online betting and casino platform, accessible at ayu138.cam, and all associated interfaces operated under the ayu138 brand.
• "You" / "Player" / "Data Subject" — any individual who registers an account, visits the ayu138 website, or otherwise interacts with the platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including name, email address, phone number, national identity number, financial account details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. ayu138 acts as the Data Controller for all Personal Data processed in connection with player accounts.
• "Data Processor" — a third party that processes Personal Data on behalf of ayu138 under a binding contractual arrangement (e.g., payment gateway providers, KYC verification services).
• "Cookie" — a small text file stored on your device by the ayu138 website that enables functionality, analytics, and session management.
• "KYC" — Know Your Customer; the identity and age verification process mandated before withdrawal processing.
• "WIB" — Western Indonesia Time (UTC+7), the primary operational timezone for ayu138.

Data Controller

ayu138 is the Data Controller responsible for the Personal Data you provide and that is generated through your use of the ayu138 platform. As Data Controller, ayu138 determines why and how your personal information is processed, and bears full responsibility for ensuring that processing is conducted lawfully, fairly, and transparently.

For all data protection inquiries, subject access requests, or complaints relating to how ayu138 handles your Personal Data, please refer to the contact details set out in Clause 16 of this Policy.

Data We Collect

ayu138 collects the following categories of Personal Data from players and platform visitors:

3.1 Identity & Registration Data

• Full legal name (as it appears on your KTP or passport);
• Date of birth;
• Gender (optional, for promotional profiling only);
• Nationality and country of residence;
• Indonesian National Identity Card (KTP) number or passport number (collected during KYC).

3.2 Contact Data

• Email address (primary account communication channel);
• Indonesian mobile phone number (used for OTP verification and account security);
• City of residence (e.g., Jakarta, Surabaya, Bandung, Medan, Bali — used for regional promotional targeting).

3.3 Financial Data

• Bank account name and account number for linked local bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata);
• E-wallet identifiers for linked services (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Deposit and withdrawal transaction records, including amounts in IDR, timestamps, and payment method used.

3.4 Transactional & Gaming Data

• Betting history, including markets wagered, stakes placed, and outcomes;
• Game session data, including session start/end times, games played, and wager volumes;
• Account balance history and bonus redemption records.

3.5 Technical & Device Data

• IP address and geolocation derived from IP;
• Device type, operating system, browser type and version;
• Unique device identifiers;
• Session cookies and login timestamps.

3.6 KYC Verification Documents

• Scanned or photographed copies of government-issued identity documents;
• Selfie photographs taken as part of liveness verification;
• Proof of payment method ownership (e.g., mobile banking screenshots).

How We Collect Data

ayu138 collects Personal Data through the following channels:

• Directly from you: when you complete the registration form, submit KYC documents, contact our support team, or update your account profile;
• Automatically: through cookies, web beacons, server logs, and analytics tools as you browse and interact with the ayu138 platform;
• From third-party service providers: identity verification agencies, payment processors, and fraud detection services may supply supplementary data to verify or enrich your account record;
• From publicly available sources: where permitted by law, ayu138 may cross-reference publicly available identity records to assist in KYC or fraud investigation processes.

Purposes of Processing

ayu138 processes your Personal Data for the following clearly defined purposes:

Legal Basis for Processing

ayu138 processes your Personal Data on the following legal grounds:

• Contractual necessity: processing required to fulfill the agreement between you and ayu138, including account management, payments, and game delivery;
• Legal obligation: processing required to comply with applicable anti-money laundering regulations, identity verification mandates, and financial reporting requirements;
• Legitimate interests: processing necessary to protect the platform against fraud, maintain security, and improve service quality, provided such interests are not overridden by your fundamental rights;
• Consent: where you have given explicit consent — for example, opting in to receive promotional offers by email or SMS. You may withdraw consent at any time by contacting our support team or updating your communication preferences in your account settings.

Data Sharing & Disclosure

ayu138 does not sell, license, or trade your Personal Data to unaffiliated third parties for their own commercial purposes. We may, however, share your data with the following categories of recipients where strictly necessary:

• Payment service providers: local bank systems (BCA, BRI, BNI, Mandiri and others) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) — solely to process transactions you have initiated;
• KYC and identity verification providers: specialist third-party agencies that assist in verifying your identity and age in compliance with our legal obligations;
• Game studio partners: providers such as Evolution Gaming, Pragmatic Play, and Pocket Games Soft receive limited session and game-state data necessary to operate games within the platform;
• Fraud detection and security services: external cybersecurity and risk management providers that help identify and prevent fraudulent activity;
• Regulatory authorities and law enforcement: where required by applicable law, court order, or legitimate regulatory demand — ayu138 will disclose data to competent authorities;
• Group companies: affiliated entities within the ayu138 corporate structure, subject to the same data protection standards set out in this Policy.

Data Retention

ayu138 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be attributed to an identifiable individual. Where data is anonymized rather than deleted, it may be retained indefinitely for aggregated statistical or analytical purposes.

Data Security

ayu138 applies a multi-layered security framework to protect your Personal Data against unauthorized access, accidental loss, destruction, alteration, and unlawful disclosure. Our technical and organizational security measures include:

• SSL/TLS encryption: all data transmitted between your device and the ayu138 platform is encrypted using industry-standard Transport Layer Security (TLS 1.2 or higher);
• Encryption at rest: sensitive Personal Data stored in ayu138 databases — including identity documents and financial account details — is encrypted at rest using AES-256 encryption;
• Access controls: internal access to Personal Data is restricted on a strict need-to-know basis, with role-based access controls and multi-factor authentication required for all administrative systems;
• Intrusion detection and monitoring: ayu138 operates continuous network monitoring and intrusion detection systems to identify and respond to anomalous activity in real time;
• Regular security audits: the platform undergoes periodic third-party penetration testing and security assessments to identify and remediate vulnerabilities before they can be exploited;
• Staff training: all ayu138 personnel with access to personal data undergo mandatory data protection and security awareness training.

In the event of a data security incident that is likely to result in a risk to your rights and freedoms, ayu138 will notify affected Players without undue delay and take all reasonable steps to contain, investigate, and remediate the incident.

Cookies & Tracking Technologies

The ayu138 website uses cookies and similar tracking technologies to provide a functional, secure, and personalized browsing experience. By continuing to use the ayu138 platform, you consent to the use of cookies as described in this clause.

10.1 Types of Cookies Used

10.2 Managing Cookies

You may configure your browser to refuse all cookies or to alert you when cookies are being sent. Please note that disabling strictly necessary cookies will impair or entirely prevent your ability to log in and use the ayu138 platform. Analytics and marketing cookies can be disabled without affecting core platform functionality.

For instructions on managing cookies in your specific browser (Chrome, Firefox, Safari, Samsung Internet, or others commonly used in Indonesia), please consult your browser's help documentation.

Your Rights

As a Player whose Personal Data is processed by ayu138, you hold the following rights with respect to your information. To exercise any of these rights, please contact us using the details provided in Clause 16.

• Right of Access: you may request a copy of all Personal Data that ayu138 holds about you, together with information about how that data is processed and with whom it has been shared.
• Right to Rectification: if any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. For name or date-of-birth corrections, updated identity documentation may be required.
• Right to Erasure ("Right to be Forgotten"): you may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis for processing exists. Note that ayu138 may be legally required to retain certain data (e.g., financial transaction records) even following an erasure request.
• Right to Restriction of Processing: you may request that ayu138 limits the processing of your Personal Data in specific circumstances, such as where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to Data Portability: where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to Object: you have the right to object at any time to processing of your Personal Data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case ayu138 will cease processing unless compelling legitimate grounds exist that override your interests.
• Right to Withdraw Consent: where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

ayu138 will respond to all valid rights requests within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, ayu138 may extend this period by a further 60 days, in which case you will be notified of the extension and the reasons for it.

Minors & Age Restriction

The ayu138 platform is strictly intended for adults aged 21 years or older. ayu138 does not knowingly collect Personal Data from any individual under the age of 21. Registration by minors is prohibited, and any account identified as belonging to a person under 21 years of age will be immediately closed and all associated balances forfeited.

If you believe that a minor has registered an account on ayu138 using false information, please notify us immediately via the contact details in Clause 16. Upon receiving a credible report, ayu138 will investigate and, if confirmed, delete all associated Personal Data without undue delay.

Parents and guardians are encouraged to use parental control software to restrict access to online gambling platforms. ayu138 supports responsible access to gambling services and cooperates fully with legitimate child-protection initiatives.

International Data Transfers

ayu138 operates as an international platform. Certain Data Processors engaged by ayu138 — including game studio partners such as Evolution Gaming, Pragmatic Play, and Pocket Games Soft, as well as cybersecurity and analytics vendors — may be located outside Indonesia. Where your Personal Data is transferred to a jurisdiction that does not maintain an equivalent level of data protection, ayu138 ensures appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating internationally recognized standard contractual clauses;
• Binding corporate rules where applicable within affiliated corporate groups;
• Technical and organizational measures that maintain the security standards described in Clause 9 regardless of where data is processed.

By registering an account with ayu138, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Indonesia in the circumstances described above, subject to the safeguards specified herein.

Third-Party Services

The ayu138 platform integrates third-party services necessary for its operation, including payment gateways, game studios, and security tools. While ayu138 carefully selects all third-party partners and requires them to maintain appropriate data protection standards, we are not responsible for the privacy practices of independent third parties once data leaves our direct control under a lawful disclosure.

This Privacy Policy does not extend to the privacy practices of third-party game providers or financial institutions you interact with in connection with your ayu138 account. We encourage you to review the privacy policies of any third-party service that handles your data, including your chosen local bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others) and e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja).

Policy Amendments

ayu138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. Where changes are material — meaning they significantly affect how we collect, use, or share your Personal Data — we will notify you by in-app notification or email to your registered address at least 7 days before the revised Policy takes effect.

Non-material amendments (such as editorial corrections or clarifications that do not alter the substance of our data processing activities) may be made without advance notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Your continued use of the ayu138 platform following the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with a material change, you should cease using the platform and request account closure before the effective date.

Contact & Data Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your Personal Data by ayu138, please contact our support team through the following channel:

ayu138 will acknowledge all data-related inquiries within 3 business days (WIB) and provide a substantive response within 30 calendar days as required under applicable privacy standards. Where a request cannot be fulfilled — for example, where legal retention obligations prevent deletion — we will explain the reasons in full.

For additional guidance on your rights as a player, we also recommend reviewing our Responsible Gaming page and our full Terms & Conditions.