Privacy Policy — bo178

This Privacy Policy ("Policy") sets out the basis on which bo178 ("we", "us", "our") collects, processes, stores, and discloses personal data relating to individuals ("you", "Member") who access or use the bo178 betting platform at https://bo178.cam (the "Platform").

bo178 operates as Indonesia's premier online betting destination, offering sports betting, live casino, togel (Indonesia's traditional numbers lottery) markets, premium slots, and esports wagering to adult players across the Indonesian archipelago. In the course of delivering these services, we necessarily process certain categories of personal data as described in this Policy.

We are committed to handling your personal data responsibly, transparently, and in compliance with applicable international data protection standards. This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall legal framework governing your use of the Platform.

By registering a bo178 Account or continuing to use the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to arrange closure of your Account.

For the purposes of this Policy, bo178 acts as the data controller in respect of the personal data of its Members. As data controller, bo178 determines the purposes and means by which personal data is processed.

Where bo178 engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification partners, and game content providers — those parties act as data processors under binding contractual arrangements that prohibit them from using the data for any purpose other than the specific services they provide to bo178.

For all data-related enquiries, requests, or complaints, you may contact our Data Protection contact directly:

• Email: [email protected] (subject line: "Data Protection Request")
• Response Time: We acknowledge all data requests within 5 business days and provide a substantive response within 30 calendar days.

bo178 collects personal data in the following categories, depending on how you interact with the Platform:

We do not intentionally collect sensitive personal data (such as racial or ethnic origin, health data, religious beliefs, or biometric data beyond standard identity verification) unless strictly required by applicable law or regulatory guidance.

bo178 uses your personal data solely for the following defined purposes:

• Account Administration: Creating, managing, and securing your bo178 Account; verifying your identity at registration and during ongoing KYC reviews; processing password resets and Account-security requests.
• Service Delivery: Processing deposits and withdrawals via your chosen payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja); making available sports betting markets (including BRI Liga 1, EPL, La Liga, Champions League, and Timnas Indonesia fixtures); running live casino, togel markets, and slot games; providing customer support.
• Fraud Prevention and Security: Detecting and preventing account takeover, money laundering, duplicate account creation, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Legal and Regulatory Compliance: Meeting anti-money-laundering (AML) obligations, responding to lawful requests from regulatory or law enforcement authorities, and maintaining records as required by applicable law.
• Responsible Gaming Monitoring: Identifying patterns of play that may indicate problem gambling behaviour; applying deposit limits, cooling-off periods, or self-exclusion at your request or where required by our responsible gaming obligations.
• Service Improvement: Analysing aggregated, anonymised usage data to improve Platform functionality, game offerings, and user experience.
• Marketing Communications (with consent): Sending promotional offers, seasonal bonuses (e.g., Idul Fitri reload bonus, BRI Liga 1 season specials), and platform updates to Members who have opted in. You may withdraw consent at any time.

bo178 processes your personal data on one or more of the following legal bases:

bo178 does not sell, rent, or trade your personal data. We share data only with the categories of recipients described below, and only to the extent necessary for the stated purpose:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction data necessary to process deposits and withdrawals.
• KYC & Identity Verification Partners: Licensed third-party KYC service providers receive the identity documents and personal details required to complete the verification process. These providers are contractually prohibited from using the data for any other purpose.
• Game Content Providers: Studios including Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Pocket Games Soft may receive a session token and anonymised player identifier to facilitate fair-game operation. They do not receive your full identity or financial data.
• Regulatory and Law Enforcement Authorities: Where required by lawful order or legal obligation, bo178 may disclose personal data to relevant government authorities. We will notify you of any such disclosure where legally permitted to do so.
• Professional Advisors: Legal, audit, and compliance professionals engaged by bo178 may access personal data on a need-to-know basis under strict confidentiality obligations.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring of bo178, personal data may be transferred to the successor entity subject to equivalent data protection obligations.

The bo178 Platform uses cookies and similar technologies to ensure the proper functioning of the site, maintain your session state, and collect aggregated analytical data. We do not use third-party advertising cookies or cross-site tracking technologies.

You may manage cookie preferences through your bo178 Account settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in or use the Platform.

bo178 retains personal data for as long as necessary to fulfil the purposes for which it was collected, and no longer. The following retention periods apply:

• Active Account Data: Retained for the duration of your Account's active status plus a minimum of five (5) years following Account closure, to satisfy AML record-keeping obligations.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification, in line with standard financial services compliance requirements.
• Transaction Records: Retained for five (5) years from the date of each transaction.
• Support Communications: Retained for three (3) years from the date of the final communication in a given support thread, or until resolution of any related complaint or legal matter.
• Technical / Log Data: Retained for up to twelve (12) months, after which it is aggregated, anonymised, or deleted.
• Marketing Consent Records: Retained from the date of consent grant until consent withdrawal plus one (1) year, to demonstrate compliance.

Upon the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard deletion procedures. You may request early deletion of your data where there is no overriding legal obligation to retain it — see Section 11 for details on how to exercise this right.

bo178 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• TLS/SSL Encryption: All data in transit between your browser or app and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive personal data — including KYC documents, financial identifiers, and authentication credentials — is encrypted at rest using AES-256 or equivalent standard.
• Access Controls: Internal access to personal data is governed by a strict need-to-know principle. Staff access is role-restricted, logged, and subject to regular review.
• Two-Factor Authentication (2FA): 2FA is available to all Members and is strongly recommended to protect Account access. Internal staff systems mandate 2FA for all personnel with access to Member data.
• Penetration Testing: The Platform undergoes regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses.
• Incident Response: bo178 maintains a documented data breach response procedure. In the event of a security incident that poses a risk to your rights and freedoms, we will notify affected Members and relevant authorities within the timeframes required by applicable law.

bo178 operates on an international infrastructure. In the course of providing its services, your personal data may be transferred to and processed in countries outside Indonesia where bo178's servers, data processors, or third-party service providers are located.

Where such international transfers occur, bo178 takes steps to ensure that an adequate level of data protection is maintained. These steps include:

• Entering into standard contractual clauses or equivalent data transfer agreements with receiving parties.
• Only transferring data to jurisdictions or entities that maintain data protection standards consistent with the principles in this Policy.
• Implementing supplementary technical measures (such as end-to-end encryption) where the adequacy of the destination jurisdiction's data protection framework is uncertain.

By using the bo178 Platform, you acknowledge and consent to the transfer of your personal data to international servers for the purpose of service delivery as described in this Policy.

As a bo178 Member, you hold the following rights in respect of your personal data. To exercise any of these rights, submit your request in writing to [email protected] with the subject line "Data Subject Request" and your Account username.

bo178 will acknowledge all data subject requests within five (5) business days and provide a substantive response within 30 calendar days. Where a request is particularly complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

bo178 does not knowingly collect personal data from persons under 21 years of age. If we become aware that personal data has been collected from a person under 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated Account.

If you believe a person under 21 has registered an Account on the Platform or has access to your Account, please contact us immediately at [email protected]. Parents and guardians are encouraged to use device-level parental controls to prevent underage access to online gambling platforms.

bo178 uses gaming activity data — including bet frequency, session duration, wagering amounts, and win/loss patterns — for the purpose of responsible gaming monitoring. This processing is carried out on the basis of our legitimate interests as a responsible operator and, where applicable, our legal obligations as a licensed platform.

Specifically, this data is used to:

• Identify Members who may be exhibiting signs of problem gambling behaviour and proactively reach out to offer support resources.
• Enforce deposit limits, cooling-off periods, and self-exclusion measures that you have requested through your Account settings or via our support team.
• Honour self-exclusion requests by screening new registration attempts against a list of self-excluded Members to prevent re-registration during the exclusion period.
• Comply with any obligation imposed by our licensing authority to monitor and report on the effectiveness of our responsible gaming programme.

Data processed for responsible gaming purposes is handled with the highest level of confidentiality and is not used for any marketing or commercial purpose. For comprehensive information on the responsible gaming tools available to you, please visit our Responsible Gaming page.

bo178 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. The most current version of this Policy is always available on the Platform at https://bo178.cam/privacy-policy.

Where a proposed amendment is material — meaning it meaningfully changes how we collect, use, or share your personal data — bo178 will provide at least seven (7) calendar days' advance notice via the email address registered to your Account and through a prominent notice on the Platform homepage.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of, and agreement to, the revised Policy. The "Last Updated" date at the top of this page reflects the date on which the current version entered into force.

We encourage you to review this Policy periodically to stay informed about how bo178 protects your privacy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way bo178 handles your personal data, please contact us through any of the following channels:

• Support Email: [email protected] (subject line: "Privacy Policy Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week directly on the Platform.
• Support Hours: WIB (UTC+7) · 24 hours, 7 days a week.

bo178 treats all privacy complaints seriously. Upon receipt of a written complaint, we will:

1. Acknowledge receipt within five (5) business days.
2. Investigate the complaint thoroughly and in good faith.
3. Provide a written response outlining our findings and any remedial action taken within thirty (30) calendar days.