Privacy Policy

1. Introduction

1.1  co888 is an internationally operated online betting and gaming platform serving the Indonesian market. As part of providing our services, we collect and process personal data about our registered players and, in some cases, visitors to our platform who have not yet registered.

1.2  This Privacy Policy sets out in full how co888 collects, uses, stores, protects, and — where applicable — shares personal data. It also describes the rights you hold in relation to your data and the mechanisms through which you may exercise those rights.

1.3  This Policy should be read alongside co888's Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions on a privacy matter, this Policy shall take precedence.

1.4  co888 may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page will reflect the most recent revision. Registered players will be notified of material changes via the email address on their account prior to those changes taking effect.

2. Definitions

• "Personal Data" means any information that identifies or could reasonably be used to identify a specific individual, including name, email address, phone number, IP address, financial account details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" means the individual to whom the personal data relates — in most cases, you, the registered player or platform visitor.
• "Data Controller" means co888, which determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means a third-party organisation that processes personal data on co888's behalf, subject to a contractual data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification procedures co888 conducts on all registered accounts.

3. Data We Collect

3.1  co888 collects the following categories of personal data:

3.2  co888 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (other than where a selfie is required for KYC), health data, or data about sexual orientation.

4. How We Collect Data

4.1  Directly from you: The majority of personal data co888 holds is provided directly by you during account registration, KYC submission, deposit/withdrawal transactions, and communications with our support team.

4.2  Automatically from your device: When you access the co888 platform, our servers and analytics tools automatically record technical and usage data, including your IP address, device identifiers, and browsing behaviour on the platform. This data is collected via server logs, cookies, and similar tracking technologies (see Section 7 for full cookie details).

4.3  From third-party service providers: co888 may receive personal data from the following third-party sources:

• Payment processors and Indonesian banking partners (transaction confirmation data, fraud flags)
• KYC and identity verification service providers (verification outcomes, risk scores)
• Fraud detection and anti-money-laundering screening services
• Technical infrastructure providers (server logs, error reports)

5. Purposes & Legal Basis for Processing

5.1  co888 processes your personal data only for the specific purposes listed below. For each purpose, we identify the legal basis on which we rely:

5.2  co888 does not use personal data for automated decision-making processes that produce legal or similarly significant effects without human oversight, except where required by anti-money-laundering or fraud-screening obligations, in which case affected players may request a human review of any automated determination.

6. Data Sharing

6.1  co888 does not sell, rent, or trade personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for each stated purpose.

6.1 Payment Processors & Banking Partners

To facilitate deposits and withdrawals in Indonesian Rupiah (IDR / Rp), co888 shares relevant transaction and identity data with payment processing partners, including Indonesian banking institutions (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). These partners receive only the minimum data required to execute and confirm each transaction.

6.2 KYC & Identity Verification Providers

co888 engages specialist third-party KYC service providers to verify player identities and ages. These providers receive identity documents and related data solely for the purpose of performing verification checks. All KYC partners are bound by strict contractual data processing agreements and are prohibited from using player data for any other purpose.

6.3 Fraud Prevention & AML Screening

To protect the platform and its players from fraud, money laundering, and other financial crime, co888 shares relevant transaction and identity data with specialist fraud detection and anti-money-laundering screening services. These services process data on co888's behalf under binding data processing agreements.

6.4 Technology & Infrastructure Providers

co888's platform is hosted and maintained with the assistance of third-party technology providers, including cloud hosting services, database management providers, and cybersecurity firms. These providers may process technical data incidentally in the course of providing infrastructure services. All are bound by contractual obligations consistent with this Policy.

6.5 Game Content Providers

Game studios whose content is available on co888 — including Pragmatic Play, Evolution Gaming, Pocket Games Soft, Microgaming, NetEnt, and Spribe — may receive limited technical and session data necessary to deliver their game content to your device. These studios do not receive your financial account details or identity documents.

6.6 Legal & Regulatory Disclosure

co888 may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other governmental authorities where required to do so by applicable law, court order, or binding regulatory direction. In such cases, co888 will disclose only the minimum data required to satisfy the legal obligation and will notify the affected player where legally permitted to do so.

7. Cookies & Tracking Technologies

7.1  co888 uses cookies and similar tracking technologies to maintain platform functionality, analyse usage patterns, and support fraud prevention. The following categories of cookies are used:

7.2  co888 does not use third-party advertising or behavioural targeting cookies. No data collected via cookies on the co888 platform is shared with advertising networks or used to serve targeted advertisements on external websites.

7.3  You may configure your browser to block or delete cookies at any time. However, disabling strictly necessary cookies will impair or prevent platform functionality, including login and payment processing. Disabling functional cookies may affect your user experience but will not prevent access to core platform features.

8. Data Retention

8.1  co888 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, plus any additional period required by applicable law or regulation. The following retention periods apply:

8.2  Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any identifiable individual. Anonymised, aggregated data — from which no individual can be identified — may be retained indefinitely for statistical and platform improvement purposes.

9. Data Security

9.1  co888 employs a layered security architecture to protect personal data from unauthorised access, disclosure, alteration, or destruction. Key technical and organisational security measures include:

• 256-bit SSL/TLS encryption for all data in transit between player devices and co888's servers.
• AES-256 encryption for sensitive personal and financial data stored in co888's databases.
• Role-based access controls ensuring that staff members can only access personal data that is relevant to their specific job function.
• Multi-factor authentication required for all co888 employee access to systems holding personal data.
• Regular penetration testing and independent security audits conducted by qualified third-party cybersecurity firms.
• Automated anomaly detection systems that flag and investigate unusual access patterns in real time.
• Physical security controls at all co888-operated data processing facilities, including access logging and CCTV monitoring.

9.2  In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, co888 will notify affected players without undue delay, and in any event within 72 hours of the Company becoming aware of the breach, where technically and operationally feasible.

9.3  While co888 takes every reasonable precaution, no internet-based platform can guarantee absolute security. Players are encouraged to use strong, unique passwords for their co888 accounts and to enable any available two-factor authentication features. If you suspect your account has been compromised, contact co888 support immediately.

10. International Data Transfers

10.1  As an internationally operated platform, co888 may transfer personal data to countries outside of Indonesia for storage or processing by third-party service providers. Such transfers may occur in connection with cloud hosting, KYC verification, or fraud prevention services.

10.2  Where personal data is transferred internationally, co888 ensures that appropriate safeguards are in place prior to the transfer, including one or more of the following mechanisms:

• Transfer to a country recognised as providing an adequate level of data protection by the relevant regulatory authority.
• Standard contractual clauses or equivalent data transfer agreements binding the recipient to obligations equivalent to those in this Policy.
• Binding corporate rules applicable to co888's group entities and approved processors.

10.3  Players may request information about the specific safeguards applicable to any particular international transfer of their data by contacting the co888 privacy team at the address set out in Section 15 of this Policy.

11. Your Rights

11.1  As a data subject, you hold the following rights in relation to the personal data co888 processes about you. These rights may be exercised by contacting the co888 support team as described in Section 15:

11.2  co888 will respond to all rights requests within 30 calendar days of receipt. Where a request is complex or co888 receives a high volume of requests, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.

11.3  co888 will not charge a fee for exercising any of the above rights under normal circumstances. Where a request is manifestly unfounded or excessive — in particular where it is repetitive in nature — co888 reserves the right to charge a reasonable administrative fee or to decline to act on the request, with written justification provided.

12. Minors

12.1  The co888 platform is strictly for individuals aged 21 and above. co888 does not knowingly collect, store, or process personal data belonging to any individual under the age of 21.

12.2  If co888 discovers or has reason to believe that personal data has been submitted by or on behalf of a person under 21, that data will be deleted immediately, the associated account will be closed, and any balances will be forfeited in accordance with co888's Terms & Conditions.

12.3  If you are a parent or guardian and believe that a person under 21 in your care has registered on co888 or submitted personal data to the platform, please contact our support team immediately so that we may take appropriate action without delay.

13. Marketing Communications

13.1  co888 sends promotional communications — including bonus offers, deposit match notifications, seasonal promotions (such as those tied to Idul Fitri, Ramadhan, or Indonesian Independence Day on 17 August), and platform updates — only to players who have explicitly opted in to receive such communications at the time of account registration or subsequently through account settings.

13.2  You may unsubscribe from marketing communications at any time by:

• Clicking the "Unsubscribe" link included in any marketing email.
• Updating your communication preferences through your account settings panel.
• Contacting the co888 support team directly and requesting removal from marketing lists.

13.3  Unsubscribing from marketing communications does not affect the delivery of transactional communications that are necessary to operate your account, such as deposit confirmations, withdrawal notifications, and security alerts. These service communications cannot be opted out of while your account remains active, as they are essential to the contract between you and co888.

13.4  co888 does not share your contact details with third-party marketers. All promotional communications originate directly from co888 or its authorised communications service providers acting on co888's behalf.

14. Policy Changes

14.1  co888 may update this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or the services we offer. The current version of this Policy is always available at https://co888.cam/privacy-policy.

14.2  Where a proposed change is material — meaning it significantly alters the way in which co888 processes your personal data or affects your rights — we will notify registered players by email at least fourteen (14) calendar days before the revised Policy takes effect. Non-material clarifications and corrections may be updated without advance notice.

14.3  Your continued use of the co888 platform following the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any material change, you should close your account before the effective date and contact our support team to exercise any applicable data rights.

15. Contact & Complaints

15.1  If you have any questions about this Privacy Policy, wish to exercise any of the rights described in Section 11, or want to raise a concern about how co888 handles your personal data, please contact our privacy team:

15.2  co888 takes all privacy concerns seriously and will acknowledge receipt of your request within 3 business days. If you are not satisfied with co888's response to a privacy complaint, you have the right to escalate the matter to the data protection authority or regulatory body with jurisdiction over co888's operations.

15.3  co888 encourages players to contact us directly in the first instance, as we are committed to resolving privacy concerns promptly and to the satisfaction of the data subject. In our experience, most concerns can be resolved through direct dialogue without the need for regulatory escalation.