padi8 Privacy Policy

This Privacy Policy applies to all personal data processed by padi8 in connection with the operation of the online gaming platform accessible at https://padi8.vip (the "Platform"). It covers data collected from:

• Registered account holders and applicants.
• Visitors who browse the Platform without registering an account.
• Individuals who contact padi8 via live chat, email, or any other support channel.
• Players who participate in promotions, bonus programs, or loyalty schemes offered by padi8.

This Policy should be read alongside the padi8 Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference. By registering an account or continuing to use the Platform, you acknowledge that you have read, understood, and accepted the practices described in this Privacy Policy.

padi8 is committed to handling personal data with the highest standards of care, transparency, and security. We apply data minimisation principles — collecting only what is genuinely necessary for the purposes described in this Policy — and we do not retain data for longer than is required.

The following terms have the meanings given below throughout this Privacy Policy:

padi8 collects the following categories of Personal Data, depending on your interaction with the Platform:

Identity & Contact Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify compliance with the 21+ age requirement).
• Residential address, including city (e.g., Jakarta, Surabaya, Bali, Medan, Bandung, Yogyakarta) and postal code.
• Email address and phone number provided at registration.
• Government-issued photo identification (KTP, SIM, or passport) submitted during KYC verification.
• Selfie or liveness-check image where required for enhanced identity verification.

Financial Data

• Bank account details (bank name, account number, account holder name) for withdrawal processing — covering accounts at BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, and other supported institutions.
• E-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja transactions.
• Deposit and withdrawal transaction history, including amounts in IDR, timestamps, and method used.
• Account balance and bonus wallet balances at any given point in time.

Gaming Activity Data

• All wagers placed, games accessed, bet amounts, outcomes, and session durations.
• Sportsbook selections, including markets on BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, Champions League, AFF Cup, and other events.
• Responsible gaming settings you apply to your account, including deposit limits and self-exclusion status.

Technical & Device Data

• IP address, device type, operating system, browser type and version, and screen resolution.
• Session start and end timestamps and pages visited on the Platform.
• Geolocation data derived from your IP address (country and region level — padi8 does not collect precise GPS coordinates).
• Device fingerprint data used for fraud detection and duplicate account identification.

Communications Data

• Records of live chat conversations with padi8 support agents, including timestamps and content.
• Email correspondence sent to or received from padi8 support.
• Feedback, survey responses, and dispute submissions submitted through the Platform.

padi8 collects Personal Data through the following channels:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact support, or update your account profile.
• Automatically through the Platform: Via cookies, server logs, and session-tracking technologies that record your interactions with the Platform as described in Section 11.
• From third-party KYC and identity verification providers: Where padi8 uses an automated identity verification service to cross-reference the documents and information you submit.
• From payment processors and banking partners: Transaction confirmation data received from payment gateways and Indonesian bank transfer systems upon processing of deposits or withdrawals.
• From fraud prevention and risk management services: Device fingerprint data, IP reputation signals, and behavioural analytics supplied by third-party security service providers acting as Processors under data processing agreements with padi8.

padi8 processes your Personal Data for the following clearly defined purposes:

padi8 relies on the following legal bases to process your Personal Data:

• Contractual necessity: Processing is necessary to perform the contract between you and padi8 — specifically, to operate your Account, process your transactions, and deliver the Services you have requested.
• Legal obligation: Processing is necessary to comply with applicable legal and regulatory requirements, including AML/KYC obligations, age verification requirements, and record-keeping mandates under the gaming licence under which padi8 operates.
• Legitimate interests: Processing is necessary for padi8's legitimate interests in preventing fraud, ensuring platform security, resolving disputes, and improving the Platform — provided those interests are not overridden by your data protection rights.
• Consent: For the sending of optional promotional communications and for the use of non-essential cookies, padi8 relies on your freely given, specific, and informed consent, which you may withdraw at any time without affecting the lawfulness of processing carried out prior to withdrawal.

padi8 does not sell your Personal Data to third parties. We share Personal Data only in the following circumstances and with the following categories of recipients:

• KYC and identity verification providers: Third-party services engaged to cross-reference your submitted documents and confirm identity accuracy. These providers act as Processors and are contractually bound to process your data only for the purpose of identity verification on padi8's behalf.
• Payment processors and banking partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to execute deposit and withdrawal transactions.
• Fraud prevention and security services: Specialist third-party providers that analyse device fingerprints, IP data, and behavioural signals to identify fraudulent activity. Data shared with these providers is limited to technical identifiers and is processed under strict data processing agreements.
• Game content providers and software studios: Where required to authenticate player sessions and record game outcomes for providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. Data shared is limited to session tokens and player identifiers.
• Regulatory and law enforcement authorities: Where padi8 is required by applicable law, court order, or binding regulatory direction to disclose Personal Data. padi8 will only disclose the minimum information required to comply with such requests.
• Professional advisers: Lawyers, auditors, and compliance consultants engaged by padi8 under obligations of professional confidentiality, where access to Personal Data is genuinely necessary for the advisory engagement.
• Business successors: In the event of a merger, acquisition, or sale of padi8's business assets, Personal Data may be transferred to the successor entity, subject to equivalent privacy protections.

The padi8 Platform serves players primarily based in Indonesia, and the majority of data processing takes place within the jurisdiction in which padi8 is licensed. However, certain third-party Processors engaged by padi8 — including game software providers, cloud infrastructure vendors, and fraud detection services — may process Personal Data in jurisdictions outside Indonesia.

Where Personal Data is transferred internationally, padi8 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses or equivalent contractual protections binding the recipient to data protection standards consistent with this Policy.
• Data processing agreements that restrict the Processor's use of Personal Data strictly to the purpose for which it was shared.
• Technical security measures (encryption in transit and at rest) that apply regardless of the geography of processing.

You may request further information about the specific safeguards applied to international transfers by contacting padi8 support via live chat.

padi8 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, and for as long as required by applicable legal, regulatory, and licensing obligations. The following retention guidelines apply:

• Active Account data: Retained for the lifetime of the Account and for a period of at least 5 years following account closure, to satisfy AML record-keeping requirements and potential dispute resolution obligations.
• KYC documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later, in accordance with standard AML/KYC regulatory requirements.
• Transaction records: Full financial transaction history is retained for a minimum of 5 years following the date of each transaction.
• Support communications: Live chat logs and email correspondence are retained for a minimum of 2 years following the close of the relevant support interaction.
• Gaming activity logs: Bet history and game session records are retained for a minimum of 3 years from the date of the relevant session.
• Technical and device data: Server logs and IP records are retained for up to 12 months unless a longer retention period is required for an active fraud or dispute investigation.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to any identifiable individual.

padi8 implements a multi-layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• TLS/SSL encryption in transit: All data transmitted between your device and the padi8 Platform is encrypted using industry-standard Transport Layer Security (TLS). The padlock icon visible in your browser confirms this encryption is active.
• Encryption at rest: Sensitive Personal Data — including KYC documents and financial records — is encrypted at rest using AES-256 or equivalent standards on padi8's secure server infrastructure.
• Access controls: Access to Personal Data within padi8's systems is restricted on a strict need-to-know basis. Staff members may only access the data categories required to perform their specific role. All access is logged and audited.
• Penetration testing and vulnerability assessments: padi8's technical infrastructure undergoes regular security assessments by qualified security professionals to identify and remediate vulnerabilities before they can be exploited.
• Incident response procedures: padi8 maintains documented data breach response procedures. In the event of a breach that is likely to result in a risk to affected individuals, padi8 will notify affected players and relevant authorities in accordance with applicable notification obligations.
• Staff training: All padi8 staff who handle Personal Data receive mandatory data protection and security training as part of their onboarding and ongoing professional development.

The padi8 Platform uses cookies and similar technologies to deliver core Platform functionality, maintain session security, and collect analytical data that helps us improve the Platform. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the Platform. Disabling analytical cookies will not affect core functionality but will limit padi8's ability to optimise the user experience based on usage data.

padi8 respects your rights in relation to your Personal Data. Depending on applicable law, you may have the following rights:

To exercise any of the above rights, contact padi8 support via live chat or by email (see Section 15). padi8 will respond to all valid requests within 30 days. In complex cases, this period may be extended by a further 30 days, with notice provided to you.

The padi8 Platform is strictly intended for adults aged 21 and over. padi8 does not knowingly collect Personal Data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and padi8 employs both technical controls and document-based verification to enforce this requirement.

If padi8 discovers that Personal Data has been collected from an individual who is under 21 years of age, the following actions will be taken immediately:

• The Account will be suspended and access to the Platform revoked.
• All associated data — including identity documents, financial records, and gaming activity — will be securely deleted, except where retention is required by applicable law.
• Any real-money balance in the Account (net of any winnings, which will be forfeited) will be returned through the original deposit method following identity confirmation of the rightful account holder.

If you are a parent or guardian and believe that a minor may have registered an Account on the padi8 Platform, please contact padi8 support immediately via live chat so that the Account can be reviewed and closed without delay.

padi8 reserves the right to update this Privacy Policy at any time to reflect changes in legal requirements, regulatory guidance, Platform functionality, or data processing practices. When material changes are made, the "Last Updated" date at the top of this page will be revised accordingly.

Where a change is significant — for example, a change in the categories of data collected, the purposes for which data is processed, or the third parties with whom data is shared — padi8 will provide additional notice to registered Account holders via the email address on file or via an in-platform notification upon next login.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease using the Platform and may request account closure by contacting padi8 support.

For any questions, concerns, or requests relating to this Privacy Policy or padi8's handling of your Personal Data, please contact the padi8 support team through the following channels:

• Live Chat: Available 24/7 directly within the Platform — the fastest channel for data rights requests and privacy-related queries. Average response time under 90 seconds (WIB).
• Email: support padi8.vip (plain text — not a clickable link). Responses within 24 hours for standard queries; data rights requests handled within the statutory 30-day window.
• Languages: Indonesian and English. Native Indonesian-speaking agents are available at all hours for players across Jakarta, Surabaya, Bali, Medan, Bandung, and the rest of Indonesia.

If you are not satisfied with padi8's response to a privacy concern, you have the right to escalate your complaint to the relevant data protection authority in the jurisdiction applicable to you. padi8 commits to cooperating fully with any such investigation.