Privacy Policy

1 Overview & Scope

1.1 This Privacy Policy ("Policy") describes the data practices of ipo189 ("we," "us," "our"), the operator of the online gaming platform accessible at https://ipo189.cam ("Platform"). It applies to all users ("you," "Player") who access or interact with the Platform in any capacity, including browsing as a guest, registering an account, making a deposit, placing a wager, or contacting our customer support team.

1.2 ipo189 is primarily designed to serve adult players based in Indonesia. We recognise the importance of data privacy for all individuals and are committed to handling your personal information responsibly, transparently, and securely.

1.3 This Policy covers data collected through the Platform's website, any related sub-domains, and direct communications with our support team. It does not cover the privacy practices of any third-party services linked to or integrated within the Platform — please consult those services' own privacy policies directly.

2 Definitions

For clarity and consistency throughout this Policy, the following definitions apply:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living natural person, directly or indirectly. Examples include your full name, email address, date of birth, phone number, IP address, and payment account details.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For data collected via the Platform, ipo189 is the Data Controller.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller pursuant to a contractual agreement. Examples include payment processors and KYC verification service providers.
• "Cookies" — small text files placed on your device by the Platform that enable certain functions such as session authentication, preference storage, and performance analytics.
• "KYC" — Know Your Customer; the identity and age verification process required before a Player's withdrawal request is approved.
• "AML" — Anti-Money Laundering; the set of legal controls and internal procedures ipo189 uses to prevent the use of the Platform for financial crime.

3 Data We Collect

3.1 ipo189 collects only the Personal Data that is necessary for the purposes described in this Policy. The categories of data we collect include:

3.2 We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information, except where health-related information is voluntarily provided in the context of a responsible gaming self-exclusion request — in which case it is handled with the highest level of confidentiality.

4 How We Collect Data

4.1 ipo189 collects your Personal Data through the following means:

• Direct Submission: Information you provide when creating an account, completing KYC verification, submitting a deposit or withdrawal request, contacting our support team, or updating your account profile.
• Automated Technologies: Technical and usage data collected automatically when you access the Platform, including through cookies, server logs, and session-tracking tools. See Section 7 for full cookie details.
• Third-Party Sources: Identity verification data returned by our KYC service providers after you submit documents for verification. Payment confirmation data received from our banking and e-wallet partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) to confirm successful transactions.
• Fraud & AML Monitoring: Transaction pattern data and device fingerprinting signals generated by our internal risk-management and anti-fraud systems during the normal course of Platform operation.

5 How We Use Your Data

5.1 ipo189 uses your Personal Data exclusively for the following purposes:

• Account Administration: Creating, managing, and maintaining your player account, including authentication and password recovery.
• Transaction Processing: Facilitating deposits and withdrawals via Indonesian bank transfers and e-wallets, reconciling payment records, and resolving transaction disputes.
• Identity Verification (KYC): Confirming your age (21+), identity, and payment method ownership in compliance with our AML obligations and responsible gaming commitments.
• Fraud Prevention & Security: Detecting and preventing unauthorised account access, bonus abuse, money laundering, and other prohibited activities as defined in our Terms & Conditions.
• Customer Support: Responding to your enquiries, resolving complaints, and providing account assistance.
• Platform Improvement: Analysing aggregated usage patterns to improve game performance, page speed, feature design, and overall user experience.
• Responsible Gaming: Monitoring player activity to identify patterns consistent with problem gambling and proactively offering player-protection tools where appropriate.
• Marketing Communications (Opt-In Only): Sending promotional offers, bonus announcements, and seasonal campaign information to players who have explicitly opted in to receive such communications. You may withdraw consent at any time.
• Legal & Regulatory Compliance: Meeting our obligations under applicable laws and cooperating with regulatory authorities, law enforcement agencies, and financial institutions as required.

6 Legal Basis for Processing

6.1 ipo189 processes your Personal Data on the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between you and ipo189 — namely, operating your account, processing your deposits and withdrawals, and delivering the games and services you have requested.
• Legal Obligation: Processing required for us to comply with applicable legal and regulatory obligations, including AML due diligence, KYC verification, and cooperation with law enforcement authorities.
• Legitimate Interests: Processing carried out in the legitimate interests of ipo189, such as fraud prevention, platform security, internal analytics, and customer support — provided those interests are not overridden by your own rights and interests.
• Consent: Processing for which we have obtained your explicit consent, including the sending of marketing communications. You may withdraw consent at any time by contacting our support team or using the unsubscribe link in any marketing email.

7 Cookies & Tracking Technologies

7.1 ipo189 uses cookies and similar technologies to provide a functional, secure, and optimised experience on the Platform. The types of cookies we use are:

7.2 ipo189 does not use third-party advertising or retargeting cookies. We do not share cookie data with advertising networks for the purpose of displaying targeted ads on external websites.

7.3 Most browsers allow you to manage cookie preferences through their settings. Disabling strictly necessary cookies may prevent the Platform from functioning correctly. Performance cookies may be disabled without affecting core functionality, though it may limit our ability to identify and resolve technical issues promptly.

8 Data Sharing & Disclosure

8.1 ipo189 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We may share your data only in the following limited circumstances:

• Payment Partners: Your name and payment account details are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to the extent necessary to process your deposit or withdrawal transaction.
• KYC & Identity Verification Providers: Document images and identity data submitted during KYC are processed by our contracted verification partners under strict data-processing agreements. These providers are prohibited from using your data for any purpose other than the verification service they provide to ipo189.
• Fraud & AML Service Providers: Aggregated transaction and behavioural data may be shared with our contracted risk-management and AML screening partners to detect and prevent financial crime.
• Legal & Regulatory Authorities: We will disclose Personal Data to government bodies, law enforcement agencies, or financial intelligence units where we are required to do so by applicable law, court order, or regulatory direction.
• Corporate Transactions: In the event of a merger, acquisition, restructure, or sale of substantially all of ipo189's assets, your Personal Data may be transferred to the successor entity, which will be bound by this Policy or a policy offering equivalent protection.

9 Data Retention

9.1 ipo189 retains your Personal Data only for as long as is necessary to fulfil the purposes outlined in this Policy, or as required by applicable law and regulatory obligations.

9.2 The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account's active status plus a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Transaction Records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of five (5) years from the date of each transaction.
• KYC Documents: Identity and address verification documents are retained for a minimum of five (5) years following the completion of verification or account closure, whichever is later.
• Support Communications: Live-chat transcripts and email correspondence are retained for up to three (3) years from the date of each interaction for quality assurance and dispute resolution purposes.
• Marketing Preference Records: Records of your opt-in or opt-out status are retained for the lifetime of your account and for three (3) years thereafter.

9.3 Where Personal Data is no longer required for any legitimate purpose, it will be securely deleted or anonymised in accordance with our internal data-destruction procedures.

10 Data Security

10.1 ipo189 applies a multi-layered security framework to protect your Personal Data from unauthorised access, loss, alteration, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data in transit between your browser and our servers is encrypted using industry-standard Transport Layer Security protocols.
• Encrypted Data Storage: Sensitive fields within our databases — including identity document references and financial account identifiers — are stored in an encrypted format.
• Access Controls: Strict role-based access controls ensure that only authorised personnel with a legitimate operational need can access Personal Data. All internal access is logged and audited.
• Regular Security Audits: The Platform undergoes periodic penetration testing and vulnerability assessments conducted by qualified independent security professionals.
• Two-Factor Authentication: Players are encouraged to enable two-factor authentication (2FA) on their accounts for an additional layer of login security.
• Incident Response: In the event of a data breach that poses a risk to your rights, ipo189 will notify affected players and relevant authorities without undue delay and in accordance with applicable legal requirements.

11 Your Privacy Rights

11.1 ipo189 recognises and respects the following rights with respect to your Personal Data. To exercise any of these rights, please submit a written request to our support team at [email protected]. We will respond within 30 days of receiving a verifiable request.

11.2 Please note that some requests — particularly erasure requests — may not be fulfilled in their entirety where retention is required by law (e.g., AML record-keeping obligations). In such cases, we will inform you of the reason and of the portion of the request that can be fulfilled.

12 Minors & Age Verification

12.1 The ipo189 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from individuals under the age of 21.

12.2 As part of our KYC process, every player is required to submit government-issued identity documentation confirming their date of birth before any withdrawal is processed. Accounts where the player is found to be under 21 years of age will be permanently closed and any associated balance forfeited.

12.3 If you are a parent or guardian and believe that a minor in your care has registered an account on ipo189, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

13 International Data Transfers

13.1 ipo189 operates internationally. As a result, your Personal Data may be transferred to and processed in countries other than Indonesia, including locations where our server infrastructure, KYC providers, or other contracted Data Processors are based.

13.2 Where Personal Data is transferred outside Indonesia, ipo189 takes appropriate safeguards to ensure that your data receives a level of protection consistent with this Policy. These safeguards may include contractual data-protection clauses with the receiving entity and technical security measures appropriate to the sensitivity of the data being transferred.

13.3 By registering an account with ipo189, you acknowledge and consent to the international transfer of your Personal Data as described in this section.

14 Third-Party Services

14.1 The Platform integrates games and services provided by third-party studios and technology partners, including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. While these partners operate within the Platform environment, they maintain their own data practices as Data Processors acting on behalf of ipo189.

14.2 The Platform may contain links to external websites or resources. ipo189 has no control over the content or privacy practices of those external sites and accepts no responsibility for them. We encourage you to read the privacy policy of any external site you visit.

14.3 Payment partners — including Indonesian banks such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, and BSI, as well as e-wallet providers OVO, DANA, GoPay, ShopeePay, and LinkAja — process your financial data in accordance with their own regulatory obligations and privacy policies. ipo189 shares only the minimum data necessary to process your transaction with each provider.

15 Changes to This Policy

15.1 ipo189 reserves the right to update or revise this Privacy Policy at any time. When we do, we will update the "Last Updated" date at the top of this page and, where changes are material, we will make reasonable efforts to notify active players via email or an in-platform notification.

15.2 We encourage you to review this Policy periodically to stay informed about how we are protecting your data. Your continued use of the Platform after the publication of a revised Policy constitutes your acceptance of the changes.

15.3 If you do not agree with any amendment to this Policy, you must cease using the Platform and may request account closure by contacting our support team.

16 Contact & Data Requests

16.1 For any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please contact the ipo189 Privacy & Compliance team through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the Platform's live-chat widget. Indonesian-speaking agents are available on every shift.
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to resolve or formally respond to all data-subject requests within 30 calendar days.

16.2 When submitting a data-subject request (access, rectification, erasure, etc.), please include your registered account username and the email address associated with your account so we can verify your identity before processing the request.