Privacy Policy

1. About This Policy and the Data Controller

This Privacy Policy governs the collection and processing of personal data by the operator of fyp138.cam (hereinafter "fyp138," "we," "us," or "our") in connection with the online gaming services provided to registered members in Indonesia. fyp138 acts as the data controller with respect to all personal information you submit when registering an account, making deposits or withdrawals, contacting our customer support team, or otherwise interacting with our platform.

We recognize that Indonesian players place significant trust in us when they share their personal information. We take that trust seriously. Our data-handling practices are designed to comply with internationally recognized data protection principles and are aligned with the spirit of Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP). This policy applies to all fyp138 websites, mobile-optimized pages, and any associated applications or services regardless of the device you use to access them.

If you have any questions about this Privacy Policy or how your data is handled, you may contact our Data Protection contact via email at [email protected], and we will respond within five (5) business days.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Subject" refers to you — the individual whose personal data is collected and processed by fyp138.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of personal data for one or more specific purposes.
• "Third Party" means any natural or legal person, authority, agency, or body other than the data subject, fyp138, and persons who are authorized to process data under our direct authority.
• "Cookies" refers to small text files placed on your device by our website to store session information, preferences, and browsing behavior to improve your experience on the platform.

3. What Personal Data We Collect

The specific data we collect depends on how you interact with fyp138. The categories below describe the full scope of personal information we may hold about you at any given time.

3.1 Identity and Contact Information

• Full legal name (as it appears on your government-issued KTP)
• Date of birth (to verify you are at least 21 years of age)
• Indonesian National Identity Number (NIK) from your KTP
• Current residential address (including city, province, and postal code)
• Mobile phone number registered in Indonesia
• Email address used for account registration and communications

3.2 Financial and Payment Information

• Bank account name, bank name (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga), and account number used for deposits and withdrawals
• E-wallet identifiers associated with OVO, DANA, GoPay, ShopeePay, or LinkAja accounts registered in your name
• Transaction history including deposit amounts, withdrawal requests, dates, and processing status
• Source-of-funds documentation submitted during enhanced due-diligence checks (e.g., bank statements, payslips)

3.3 Gaming Activity Data

• Game session logs including games played, bet amounts, win/loss outcomes, and session durations
• Sports betting history including markets, selections, odds accepted, and settlement outcomes
• Togel (numbers lottery) ticket purchases and draw participation records
• Bonus and promotional offer uptake, wagering progress, and expiry records
• VIP tier status, loyalty points balance, and reward redemption history

3.4 Technical and Device Data

• IP address and geolocation data at the time of login and during active sessions
• Device type, operating system, browser version, and hardware identifiers
• Cookie identifiers, session tokens, and local storage data
• Log files recording page visits, clicks, feature interactions, and error events
• VPN or proxy detection signals used to enforce our geolocation eligibility policy

3.5 Communications Data

• Records of live chat conversations, email exchanges, and WhatsApp messages with our support team
• Customer feedback, complaint records, and dispute correspondence
• Responses to surveys, promotions, or research invitations you choose to participate in

4. How and Why We Use Your Personal Data

The table below summarizes the primary purposes for which fyp138 processes your personal data, along with the legal basis for each processing activity.

5. Cookies and Tracking Technologies

fyp138 uses cookies and similar tracking technologies (such as pixel tags and local storage objects) to deliver our services, improve platform performance, and provide a personalized experience. When you first visit our website, you will be presented with a cookie preferences notice where you can manage non-essential cookies. The types of cookies we use include the following:

• Strictly Necessary Cookies: Essential for the website to function. They enable session authentication, security features, and core gaming functionality. You cannot opt out of these without ceasing to use the platform.
• Performance and Analytics Cookies: Collect anonymized data about how visitors interact with our website (pages visited, errors encountered, session duration) to help us improve the platform. We use first-party analytics only.
• Functionality Cookies: Remember your preferences such as language settings, currency display, and game filter configurations so you do not need to re-enter them on each visit.
• Targeting and Session Cookies: Used to understand your gaming interests and deliver contextually relevant promotional content within the platform. We do not use third-party advertising networks or sell your browsing data to advertisers.

You may control or delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the fyp138 platform, including the ability to stay logged in or access certain game features.

6. Data Sharing and Third-Party Disclosure

fyp138 does not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing purposes . We may, however, share your data with carefully selected third parties under the following circumstances:

• Payment Service Providers: We share your name, bank account details, and transaction amounts with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit and withdrawal requests. These providers are bound by their own privacy obligations and may not use your data for any other purpose.
• Game Technology Providers: Software providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, and Spribe may receive limited technical session data (such as an anonymized player token and bet amounts) necessary to deliver their games within our platform. They do not receive your name, KTP, or payment details.
• Identity Verification Partners: We work with licensed KYC and AML service providers to verify the authenticity of identity documents you submit. These partners process your KTP image and personal details under strict data-processing agreements and are prohibited from retaining your data beyond the verification window.
• Fraud Prevention and Security Services: We use specialized fraud detection technology that processes IP addresses, device fingerprints, and behavioral signals to identify suspicious account activity, duplicate registrations, and bonus abuse. No individually identifiable financial data is shared beyond what is strictly necessary.
• Legal and Regulatory Authorities: We may disclose personal data to Indonesian law enforcement agencies, financial intelligence units, or regulatory bodies when required to do so by applicable law, court order, or in response to a lawful investigation. We will notify you of such disclosure where permitted by law.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be transferred to the acquiring entity as part of the transaction. We will notify you via email prior to any such transfer and ensure the recipient is bound by privacy obligations at least as stringent as those in this policy.

In all cases where we share personal data with third parties, we require those parties to implement appropriate technical and organizational safeguards to protect your data, restrict its use to the agreed purpose, and comply with applicable data protection law.

7. International Data Transfers

fyp138 operates server infrastructure across multiple international jurisdictions to ensure platform availability, redundancy, and performance for Indonesian users. As a result, your personal data may be stored on or transferred to servers located outside Indonesia. Where such transfers occur, we ensure adequate protections are in place by using standard contractual clauses approved by international data protection authorities, selecting service providers that maintain recognized security certifications (such as ISO 27001 or SOC 2), and limiting transferred data to the minimum necessary for the specified purpose.

We do not transfer your personal data to countries that are assessed as providing an inadequate level of data protection without first implementing appropriate safeguards. Our third-party partners processing data on our behalf are contractually obligated to apply the same data protection standards that we apply internally.

8. Data Retention

fyp138 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. The following general retention periods apply:

• Active account data (identity, contact, gaming activity, financial records): Retained for the duration of your account and for a minimum of five (5) years after account closure, in compliance with Indonesian anti-money laundering and financial record-keeping requirements.
• KYC and identity verification documents (KTP scans, selfies, source-of-funds documents): Retained for a minimum of five (5) years from the date of submission or account closure, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the last interaction, to support dispute resolution and quality assurance.
• Technical logs and device data: Retained for up to twelve (12) months in an identifiable form, then anonymized for aggregate analytics purposes.
• Marketing consent records: Retained for the lifetime of your account plus three (3) years to demonstrate compliance with consent obligations.

When retention periods expire, your personal data is securely deleted or anonymized so that it can no longer be associated with you. We conduct periodic data audits to ensure compliance with these retention schedules.

9. Your Data Subject Rights

As a data subject whose personal information is processed by fyp138, you are entitled to the following rights. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and include your registered account email and a description of your request. We will respond within 30 calendar days and may request additional information to verify your identity before acting on your request.

• Right of Access: You may request a copy of the personal data we hold about you, along with information about the purposes for which it is processed, the categories of data involved, and the third parties with whom it is shared.
• Right to Rectification: If you believe any personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it. Certain data (such as your registered name and date of birth) may require submission of updated official documentation before changes can be made.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that we may be unable to fulfill erasure requests where data retention is required by law (e.g., AML obligations).
• Right to Restriction of Processing: You may request that we limit the processing of your personal data in certain circumstances, for example while a rectification request is being assessed or where you contest the lawfulness of processing.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) for transfer to another service provider.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes (including profiling for marketing). You may also object to processing based on our legitimate interests; we will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where we rely on your consent as the legal basis for processing (for example, sending you personalized promotional offers), you may withdraw that consent at any time by updating your communication preferences in your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

We will not charge a fee for handling legitimate data rights requests. However, we reserve the right to charge a reasonable administrative fee or decline manifestly unfounded or excessive requests.

10. Data Security Measures

fyp138 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes, but is not limited to, the following controls:

• SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard Transport Layer Security (TLS 1.3). This ensures that your login credentials, financial information, and personal data cannot be intercepted in transit.
• Data Encryption at Rest: Sensitive personal data stored in our databases (including KTP numbers, bank account details, and password hashes) is encrypted using AES-256 encryption to protect against unauthorized database access.
• Access Controls: Access to personal data within our organization is restricted on a strict need-to-know basis. Staff who require access to sensitive data must authenticate using multi-factor authentication and are subject to role-based access control policies.
• Two-Factor Authentication (2FA): We offer optional two-factor authentication for all player accounts, adding an additional layer of protection against unauthorized account access.
• Regular Security Audits: Our platform and infrastructure undergo regular internal and independent external security assessments, including penetration testing, vulnerability scanning, and code reviews.
• Incident Response Plan: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach and take immediate steps to contain, investigate, and remediate the incident.

While we apply rigorous security practices, no online platform can guarantee absolute security. You are equally responsible for maintaining the confidentiality of your account credentials and for notifying us immediately at [email protected] if you suspect unauthorized access to your account.

11. Children's Privacy

fyp138 is strictly an adult gaming platform intended exclusively for individuals who are 21 years of age or older. We do not knowingly collect personal data from anyone under the age of 21. During the account registration process, we collect your date of birth and require identity document (KTP) verification to confirm your age before activating your account or processing any withdrawal. If we discover or are notified that we have inadvertently collected personal data from a person under 21, we will immediately suspend the account, permanently delete all associated personal data, and notify the relevant parties as required by law. If you believe a minor has registered on fyp138, please contact us immediately at [email protected].

12. Marketing Communications and Opt-Out

With your consent at the time of registration, fyp138 may send you promotional emails, SMS notifications, and in-platform messages about bonuses, seasonal promotions (such as Idul Fitri and Ramadhan special offers), new game launches, and VIP program updates. You may withdraw your consent and opt out of all marketing communications at any time through any of the following methods:

• Updating your notification preferences in the Account Settings section of your fyp138 account dashboard
• Clicking the "Unsubscribe" link at the bottom of any promotional email we send you
• Contacting our customer support team via live chat or email at [email protected] and requesting removal from all marketing lists

Please allow up to 5 business days for opt-out requests to take full effect across all communication channels. Note that even after opting out of marketing, we will continue to send you essential service communications (such as deposit confirmations, withdrawal notifications, account security alerts, and policy update notices) as these are necessary for the operation of your account.

13. Links to Third-Party Content

Our platform may display the names and logos of third-party service providers such as game studios, payment processors, and sports data providers for informational purposes. fyp138 is not responsible for the privacy practices or data-handling policies of any third-party organizations. We encourage you to review the privacy policies of any third party whose services you use independently of fyp138. This Privacy Policy applies solely to data processed by fyp138 in connection with your use of our gaming platform.

14. Changes to This Privacy Policy

fyp138 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or regulatory guidance. The "Last Updated" date at the top of this page will be revised whenever material changes are made. For significant changes that affect your rights or the way we use your personal data, we will provide prominent notice on the platform and, where practicable, notify you by email at least 14 days before the changes take effect. Your continued use of fyp138 services after the effective date of any changes constitutes your acknowledgment of the revised policy. We recommend checking this page periodically to stay informed.

15. Contact and Data Protection Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or the way fyp138 handles your personal data, please reach out to our team through the following channels. We are committed to addressing your inquiry promptly and transparently.

• Email: [email protected] (subject line: "Privacy Policy Inquiry" or "Data Rights Request")
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on fyp138.cam
• Response Time: General inquiries within 2 business days; formal data rights requests within 30 calendar days