lux88 Privacy Policy

The following terms have the meanings given below throughout this Policy:

Term	Meaning
"Personal Data"	Any information relating to an identified or identifiable natural person, including name, date of birth, address, email address, phone number, financial details, and device identifiers.
"Processing"	Any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
"Controller"	lux88, which determines the purposes and means of Processing your Personal Data.
"Processor"	A third party that Processes Personal Data on behalf of lux88 under a data-processing agreement, such as payment-gateway providers and cloud-hosting services.
"Consent"	A freely given, specific, informed, and unambiguous indication of your agreement to the Processing of your Personal Data for a stated purpose.
"KYC"	Know Your Customer — the identity verification process required by our international licensing obligations and anti-money-laundering programme.
"Cookies"	Small text files placed on your device by the Platform to support session management, fraud detection, and analytics.

lux88 collects only the Personal Data that is necessary for the purposes described in this Policy. We collect data through three principal channels: information you provide directly, information generated by your use of the Platform, and information received from third parties.

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, residential address in Indonesia, email address, and chosen username and password when you create a lux88 account.
• KYC documents: Government-issued photo identification (e.g., KTP — Indonesian National Identity Card — or passport), proof of residential address, proof of payment method ownership, and selfie photographs as required by our compliance team.
• Financial data: Bank account details, e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction records associated with deposits and withdrawals in IDR.
• Support communications: The content of live chat transcripts, emails sent to [email protected], and any other correspondence with our customer support team.
• Responsible gaming data: Self-imposed deposit limits, loss limits, time-out periods, and self-exclusion requests submitted via your account dashboard.

2.2 Data Generated by Your Platform Use

• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, and device fingerprint identifiers.
• Usage data: Pages visited, games played, wagers placed, bet history, session duration, login timestamps, and navigation paths through the Platform.
• Cookie and tracking data: Session cookies, authentication tokens, and analytics identifiers as described in Clause 7.
• Location data: General geographic location inferred from your IP address (city and region level only; we do not use GPS-level location data).

2.3 Data Received from Third Parties

• Payment processors: Transaction status confirmations and fraud-risk scores from BCA, BRI, BNI, Mandiri, and e-wallet providers.
• Identity verification services: Document authenticity results and PEP/sanctions screening outcomes from our KYC service partners.
• Fraud prevention services: Device reputation scores and behavioural risk signals from third-party fraud detection providers.

lux88 Processes your Personal Data on one or more of the following legal bases, depending on the specific Processing activity:

Legal Basis	When It Applies
Contractual necessity	Processing required to open and operate your account, process deposits and withdrawals, settle wagers, and provide customer support.
Legal obligation	Processing required to comply with anti-money-laundering (AML) regulations, KYC requirements under our international gaming licence, and lawful requests from regulatory authorities.
Legitimate interests	Fraud detection, platform security, abuse prevention, and internal analytics used to improve our services — where these interests are not overridden by your data-protection rights.
Consent	Sending promotional emails and marketing communications. You may withdraw Consent at any time without affecting the lawfulness of prior Processing.

lux88 uses your Personal Data for the following purposes:

• Account management: Creating and maintaining your lux88 account, authenticating your identity at login, and processing account-closure requests.
• Service delivery: Processing IDR deposits and withdrawals, settling sportsbook wagers (including BRI Liga 1, EPL, Champions League, and other markets), delivering live casino sessions, running slot titles from providers such as Pragmatic Play, Evolution Gaming, and Pocket Games Soft, and crediting togel (Indonesia's traditional numbers lottery) winnings.
• KYC and compliance: Verifying your identity, confirming you meet the 21+ age requirement, screening against PEP and sanctions lists, and fulfilling our AML obligations under our international licence.
• Fraud and security: Detecting and preventing fraudulent account registrations, unauthorised access, payment fraud, bonus abuse, and multi-accounting in breach of our Terms & Conditions.
• Responsible gaming: Monitoring for indicators of problem gambling behaviour, applying self-imposed limits, and contacting members where our responsible gaming programme identifies elevated risk.
• Customer support: Responding to your queries, complaints, and requests, and maintaining a record of prior interactions to improve service consistency.
• Marketing (with Consent): Sending you information about promotions, seasonal bonuses (e.g., Idul Fitri cashback campaigns, Ramadhan reload offers), and new game launches where you have opted in.
• Analytics and improvement: Understanding how members use the Platform, identifying technical issues, and improving our product features and user experience.

lux88 does not sell, rent, or trade your Personal Data. We share it only in the following limited circumstances:

5.1 Service Providers (Processors)

We engage third-party Processors to provide specific services on our behalf, including payment processing (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), cloud hosting and data storage, KYC identity verification, fraud prevention, and customer support tooling. Each Processor is bound by a contractual data-processing agreement that restricts them to Processing your data only as instructed by lux88 and prohibits any independent use.

5.2 Game Software Providers

Certain game outcome data and anonymised session identifiers may be shared with third-party game studios (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe) for the purpose of game auditing, dispute resolution, and RNG certification. These providers do not receive your name, contact details, or financial information.

5.3 Legal and Regulatory Disclosure

lux88 may disclose your Personal Data to competent authorities, courts, or regulators where required to do so by applicable law, court order, or the requirements of our international gaming licence. We will notify you of any such disclosure to the extent permitted by law.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of lux88's assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent data-protection safeguards. You will be notified of any such transfer prior to its completion.

lux88 retains your Personal Data for as long as necessary to fulfil the purposes for which it was collected, and for such additional periods as are required by our licensing obligations or applicable law. The following default retention periods apply:

Data Category	Retention Period
Account registration data	For the duration of the account, plus 5 years after closure.
KYC identity documents	5 years from the date of verification, in line with AML obligations.
Financial transaction records	5 years from the transaction date.
Customer support communications	3 years from the date of the interaction.
Marketing consent records	Until Consent is withdrawn, plus 2 years thereafter as a compliance record.
Session and usage logs	13 months from the date of the session.
Fraud investigation records	Up to 7 years where a fraud event is identified.

When the applicable retention period expires, Personal Data is securely deleted or irreversibly anonymised. Anonymised aggregate data (e.g., platform traffic statistics with no individual identifiers) may be retained indefinitely for business analytics.

lux88 uses Cookies and similar technologies on the Platform. The table below describes the categories of Cookies we deploy and their purposes:

Cookie Category	Purpose	Can Be Disabled?
Strictly necessary	Session authentication, login state management, CSRF protection, and load balancing. These Cookies are essential for the Platform to function.	No
Functional	Remembering your language preferences, game lobby display settings, and responsible gaming dashboard configuration.	Yes
Analytics	Aggregated, anonymised measurement of page traffic, feature usage, and navigation flows to improve the Platform. No individual user profiles are built from analytics data.	Yes
Fraud prevention	Device fingerprinting and behavioural signals used to detect multi-accounting, bot activity, and unauthorised access attempts. Treated as strictly necessary for security purposes.	No

lux88 does not deploy advertising cookies, retargeting pixels, or third-party social media tracking scripts on the Platform. You may manage functional and analytics Cookies through your browser settings. Disabling strictly necessary or fraud-prevention Cookies may impair Platform functionality or prevent you from logging in.

lux88 applies a layered security architecture to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. Our security measures include but are not limited to:

• Transport encryption: 256-bit TLS/SSL encryption is enforced on all connections between your browser or mobile device and the lux88 Platform.
• At-rest encryption: Sensitive data fields, including identity documents and financial account numbers, are encrypted at rest using AES-256.
• Password hashing: Account passwords are stored using a one-way cryptographic hash function with a unique per-user salt. Passwords are never stored or transmitted in plaintext.
• Access controls: Access to production systems and member data is restricted to authorised personnel on a need-to-know basis, with multi-factor authentication required for all administrative access.
• Security monitoring: Continuous logging and alerting for anomalous access patterns, failed authentication attempts, and unusual transaction activity.
• Penetration testing: Regular independent security assessments of Platform infrastructure and application code.

As a member of the lux88 Platform, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact us via live chat or email at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 72 hours and respond substantively within 30 days.

9.1 Right of Access

You have the right to request a copy of the Personal Data lux88 holds about you, including the categories of data, the purposes for which it is used, and any third parties to whom it has been disclosed. We will provide this information in a structured, commonly used, machine-readable format.

9.2 Right to Rectification

If any Personal Data held by lux88 is inaccurate or incomplete, you have the right to request correction. For registered account data (name, date of birth, address), updates may require re-submission of identity documents to confirm accuracy.

9.3 Right to Erasure

You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw Consent and no other legal basis applies. Please note that lux88 is required to retain certain data (KYC records, financial transaction logs) for mandatory periods under our licensing and AML obligations, and erasure requests cannot override these legal retention requirements.

9.4 Right to Restrict Processing

You may request that lux88 restrict the Processing of your Personal Data in certain circumstances — for example, while the accuracy of data is disputed, or while you object to Processing based on legitimate interests. During a restriction, data may be stored but not otherwise used.

9.5 Right to Data Portability

Where Processing is based on Consent or contractual necessity and carried out by automated means, you have the right to receive your Personal Data in a portable format and to transmit it to another data controller of your choosing.

9.6 Right to Object to Marketing

You have an absolute right to object to the Processing of your Personal Data for direct marketing purposes. Following an objection, lux88 will cease all marketing communications to you promptly and without charge.

9.7 Right to Withdraw Consent

Where Processing is based on Consent (e.g., promotional emails), you may withdraw that Consent at any time by contacting support or updating your account notification preferences. Withdrawal of Consent does not affect the lawfulness of Processing carried out before the withdrawal.

lux88 operates as an internationally licensed platform. Your Personal Data may be transferred to and Processed in countries outside Indonesia where lux88's hosting infrastructure, KYC partners, and payment processors are located. When we transfer Personal Data internationally, we ensure appropriate safeguards are in place, including:

• Contractual data-processing agreements incorporating standard data-protection clauses binding our Processors to equivalent protections.
• Restricting transfers to jurisdictions with recognised data-protection frameworks wherever practicable.
• Applying the same security standards to data wherever it is Processed, regardless of geographic location.

By registering an account with lux88 and accepting this Policy, you acknowledge and consent to the transfer of your Personal Data to the locations necessary to provide the lux88 service, subject to the safeguards described above.

lux88 strictly enforces a minimum age requirement of 21 years for all members. The Platform does not knowingly collect Personal Data from any individual under the age of 21. If lux88 identifies or is notified that a member is under 21, the account will be immediately suspended, all associated Personal Data will be deleted from our active systems as quickly as our legal retention obligations allow, and any Balance held in the account will be handled in accordance with our Terms & Conditions.

lux88 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data-handling practices, Platform features, or applicable legal requirements. When we make material changes, we will notify registered members via the email address associated with their account and post the updated Policy on this page with a revised effective date. We encourage you to review this Policy periodically.

Your continued use of the Platform following the notification of a material change constitutes acceptance of the revised Policy. If you do not agree to the revised terms, you should cease using the Platform and may request account closure as described in our Terms & Conditions.

All privacy-related enquiries, data rights requests, and concerns regarding this Policy should be directed to the lux88 data team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, via the Platform. For data rights requests, please state "Data Rights Request" at the start of your message.
• Email: [email protected] — use the subject line "Privacy Policy Enquiry" or "Data Rights Request" as appropriate. We aim to acknowledge all requests within 72 hours (WIB) and provide a substantive response within 30 calendar days.