pw138 Privacy Policy

This Privacy Policy ("Policy") applies to all personal data processed by pw138 ("pw138", "we", "us", "our") in connection with the operation of the online gaming platform accessible at https://pw138.app (the "Platform"). It covers data processed when you visit the Platform as a guest, register a Member account, make a deposit or withdrawal, participate in games or sports betting, contact our customer support team, or interact with any promotional communications sent by pw138.

pw138 is committed to handling personal data with transparency, integrity, and respect for individual privacy. This Policy is drafted in accordance with internationally recognised data protection principles and reflects our specific obligations to Members located in Indonesia, where we primarily operate. Where applicable, the Policy also reflects the spirit of the EU General Data Protection Regulation (GDPR) as a recognised global benchmark for best practice in personal data protection.

By registering a pw138 Account or continuing to use the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform.

The following terms have the meanings set out below throughout this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including but not limited to name, identification number, location data, email address, phone number, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
• "Controller" means pw138, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means any third party that processes Personal Data on behalf of pw138 under a written data processing agreement.
• "Member" means any natural person who has completed registration and holds an active pw138 Account.
• "KYC" means Know Your Customer — the identity and age verification programme required of all Members prior to withdrawal processing.
• "Cookies" means small text files stored on your device by your browser at the instruction of the Platform.
• "Third-Party Service Providers" means payment processors, KYC verification agencies, game studios, fraud detection vendors, and other suppliers engaged by pw138 to support Platform operations.

pw138 collects Personal Data in the categories described below. We limit collection to what is genuinely necessary for the stated purposes.

pw138 collects Personal Data through the following channels:

pw138 processes your Personal Data only where a valid legal basis exists. The table below maps each processing purpose to its legal basis:

pw138 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share data only in the circumstances described below, and only to the extent necessary for each purpose.

pw138 retains Personal Data for no longer than is necessary to fulfil the purpose for which it was collected, subject to applicable legal minimum retention periods. The following retention schedules apply:

After the applicable retention period expires, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. Anonymised, aggregated data may be retained indefinitely for statistical and product improvement purposes.

pw138 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our key technical and organisational security measures include:

• Transport Encryption: All data transmitted between your browser and the pw138 Platform is encrypted using TLS 1.3. Connections using older, insecure protocol versions (TLS 1.0, TLS 1.1, SSL 3.0) are rejected.
• Data-at-Rest Encryption: Sensitive Personal Data stored in pw138 databases — including KYC documents and financial records — is encrypted using AES-256 at rest.
• Password Hashing: Member passwords are never stored in plain text. pw138 uses a salted hashing algorithm (bcrypt with a work factor of ≥12) to store credential data.
• Access Controls: Access to Personal Data within pw138's internal systems is restricted on a strict need-to-know basis. Role-based access controls (RBAC) ensure that only authorised personnel can access specific data categories. All administrative access is logged and audited.
• Two-Factor Authentication: Two-factor authentication (2FA) is available to all Members and is mandatory for pw138 staff accessing systems containing Personal Data.
• Penetration Testing: pw138 commissions independent security assessments and penetration tests on a regular basis. Critical findings are remediated within defined SLA windows.
• Incident Response: pw138 maintains a documented data breach response plan. In the event of a breach affecting Member Personal Data, pw138 will notify affected Members within 72 hours of becoming aware of the incident, to the extent practicable.

pw138 uses cookies and similar browser storage mechanisms to operate the Platform, maintain your login session, prevent fraud, and analyse usage patterns. The following cookie categories are in use:

pw138 respects your rights over your own Personal Data. Subject to applicable law and certain exemptions (e.g., where retention is required by AML or financial regulation), you may exercise the following rights at any time:

If pw138 discovers or has reason to believe that a Member is under 21 years of age, we will immediately suspend the Account, freeze all balances, and initiate a verification process. If the Member cannot confirm they are 21 or older, the Account will be permanently closed and any deposited balance returned to the originating payment method after investigation.

If you are a parent or guardian and believe that a minor in your care has registered on pw138 without authorisation, please contact us immediately at support@pw138.app with the subject line "Underage Account Report". We will investigate and take appropriate action within 24 hours of receiving a verified report.

pw138 operates infrastructure that may involve the processing of Personal Data outside of Indonesia. For instance, game studio servers operated by Evolution Gaming or Pragmatic Play may be located in Europe or Asia. KYC verification partners may process data in jurisdictions with their own data protection frameworks.

Where Personal Data is transferred internationally, pw138 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses (Standard Contractual Clauses or equivalent) incorporated into all data processing agreements with Third-Party Service Providers.
• Technical security measures (encryption in transit and at rest) applied consistently regardless of the jurisdiction in which processing occurs.
• Transfer impact assessments conducted for high-risk destination countries to ensure that Member rights are not materially undermined.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia. pw138 takes all reasonable steps to ensure such transfers are conducted securely and in compliance with applicable data protection standards.

pw138 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When a material change is made, we will:

• Update the "Last Updated" date at the top of this Policy.
• Send a notification email to all registered Members at the email address on file, at least seven (7) days before the changes take effect.
• Display a prominent banner on the Platform homepage for at least seven (7) days following publication of the revised Policy.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and request account closure by contacting support at support@pw138.app.

Previous versions of this Policy are archived and available upon request by contacting our Data Protection contact listed in Section 14.

If you have any questions, concerns, or complaints regarding this Privacy Policy or pw138's personal data practices, please contact us using the details below:

pw138 is committed to resolving privacy complaints internally in the first instance. If you are not satisfied with our response, you may escalate your complaint to the relevant data protection authority in your jurisdiction.