Privacy Policy — bro108

bro108 is committed to maintaining the trust and confidence of all Members who use our Platform. When you create an account, place a bet, make a deposit or withdrawal, or contact our support team, you inevitably share certain personal information with us. This Privacy Policy sets out a transparent account of how bro108 handles that information.

Our approach to data privacy is grounded in three core principles: minimisation (we collect only what is necessary), purpose limitation (we use data only for the stated purposes), and security (we protect your data using industry-standard technical and organisational measures).

bro108 operates as an internationally licensed offshore gaming platform serving players across Indonesia, including major cities such as Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and Makassar. All financial transactions are conducted in Indonesian Rupiah (IDR) via local bank transfers and e-wallets. The data practices described in this policy reflect the obligations of an internationally regulated gaming operator and are designed to meet the standard expected by our Members.

The following terms carry the meanings set out below throughout this Privacy Policy. Where a term is also defined in the bro108 Terms & Conditions, the definition in the Terms & Conditions shall take precedence in the context of any dispute.

bro108 collects Personal Data across several categories, depending on how you interact with the Platform. The table below summarises each category, the specific data points collected within it, and the retention period applied:

We do not collect sensitive categories of Personal Data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond document photographs required for KYC), or health data, unless you voluntarily disclose such information in the course of a responsible gaming self-exclusion request.

bro108 collects Personal Data through the following channels:

• Direct Interactions: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support via live chat or email, participating in promotions, or submitting a responsible gaming request.
• Automated Technologies: When you access the Platform, our servers automatically record Technical Data and Usage Data via server logs, Cookies, pixel tags, and similar tracking technologies. This data is collected whether or not you are logged in to an Account.
• Third-Party Sources: bro108 may receive Personal Data from third-party KYC verification providers (who validate your identity documents against public and commercial databases), payment processors (who confirm successful deposits and withdrawals), and fraud detection services (who flag anomalous patterns across their client networks).
• Public Sources: In limited circumstances related to anti-money-laundering (AML) checks or Politically Exposed Person (PEP) screening, bro108 may cross-reference your information against publicly available sanctions lists, government registries, or news databases.

bro108 relies on the following legal bases to Process your Personal Data, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing your Identity Data, Contact Data, and Financial Data is necessary to deliver the services you have contracted for — including account registration, bet settlement, deposits and withdrawals, and customer support. Without this processing, bro108 cannot operate your Account.
• Legal Obligation: Processing required to comply with applicable KYC, AML, and record-keeping obligations is mandated by the legal framework under which bro108 is licensed. This includes identity verification, transaction monitoring, and retention of financial records for a minimum of seven years.
• Legitimate Interests: bro108 processes Technical Data and Usage Data on the basis of legitimate interests — specifically, ensuring Platform security, detecting fraud, preventing multi-accounting, and improving the quality of the gaming experience. In each case, these interests are balanced against your privacy rights and do not override them.
• Consent: Processing for direct marketing communications (promotional emails, bonus offers, and VIP programme updates) is based on your explicit opt-in consent, which you may withdraw at any time by updating your communication preferences in the Account dashboard or by contacting support.

bro108 uses the Personal Data it collects for the following purposes, each of which is tied to the legal basis identified in Section 5:

1. Account Management: Creating, maintaining, and administering your Member Account, including processing login sessions, updating account details, and handling voluntary account closures.
2. KYC and Age Verification: Verifying that you are at least 21 years of age and confirming your identity before processing your first withdrawal. bro108 enforces a strict 21+ policy and uses submitted documents to screen against relevant sanctions databases.
3. Payment Processing: Facilitating deposits and withdrawals via your chosen Indonesian payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay). Financial Data is shared with the relevant payment processor only to the extent necessary to execute the transaction.
4. Fraud and Security: Detecting and preventing fraudulent activity, unauthorised account access, multi-accounting, bonus abuse, and money laundering. Technical Data and Usage Data are analysed by our automated risk management systems on a continuous basis.
5. Customer Support: Responding to your queries, resolving disputes, processing responsible gaming requests, and maintaining records of interactions for quality assurance and training purposes.
6. Personalisation: Customising the Platform experience based on your gaming preferences, bet history, and preferred payment methods — for example, surfacing relevant sports markets or slot titles based on your previous activity.
7. Marketing Communications: Sending you promotional offers, bonus notifications, and VIP programme updates where you have provided consent. All marketing emails include a one-click unsubscribe mechanism.
8. Regulatory Compliance: Maintaining records required under the terms of bro108's operating licence, responding to lawful requests from regulatory authorities, and fulfilling AML reporting obligations where applicable.
9. Platform Improvement: Aggregated and anonymised usage data is analysed to identify technical issues, optimise page performance, and inform product development decisions. Anonymised data at this level cannot be traced back to any individual Member.

bro108 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share Personal Data only in the limited circumstances described below, and only to the extent strictly necessary for the relevant purpose:

• Payment Processors: Your Financial Data is shared with the relevant payment gateway or bank — BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay — solely to execute the deposit or withdrawal you have requested. These processors are bound by their own regulatory obligations and data protection commitments.
• KYC Verification Providers: Identity documents submitted during the KYC process are transmitted to our third-party verification partner via an encrypted connection. The verification provider processes your document data only for the purpose of confirming your identity and age on bro108's behalf.
• Fraud and Risk Management Providers: Technical Data and transactional metadata may be shared with specialist fraud-detection services that operate cross-platform risk databases. These services analyse patterns to identify activities such as bonus abuse, chip dumping, and payment fraud.
• Game Studios: When you play a game hosted by a third-party studio — such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, or Pocket Games Soft — limited Technical Data (including session identifiers and bet values) is transmitted to the studio's infrastructure to render the game and settle results. Game studios do not receive your Identity Data or Contact Data.
• Regulatory and Legal Authorities: bro108 will disclose Personal Data to competent authorities, courts, or law enforcement agencies where required to do so by a valid legal order, or where disclosure is necessary to protect the rights, property, or safety of bro108 or its Members.
• Corporate Transactions: In the event of a merger, acquisition, or sale of bro108's business assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. bro108 will notify affected Members of any such transfer via the registered email address.

bro108 uses Cookies and similar technologies to operate the Platform, remember your preferences, support security measures, and collect anonymised analytics. The following categories of Cookies are in use:

You may manage your Cookie preferences at any time through your browser settings. Note that disabling Strictly Necessary or Functional Cookies may impair key Platform features, including the ability to log in or maintain an active session. bro108 does not currently respond to browser Do Not Track (DNT) signals, as no uniform industry standard for DNT has been established.

bro108 implements a layered security architecture to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. Our primary security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the bro108 Platform is encrypted in transit using TLS 1.2 or higher. A valid SSL certificate is maintained at all times and is verifiable via the padlock icon in your browser address bar.
• Encryption at Rest: Sensitive stored data — including Identity Data, Financial Data, and hashed authentication credentials — is encrypted at rest using AES-256. Passwords are never stored in plaintext; they are processed using a salted cryptographic hashing algorithm.
• Access Controls: Internal access to Member data is restricted on a strict need-to-know basis. Access is governed by role-based permissions, and all internal data access events are logged and subject to periodic audit.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA in their Account security settings. All bro108 administrative and support staff accounts are required to use 2FA without exception.
• Intrusion Detection and Monitoring: The Platform is monitored 24 hours a day, 7 days a week by automated intrusion detection systems. Anomalous access patterns trigger immediate alerts for review by our security operations team.
• Regular Security Audits: bro108 conducts periodic penetration testing and vulnerability assessments conducted by independent security specialists. Critical vulnerabilities are remediated within defined service-level timeframes.

In the event of a data breach that is likely to result in significant risk to affected Members, bro108 will notify the relevant supervisory authority and all impacted Members within the timeframes required by applicable law, and in any case within 72 hours of becoming aware of the breach.

bro108 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by the legal and regulatory framework applicable to our operations. The retention periods applicable to each data category are set out in the table in Section 3 above.

The minimum five-year post-closure retention period for Identity Data and Contact Data, and the seven-year period for Financial Data, reflect obligations under international AML standards that require gaming operators to maintain audit-ready records for regulatory inspection. These retention periods cannot be shortened at a Member's request.

At the expiry of the applicable retention period, Personal Data is either permanently deleted from all bro108 systems and backups, or irreversibly anonymised such that it can no longer be associated with any identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical and business intelligence purposes.

During any active Account suspension, investigation, or pending legal dispute, the normal retention clock is paused until the matter is fully resolved. bro108 will not delete data that is the subject of an open investigation or legal hold.

As a Member of the bro108 Platform, you hold a number of rights over your Personal Data. bro108 is committed to honouring these rights promptly and transparently. The rights available to you are described below: