vt38 Privacy Policy

1. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, date of birth, contact details, financial data, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, vt38.
• "Data Processor" means a third party that processes personal data on behalf of vt38 under a contractual data processing agreement.
• "Player" means any individual who registers an account on the vt38 Platform or otherwise interacts with it.
• "KYC" means Know Your Customer — the identity verification process required before withdrawals can be processed.
• "Cookie" means a small text file placed on a Player's device by the vt38 website for the purposes described in Section 9.
• "IDR" means Indonesian Rupiah, the sole currency used for financial transactions on the vt38 Platform.

2. Data Controller

2.1 vt38 acts as the Data Controller for all personal data collected through the Platform. As Data Controller, vt38 is responsible for ensuring that personal data is processed lawfully, fairly, and transparently in accordance with this Privacy Policy.

2.2 vt38 is an internationally operated online betting platform. While primarily serving players across Indonesia — including major cities such as Jakarta, Surabaya, Bandung, Medan, Bali, and Yogyakarta — the Platform is operated from an internationally incorporated entity. Data processing may therefore occur in jurisdictions outside Indonesia.

2.3 For all privacy-related inquiries, including data subject rights requests, please contact our Data Protection team at: [email protected] (plain text — not a clickable link). Include "Privacy Request" in the subject line of your email.

3. Data We Collect

3.1 Registration Data. When you create an account on vt38, we collect the following information:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (to verify you are at least 21 years of age)
• Current residential address (including city, province, and postal code)
• Email address
• Mobile telephone number
• Chosen username and encrypted password

3.2 Identity Verification (KYC) Data. To comply with our anti-money-laundering (AML) obligations and to verify player identity before processing withdrawals, we collect:

• Scanned or photographed copies of government-issued photo identification (KTP, SIM, or passport)
• Proof of residential address documents (utility bills, bank statements dated within 90 days)
• Proof of payment method ownership (photographs or screenshots of the bank account or e-wallet registered in your name)
• Facial verification photographs where required for enhanced due diligence

3.3 Financial Transaction Data. We record details of all financial transactions associated with your account, including:

• Deposit and withdrawal amounts in IDR (Rp)
• Payment method used (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction timestamps in WIB (Western Indonesia Time, UTC+7)
• Bank account numbers or e-wallet identifiers used for transactions

3.4 Betting & Gaming Activity Data. We maintain records of your activity on the Platform, including:

• Sports bets placed, including market type, stake, odds, and outcome
• Casino game sessions, including game title, provider, bet size, and result
• Togel (Indonesia's traditional numbers lottery) ticket purchases and draw results
• Bonus and promotion usage history

3.5 Technical & Device Data. When you access vt38, we automatically collect:

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Session duration and navigation patterns within the Platform
• Cookie identifiers and similar tracking technologies (see Section 9)

3.6 Communications Data. When you contact our support team — via live chat, email, or WhatsApp — we retain records of those communications, including the content of messages and the date and time of contact.

4. How Data Is Collected

4.1 vt38 collects personal data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, place a bet, or contact our support team.
• Automatically — through cookies, server logs, and device fingerprinting technologies as you browse and use the Platform.
• From third-party service providers — including licens ed payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), KYC verification partners, and fraud detection services, who may share data with us as part of the services they provide.
• From publicly available sources — such as public records or social media profiles, where we have reasonable grounds to verify identity or investigate fraud.

5. Purpose of Processing

5.1 vt38 processes your personal data only for specific, legitimate, and clearly defined purposes. The table below outlines each purpose and the corresponding category of data used:

• Account creation and management: Registration data, communications data — to set up and maintain your vt38 account and provide you with access to the Platform.
• Identity verification (KYC): KYC data, registration data — to confirm your identity and age (21+) before processing withdrawals, in compliance with our anti-money-laundering obligations.
• Payment processing: Financial transaction data, KYC data — to facilitate deposits and withdrawals in IDR via your chosen local bank or e-wallet.
• Fraud prevention and security: Technical data, financial transaction data, betting activity data — to detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, and money laundering.
• Platform improvement: Technical data, betting activity data — to analyze usage patterns, identify technical issues, and improve the overall player experience.
• Customer support: Communications data, registration data — to respond to your inquiries, resolve disputes, and process responsible gaming requests such as self-exclusion.
• Regulatory compliance: KYC data, financial transaction data — to meet our obligations under applicable anti-money-laundering, data protection, and gaming regulations.
• Personalized promotions: Betting activity data, registration data — to offer relevant bonuses and seasonal promotions (e.g., Idul Fitri, Ramadhan specials) to eligible players, where you have not opted out of marketing communications.

6. Legal Basis for Processing

6.1 vt38 relies on the following legal bases to process your personal data:

• Contractual necessity: Processing required to fulfill the contract between vt38 and the Player — including account management, payment processing, and KYC verification — is carried out on the basis that it is necessary to perform the services you have requested.
• Legal obligation: Processing required to comply with anti-money-laundering regulations, gaming regulations, and other applicable legal requirements is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement is carried out on the basis of vt38's legitimate interests, provided those interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out on the basis of your freely given, informed, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Data Sharing

7.1 vt38 does not sell, rent, or trade your personal data to any third party for commercial or advertising purposes. We share personal data only in the following limited circumstances:

• Payment processors: We share the minimum necessary financial and identity data with our local payment partners — including BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja — solely to process deposits and withdrawals on your behalf.
• KYC verification providers: We share identity documents and related data with licensed KYC verification service providers who perform identity checks on our behalf under strict data processing agreements.
• Fraud prevention services: We share technical and transactional data with fraud detection platforms to identify and prevent financial crime, bonus abuse, and multi-accounting.
• Game content providers: Game providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft may receive session and wagering data necessary to deliver their games through the vt38 Platform. These providers are contractually prohibited from using this data for any purpose beyond game delivery.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so or where disclosure is necessary to protect the rights, property, or safety of vt38, its players, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of vt38's business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7.2 All third parties with whom vt38 shares personal data are required to maintain appropriate technical and organizational security measures and are prohibited from processing the data for any purpose beyond the specific service they provide to vt38.

8. International Data Transfers

8.1 As an internationally operated platform, vt38 may transfer personal data to countries outside Indonesia in the course of operating its services. Such transfers may occur when data is processed by our KYC verification providers, fraud detection services, or game content partners operating in other jurisdictions.

8.2 Whenever personal data is transferred internationally, vt38 ensures that appropriate safeguards are in place to protect the data, including contractual data protection clauses equivalent to recognized international data protection standards.

8.3 By using the vt38 Platform, you acknowledge and consent to the transfer of your personal data to countries outside Indonesia as described in this section.

9. Cookies & Tracking Technologies

9.1 The vt38 Platform uses cookies and similar tracking technologies to deliver a functional, personalized, and secure experience. The following categories of cookies are used:

9.2 You may manage your cookie preferences through your browser settings at any time. Disabling strictly necessary or security cookies may impair the functionality of the Platform. Disabling performance or functional cookies will not prevent you from accessing the Platform but may reduce the personalization of your experience.

9.3 vt38 does not use third-party advertising cookies or cross-site tracking technologies that follow your activity across external websites.

10. Data Retention

10.1 vt38 retains personal data only for as long as it is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following standard retention periods apply:

• Active account data: Retained for the full duration of the account's active status plus a minimum of 5 years following account closure, in line with anti-money-laundering record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years following account closure or the last transaction, whichever is later.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction.
• Customer support communications: Retained for 2 years from the date of the last communication in a support thread.
• Technical and device logs: Retained for up to 12 months for security and fraud investigation purposes.
• Marketing consent records: Retained for the duration of the consent plus 2 years after withdrawal of consent, as evidence of compliance.

10.2 Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Anonymized data may be retained indefinitely for aggregate statistical analysis.

10.3 Where you request deletion of your personal data under your Right to Erasure (see Section 13), vt38 will fulfill that request within 30 days, subject to any overriding legal retention obligations described above.

11. Data Security

11.1 vt38 implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS 1.3 encryption for all data transmitted between your browser and the vt38 Platform
• AES-256 encryption for all personal data stored in our databases
• Role-based access controls ensuring that staff can only access personal data on a strict need-to-know basis
• Multi-factor authentication required for all internal administrative access to player data systems
• Regular independent penetration testing and vulnerability assessments
• 24/7 automated intrusion detection and alerting systems
• Segregated data environments with access logging and audit trails

11.2 In the event of a personal data breach that poses a risk to players' rights and freedoms, vt38 will notify affected players within 72 hours of becoming aware of the breach, and will cooperate fully with any regulatory investigation.

11.3 While vt38 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for ensuring that your own devices are adequately secured.

12. Minors & Age Restriction

12.1 The vt38 Platform is strictly intended for adults aged 21 and above. vt38 does not knowingly collect personal data from individuals under the age of 21.

12.2 If vt38 discovers or is notified that an account has been registered by a person under 21 years of age, all personal data associated with that account will be deleted within 48 hours, all funds will be handled in accordance with our Terms & Conditions, and the account will be permanently closed.

12.3 If you believe that a minor has created an account on vt38, please notify us immediately at [email protected]. vt38 takes underage access extremely seriously and will act on all credible reports without delay.

13. Exercising Your Privacy Rights

13.1 To exercise any of the rights described in the "Your Data Rights" section of this page — including access, rectification, erasure, restriction, portability, or objection — please submit a written request to: [email protected]

13.2 Your request should include:

• Your full registered name and the email address associated with your vt38 account
• A clear description of the right you wish to exercise and the specific data it relates to
• A copy of a valid government-issued ID to verify your identity (to prevent unauthorized third-party requests)

13.3 vt38 will acknowledge your request within 5 business days and will fulfill it within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

13.4 There is no charge for submitting a data subject rights request. However, if requests are manifestly unfounded or excessive — particularly if repetitive — vt38 reserves the right to charge a reasonable administrative fee or to decline the request, with written justification provided.

14. Policy Amendments

14.1 vt38 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, we will notify registered players via email to their registered address no less than 14 calendar days before the changes take effect.

14.2 The current version of this Privacy Policy is always accessible at https://vt38.cam/privacy-policy. The effective date displayed at the top of this page indicates when the most recent version came into force.

14.3 Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised policy, you must close your account and request deletion of your data before the amendments take effect.

15. Contact & Complaints

15.1 For any questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please contact the vt38 Data Protection team:

• Email: [email protected] (plain text — not a clickable link). Use the subject line "Privacy Request" for all data-related inquiries.
• Live Chat: Available 24/7 through the vt38 Platform dashboard for general support queries.
• Response Time: Privacy-specific requests are acknowledged within 5 business days and resolved within 30 calendar days.

15.2 If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority or regulatory body in your jurisdiction. vt38 will cooperate fully with any such inquiry.

15.3 For issues related to responsible gaming, self-exclusion, or account closure, please visit our dedicated Responsible Gaming page or contact support directly. Responsible gaming requests are treated as the highest priority by our support team.