jp888 Privacy Policy

This Policy applies to all personal data processed by jp888 in connection with your use of the Platform, regardless of the device or channel through which you access jp888 — including mobile browsers, desktop browsers, and any other interface through which jp888 makes its services available.

This Policy does not apply to:

• Third-party websites or services linked from jp888, such as game studios or payment providers, which operate their own independent privacy policies.
• Personal data submitted to third-party identity verification services as part of the KYC process, which is governed by those services' own data processing terms.
• Anonymised or aggregated data that cannot reasonably be used to identify you as an individual.

jp888 acts as the data controller in respect of personal data collected directly through the Platform. Where jp888 uses third-party processors to handle personal data on its behalf — such as payment processors, cloud hosting providers, or fraud detection services — jp888 remains responsible for ensuring those processors handle your data in accordance with standards no less protective than those set out in this Policy.

• "Personal Data" means any information that relates to an identified or identifiable natural person — including name, national ID number, date of birth, mobile number, email address, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transfer, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data. jp888 is the Data Controller for Personal Data collected through the Platform.
• "Data Processor" means any third party that Processes Personal Data on behalf of jp888 under a written data processing agreement.
• "Member" means any registered user of the jp888 Platform who has completed account registration and holds an active jp888 Account.
• "KYC" means Know Your Customer — the identity and age verification process jp888 conducts to confirm a Member's identity, age, and source of funds before approving withdrawal requests and at other points as required.
• "Cookies" means small text files placed on your device by the jp888 Platform to facilitate session management, analytics, and personalisation.
• "IDR" / "Rp" means Indonesian Rupiah, the currency used for all jp888 Account transactions.

jp888 collects Personal Data in the following categories. We apply the principle of data minimisation — we collect only what is genuinely necessary for the stated purpose.

jp888 does not collect or store full payment card numbers. If card-based payment methods are made available in future, card data will be handled exclusively by PCI DSS-compliant payment processors and will not be stored on jp888 servers.

jp888 collects Personal Data through the following means:

• Direct Submission: Data you provide when registering a jp888 Account, completing KYC verification, making a deposit or withdrawal request, submitting a support ticket, or participating in a promotion.
• Automated Technical Collection: Data collected automatically when you browse jp888.one, including IP address, device fingerprint, session duration, page views, and interaction events, via server logs, session cookies, and analytics tools.
• Third-Party Identity Verification: Data returned to jp888 by accredited KYC and identity verification partners during the document verification process.
• Payment Processors: Transaction confirmation data (reference numbers, timestamps, amounts, payment method type) returned by local Indonesian bank transfer gateways and e-wallet providers including OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Fraud & Risk Systems: Device reputation data, IP risk scoring, and pattern-of-play signals from integrated third-party fraud prevention tools used to protect both jp888 and its Members from financial crime.

jp888 processes your Personal Data only where a valid legal basis exists. The following table sets out the primary purposes for which jp888 processes Personal Data and the corresponding legal basis for each:

Where jp888 relies on legitimate interests as the legal basis, we have assessed that our legitimate interests are not overridden by your fundamental data rights and freedoms. You may request details of that assessment by contacting our Data Protection contact at the address in Clause 15.

jp888 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. jp888 may share your Personal Data with the following categories of recipients, strictly to the extent necessary for the stated purpose:

• Payment Processors and Banking Partners: Indonesian local bank transfer gateway operators and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive your payment details solely to execute deposit and withdrawal transactions.
• Identity Verification Partners: Accredited KYC and document verification providers receive your identity documents to confirm your name, age, and address as part of the mandatory verification process.
• Game Studio Providers: Game studios including Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, PG Soft, and Spribe may receive your session token and game interaction data for the purpose of rendering live games and RNG game content within the jp888 Platform. These studios do not receive your financial data or full identity documents.
• Fraud and Security Vendors: Third-party fraud detection and cybersecurity vendors process Technical Data and Usage Data on jp888's behalf to identify suspicious activity, prevent account takeover, and protect the Platform's integrity.
• Cloud Infrastructure Providers: jp888's hosting and data storage infrastructure providers process Personal Data as data processors under written agreements that require them to apply equivalent data protection standards.
• Legal and Regulatory Authorities: jp888 may disclose Personal Data to competent authorities, regulators, or courts where required by applicable law, a valid legal order, or jp888's licensing obligations — and only to the extent strictly required by that legal obligation.

As an internationally operated platform serving Members in Indonesia, jp888 may transfer your Personal Data to servers and processors located outside Indonesia. Where such transfers occur, jp888 applies appropriate safeguards to ensure your Personal Data is protected to a standard at least equivalent to that described in this Policy, including:

• Entering into standard data processing agreements with all international processors that impose binding data protection obligations.
• Selecting infrastructure providers and game studio partners that hold recognised international data security certifications (including ISO 27001 where applicable).
• Ensuring that no Personal Data is transferred to a destination country that lacks an adequate framework for protecting personal data without first implementing contractual or technical safeguards to compensate for that gap.

You may request details of the specific safeguards jp888 has applied to any international transfer of your Personal Data by contacting the jp888 Data Protection contact listed in Clause 15.

jp888 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

At the end of the applicable retention period, jp888 will securely delete or irreversibly anonymise your Personal Data. Anonymised or aggregated data derived from your usage may be retained indefinitely for analytical and product improvement purposes, as it cannot be used to identify you.

jp888 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your browser and jp888 servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to jp888 Login sessions, deposit and withdrawal requests, and all account management actions.
• Data Encryption at Rest: Sensitive Personal Data stored on jp888 servers — including identity documents and financial details — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Member Personal Data within jp888's internal systems is restricted on a need-to-know basis. Staff access is governed by role-based access control (RBAC) policies and is subject to regular audit.
• Two-Factor Authentication (2FA): jp888 offers SMS OTP-based 2FA for all Member accounts and strongly recommends its use to prevent unauthorised account access.
• Intrusion Detection and Monitoring: jp888's infrastructure is monitored continuously for anomalous activity, potential intrusions, and security incidents by automated systems and a dedicated security operations function.
• Penetration Testing: jp888's Platform undergoes regular security testing including third-party penetration testing to identify and remediate vulnerabilities before they can be exploited.

jp888 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged in during a jp888 session, security tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Store your preferences such as language settings, game lobby layout, and responsible gaming limit configurations so that your experience is consistent across sessions.
• Analytics Cookies: Collect anonymised information about how Members use the Platform — pages visited, session lengths, features used — to help jp888 improve the product. jp888 uses privacy-respecting analytics tools and does not share raw analytics data with advertising networks.
• Security and Fraud Prevention Cookies: Assist jp888's fraud detection systems in identifying devices associated with known fraudulent activity and detecting unusual login patterns.

jp888 does not deploy third-party advertising cookies or retargeting pixels on the Platform. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to log in to and use the jp888 Platform.

As a jp888 Member, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact jp888 using the details in Clause 15. jp888 will respond to all valid rights requests within 30 days of receipt.

jp888 enforces age verification as a mandatory step in the KYC process. Where jp888 discovers or has reasonable grounds to believe that a registered Member is under 21 years of age, jp888 will immediately suspend the Account, void all Wagers placed, return any net deposits made (less any Bonuses consumed), and permanently delete the Personal Data of the underage individual in accordance with applicable law.

If you are a parent or guardian and believe that your child has created a jp888 Account, please contact jp888 immediately at [email protected]. jp888 will investigate and act promptly on all such reports.

The jp888 Platform integrates with certain third-party services to deliver its core functionality, including live casino game streams from Evolution Gaming, Pragmatic Play Live, and Microgaming; RNG game content from NetEnt, PG Soft, and Spribe; and payment processing via Indonesian bank and e-wallet infrastructure. These third-party services operate under their own privacy policies and data processing terms, which are independent of this Policy.

jp888 does not control and is not responsible for the privacy practices of third-party game studios or payment providers. jp888 recommends that you review the privacy documentation of any third-party service whose data practices are relevant to you. jp888 limits the data shared with third-party game studios to the minimum session data necessary to render the game within the Platform — your full identity, financial data, and KYC documents are not passed to game studios.

jp888 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where a material change is made — that is, a change that significantly affects how we use your Personal Data or the rights available to you — jp888 will notify you via the email address or mobile number registered to your Account at least seven days before the change takes effect.

The "Last Revised" date at the top of this Policy will always reflect the most recent update. We encourage you to review this Policy periodically. Continued use of the jp888 Platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, please cease using the Platform and request Account closure via jp888 support.

For any questions, concerns, or formal requests relating to this Privacy Policy or your Personal Data rights, please contact jp888 through the following official channel:

jp888 takes all privacy enquiries seriously and will acknowledge receipt of every formal data rights request promptly. For complex requests — such as a full subject access request or a request for data portability — jp888 targets a full response within 30 calendar days. Where additional time is required due to the complexity or volume of a request, jp888 will notify you of the extension and the reason within the initial 30-day window.

jp888 does not accept privacy requests submitted via social media, third-party messaging applications, or any channel other than the official support email and in-Platform live chat. Communications purporting to handle jp888 data rights requests through any other channel are not authorised and will not be acted upon.