ajo88 Privacy Policy

Throughout this Privacy Policy, the following terms carry the meanings set out below unless context requires otherwise.

ajo88 is the data controller for all Personal Data collected through the Platform. As data controller, ajo88 determines the purposes and means by which Personal Data is processed in connection with the operation of the Platform and the provision of sports betting, casino, and gaming services to members located in Indonesia and other eligible jurisdictions.

All data protection enquiries, subject access requests, and privacy-related complaints should be directed to the ajo88 Privacy Team using the contact details set out in Section 14 of this Policy. ajo88 undertakes to respond to all data subject requests within 30 calendar days of verified receipt.

ajo88 collects the following categories of Personal Data in the course of providing its services to members:

ajo88 does not deliberately collect special categories of sensitive Personal Data — such as health, religious belief, or political opinion — unless you voluntarily provide this information in the context of a responsible gaming self-assessment or a support interaction. Where such data is received, it is processed solely for the purpose for which it was provided and is not used for marketing or profiling.

ajo88 collects Personal Data through the following channels:

4.1 Directly From You

• During account registration, when you submit your name, contact details, and preferred payment method;
• During KYC verification, when you upload identity documents and selfie photographs;
• When you contact support via live chat or email;
• When you complete responsible gaming self-assessment questionnaires or request account restrictions;
• When you respond to surveys or provide feedback.

4.2 Automatically Through the Platform

• Session data collected via server logs each time you access the Platform;
• Cookies and similar tracking technologies as described in Section 10;
• Betting and gaming activity recorded in real time as you interact with Platform markets and games;
• Device fingerprint data collected to support fraud prevention and responsible gaming monitoring.

4.3 From Third Parties

• Payment processors confirm deposit and withdrawal status and may share transaction identifiers and account verification flags;
• Identity verification service providers may return a verified/unverified status and risk score derived from the documents you submitted;
• Fraud intelligence services may provide risk signals associated with IP addresses, device identifiers, or payment instrument patterns.

ajo88 processes your Personal Data only where a lawful basis exists for doing so. The following table summarises the primary processing purposes and the corresponding legal basis for each:

ajo88 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes under any circumstances. Personal Data is shared only in the following limited contexts:

6.1 Service Providers

ajo88 engages carefully selected third-party service providers to assist in the operation of the Platform. These include payment gateway operators facilitating transactions through BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja; identity verification and KYC platform providers; cloud hosting and infrastructure providers; fraud detection and cybersecurity services; and customer support platform operators. Each provider is bound by contractual data processing agreements that restrict use of your data to the specific service they deliver on ajo88's behalf.

6.2 Game Studios & Content Providers

Certain live casino and slot games are powered by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These studios may receive your account identifier and session token to facilitate gameplay. They do not receive your full identity, financial, or KYC data. Their own privacy practices govern how they handle session-level data within their game environments.

6.3 Legal & Regulatory Disclosure

ajo88 may disclose Personal Data to law enforcement agencies, courts, or regulatory authorities where required by applicable law, valid court order, or regulatory direction — including requests related to anti-money laundering investigations, fraud inquiries, or match-fixing investigations coordinated by sports governing bodies.

6.4 Business Transfers

In the event that ajo88's business or a material part of it is acquired, merged, or restructured, your Personal Data may be transferred as part of that transaction. You will be notified of any such transfer and of any resulting change to this Privacy Policy with at least 30 days' advance notice.

As an internationally operated platform serving members primarily located in Indonesia, ajo88 may store and process your Personal Data on servers located outside Indonesia. Where Personal Data is transferred internationally, ajo88 ensures that adequate safeguards are in place prior to any transfer, including:

• Contractual clauses in data processing agreements that impose equivalent data protection obligations on recipient entities;
• Processing exclusively within jurisdictions that maintain recognised data protection frameworks comparable to internationally accepted standards;
• Technical and organisational measures — including encryption at rest and in transit — that protect data regardless of the jurisdiction in which it is stored.

You may request further information about the specific safeguards applicable to any international transfer of your Personal Data by contacting the ajo88 Privacy Team at the address in Section 14.

ajo88 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual. Where deletion is not immediately technically feasible (for example, within encrypted backup archives), data is quarantined and excluded from active processing until scheduled deletion cycles are run.

ajo88 implements a layered information security framework designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and ajo88 servers is encrypted using industry-standard TLS 1.2 or higher. The padlock indicator visible in your browser confirms this connection is active.
• Encryption at Rest: Sensitive data fields — including KYC documents, financial account identifiers, and authentication credentials — are encrypted within the database using AES-256 symmetric encryption.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. Employee access is governed by role-based permissions, and all privileged access is logged and audited.
• Two-Factor Authentication: ajo88 supports SMS-based two-factor authentication (2FA) for Member accounts. ajo88 staff accounts that access production systems require mandatory 2FA.
• Fraud Monitoring: Automated systems monitor account activity in real time for anomalous patterns indicative of account takeover, credential stuffing, or unauthorised payment activity.
• Vulnerability Management: The Platform undergoes regular penetration testing and security assessments by independent third-party security firms. Critical vulnerabilities are remediated within defined SLA windows.
• Incident Response: ajo88 maintains a documented data breach response procedure. In the event of a breach that poses a high risk to Members, affected individuals will be notified without undue delay and in accordance with applicable notification obligations.

The ajo88 Platform uses cookies and similar tracking technologies to deliver core functionality, maintain session state, improve platform performance, and — where you have given consent — to personalise your experience and measure marketing effectiveness.

10.1 Cookie Categories

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: Remember your preferences such as preferred language, time zone (defaulting to WIB, UTC+7), and odds format. These are set on first login and persist for the duration of your session or for a defined period.
• Analytics Cookies: Collect anonymised data about how members navigate the Platform — which pages are visited most, where sessions begin and end, and which features are used — to inform product improvement decisions. Used only with your consent.
• Marketing Cookies: Track Platform visits and interactions to enable ajo88 to measure the effectiveness of promotional campaigns. Used only with your consent and only in connection with ajo88's own marketing activity.

10.2 Managing Cookies

You may adjust your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies will affect Platform functionality; disabling all other categories will not prevent you from using the Platform but may reduce personalisation. Note that clearing browser cookies will also delete your remembered preferences and may require you to re-authenticate at next login.

As a Member of the ajo88 platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, submit a written request to the ajo88 Privacy Team using the contact details in Section 14. ajo88 will respond within 30 calendar days of verifying your identity.

The ajo88 platform is strictly intended for adults aged 21 years and over. ajo88 does not knowingly collect, process, or retain Personal Data from any person under the age of 21. Age verification is a mandatory component of the account registration and KYC process.

If ajo88 discovers or is notified that Personal Data has been collected from a person under 21 years of age, the relevant account will be suspended immediately, all associated Personal Data will be deleted as quickly as technically feasible, and any deposits made will be returned to the verified payment source where practicable.

If you are a parent or guardian and believe that a minor in your care has created an account on the Platform or provided Personal Data to ajo88, please contact the Privacy Team immediately using the details in Section 14.

ajo88 reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, the introduction of new Platform features, evolving legal obligations, or feedback from Members.

Material changes — meaning changes that meaningfully affect your rights or the way your data is used — will be communicated to registered Members via an in-platform notification at login or by email to your registered address, with a minimum of 14 days' notice prior to the updated Policy taking effect.

The version number and effective date at the top of this Policy will be updated with each revision. Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not accept a material change, you should contact ajo88 support to close your Account before the change takes effect.

For all privacy-related enquiries, data subject requests, and complaints relating to ajo88's handling of your Personal Data, please contact the ajo88 Privacy Team through the following channels:

• Live Chat: Available 24/7 directly on the Platform at ajo88.ws. Use the subject line "Privacy Request" to route your query to the Privacy Team. Live chat is the fastest channel for general privacy questions.
• Email: [email protected] — please include "Privacy Request" and your registered username in the subject line to ensure prompt routing. ajo88 undertakes to acknowledge receipt within 2 business days and to provide a substantive response within 30 calendar days of identity verification.

If you are not satisfied with ajo88's response to a privacy complaint, you have the right to escalate your complaint to the relevant supervisory authority or data protection regulator in your jurisdiction. ajo88 will cooperate fully with any such investigation.