Privacy Policy

Definitions

The following terms carry the meanings ascribed to them throughout this Policy:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a living individual, including name, email address, phone number, financial account details, IP address, device identifier, and behavioral data tied to an identifiable user.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — hgo88, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — A third-party service provider that processes personal data on behalf of hgo88, subject to a binding data processing agreement.
• "KYC" — Know Your Customer — the identity and address verification process required before withdrawals may be processed.
• "Cookies" — Small text files placed on your device by the hgo88 platform for session management, analytics, and preference storage purposes.
• "Player" — Any individual who has registered a verified account on the hgo88 platform.
• "Sensitive Data" — A subset of personal data that warrants heightened protection, including government-issued ID numbers, financial account credentials, and biometric data where applicable.

Data We Collect

hgo88 collects personal data across several categories, each serving a defined operational or legal purpose. The table below summarises the categories and specific data points collected:

hgo88 does not knowingly collect special category data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) as part of its standard operations. If such data is incidentally provided by a Player, it will not be processed beyond what is strictly necessary to handle the communication in which it was shared.

How Data Is Collected

hgo88 collects personal data through the following channels:

• Direct Submission: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting our support team.
• Automated Collection: Technical and behavioural data collected automatically when you access the platform, including via cookies, web beacons, server logs, and analytics tools embedded in the platform.
• Payment Providers: Transaction confirmation data received from our payment processing partners, including Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), solely for the purpose of confirming deposit and withdrawal status.
• Identity Verification Partners: Where automated KYC tools are used, our verification service providers may return a verification result (pass / refer / fail) alongside limited identity confirmation signals. hgo88 does not receive raw biometric data from these providers.
• Fraud Prevention Services: Risk scores and device fingerprint signals from fraud-detection partners, used exclusively for security and AML compliance purposes.

Purpose & Legal Basis for Processing

hgo88 processes your personal data only where a valid legal basis exists. The primary bases on which we rely are:

• Contractual Necessity: Processing required to create and manage your account, process deposits and withdrawals, settle bets, and deliver the services you have requested under our Terms & Conditions. Without this processing, hgo88 cannot provide its services to you.
• Legal Obligation: Processing required to comply with our obligations as an internationally licensed gaming operator, including KYC verification, anti-money-laundering (AML) checks, responsible gaming monitoring, and regulatory reporting.
• Legitimate Interests: Processing carried out for hgo88's genuine business interests where those interests are not overridden by your privacy rights — including fraud detection, platform security, IT system maintenance, and internal business analytics. We conduct a proportionality assessment before relying on this basis.
• Consent: Processing for optional purposes where you have given clear, informed, and freely withdrawable consent — primarily the sending of promotional and marketing communications. You may withdraw consent for marketing at any time (see Section 12).

hgo88 does not use personal data to make fully automated decisions that produce significant legal or similarly significant effects on Players without human oversight. Fraud flags generated by automated systems are always reviewed by a human analyst before action is taken on an account.

Data Sharing

hgo88 does not sell your personal data. We share personal data with third parties only where strictly necessary and under the following controlled circumstances:

• Payment Processors: Financial data is shared with the relevant Indonesian bank or e-wallet operator (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute deposit and withdrawal transactions. These providers act as independent data controllers for their own processing activities and are subject to their own privacy policies.
• KYC & Identity Verification Partners: Identity documents and personal data are shared with licensed KYC service providers for the purpose of verifying your identity and age. These providers process data as data processors under binding agreements with hgo88.
• Game Providers: Certain game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) receive a minimal Player identifier (non-personally-identifiable session token) to manage game sessions. No name, address, or financial data is shared with game studios.
• Fraud Prevention & Security Services: Technical data (IP address, device fingerprint, session data) is shared with fraud-detection service providers for security and AML compliance purposes.
• Legal & Regulatory Authorities: Where required by applicable law, a court order, or a legitimate request from a regulatory or law enforcement authority, hgo88 will disclose personal data without further notice to the Player. hgo88 will seek to notify affected Players of such requests where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of hgo88's business assets, personal data may be transferred to the acquiring entity as part of that transaction. Affected Players will be notified by email within 30 days of any such transfer.

International Data Transfers

hgo88 operates as an international platform and, as a result, your personal data may be transferred to and processed in countries outside of Indonesia. These transfers may occur when our servers, KYC partners, or other service providers are located in jurisdictions such as Malta, Curaçao, the Isle of Man, Gibraltar, or other established international gaming hubs.

Where personal data is transferred internationally, hgo88 ensures that appropriate safeguards are in place, which may include:

• Transfers to countries recognised as providing an adequate level of data protection under applicable standards.
• Use of standard contractual clauses or equivalent contractual safeguards in agreements with receiving parties.
• Transfers to certified entities operating under recognised international data privacy frameworks.

You may request information about the specific safeguards applied to any international transfer of your personal data by contacting us at the address set out in Section 16.

Data Retention

hgo88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligation. The following retention periods apply as a general guide:

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised aggregated data (e.g., platform-level statistics) may be retained indefinitely for analytical purposes.

Security Measures

hgo88 implements a layered security architecture to protect personal data against unauthorised access, alteration, disclosure, or destruction. Key measures include:

• Encryption in Transit: All communications between your device and our servers are secured using TLS 1.2 or higher (256-bit SSL encryption). This protects your login session, financial transactions, and any data submitted via the platform from interception.
• Encryption at Rest: Sensitive data stored in our databases — including KYC documents and financial account details — is encrypted at rest using industry-standard symmetric encryption algorithms.
• Access Controls: Access to personal data systems is restricted to authorised personnel on a strict need-to-know basis. Multi-factor authentication is required for all internal system access. Access logs are maintained and reviewed regularly.
• Network Security: Our infrastructure is protected by firewalls, intrusion detection systems (IDS), and DDoS mitigation services. Regular vulnerability assessments and penetration tests are conducted by independent security specialists.
• Staff Training: All hgo88 staff who handle personal data receive regular data protection and security awareness training. Confidentiality obligations are embedded in all employment and contractor agreements.
• Incident Response: hgo88 maintains a documented data breach incident response plan (see Section 14). In the event of a confirmed breach, we follow defined escalation, containment, and notification procedures.

Cookies & Tracking Technologies

hgo88 uses cookies and similar tracking technologies to operate the platform effectively, maintain your session, and understand how the platform is used. The types of cookies we deploy are as follows:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. They cannot be disabled without materially affecting your ability to use the platform.
• Functional Cookies: Store your preferences such as language settings, last visited game category, and deposit method selection to provide a more personalised experience on return visits.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Players navigate and use the platform. This helps hgo88 identify areas for improvement. Where third-party analytics tools are used, data is processed in anonymised form and is not shared for advertising purposes.
• Security Cookies: Used for fraud detection and bot-prevention purposes, including device fingerprinting and behavioural anomaly detection. These operate in the background and do not affect the visible platform experience.

You can control cookie settings through your browser. Most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will prevent you from logging in or completing transactions on the platform. Analytics and functional cookies can be disabled without affecting core account functionality.

hgo88 does not use third-party advertising or retargeting cookies. We do not share cookie data with social media platforms or advertising networks.

Minors

The hgo88 platform is strictly for adults aged 21 years and older. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in the registration and KYC process.

If hgo88 discovers or is notified that personal data has been collected from a person under 21 years of age, we will:

• Immediately suspend the relevant account pending investigation.
• Delete all personal data associated with the underage individual as promptly as practicable, subject to any legal obligation to retain evidence of the age violation.
• Return any deposited funds to the originating payment source after deduction of any bonuses claimed.

If you believe a minor has registered an account on hgo88, please contact us immediately at the details provided in Section 16. We treat all such reports as high-priority.

Your Rights

As a Player whose personal data is processed by hgo88, you hold the following rights. To exercise any of these rights, contact us using the details in Section 16. hgo88 will respond to all valid rights requests within 30 calendar days.

hgo88 will not charge a fee for handling rights requests unless the request is manifestly unfounded or excessive. Where a fee is appropriate, we will inform you before proceeding. We may require you to verify your identity before fulfilling a rights request to ensure we do not disclose data to an unauthorised party.

Marketing Communications

hgo88 may send you promotional communications about bonuses, new games, seasonal offers (such as Idul Fitri promotions, Ramadhan specials, and Indonesian Independence Day campaigns), and platform updates — but only where you have given your consent to receive such communications at the time of registration or subsequently.

You may withdraw your consent to marketing communications at any time by:

• Clicking the "unsubscribe" link present in every marketing email we send.
• Updating your notification preferences within your account settings panel.
• Sending a written request to [email protected] with the subject line "Marketing Opt-Out".

Withdrawal of consent to marketing does not affect the lawfulness of processing that occurred before withdrawal. Opting out of marketing communications does not affect essential service communications (such as account security alerts, deposit confirmations, withdrawal notifications, or KYC status updates) — these will continue to be sent as they are necessary for the operation of your account.

Third-Party Services

The hgo88 platform integrates third-party services to deliver game content, process payments, and maintain platform security. While hgo88 applies contractual obligations to all service providers (as described in Section 5), each third-party provider operates under its own terms of service and privacy policy for the portions of processing it independently controls.

Key third-party service categories used by hgo88 include:

• Game Content Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and other licensed studios. These providers supply game software via APIs; only a minimal, non-personally-identifiable session token is shared for game session management.
• Payment Infrastructure: Indonesian banking rails (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers process your transaction data as independent controllers under their own regulatory obligations.
• Analytics Tools: Server-side analytics services used to monitor platform performance and detect anomalies. Data processed through these tools is aggregated and anonymised before analysis.
• Customer Support Infrastructure: Live chat and ticketing system providers. Conversation data is processed under a data processing agreement with hgo88 as controller.

hgo88 is not responsible for the privacy practices of third-party providers acting as independent data controllers. We encourage you to review the privacy policies of any third-party services you interact with directly.

Data Breach Procedure

Despite the robust security measures described in Section 8, no system can guarantee absolute immunity from a data breach. In the event that hgo88 becomes aware of a personal data breach — meaning an accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data — we will follow the procedures outlined below:

1. Containment: Upon detection, the security team will immediately work to contain the breach, isolate affected systems, and prevent further unauthorised access.
2. Assessment: A rapid risk assessment will be conducted to determine the scope of the breach, the categories and volume of personal data affected, and the likely consequences for affected Players.
3. Notification — Regulatory: Where the breach is likely to result in a risk to the rights and freedoms of Players, hgo88 will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible.
4. Notification — Players: Where the breach is likely to result in a high risk to affected Players, hgo88 will notify those Players directly — by email to the address registered on their account — without undue delay. The notification will describe the nature of the breach, the data affected, the likely consequences, and the steps Players can take to protect themselves.
5. Remediation: Following containment, hgo88 will conduct a thorough post-incident review, implement additional controls where necessary, and document the breach in our internal incident register.

If you suspect that your hgo88 account has been compromised, please contact our support team immediately via live chat or by emailing [email protected]. We will investigate all reports of suspected unauthorised access as high-priority security incidents.

Policy Amendments

hgo88 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. The "Last Revised" date at the top of this document will be updated whenever changes are made.

Where amendments are material — for example, where we introduce a new category of data processing, a new data-sharing arrangement, or a change to retention periods — hgo88 will notify registered Players by email at least 14 calendar days before the change takes effect, giving you adequate time to review the update and, where applicable, withdraw your consent.

For non-material amendments (such as typographical corrections or clarifications of existing practices), changes take effect immediately upon publication. Your continued use of the platform after any amendment to this Policy constitutes your acceptance of the revised terms. If you do not agree with a material amendment, you should close your account and request withdrawal of your balance before the amendment takes effect.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to make a privacy-related complaint, please contact hgo88 using the following details:

• Email: [email protected] — please use the subject line "Privacy Request" or "Data Rights Request" for faster routing.
• WhatsApp: +62 811 9988 0088 (available 08:00–24:00 WIB)
• Live Chat: Available 24/7 via the hgo88 platform.

hgo88 aims to acknowledge all privacy requests within 48 hours and to provide a substantive response within 30 calendar days. Complex requests may require up to an additional 60 days; where this is the case, we will inform you of the extended timeline within the initial 30-day window.

If you are not satisfied with hgo88's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction of hgo88's licensing, or to seek independent legal advice.