Privacy Policy

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable individual, including name, identity card number, email address, phone number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Platform" means the jos138 website at https://jos138.cam and any associated mobile interfaces or applications.
• "Controller" means jos138, the entity that determines the purposes and means of Processing Personal Data.
• "Third Party" means any person or entity other than you and jos138.
• "KYC" means Know Your Customer — the identity and document verification process required under our anti-fraud and compliance obligations.
• "Cookies" means small text files placed on your device when you visit the Platform, used to store session and preference data.

This Privacy Policy applies to all Personal Data collected by jos138 in connection with the Platform, whether submitted during account registration, deposited via Indonesian banking channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon), transmitted through e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja), or generated through your interaction with Platform features such as sports betting markets, togel (Indonesia's traditional numbers lottery) draws, live casino rooms, and slot gacor (high-payout video slots) games.

This policy does not apply to Third Party websites or services linked from the Platform. jos138 is not responsible for the privacy practices of any Third Party service provider beyond the data-processing agreements described in Section 7.

jos138 collects the following categories of Personal Data:

We do not collect sensitive categories of Personal Data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where expressly required by applicable law or KYC regulations.

jos138 collects Personal Data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit, requesting a withdrawal, or contacting our support team.
• Automated technologies: Cookies, web beacons, server logs, and similar technologies that record Technical Data and Usage Data as you interact with the Platform.
• Payment providers: Confirmation data returned by BCA, BRI, BNI, Mandiri, and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) when a transaction is processed — typically limited to status codes and masked account references.
• Identity verification partners: Document authenticity checks performed by our KYC service provider when you submit identity documents.
• Fraud prevention services: Device fingerprint data and behavioural analytics signals used to detect unusual account activity.

jos138 processes your Personal Data on one or more of the following legal bases, depending on the specific purpose:

• Contract performance: Processing necessary to create and manage your account, process deposits and withdrawals, and settle bets — without which we cannot provide the Platform service to you.
• Legal obligation: Processing required to comply with KYC, anti-money-laundering (AML), and fraud-prevention obligations.
• Legitimate interests: Processing for Platform security monitoring, fraud detection, responsible gaming enforcement, and internal analytics — where those interests are not overridden by your privacy rights.
• Consent: Where we ask for your explicit opt-in before sending marketing communications or deploying non-essential cookies.

jos138 uses the Personal Data collected for the following purposes:

• Account management: To create, verify, and maintain your jos138 account, including authentication and password reset processes.
• Transaction processing: To process deposits, withdrawals, and internal fund transfers in Indonesian Rupiah (IDR) via BCA, BRI, BNI, Mandiri, and Indonesian e-wallet networks.
• KYC compliance: To verify your identity, age (21+ requirement), and residency status in accordance with our legal obligations and fraud-prevention policies.
• Game delivery: To deliver sports betting markets, live casino games, togel draws, slot gacor titles, and all other Platform features, and to record and settle wagers.
• Bonus administration: To determine bonus eligibility, track wagering requirements, and enforce bonus terms.
• Customer support: To respond to your inquiries via live chat and email, troubleshoot account issues, and investigate complaints.
• Platform security: To detect and prevent fraud, collusion, bonus abuse, use of automated software, and other prohibited conduct outlined in our Terms & Conditions.
• Responsible gaming: To enforce deposit limits, session time reminders, self-exclusion periods, and other responsible gaming tools, and to identify patterns of problematic gambling behaviour.
• Internal analytics: To understand aggregate usage trends, optimise Platform performance, test new features, and improve the user experience.
• Legal compliance: To respond to lawful requests from regulatory authorities, comply with court orders, and fulfil our obligations under Indonesian and international law.
• Marketing communications: To send promotional emails or in-app notifications about new games, bonuses, or features — only where you have consented or where permitted by law.

We do not use your Personal Data for automated decision-making that produces legal effects or similarly significant consequences, except for automated fraud-detection systems that may flag suspicious accounts for manual review.

jos138 does not sell, rent, or trade your Personal Data to Third Party marketers or data brokers. We may, however, share Personal Data with the following categories of Third Party service providers, strictly limited to the purposes stated:

All Third Party service providers are bound by data processing agreements requiring them to implement appropriate security measures, limit data usage to the specified purpose, and delete or return data upon termination of services. jos138 conducts due diligence on all Third Party processors to ensure compliance with international data protection standards.

When you deposit funds or request a withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, or LinkAja, jos138 collects the bank account name, account number, and transaction details necessary to process the payment.

Your full bank account number and e-wallet identifiers are stored in encrypted form on secure servers. jos138 staff do not have access to view full financial credentials — internal systems display only masked references (e.g., "**** 4321") for operational purposes.

KYC Documentation: Before your first withdrawal, you will be required to submit one or more of the following documents:

• Government-issued national identity card (KTP), passport, or driver's licence
• Proof of address (utility bill, bank statement, or government correspondence dated within the last 3 months)
• Selfie photograph holding your identity document (to prevent impersonation)

KYC documents are transmitted via encrypted channels to our identity verification partner and are reviewed by trained compliance staff. Original documents are stored securely for the retention period required by law (see Section 10), after which they are permanently deleted.

jos138 uses cookies and similar technologies to operate the Platform, remember your preferences, and understand how you use our services. The following categories of cookies are deployed:

• Essential cookies: Required for basic Platform functionality, including login session management, load balancing, and secure communication. These cannot be disabled without breaking the Platform.
• Functional cookies: Store your language preference, display settings, and responsible gaming tool configurations to enhance usability.
• Analytical cookies: Collect anonymised aggregate data on page views, click patterns, and feature usage to help us optimise the Platform. We use first-party analytics only — no Google Analytics or other Third Party trackers.
• Security cookies: Detect unusual login patterns, track failed authentication attempts, and help prevent fraud and account takeover.

jos138 does not deploy advertising cookies, social media tracking pixels, or any Third Party marketing cookies. You can manage cookie preferences through your browser settings, though disabling essential cookies will prevent you from using the Platform.

jos138 retains Personal Data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by law. The following retention schedules apply:

• Account data: Retained for the lifetime of your active account, plus 7 years after account closure to comply with financial record-keeping obligations.
• Transaction records: Retained for 7 years from the date of transaction for tax, audit, and anti-money-laundering compliance.
• KYC documents: Retained for 7 years after the last transaction to comply with identity verification obligations.
• Betting history and game logs: Retained for 5 years to support dispute resolution and regulatory reporting.
• Live chat transcripts: Retained for 3 years for training, quality assurance, and complaint investigation purposes.
• Marketing consent records: Retained for 3 years after withdrawal of consent to evidence compliance with data protection law.
• Technical logs (IP addresses, session data): Retained for 90 days for security monitoring and troubleshooting.

At the end of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer identify you. Anonymised data may be retained indefinitely for statistical analysis.

jos138 implements comprehensive technical and organisational measures to protect Personal Data against unauthorised access, loss, alteration, or disclosure:

• Encryption in transit: All data transmitted between your device and jos138 servers is protected by 256-bit TLS/SSL encryption.
• Encryption at rest: Sensitive data fields (passwords, financial credentials, KYC documents) are encrypted using AES-256 encryption when stored in databases.
• Access controls: Personal Data is accessible only to authorised jos138 staff who require it to perform their job functions. Access is logged and audited regularly.
• Multi-factor authentication: Administrative access to data systems requires two-factor authentication (2FA).
• Regular security testing: jos138 conducts penetration testing, vulnerability scanning, and code audits to identify and remediate security weaknesses.
• Employee training: All staff handling Personal Data undergo regular training on data protection principles, confidentiality obligations, and security best practices.
• Incident response plan: In the event of a data breach, jos138 will notify affected Users and relevant authorities within 72 hours, in accordance with applicable breach notification obligations.

While jos138 employs robust security measures, no internet transmission or electronic storage system is entirely secure. You acknowledge that you provide Personal Data at your own risk, and jos138 cannot guarantee absolute security.

Subject to applicable law, you have the following rights concerning your Personal Data held by jos138:

• Right of access: You may request a copy of the Personal Data we hold about you, delivered in a commonly used electronic format.
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data. You can update most account information directly through the Platform settings page.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes collected, or where you withdraw consent. This right is subject to our legal retention obligations (see Section 10).
• Right to restrict processing: You may request that we suspend processing of your Personal Data in certain circumstances, such as while we verify its accuracy or assess your objection.
• Right to data portability: You may request that we transfer your Personal Data to another service provider in a structured, machine-readable format, where technically feasible.
• Right to object: You may object to processing based on legitimate interests, including for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact our support team via live chat or email (plain text, not a link): support@jos138.cam. We will respond to your request within 30 days. You also have the right to lodge a complaint with the data protection authority in your jurisdiction if you believe we have not handled your Personal Data lawfully.

The jos138 Platform is strictly for adults. You must be at least 21 years of age to create an account or use the Platform. jos138 does not knowingly collect Personal Data from individuals under the age of 21.

If we become aware that a User is underage, we will immediately suspend the account, conduct an age verification review, and delete all associated Personal Data if the User cannot provide proof of being 21 or older. Parents or guardians who believe their child has provided Personal Data to jos138 should contact our support team immediately.

jos138 operates internationally and stores Personal Data on secure servers which may be located outside Indonesia. When we transfer Personal Data across borders, we ensure that appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities
• Adequacy decisions recognising equivalent data protection standards in the destination jurisdiction
• Binding corporate rules or certification schemes where applicable

All international data transfers are conducted in accordance with applicable data protection laws. By using the Platform, you acknowledge and consent to the transfer of your Personal Data outside Indonesia for the purposes set out in this Privacy Policy.

jos138 reserves the right to amend this Privacy Policy at any time to reflect changes in law, our data practices, or Platform features. When material changes are made, we will update the "Last Updated" date at the top of this page and notify registered Users via email or in-platform notification.

Your continued use of the Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you must cease using the Platform and request deletion of your account by contacting our support team.

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or need to report a data security concern, please contact the jos138 data protection team:

• Live Chat: Available 24/7 via the in-app chat widget. Indonesian-speaking agents are available during WIB business hours.
• Email (plain text — not a link): support@jos138.cam

We aim to respond to all data protection inquiries within 30 days. For urgent security matters, live chat is the fastest resolution channel.