Privacy Policy — sojo88

1 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including but not limited to name, date of birth, identity number, email address, IP address, device identifiers, financial account details, and transaction history.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, or destruction.
• "Controller" means sojo88, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Processor" means any third-party service provider that processes Personal Data on behalf of sojo88 and under sojo88's documented instructions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their Personal Data.
• "KYC" means Know Your Customer — the identity, age, and source-of-funds verification process conducted by sojo88 in compliance with its anti-money-laundering obligations.

2 Scope & Application

This Policy applies to all Personal Data collected by sojo88 in connection with the Platform's services, including sports betting, live casino, togel (Indonesia's traditional numbers lottery), slot games, and all associated customer support, payment processing, and marketing activities.

This Policy applies to all members who are residents of Indonesia and who are 21 years of age or older. sojo88's services are not directed at persons under 21 years of age. If you are under 21, you must not register an account or provide any Personal Data to sojo88.

This Policy covers data collected through the sojo88 website (https://sojo88.cam), any mobile-optimized version of the Platform, and all communications between sojo88 and its members (including email, live chat, and any future application platforms). It does not cover third-party websites or services that may be linked to or from the Platform.

3 Data We Collect

sojo88 collects the following categories of Personal Data, depending on how you interact with the Platform:

4 How We Collect Your Data

sojo88 collects Personal Data through the following methods:

• Direct submission: Information you provide voluntarily when registering an account, completing KYC, making a deposit or withdrawal request, contacting support, or participating in a promotion.
• Automated technical collection: Data collected automatically by our servers and analytics infrastructure when you access the Platform, including IP address, device identifiers, session data, and cookie-derived behavioral data.
• Third-party sources: Identity verification data returned by KYC verification service providers; fraud-screening signals provided by anti-fraud partners; payment status data returned by our banking and e-wallet partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and others).
• Cookies and similar technologies: Session cookies, persistent cookies, and local storage objects placed on your device when you browse the Platform. See Section 8 for full details.

5 How We Use Your Data

sojo88 uses the Personal Data it collects for the following purposes:

sojo88 does not use automated decision-making or profiling in ways that produce legal or similarly significant effects on members, except where such processing is necessary to comply with anti-money-laundering obligations or to detect fraudulent account activity.

6 Legal Bases for Processing

sojo88 processes Personal Data only where a valid legal basis exists. The principal legal bases on which sojo88 relies are:

• Contractual necessity: Processing required to enter into or perform the contract between sojo88 and the member — including account creation, KYC, payment processing, and the delivery of betting and gaming services.
• Legal obligation: Processing required to comply with applicable law, including anti-money-laundering regulations, record-keeping requirements, and any lawful request from a competent authority.
• Legitimate interests: Processing necessary for sojo88's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by the member's fundamental rights and freedoms.
• Consent: Processing for purposes not covered by the above bases — most notably, sending promotional communications and applying non-essential cookies — where the member has given a freely-given, specific, and informed consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

sojo88 does not sell, rent, or trade your Personal Data. We share your data only in the following limited and controlled circumstances:

• Payment processors and banking partners: Financial Data is shared with the relevant local bank (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Danamon) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit or withdrawal transaction. These parties act as independent data controllers under their own privacy policies for the transactional data they handle.
• KYC and identity verification providers: Identity Data and KYC Document Data are shared with certified third-party KYC verification service providers under strict data processing agreements. These providers are prohibited from using your data for any purpose other than completing the verification requested by sojo88.
• Anti-fraud and security partners: Technical Data and aggregated behavioral signals may be shared with specialist fraud-detection platforms to identify and prevent fraudulent account activity, bot usage, and money laundering.
• Game content providers: When you play a game provided by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), a session token and pseudonymous player identifier is shared with that provider to deliver the game session. These providers do not receive your full name, contact details, or financial information.
• Legal and regulatory authorities: sojo88 will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts when required to do so by a valid legal order, warrant, or mandatory regulatory directive. Where legally permissible, sojo88 will notify the affected member of such a disclosure.
• Corporate restructuring: In the event of a merger, acquisition, or sale of substantially all of sojo88's assets, member Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. Members will be notified of any such transfer in advance.

8 Cookies & Tracking Technologies

sojo88 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file stored on your device when you visit a website. The types of cookies used by sojo88 are as follows:

You may manage or withdraw your consent to non-essential cookies at any time through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Clearing all cookies will log you out of your current session.

9 Data Security

sojo88 implements a layered security architecture designed to protect member Personal Data against unauthorized access, accidental loss, disclosure, alteration, or destruction. Key security measures include:

• Transport encryption: All data exchanged between your browser or device and the sojo88 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon visible in your browser address bar confirms an active encrypted connection.
• Encryption at rest: Sensitive data fields — including identity document images, bank account details, and password hashes — are encrypted in the database using AES-256 encryption. Passwords are stored exclusively as salted cryptographic hashes; sojo88 staff cannot retrieve your plain-text password.
• Access controls: Access to systems holding Personal Data is restricted to authorized personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all administrative systems.
• Network security: The Platform infrastructure is protected by enterprise-grade firewalls, distributed denial-of-service (DDoS) mitigation, intrusion detection systems, and regular vulnerability scanning.
• Incident response: sojo88 maintains a documented data breach response procedure. In the event of a confirmed security incident affecting member Personal Data, affected members will be notified within 72 hours of sojo88 becoming aware of the breach, in accordance with applicable data protection law.

10 Data Retention

sojo88 retains Personal Data for only as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following default retention periods apply:

• Active account data (identity, contact, financial, usage): Retained for the full duration of membership plus 5 years after account closure, to satisfy anti-money-laundering record-keeping requirements.
• KYC documents (ID scans, proof-of-address, selfies): Retained for 5 years from the date of submission, or 5 years from account closure, whichever is later.
• Transaction records (deposit and withdrawal history): Retained for 5 years from the date of each transaction.
• Communications data (live chat transcripts, support emails): Retained for 2 years from the date of the communication.
• Technical and analytics data: Retained for 24 months from collection, then aggregated and anonymized.
• Marketing consent records: Retained for the duration of the consent, plus 3 years thereafter to demonstrate compliance.

At the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with any individual member. Requests for earlier deletion are handled in accordance with Section 11 (Your Rights), subject to any overriding legal retention obligations.

11 Your Rights

As a member of sojo88, you have the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team at [email protected] with your registered account email address and a clear description of your request. sojo88 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.

12 Children's Privacy

sojo88's services are strictly for adults aged 21 years and older. We do not knowingly collect, process, or store Personal Data from any person under the age of 21. The minimum age requirement is enforced through our KYC verification process, which requires submission of a government-issued photo ID confirming the member's date of birth.

If sojo88 discovers or is notified that a member's account was registered by a person under 21 years of age, we will immediately suspend the account, void all associated wagers and balances, delete the underage individual's Personal Data to the extent not required to be retained for regulatory purposes, and — where required by applicable law — report the matter to the relevant authorities.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account on sojo88, please contact us immediately at [email protected]. We treat such reports with the highest priority and will act within 24 hours of receiving a verified complaint.

13 Third-Party Links

The sojo88 Platform may, from time to time, contain references or links to third-party services — for example, game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) that deliver game content through embedded iframes or redirect pages. These third-party services operate under their own independent privacy policies, which sojo88 does not control.

sojo88 is not responsible for the privacy practices or the content of any third-party service. We strongly encourage members to read the privacy policy of any third-party platform before providing any personal information directly to that platform. The presence of a third-party game or service on sojo88 does not constitute an endorsement of that party's privacy practices.

14 Policy Updates

sojo88 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, new regulatory requirements, or improvements to our services. When material changes are made, sojo88 will notify members by posting a prominent notice on the Platform and, where practicable, by sending an email notification to the address registered to each member's account.

The revised Policy will take effect 7 calendar days after the date of notification, unless the change is required immediately by law or regulatory direction. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this page periodically so that you remain informed about how sojo88 protects your data.

Continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with any change, you must cease using the Platform and contact support to request account closure. Any Personal Data collected prior to your closure request will continue to be retained for the applicable retention periods described in Section 10.

15 Contact Us

If you have any questions, concerns, or formal requests regarding this Privacy Policy or sojo88's data processing practices, please contact our Privacy & Compliance team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week, directly on the Platform. Average first-response time is under 3 minutes during WIB peak hours (09:00–22:00 WIB).
• Subject line for formal data requests: Please use the subject line "Data Privacy Request — [Your Registered Email]" so that your message is routed directly to the compliance team.

sojo88 is committed to resolving all privacy-related enquiries promptly and transparently. Formal data subject access requests, erasure requests, and objection notices will receive a substantive written response within 30 calendar days of receipt. For complex requests that require additional time, sojo88 will notify you within the initial 30-day window and provide an updated resolution timeline.