Privacy Policy

ran88 ("we", "us", "our", "the Platform") operates the online gaming platform accessible at https://ran88.org and is committed to maintaining robust privacy protections for all users. This Privacy Policy applies to every individual ("you", "your", "the Player") who accesses, browses, registers on, or transacts through the ran88 platform, regardless of the device or network used to do so.

ran88 operates in the Indonesian online gaming market, serving English-preference players across major Indonesian cities including Jakarta, Surabaya, Bandung, Medan, Bali, Semarang, and Yogyakarta. As such, this policy is designed with the specific context of Indonesian players in mind, including the use of local payment channels such as BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay, all of which involve the processing of personal financial data.

This policy should be read alongside our Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference.

For the purposes of this Privacy Policy, the following terms have the meanings assigned to them below:

• "Personal Data" — any information that can directly or indirectly identify a natural person, including but not limited to full name, date of birth, national identity number, residential address, email address, phone number, IP address, device identifier, and financial account details.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, combination, restriction, erasure, or destruction.
• "Data Controller" — ran88, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — any third-party service provider that processes personal data on behalf of ran88, including payment processors, KYC verification partners, and cloud infrastructure providers.
• "Sensitive Data" — a sub-category of personal data that warrants heightened protection, including national identity numbers (KTP numbers), financial account credentials, and identity verification documents.
• "Cookies" — small text files placed on your device by the ran88 platform to enable functionality, remember preferences, and support analytical and security operations.
• "KYC" — Know Your Customer. The identity verification process ran88 employs to confirm the age, identity, and place of residence of all registered Players.

ran88 collects the following categories of personal data from Players and site visitors. The data collected varies depending on the stage of your interaction with the platform — some data is collected simply by visiting the site, while other data is only collected upon registration or during account verification.

ran88 does not collect data that is unnecessary for the purposes described in this policy. We do not request or store full credit/debit card numbers directly — card-based payments, where available, are handled exclusively by certified PCI-DSS-compliant payment processors.

ran88 collects personal data through the following channels:

• Direct submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated technical collection: Data collected automatically when you access the ran88 website, including your IP address, device identifiers, browser fingerprint, and session activity, via server logs and first-party cookies.
• Payment processor APIs: When you initiate a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processor partners relay confirmation data — including transaction reference numbers and masked account identifiers — back to ran88 for reconciliation purposes.
• KYC verification partners: Identity verification data may be cross-referenced with third-party KYC databases and document-verification services to confirm the authenticity of submitted documents.
• Cookies and tracking technologies: First-party cookies and similar technologies collect session data, preference settings, and analytical data as described in Clause 10.

ran88 processes personal data only where a valid legal basis exists for doing so. The legal bases on which we rely are as follows:

• Contractual necessity: Processing required to perform the contract between ran88 and the Player — including account creation, payment processing, game delivery, and customer support. Without this processing, ran88 cannot provide the services described in the Terms & Conditions.
• Legal obligation: Processing required to comply with applicable legal requirements, including anti-money laundering (AML) obligations, KYC regulations, and financial record-keeping requirements imposed by ran88's licensing jurisdiction.
• Legitimate interests: Processing that is necessary for ran88's legitimate business interests, including fraud prevention, platform security, abuse detection, and service improvement — provided those interests are not overridden by your privacy rights.
• Consent: Where ran88 relies on consent as a legal basis — for example, for sending promotional communications — you may withdraw that consent at any time by contacting support or updating your account communication preferences.

ran88 uses the personal data it collects for the following specific purposes, each of which is tied to a valid legal basis as described in Clause 5:

• Account management: Creating and maintaining your Player account, authenticating your login sessions, and processing changes to your account details.
• Age and identity verification: Confirming that you are at least 21 years of age and that the identity information provided during registration is accurate. This is a non-negotiable compliance requirement — ran88 enforces a strict 21+ policy across all account activity.
• Payment processing: Processing deposit and withdrawal transactions via Indonesian local banks and e-wallets, reconciling transaction records, and maintaining your IDR account balance.
• Fraud and abuse prevention: Detecting and investigating suspicious account activity, multi-accounting, bonus abuse, automated betting behaviour, and financial fraud, including money laundering.
• Customer support: Responding to enquiries, resolving disputes, processing responsible gaming requests (such as self-exclusion and deposit limits), and maintaining support communication records.
• Platform security: Monitoring for unauthorised access attempts, protecting the integrity of the gaming environment, and maintaining SSL-encrypted connections across all sessions.
• Regulatory compliance: Fulfilling record-keeping and reporting obligations under ran88's gaming licence and applicable international AML/KYC standards.
• Marketing communications: Sending promotional offers, bonus announcements, and seasonal campaign notifications — only where you have provided consent or where legitimate interest applies. You may opt out at any time.
• Platform improvement: Analysing aggregated, anonymised usage data to improve the ran88 product, identify technical issues, and optimise the user experience for Indonesian players.

ran88 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. Data is shared with third parties only in the following limited circumstances, and only to the minimum extent necessary for each purpose:

• Payment processors: Indonesian bank transfer and e-wallet partners (including those facilitating transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, and GoPay) receive transaction-specific data necessary to execute and confirm payments. These partners operate under their own privacy policies and are bound by contractual data-protection obligations.
• KYC and identity verification providers: Specialist third-party services that assist ran88 in verifying identity documents, checking against sanctions lists, and confirming age. These providers are certified data processors bound by strict data-handling agreements.
• Game studio providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive pseudonymous session identifiers for the purpose of game delivery and fair-play auditing. No identifiable personal data beyond a session token is shared with game studios during normal gameplay.
• Cloud and infrastructure providers: ran88's platform is hosted on secure cloud infrastructure. Infrastructure providers may process data on our behalf as data processors, subject to contractual data-protection safeguards.
• Regulatory and legal authorities: ran88 may disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, or courts where required by applicable law, regulatory direction, or a valid legal order. ran88 will notify the affected Player of any such disclosure where legally permitted to do so.

ran88 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with ran88's internal data-disposal procedures. Players may request deletion of their data subject to the overriding retention obligations listed above — see Clause 11 for your full rights.

ran88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security infrastructure includes:

• 256-bit TLS / SSL encryption: All data transmitted between your browser and the ran88 platform is encrypted using industry-standard TLS 1.2 or higher. The ran88 domain enforces HTTPS across every page and endpoint.
• Encrypted data storage: Sensitive data fields — including identity document images, national identity numbers, and financial account references — are stored in encrypted form within ran88's database infrastructure.
• Password hashing: Player passwords are never stored in plain text. They are hashed using a modern one-way cryptographic algorithm with per-account salt. ran88 staff cannot retrieve your original password.
• Access controls: Access to personal data within ran88's systems is restricted on a strict need-to-know basis. Staff members are assigned role-based permissions and are required to authenticate using multi-factor authentication (MFA) to access production systems.
• Intrusion detection and monitoring: ran88 operates continuous 24/7 monitoring of its platform infrastructure, including automated alerts for anomalous access patterns, brute-force attempts, and unusual transaction activity.
• Regular security audits: ran88 engages independent third-party security auditors to conduct periodic penetration testing and vulnerability assessments of its platform and infrastructure.

ran88 uses first-party cookies and similar technologies to operate the platform effectively, improve your experience, and maintain the security of your session. We do not use third-party advertising cookies or behavioural tracking networks.

You may control cookie behaviour through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging into your ran88 account or using core platform features. Disabling functional or analytical cookies has no impact on your ability to play games or process transactions.

As a Player on the ran88 platform, you hold the following rights with respect to your personal data. ran88 is committed to honouring these rights promptly and without unnecessary obstruction:

• Right of Access: You may request a copy of all personal data ran88 holds about you. ran88 will respond to access requests within 30 days of receipt.
• Right to Rectification: If any personal data ran88 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For account details, minor corrections (such as email address updates) can be made directly in the account settings panel.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. ran88 will action this request to the fullest extent possible, subject to overriding legal retention obligations as described in Clause 8. Data that must be retained for regulatory compliance cannot be deleted before the applicable retention period expires.
• Right to Restriction: You may request that ran88 restricts its processing of your data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: You may request a structured, machine-readable export of the personal data you provided to ran88 directly. This right applies to data processed on the basis of contract or consent.
• Right to Object: You may object to ran88 processing your data on the basis of legitimate interests, including for direct marketing purposes. Objections to marketing are actioned immediately; objections to other processing will be assessed on a case-by-case basis.
• Right to Withdraw Consent: Where ran88 processes your data on the basis of consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, contact ran88's data team at support@ran88.org with the subject line "Data Rights Request". Please include your registered account email address and a brief description of your request. ran88 may request identity verification before processing a data rights request to protect against unauthorised access to a Player's records.

ran88 strictly prohibits access to the platform by any person under the age of 21. The platform is not directed at, marketed to, or designed for use by individuals under 21 years of age. ran88 does not knowingly collect personal data from anyone under 21.

If ran88 discovers or has reasonable grounds to suspect that a registered account belongs to a person under 21, that account will be immediately suspended, all activity will be reviewed, and any real-money balance will be returned to the verified payment source. KYC verification — which requires a government-issued identity document confirming date of birth — is a mandatory step before any withdrawal is processed, and acts as ran88's primary safeguard against underage access.

ran88 reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, platform features, legal obligations, or applicable regulations. When material changes are made — particularly those that affect how we use your data or alter your rights — ran88 will:

• Post the revised policy on this page with an updated version number and "Last Updated" date at the top of the document.
• Display a notice on the ran88 platform homepage for a minimum of seven (7) days following the update.
• Where the change materially affects Players' rights or the use of their data, send an email notification to all registered account holders at their registered email address, where technically feasible.

Your continued use of the ran88 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept a material change to this policy, you should cease using the platform and contact support to request account closure and data deletion.

Prior versions of this Privacy Policy are archived and may be requested from [email protected] for reference.

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data ran88 holds about you, please reach out to our dedicated support team. We are available 24 hours a day, 7 days a week, including all Indonesian public holidays.

The email address above is provided as plain text only and is not a clickable link. Please copy it manually into your email client. ran88 will never ask for your password, full bank account number, or payment card CVV via email or live chat.