Privacy Policy

1 Definitions

The following defined terms are used throughout this Privacy Policy and carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, including name, date of birth, email address, phone number, residential address, financial account details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Controller" refers to cu888, which determines the purposes and means of processing Personal Data submitted by Members and visitors to the Platform.
• "Member" refers to any individual who has completed the cu888 registration process and holds an active account on the Platform.
• "KYC Documents" refers to government-issued identification, proof of address, and payment method verification documents submitted by Members as part of the identity verification process.
• "Cookies" refers to small text files placed on a Member's device by the Platform for session management, analytics, and personalisation purposes as further described in Clause 7.
• "Third-Party Service Provider" refers to any external company engaged by cu888 to deliver a specific technical, operational, or compliance function in connection with the Platform, including payment processors, game studios, and fraud detection services.

2 Data We Collect

cu888 collects only the categories of Personal Data that are necessary to operate the Platform, comply with applicable obligations, and deliver a high-quality member experience. The table below summarises the categories of data collected and their primary purpose:

cu888 does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, health information, or biometric data beyond what is inherently present in government-issued identity documents submitted for KYC purposes.

3 How Data Is Collected

cu888 collects Personal Data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or opting into a promotion.
• Automated collection: Technical and Behavioural Data collected automatically as you navigate and interact with the Platform, including via Cookies and server-side logs as described in Clause 7.
• Third-party sources: Identity and fraud-screening data received from licensed KYC verification providers, payment processors, and financial crime screening databases where cu888 engages such services for compliance purposes.
• Support interactions: Data provided during live chat sessions, email correspondence, or telephone calls with the cu888 support team.

4 Purpose of Use

cu888 processes your Personal Data only for specific, clearly defined purposes. We do not process Personal Data in ways that are incompatible with the purposes stated at the time of collection. The primary purposes for which cu888 processes Personal Data are:

• Account management: Creating, maintaining, and administering your cu888 Member account, including authentication and password recovery.
• Transaction processing: Processing deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, and QRIS.
• KYC & compliance: Verifying your identity and age (21+), conducting anti-money-laundering (AML) and counter-terrorism financing (CTF) screening, and meeting internationally applicable regulatory requirements.
• Platform security & fraud prevention: Detecting, investigating, and preventing fraudulent activity, bonus abuse, multiple-account violations, and unauthorised access.
• Service delivery & improvement: Providing access to live casino games, sportsbook markets, slot titles, and associated features; analysing usage patterns to improve the platform experience.
• Responsible gaming: Monitoring account activity to identify signs of problem gambling and applying self-imposed or platform-imposed limits in accordance with cu888's Responsible Gaming commitments.
• Marketing communications: Sending promotional offers, tournament announcements, seasonal campaigns, and VIP rewards to Members who have opted in to marketing communications.
• Customer support: Responding to enquiries, resolving disputes, and maintaining records of support interactions for quality and compliance purposes.
• Legal obligations: Meeting any legal, regulatory, or court-mandated data retention and disclosure obligations applicable to cu888's operations.

5 Legal Basis for Processing

cu888 processes Personal Data on one or more of the following legal bases, applied on a purpose-by-purpose basis:

• Contractual necessity: Processing is necessary to perform the contract between cu888 and the Member (i.e., to operate the account, process transactions, and deliver platform services).
• Legitimate interests: Processing is necessary for cu888's legitimate business interests, including fraud prevention, platform security, product improvement, and responsible gaming monitoring, where those interests are not overridden by the Member's privacy rights.
• Legal obligation: Processing is necessary to comply with applicable legal and regulatory requirements, including AML and KYC obligations.
• Consent: Where cu888 relies on consent as the legal basis (primarily for marketing communications), Members may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing & Disclosure

6.1 Third-Party Service Providers

cu888 shares Personal Data with carefully selected Third-Party Service Providers who process data on cu888's behalf and are contractually bound to handle it securely and only for the purpose for which it is shared. Categories of such providers include:

• Payment processors and financial institutions facilitating IDR transactions (including the local bank and e-wallet integrations listed in Clause 4).
• KYC and identity verification technology providers engaged to authenticate Member identity documents.
• Game studios and live casino platform providers (such as Evolution Gaming, Pragmatic Play, Microgaming, and similar) whose software operates through the cu888 interface and which receive limited technical session data necessary to deliver the game experience.
• Fraud detection and cybersecurity service providers who analyse Technical Data to identify suspicious patterns.
• Cloud infrastructure and data hosting providers on whose servers cu888's platform and data are hosted.

6.2 Legal Disclosure

cu888 may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid court order, or a legitimate regulatory request. cu888 will, where legally permitted, notify the affected Member of any such request before disclosure.

6.3 No Sale of Data

cu888 does not sell, rent, or otherwise transfer Personal Data to third-party marketers, data brokers, or any party whose primary purpose is to use that data for their own commercial benefit. Any data sharing is limited to what is strictly necessary for the operational and compliance purposes described in this Policy.

7 Cookies & Tracking Technologies

cu888 uses Cookies and similar tracking technologies to operate the Platform effectively, maintain session security, and understand how Members interact with the site. The following categories of Cookies are used:

• Strictly necessary Cookies: Required for the Platform to function. These include session authentication tokens, security identifiers, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Performance & analytics Cookies: Used to collect aggregated, anonymised data about how Members navigate the Platform — for example, which pages are visited most frequently and how long sessions last. This data helps cu888 improve the platform experience over time.
• Functional Cookies: Used to remember Member preferences such as language settings, preferred display options, and previously selected game categories.
• Marketing Cookies: Used, with Member consent, to deliver relevant promotional communications and to measure the effectiveness of cu888's marketing campaigns. Members who have not consented to marketing will not be subject to marketing Cookies.

Members may manage Cookie preferences through their browser settings. Disabling certain Cookies may limit the functionality of the Platform. cu888 does not respond to browser "Do Not Track" signals at this time, as no universally accepted standard for interpreting such signals has been established.

8 Data Retention

cu888 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and compliance obligations. The following retention periods apply as a general guide:

• Active account data (profile information, preferences, game history): retained for the duration of the Member's active account plus 12 months following voluntary account closure.
• KYC documents and identity verification records: retained for a minimum of 5 years from the date of submission, in compliance with internationally applicable AML standards.
• Transaction records (deposit, withdrawal, and wagering history): retained for a minimum of 5 years from the date of each transaction.
• Support communications: retained for 3 years from the date of the last interaction.
• Marketing consent records: retained for the duration of the Member relationship and for 1 year following consent withdrawal, to demonstrate compliance with consent obligations.
• Technical and log data: typically retained for 12 months in rolling logs, except where specific logs are preserved as evidence in an active security or compliance investigation.

When Personal Data is no longer required and no legal obligation mandates its retention, cu888 will securely delete or irreversibly anonymise it.

9 Data Security

cu888 implements a multi-layered approach to data security, commensurate with the sensitivity of the data held and the risks posed by unauthorised access, disclosure, or loss. Key security measures include:

• SSL/TLS 256-bit encryption applied to all data in transit between Member devices and cu888 servers.
• Encryption at rest for sensitive data categories including KYC documents and financial account details stored on cu888 servers.
• Role-based access controls ensuring that only authorised personnel with a documented operational need can access specific categories of Personal Data.
• Regular penetration testing and vulnerability assessments conducted by qualified third-party security specialists.
• Incident response procedures to detect, contain, and respond to any Personal Data breach, including Member notification protocols where required.
• Staff training on data handling obligations for all cu888 personnel with access to Personal Data.

10 Your Rights

As a cu888 Member, you hold the following rights with respect to your Personal Data. cu888 will respond to any valid request within 30 calendar days of receipt:

• Right of access: You may request a copy of the Personal Data cu888 holds about you, together with information on how it is processed.
• Right of rectification: You may request correction of any Personal Data that is inaccurate or incomplete. For account profile data, many corrections can be made directly through the account dashboard.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to cu888's legal data retention obligations. Note that KYC and transaction records are subject to mandatory minimum retention periods that override erasure requests.
• Right to restrict processing: You may request that cu888 restricts processing of your Personal Data in specific circumstances — for example, while the accuracy of the data is under dispute.
• Right to data portability: You may request a copy of the Personal Data you provided to cu888 in a structured, machine-readable format for the purpose of transferring it to another service.
• Right to object: You may object to processing of your Personal Data where cu888 relies on legitimate interests as the legal basis, or where processing is for direct marketing purposes. An objection to direct marketing will always be honoured without requiring justification.
• Right to withdraw consent: Where cu888 processes your data on the basis of consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact cu888 via the support channels described in Clause 14. Requests may require identity verification before they are processed, to protect against unauthorised data access.

11 Minors & Age Restriction

cu888 does not knowingly collect Personal Data from individuals under the age of 21. Access to the Platform is strictly limited to adults aged 21 and over. If cu888 becomes aware that Personal Data has been collected from an individual under the age of 21, the relevant account will be suspended, the Personal Data will be deleted as soon as practicable, and any funds deposited will be returned to their source following verification of the deposit method.

Parents and guardians who believe that a minor in their care has registered a cu888 account are encouraged to contact cu888 support immediately at [email protected] so that the situation can be addressed promptly.

12 Third-Party Services

The cu888 Platform integrates with a number of third-party services to deliver the full member experience, including live casino software providers (such as Evolution Gaming and Pragmatic Play), payment gateway providers (processing transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and others), and analytics platforms. These third parties operate under their own privacy policies and data processing terms, which govern how they handle any data they receive in the course of providing their services through cu888.

cu888 selects third-party service providers with due regard to their data security and privacy practices and requires contractual data processing commitments from all providers who handle cu888 Member data. However, cu888 is not responsible for the privacy practices of third-party websites or services that are not operated by cu888, even if they are accessible through or referenced on the Platform.

13 Amendments to This Policy

cu888 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. Material changes — those that meaningfully affect how cu888 collects, uses, or shares Personal Data — will be communicated to active Members via their registered email address at least 7 calendar days before the amended policy takes effect. Minor editorial changes (such as corrections to spelling or formatting that do not alter the substance of any clause) may be made without prior notice.

The effective date at the top of this page will always reflect the most recent revision. Continued use of the cu888 Platform following the effective date of any amended Privacy Policy constitutes acceptance of the revised terms. If you do not agree with any amendment, you should cease use of the Platform and request account closure before the revised policy takes effect.

14 Contact & Data Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or to the Personal Data cu888 holds about you, please contact the cu888 Data Support team through the following channels:

• Live Chat: Available 24/7 in WIB via the Platform. Our Indonesian-speaking agents can assist with privacy queries and escalate formal data requests to the appropriate team.
• Email: [email protected] — please include "Privacy Request" in the subject line and provide your registered account email address and a brief description of your request. cu888 will acknowledge formal data requests within 48 hours and provide a substantive response within 30 calendar days.

Formal requests to exercise your data rights (as described in Clause 10) must be submitted in writing via email and will require identity verification before they are actioned. cu888 will not charge a fee for handling data rights requests unless they are manifestly unfounded or excessive in nature.