rt138 Privacy Policy

In this Privacy Policy, the following terms have the meanings assigned below:

rt138 acts as the Data Controller for all Personal Data collected through the rt138 platform. As Data Controller, rt138 is responsible for ensuring that Personal Data is collected, processed, and stored in accordance with this Privacy Policy and applicable data protection laws.

Certain processing activities — such as payment transaction processing, KYC document verification, and game delivery — are performed by Data Processors acting on rt138's behalf under written data processing agreements. These agreements require Data Processors to: (a) process data only on rt138's documented instructions; (b) implement appropriate technical and organizational security measures; and (c) not engage sub-processors without rt138's prior authorization.

For any data protection inquiry, you may contact the rt138 data team at the contact details provided in Clause 15 of this Policy.

rt138 collects Personal Data across several categories, depending on how you interact with the platform:

rt138 collects Personal Data through the following mechanisms:

• Direct submission: Information you provide when completing the registration form, submitting a KYC document upload, contacting customer support, or updating your account settings.
• Automated technical collection: Technical Data and Usage Data are collected automatically each time you access the rt138 platform, through server logs, session tracking, and cookies (see Clause 10).
• Payment processors: When you make a deposit or withdrawal via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja, the relevant payment processor shares transaction confirmation data with rt138 for reconciliation and fraud prevention purposes.
• KYC verification partners: Where rt138 engages a third-party KYC service to verify identity documents, that provider may share the verification outcome and associated metadata with rt138 as part of the compliance review process.
• Fraud and AML monitoring systems: Automated transaction monitoring tools generate risk signals and alerts based on your activity patterns, which form part of rt138's AML compliance records.

rt138 processes your Personal Data on the following legal bases, depending on the purpose of the processing activity:

• Contractual necessity: Processing required to open and manage your account, process deposits and withdrawals, settle bets, and provide customer support is necessary for the performance of the contract between you and rt138.
• Legal obligation: KYC identity verification, AML transaction monitoring, and record-keeping for regulatory compliance are required by law. rt138 is obligated to perform these activities regardless of consent.
• Legitimate interests: Fraud detection, platform security, abuse prevention, product analytics, and service improvement are carried out on the basis of rt138's legitimate interest in operating a secure, fair, and commercially viable platform. These interests are balanced against your privacy interests and do not override your fundamental data rights.
• Consent: Marketing communications (promotional emails, bonus notifications, SMS alerts) are sent only where you have given explicit opt-in consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing or your ability to continue using the platform.

Personal Data collected by rt138 is used exclusively for the following purposes:

1. Account management: Creating, maintaining, and closing your rt138 account; processing login and session authentication; enforcing the one-account-per-person policy.
2. Transaction processing: Receiving and reconciling deposits; processing withdrawal requests; managing Bonus Fund credits and wagering requirement tracking.
3. Identity and age verification (KYC): Confirming that you are at least 21 years of age and the lawful holder of the payment methods associated with your account, as required by our licensing obligations.
4. Fraud prevention and security: Identifying and investigating suspicious account activity, duplicate account attempts, bonus abuse, unauthorized access, chargebacks, and financial crime indicators.
5. AML compliance: Monitoring transaction patterns for money laundering risk indicators; maintaining required AML records; reporting to relevant regulatory authorities where legally mandated.
6. Customer support: Responding to your inquiries, resolving disputes, and maintaining records of support interactions for quality assurance and training purposes.
7. Responsible gaming: Monitoring player behavior for indicators of problem gambling; implementing deposit limits, session controls, or self-exclusion where requested or where the platform's responsible gaming protocols are triggered.
8. Platform improvement: Analyzing anonymized Usage Data to improve game selection, user interface design, performance, and new feature development.
9. Marketing communications: Sending promotional offers, bonus notifications, game announcements, and VIP programme updates, exclusively to players who have opted in and subject to opt-out at any time.

rt138 does not sell, rent, or trade your Personal Data. Data is shared only in the following limited and controlled circumstances:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja receive the transaction data required to process your deposit or withdrawal. These providers process data under their own privacy policies and applicable Indonesian financial regulation.
• KYC and identity verification providers: A contracted KYC partner receives copies of your identity documents solely for the purpose of verifying your identity and age on rt138's behalf. These providers are bound by confidentiality obligations and data processing agreements.
• Game studio providers: Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Habanero, Spribe, and other certified studios receive anonymized session identifiers necessary to deliver games and record outcomes. These studios do not receive your full identity or financial data.
• Regulatory and law enforcement authorities: rt138 will disclose Personal Data to regulatory authorities, financial intelligence units, or law enforcement agencies where legally required — for example, in response to a court order, AML reporting obligation, or formal regulatory inquiry.
• Professional advisers: Lawyers, auditors, and insurers engaged by rt138 may access Personal Data on a need-to-know basis, subject to professional confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or asset sale involving rt138, Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and of your rights in connection with it.

rt138 retains Personal Data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal or regulatory obligation. The following standard retention periods apply:

When the applicable retention period expires and no legal obligation requires continued storage, rt138 securely deletes or anonymizes the data in question so that it can no longer be attributed to an identifiable individual.

rt138 implements a layered set of technical and organizational security measures to protect Personal Data against unauthorized access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your browser or app and the rt138 platform is encrypted using TLS 1.2 or higher (256-bit SSL). HTTPS is enforced across every page with HTTP Strict Transport Security (HSTS) headers applied.
• Encryption at rest: Sensitive Personal Data stored in rt138's databases — including KYC document files and financial records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to Personal Data within rt138's internal systems is restricted to authorized personnel on a strict need-to-know basis. Role-based access controls are enforced and reviewed quarterly. All administrative access is logged.
• Payment security: Financial transaction processing is conducted via PCI-DSS-compliant payment infrastructure. rt138 does not store full bank account numbers or card details on its own servers.
• Penetration testing: rt138 conducts regular third-party penetration testing and vulnerability assessments of its platform infrastructure. Critical findings are remediated within defined SLA timelines.
• Incident response: rt138 maintains a documented data breach incident response procedure. In the event of a confirmed personal data breach that poses a risk to affected individuals, rt138 will notify relevant authorities within 72 hours and affected players without undue delay.

rt138 uses cookies and similar browser-based storage technologies to maintain platform functionality and detect fraud. The following cookie categories are used:

rt138 does not use third-party advertising cookies, cross-site tracking pixels, or social media tracking tags. You may manage cookie settings through your browser's native controls. Disabling strictly necessary cookies will impair or prevent access to the platform.

You hold the following rights over your Personal Data held by rt138. Requests to exercise any right should be submitted via live chat or to the email address in Clause 15:

• Right of access: You may request a copy of all Personal Data rt138 holds about you, including the purposes for which it is processed and the categories of recipients with whom it has been shared.
• Right to rectification: If any Personal Data rt138 holds about you is inaccurate or incomplete, you may request that it be corrected. Where practicable, corrections are applied within 5 business days.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where: (a) the data is no longer necessary for the purpose it was collected; (b) you withdraw consent and no other legal basis applies; or (c) the data has been unlawfully processed. This right is subject to overriding legal retention obligations (see Clause 8).
• Right to restriction: You may request that processing of your data be restricted — for example, while a rectification request is being resolved — without requiring full deletion.
• Right to data portability: For data processed on the basis of consent or contractual necessity, you may request that rt138 provide your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on rt138's legitimate interests at any time. rt138 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (primarily marketing communications), you may withdraw that consent at any time without penalty, by contacting support or adjusting your notification settings.

rt138 will respond to all valid data rights requests within 30 calendar days. Where a request is complex or numerous, this period may be extended by a further 60 days with prior notice. rt138 reserves the right to verify your identity before actioning a data rights request to ensure the security of your account and the integrity of its data obligations.

If you believe a person under the age of 21 has registered an account on rt138, please contact us immediately at the details provided in Clause 15. rt138 will investigate and take appropriate action, including closing the account and deleting associated Personal Data, within 5 business days of the report being confirmed.

Parents and guardians are encouraged to use parental control tools and website filtering software to prevent underage access to online gambling platforms. rt138 supports responsible gaming industry initiatives aimed at protecting minors from exposure to gambling content.

As an internationally operated platform, rt138 may transfer Personal Data to service providers whose infrastructure is located outside Indonesia — for example, cloud hosting providers or game studio servers operating in other jurisdictions. Where such transfers occur, rt138 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses binding the recipient to equivalent data protection standards;
• Binding corporate rules where the recipient is part of the same corporate group;
• Adequacy decisions applicable to the destination jurisdiction where available.

Transfers are conducted only where necessary for the delivery of services to Indonesian players and are subject to rt138's data processing agreements with each service provider. No Personal Data is transferred to jurisdictions that do not maintain adequate data protection standards without the contractual safeguards described above.

rt138 reserves the right to update this Privacy Policy to reflect changes in legal requirements, platform operations, data processing practices, or regulatory guidance. The "Last updated" date at the top of this Policy indicates when the most recent revision was made.

Where a material change is made — for example, a new category of data being collected, a new third-party data processor being engaged, or a change to retention periods — rt138 will notify registered players via the email address on their account at least 14 days before the change takes effect.

Continued use of the rt138 platform after the effective date of a policy amendment constitutes acknowledgment of the updated Policy. If you do not agree with a material change, you may close your account before the effective date of the revision. Account closure requests can be submitted via live chat.

For any question, concern, or request relating to this Privacy Policy or to the processing of your Personal Data by rt138, please use one of the following contact methods:

• Live chat: Available 24/7 directly on rt138.one — staffed by native Indonesian-speaking agents across all time zones (WIB, WITA, WIT). This is the fastest channel for urgent data protection matters such as suspected unauthorized account access.
• Email: support@rt138.one (plain text — not a clickable link). Written data rights requests and formal privacy complaints should be submitted by email, including your full name and registered account email address. rt138 aims to acknowledge all written requests within 2 business days and to resolve them within 30 calendar days.

When submitting a data rights request by email, please include: (a) your full name; (b) the email address registered to your rt138 account; (c) a clear description of the right you wish to exercise and the data it concerns; and (d) a copy of your government-issued ID if the request involves access to or deletion of identity or financial data. This information is required solely to verify your identity and match your request to the correct account — it will not be used for any other purpose.