Data Protection
pw138 is committed to protecting the personal information of every player on our platform. This Policy explains exactly what data we collect, why we collect it, how it is used, and the rights you hold over your own information.
Our Data Commitments
pw138 collects only the personal data strictly necessary to operate your account, verify your identity, process payments, and comply with applicable regulations. We do not collect data speculatively.
pw138 does not sell, rent, or trade your personal data to unaffiliated third parties for any commercial purpose. Your information is shared only with partners who are contractually required to protect it.
All personal data stored by pw138 is protected using AES-256 encryption at rest and TLS 1.3 encryption in transit — the same standards applied by major Indonesian financial institutions.
You have the right to access, correct, delete, and port your personal data. You may also withdraw consent and object to certain processing activities. pw138 responds to all data requests within 30 calendar days.
pw138 retains personal data only for as long as is necessary for the purpose it was collected, subject to mandatory regulatory retention obligations. Data no longer needed is securely deleted or anonymised.
This Policy is written in plain professional English — not legal boilerplate designed to obscure. We want you to understand exactly how your data is handled before you share it with pw138.
Section 01
pw138 takes the privacy of its players seriously. This Policy has been drafted to give you a clear and complete account of how your personal information flows through our platform — from the moment you register to the point at which your data is no longer required and is securely deleted. It applies to all personal data collected through the pw138 website, mobile interface, customer support channels, and any associated services operated by pw138.
This Policy applies specifically to players based in Indonesia. Where Indonesian data protection law imposes obligations that are more protective of your rights than the international standards referenced in this Policy, those Indonesian obligations take precedence for Indonesian residents.
This Policy does not apply to third-party websites or services that may be referenced on the Platform. pw138 is not responsible for the data practices of third parties, including payment processors, game studios, or identity verification providers acting as independent data controllers. Where those parties act as our data processors, they are contractually required to apply data protection standards consistent with this Policy.
Section 02
| Term | Meaning in this Policy |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, ID number, contact details, financial data, and online identifiers. |
| "Processing" | Any operation performed on personal data — including collection, recording, storage, use, disclosure, erasure, or destruction. |
| "Data Controller" | pw138, the entity that determines the purposes and means of processing your personal data. |
| "Data Processor" | A third party that processes personal data on behalf of pw138 under a written data processing agreement (e.g., KYC providers, payment processors). |
| "Consent" | A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose. |
| "KYC" | Know Your Customer — the identity and age verification process conducted by pw138 prior to permitting withdrawals and at other risk-triggered points. |
| "Sensitive Data" | A subset of personal data warranting heightened protection — including national ID (KTP) numbers, biometric data from selfie verification, and financial account details. |
Section 03
pw138 collects personal data through multiple channels. The categories below describe what we collect, the source of that data, and whether provision is mandatory or optional.
When you create an account on pw138, we collect: full legal name, date of birth, Indonesian residential address, email address, mobile phone number, and chosen username. All registration fields are mandatory — incomplete registration cannot be processed.
To comply with our anti-money-laundering and age-verification obligations, pw138 collects: a photograph of your Indonesian National Identity Card (KTP Nasional — front and reverse), a selfie photograph of you holding your KTP, and in certain higher-tier withdrawal cases, a proof-of-address document such as a recent utility bill or BCA/BRI bank statement dated within 90 days.
For every deposit and withdrawal, pw138 records: the payment method used (e.g., BCA transfer, OVO, GoPay, DANA, LinkAja, ShopeePay), transaction reference numbers, timestamps, amounts in Rupiah (IDR), and the bank account or e-wallet identifier associated with the transaction. Full bank account numbers are never stored in plain text — they are masked and tokenised after initial processing.
pw138 records all betting activity on your account, including: markets wagered on, stake amounts, odds accepted, game titles accessed, session start and end times, and net profit/loss per session. This data is used for account management, dispute resolution, bonus compliance verification, and responsible gaming monitoring.
Automatically collected when you access the Platform: IP address, device type and operating system, browser type and version, session timestamps, page view logs, and approximate geolocation derived from IP. This data is used for security monitoring, fraud detection, and platform performance analysis.
When you contact pw138 support — via live chat, email, or WhatsApp — we retain records of those communications, including message content, timestamps, and the outcome of each support interaction. These records are kept for quality assurance and dispute resolution.
You may voluntarily provide additional information — such as preferred contact time, responsible gaming self-assessment responses, or feedback submitted via our support channels. This data is processed only for the specific purpose for which you provided it.
Section 04
pw138 uses your personal data strictly for the following purposes. We do not use personal data for any purpose that is incompatible with the purpose for which it was originally collected without obtaining fresh consent.
| Purpose | Data Categories Used |
|---|---|
| Account creation and management | Registration data, device data |
| Identity and age verification (KYC) | KYC documents, registration data |
| Processing deposits and withdrawals | Financial transaction data, KYC data |
| Delivering betting and gaming services | Registration data, gameplay data |
| Fraud prevention and security monitoring | Technical data, transaction data, gameplay data |
| Regulatory compliance and AML obligations | KYC data, transaction data, communications data |
| Responsible gaming monitoring and intervention | Gameplay data, transaction data, self-assessment data |
| Customer support and dispute resolution | Communications data, transaction data, gameplay data |
| Platform analytics and performance improvement | Technical data, gameplay data (anonymised where possible) |
| Sending promotional communications (where consented) | Registration data, gameplay data, contact preferences |
Section 05
pw138 processes your personal data under one or more of the following legal bases, each of which is identified for each category of processing in Section 4 above:
Section 06
pw138 does not sell your personal data. We share personal data with third parties only in the following circumstances, and only to the minimum extent necessary for the stated purpose:
To execute deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja, pw138 shares the transaction details and account holder name necessary to complete the transfer. These processors operate under their own privacy policies and applicable Indonesian financial regulations.
pw138 uses third-party KYC service providers to verify identity documents and conduct liveness checks. Your KTP photographs and selfie data are transmitted to these providers over encrypted channels and are processed solely for verification purposes. KYC providers are contractually prohibited from using your data for any other purpose.
Technical data (IP addresses, device fingerprints, behavioural patterns) may be shared with third-party fraud detection platforms to identify and prevent fraudulent account activity, unauthorised access, and money laundering.
When you access games powered by third-party studios — including Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, and others — pw138 transmits a session token and anonymised player identifier to those providers. Your full name, contact details, and financial data are not shared with game studios.
pw138 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by applicable law, a valid court order, or a binding regulatory request. pw138 will notify you of such disclosure unless legally prohibited from doing so.
In the event of a merger, acquisition, or sale of substantially all of pw138's assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer and of any material change in the data processing practices that results from it.
Section 07
pw138 uses cookies and similar tracking technologies to operate the Platform efficiently, maintain your session state, detect fraudulent activity, and analyse usage patterns. The main categories of cookies used are:
pw138 does not use advertising cookies, retargeting pixels, or third-party behavioural tracking cookies for the purpose of serving advertisements on other websites. You may manage non-essential cookie preferences through your browser settings. Note that blocking essential or security cookies may prevent you from accessing your account.
Section 08
pw138 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the mandatory retention periods set out below. When retention is no longer required, data is securely deleted or irreversibly anonymised.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Regulatory AML and gaming licence obligations |
| KYC documents | Duration of account + 5 years post-closure | Mandatory identity record-keeping under AML regulations |
| Financial transaction records | 5 years from transaction date | Financial record-keeping and AML compliance |
| Gameplay and betting history | 3 years from last activity | Dispute resolution, responsible gaming review |
| Customer support communications | 2 years from last interaction | Quality assurance, dispute resolution |
| Technical / device logs | 90 days rolling | Security monitoring, fraud detection |
| Marketing consent records | Until consent withdrawn + 1 year | Proof of consent basis for marketing |
Section 09
Subject to applicable law and the limitations described below, you hold the following rights in respect of your personal data held by pw138. To exercise any of these rights, contact our support team with your registered account username and a description of your request.
Request a copy of all personal data pw138 holds about you, along with information on how it is being processed.
Request correction of any inaccurate or incomplete personal data. Some corrections require re-submission of KYC documents.
Request deletion of your personal data where it is no longer necessary for the purpose collected, subject to mandatory retention obligations.
Request that pw138 limit how your data is used — for example, while you contest the accuracy of data we hold.
Receive your personal data in a structured, machine-readable format (JSON or CSV) for transfer to another service provider.
Object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming purposes. We will cease processing unless compelling grounds exist.
pw138 will respond to all valid data rights requests within 30 calendar days of receipt. For complex requests, this period may be extended by a further 60 days with written notice and explanation. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.
Section 10
pw138's core infrastructure and data storage are hosted on servers located in jurisdictions with recognised data protection frameworks. Where personal data is transferred outside Indonesia to a third-party service provider (for example, a KYC verification platform or cloud storage provider operating in another country), pw138 ensures that appropriate safeguards are in place before the transfer occurs.
Safeguards applied to cross-border transfers include:
By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries other than Indonesia. pw138 will not transfer personal data to any jurisdiction that does not meet the safeguard requirements set out in this section.
Section 11
pw138 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. If a user is found to be under 21, their account will be terminated immediately, all data collected will be deleted except where retention is required by law, and any deposited funds will be returned to the registered payment source.
If you have reason to believe that a minor has registered on pw138, please contact our support team immediately at [email protected]. Reports of underage account use are treated as a compliance priority and investigated within 24 hours of receipt.
Section 12
pw138 applies a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key measures include:
While pw138 applies industry-standard controls, no security system is entirely impenetrable. You play an important role in protecting your own data by maintaining strong, unique passwords for your pw138 account and enabling two-factor authentication where available.
Section 13
The pw138 Platform may contain references to third-party services — including game studio information pages, payment provider help centres, and responsible gaming support organisations. pw138 does not control and is not responsible for the privacy practices or content of any third-party website or service. Visiting a third-party link from the Platform is at your own risk, and we encourage you to review the privacy policy of any third-party service before submitting personal data to it.
Section 14
pw138 may update this Privacy Policy from time to time to reflect changes in data processing practices, applicable law, or platform functionality. Where a material change is made, pw138 will notify registered players via in-platform notification and/or email to the registered address at least 14 calendar days before the change takes effect.
Non-material clarifications — such as spelling corrections, structural reorganisation without substantive changes, or the addition of examples — may be made without advance notice. The effective date of the current version of this Policy is noted in the Table of Contents sidebar.
Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not agree with an amended Policy, you must stop using the Platform and may request account closure through our support team.
Section 15
For any questions, data rights requests, or complaints regarding this Privacy Policy or pw138's data processing practices, please contact our support team using the details below. All contact information is provided as plain text — these are not clickable links.
If you are dissatisfied with pw138's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to your situation. pw138 will cooperate fully with any regulatory investigation into our data processing practices.
Further Reading
Our support team is available during WIB peak hours to answer any data-related queries. You can also review our full Terms & Conditions or explore our Responsible Gaming commitment.