hit88 Privacy Policy

hit88 ("we", "us", "our") operates the online gaming platform available at hit88.lol (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits, registers with, or transacts on the Platform.

This Privacy Policy has been prepared in accordance with internationally recognised data protection principles. It sets out a transparent account of the types of personal data we process, the purposes for which that data is used, the parties with whom it may be shared, and the rights available to you as a data subject.

hit88 primarily serves players based in Indonesia, including cities such as Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and Makassar. We recognise the particular importance of handling the financial and identity data associated with local payment methods — including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja — with the highest degree of care and discretion.

If you have any questions about this Privacy Policy or wish to exercise any of your data rights, please contact us using the details provided in Section 14.

hit88 collects personal data only to the extent necessary to provide you with a safe, legal, and high-quality gaming experience. The categories of personal data we collect include:

hit88 collects personal data through the following channels:

• Direct interactions — data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting our support team, or updating your account profile.
• Automated technologies — data collected passively as you browse and interact with the Platform, including via cookies, session tokens, log files, and analytics tools. See Section 7 for full details on cookies.
• Third-party sources — data received from our payment processing partners (banks and e-wallet providers), KYC identity verification service providers, fraud detection services, and game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others) in connection with your activity on the Platform.
• Publicly available sources — in limited circumstances, for fraud prevention and AML compliance purposes only, hit88 may cross-reference data against publicly available information.

hit88 uses your personal data strictly for the following purposes:

• Account management — creating, maintaining, and securing your hit88 account, including password resets and account recovery.
• Identity verification (KYC) — verifying your identity and age (you must be 21 or older to use the Platform) to comply with anti-money laundering (AML) obligations and responsible gaming requirements.
• Payment processing — executing deposits and withdrawals via your chosen local payment channel (BCA, BRI, OVO, DANA, GoPay, and others), reconciling transactions, and investigating payment discrepancies.
• Fraud prevention & security — detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, bonus abuse, and unauthorized access attempts on the Platform.
• Regulatory compliance — meeting applicable legal, regulatory, and law enforcement obligations, including record-keeping requirements and responding to lawful requests from competent authorities.
• Customer support — responding to your enquiries, resolving disputes, and providing assistance through our 24/7 Indonesian-speaking live chat and email support channels.
• Platform improvement — analyzing usage patterns and technical performance data to enhance the Platform's features, stability, and user experience for players across Indonesia.
• Responsible gaming — monitoring gaming behavior for indicators of problem gambling and administering the deposit limits, cooling-off periods, and self-exclusion tools available on your account settings panel.
• Marketing communications — sending you promotional offers, bonus announcements, and seasonal campaigns (such as Idul Fitri, Ramadhan, and Indonesian Independence Day promotions) where you have given your consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time by contacting support.

For each category of processing activity, hit88 relies on one or more of the following legal bases:

• Contractual necessity — processing that is essential to fulfilling our obligations under the Terms & Conditions you accepted at registration, including account creation, payment processing, and game delivery.
• Legal obligation — processing required to comply with applicable AML laws, KYC regulations, fraud reporting obligations, and any other binding legal requirements applicable to hit88's international operations.
• Legitimate interests — processing that serves hit88's or a third party's legitimate interests where those interests are not overridden by your rights and freedoms. This includes fraud detection, platform security, analytics, and direct marketing to existing members.
• Consent — where you have given us clear, informed, and freely given consent for a specific processing activity (such as receiving promotional emails). You may withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

hit88 shares personal data only in the following limited and controlled circumstances:

• Payment processors — banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) require your financial identity data to execute and validate transactions.
• KYC and identity verification partners — third-party identity verification services receive copies of your identity documents and selfie photographs for the sole purpose of confirming your identity and age before your first withdrawal is processed.
• Game content providers — providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive a pseudonymised player identifier and bet data necessary to deliver game sessions and settle results. They do not receive your name, address, or payment details.
• Fraud prevention and AML service providers — specialist third-party services may receive relevant transactional and behavioral data to help identify suspicious patterns and protect the integrity of the Platform.
• Legal authorities — hit88 will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by a valid legal order, warrant, or applicable law. hit88 will notify the affected Member of such a disclosure where permitted to do so.
• Business transfers — in the event of a merger, acquisition, or sale of all or part of hit88's business assets, personal data held by hit88 may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third-party service providers are contractually bound to process your data only for the specific purpose for which it was shared and to maintain appropriate security standards.

The hit88 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, and to analyze how the Platform is used so we can continue to improve it.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in and using the Platform. Disabling other cookie categories will not affect your core gaming experience but may reduce the relevance of promotional communications you receive.

hit88 retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. The following general retention periods apply:

• Active account data — retained for the duration of your membership and for a minimum of five (5) years following account closure, to satisfy AML record-keeping obligations.
• KYC documentation — retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction records — all deposit, withdrawal, and betting transaction records are retained for a minimum of five (5) years from the date of each transaction.
• Support communications — live chat transcripts and email correspondence are retained for a minimum of two (2) years from the date of the interaction.
• Marketing consent records — consent logs are retained for as long as marketing communications are sent to you, plus an additional three (3) years as evidence of consent.
• Technical and usage logs — server logs and analytics data are retained for a maximum of thirteen (13) months in identifiable form, after which they are aggregated or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

hit88 takes the security of your personal data seriously and maintains a comprehensive set of technical and organisational safeguards designed to protect your information against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the Platform.
• Encryption at rest for all stored personal data and financial records, using industry-standard AES-256 encryption.
• Password hashing using a modern one-way hashing algorithm — your password is never stored in plain text and cannot be retrieved by hit88 staff.
• Access controls — Platform staff access to Member personal data is role-restricted and subject to a documented least-privilege policy. All access events are logged and periodically audited.
• Two-factor authentication (2FA) available for all Member accounts. hit88 strongly recommends enabling 2FA via your account security settings.
• Penetration testing and vulnerability scanning conducted on a regular scheduled basis by independent security specialists.
• Incident response plan — in the event of a confirmed data breach that poses a risk to Member rights and freedoms, hit88 will notify affected Members and relevant authorities within the timeframes required by applicable law.

As a data subject, you have the following rights in relation to the personal data that hit88 holds about you. To exercise any of these rights, please contact us using the details in Section 14. hit88 will respond to all valid requests within 30 days.

• Right of access — you may request a copy of all personal data that hit88 holds about you, along with information about how it is being processed.
• Right to rectification — you may request that hit88 correct any inaccurate or incomplete personal data held about you. For account profile corrections, you may also update certain fields directly via your account settings panel.
• Right to erasure — you may request that hit88 delete your personal data where there is no longer a legitimate basis for retaining it. Note that this right is subject to overriding legal obligations — for example, AML laws require us to retain certain records for five years regardless of an erasure request.
• Right to restriction of processing — you may request that hit88 restrict the processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to data portability — where processing is based on your consent or on a contract, you may request that hit88 provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object — you may object to the processing of your personal data where hit88 relies on legitimate interests as its legal basis. hit88 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent — where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

The hit88 Platform is strictly intended for adults aged 21 years and older. hit88 does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step of the KYC process, and accounts found to belong to individuals under 21 will be immediately suspended and all funds returned where legally permissible.

If you are a parent or guardian and you believe that a minor in your care has registered on the Platform or submitted personal data to hit88, please contact us immediately at [email protected] and we will take prompt action to investigate and delete the relevant data.

The Platform may, in limited contexts, display references to or information about third-party services such as payment providers, game studios, or sports leagues (including BRI Liga 1, UEFA Champions League, EPL, La Liga, Serie A, Bundesliga, and others). hit88 does not operate and is not responsible for the privacy practices of any third-party websites or services. This Privacy Policy applies solely to data collected and processed by hit88 through the hit88 Platform.

If you navigate away from the Platform to a third-party website, we strongly recommend reviewing that site's privacy policy before submitting any personal information.

hit88 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. Where a material change is made — that is, a change that affects how your personal data is used in a way that is less protective or substantially different from what was previously disclosed — hit88 will:

• Post the updated Privacy Policy on this page with a revised "Last Updated" date.
• Send an email notification to the address registered on your account no less than seven (7) days before the change takes effect.
• Display a prominent notice on the Platform during the notice period.

Your continued use of the Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Privacy Policy, you must cease using the Platform and may request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a privacy concern or complaint, please contact the hit88 Data Protection team through the following channels:

• Live Chat: Available 24/7 directly from the hit88 Platform. This is the fastest channel — our Indonesian-speaking agents can escalate privacy concerns to the Data Protection team on your behalf immediately.
• Email: [email protected] — include "Privacy Request" in the subject line. We aim to acknowledge all privacy-related emails within 48 hours and resolve them within 30 days.

hit88 takes all privacy concerns seriously. If you are not satisfied with our response to a complaint, you retain the right to escalate the matter to a relevant data protection authority or supervisory body in your jurisdiction.