Privacy Policy

1. Overview

crs88 ("we", "us", "our") operates the online gaming platform accessible at https://crs88.cam, providing casino games, live dealer tables, sports betting, togel (Indonesia's traditional numbers lottery), and related gaming services to registered players primarily based in Indonesia.

This Privacy Policy applies to all personal data collected through our website, mobile-optimized interface, customer support channels (live chat, email, WhatsApp), and any other digital touchpoint associated with crs88. It governs how we handle the personal information of all registered players, prospective players, and visitors to our platform.

crs88 acts as the data controller for all personal information collected through our platform. We are committed to maintaining the confidentiality, integrity, and availability of your data in accordance with internationally recognized data protection principles.

2. Definitions

The following terms have specific meanings throughout this Privacy Policy:

• "Personal Data" — any information that can directly or indirectly identify a living individual, including name, email address, phone number, bank account details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, and deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data; in this context, crs88.
• "Data Processor" — any third party that processes Personal Data on behalf of crs88 under a contractual arrangement.
• "Cookies" — small data files stored on your device by a web browser, used to remember preferences and track usage behavior.
• "KYC" (Know Your Customer) — the identity verification process required to confirm a player's identity, age, and payment method ownership.
• "Platform" — the crs88 website, mobile interface, and all associated digital services.

3. Personal Data We Collect

crs88 collects the minimum personal information necessary to provide our services, comply with legal obligations, and prevent fraud. We do not collect data beyond what is required for these purposes.

3.1 Account Registration Data

• Full legal name (as on government-issued ID)
• Date of birth (to verify 21+ age requirement)
• Email address
• Mobile phone number (including Indonesian +62 prefix)
• Residential address in Indonesia (province, city, postal code)
• Username and encrypted password

3.2 Identity Verification (KYC) Data

• Government-issued photo ID (KTP — Kartu Tanda Penduduk, passport, or SIM driver's license)
• Selfie or facial recognition scan (where required for enhanced verification)
• Proof of address (utility bill, bank statement, or government correspondence issued within 90 days)
• Proof of payment method ownership (bank statement or e-wallet screenshot)

3.3 Financial Transaction Data

• Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata account numbers — stored in encrypted format)
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Deposit and withdrawal history, amounts, timestamps, and transaction reference numbers
• Bet history, game session records, and wagering activity

3.4 Technical and Usage Data

• IP address and geolocation data (city-level precision)
• Device type, operating system, browser type, and version
• Session duration, pages visited, features accessed, and click-stream data
• Login timestamps and logout events
• Error logs and technical diagnostic data

3.5 Communication Data

• Live chat transcripts and support ticket records
• Email correspondence with our support team
• Feedback, complaints, and survey responses
• Responsible gaming interaction records (e.g., self-exclusion requests, deposit limit changes)

4. How We Collect Your Data

We collect personal data through the following channels:

Collection Method	Data Collected	When It Occurs
Account Registration Form	Name, email, phone, date of birth, address	At sign-up
KYC Verification Upload	Government ID scans, address proof, payment proof	Upon first withdrawal or request
Deposit & Withdrawal Forms	Bank account numbers, e-wallet IDs, transaction amounts	At each financial transaction
Platform Usage (Automatic)	IP address, device info, session data, cookies	During every visit and session
Customer Support Interactions	Communication content, support request details	When you contact our team
Third-Party Payment Processors	Transaction confirmation data, payment status	When deposits/withdrawals are processed

5. Purpose of Processing Your Data

crs88 processes your personal data strictly for the following purposes:

• Account Management: Creating, maintaining, and securing your player account; authenticating your identity on each login.
• Service Delivery: Enabling you to access and use all platform features including casino games, sports betting, togel lottery, and live dealer tables.
• Financial Processing: Processing deposits, executing withdrawal requests, applying bonuses, and maintaining accurate account balances in IDR.
• Identity Verification (KYC): Verifying that you meet our eligibility requirements, including being at least 21 years of age and a resident of Indonesia.
• Fraud Prevention and AML Compliance: Detecting suspicious activity, preventing money laundering, and complying with international anti-fraud standards.
• Responsible Gaming: Monitoring for problem gambling behavior, processing self-exclusion requests, enforcing deposit limits, and providing support resources.
• Customer Support: Responding to your queries, resolving disputes, and improving our service quality based on support interactions.
• Platform Improvement: Analyzing usage patterns to enhance the user experience, optimize game performance, and develop new features.
• Legal Compliance: Meeting our obligations under applicable international gaming regulations, data protection laws, and anti-money laundering (AML) requirements.
• Security Monitoring: Protecting the platform, other players, and our systems from unauthorized access, hacking, and malicious activity.

6. Legal Basis for Processing

crs88 processes your personal data under one or more of the following legal bases, consistent with internationally recognized data protection principles:

• Contractual Necessity: Processing required to fulfill our obligations under our Terms and Conditions — including account management, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable laws — including KYC verification, anti-money laundering (AML) reporting, and age verification.
• Legitimate Interests: Processing carried out to pursue our legitimate business interests — including fraud prevention, platform security, and customer support — where these interests do not override your fundamental rights.
• Consent: Where we rely on your explicit consent (for example, for marke ting communications or optional data collection), you may withdraw your consent at any time by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

7. Data Sharing and Disclosure

crs88 does not sell, rent, or trade your personal data to third parties for marketing purposes under any circumstances. We share your data only in the following limited and necessary situations:

7.1 Payment Service Providers

To process deposits and withdrawals, we share relevant financial information with our partner payment processors, including local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). These processors are contractually bound to use your data solely for payment processing and are prohibited from retaining or repurposing it.

7.2 Identity Verification Partners

We engage licensed third-party KYC and identity verification service providers to validate government-issued documents and confirm player eligibility. These partners operate under strict data processing agreements and are certified to handle sensitive identity documents securely.

7.3 Game Software Providers

Our platform integrates games from internationally licensed studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft. Limited technical data (session tokens, bet amounts, game outcomes) is shared with these providers solely to enable gameplay. No identifiable personal data beyond what is technically necessary is disclosed.

7.4 Fraud Prevention and Security Services

We use third-party fraud detection and cybersecurity services to protect the platform and our players. These services may process IP addresses, device fingerprints, and behavioral data to identify suspicious patterns. All such partners are bound by confidentiality obligations.

7.5 Legal and Regulatory Authorities

crs88 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required by law or where we believe disclosure is necessary to protect the rights, property, or safety of crs88, our players, or the public. We will notify affected players of such disclosures where legally permitted to do so.

7.6 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of the transaction. We will provide notice prior to any such transfer and will ensure the receiving entity is bound by terms no less protective than this Privacy Policy.

8. Cookies and Tracking Technologies

crs88 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyze usage patterns. By continuing to use our platform, you consent to our use of cookies as described below.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences such as language settings, last-selected payment method, and game category filters. These improve your experience but are not essential.
• Analytical Cookies: Collect anonymized data on how players use the platform — pages visited, features clicked, session duration — to help us improve our services. We use privacy-respecting analytics tools that do not build advertising profiles.
• Security Cookies: Detect and prevent fraudulent logins, bot activity, and suspicious behavioral patterns to protect your account and the platform.

8.2 Managing Cookies

You may control cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will impair your ability to log in and use core platform features. Disabling analytical cookies will not affect your ability to play but may result in a less personalized experience.

8.3 No Third-Party Advertising Cookies

crs88 does not deploy third-party advertising cookies or tracking pixels from ad networks such as Google Ads, Meta Pixel, or any other advertising platform. We do not participate in cross-site behavioral advertising or retargeting programs.

9. Data Retention

crs88 retains your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by applicable law. The following retention periods apply:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years after closure	Legal obligation and dispute resolution
KYC identity documents	Duration of account + 7 years after closure	AML compliance and regulatory requirements
Financial transaction records	7 years from transaction date	Financial record-keeping and AML obligations
Bet history and game records	5 years from session date	Dispute resolution and regulatory audit
Customer support communications	3 years from last interaction	Quality assurance and dispute evidence
Cookies and session data	Session cookies: deleted on logout. Persistent cookies: up to 12 months	Platform functionality and analytics

Upon expiry of the applicable retention period, your data is securely deleted or anonymized so that it can no longer be linked to your identity.

10. Data Security

crs88 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

10.1 Technical Safeguards

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.3 protocols, the same standard used by major Indonesian financial institutions including BCA and Bank Mandiri.
• Encrypted Data Storage: Sensitive data including passwords (hashed with bcrypt), bank account numbers, and identity documents are stored in encrypted format. Plaintext passwords are never stored.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA via SMS OTP (Indonesian +62 numbers supported) or authenticator application.
• Firewall and Intrusion Detection: Our infrastructure is protected by enterprise-grade firewalls, real-time intrusion detection systems (IDS), and distributed denial-of-service (DDoS) mitigation services.
• Regular Security Audits: We engage independent third-party cybersecurity firms to conduct quarterly penetration testing and annual security audits of our platform infrastructure.

10.2 Organizational Safeguards

• Access to player data is restricted to employees whose job functions require it, governed by role-based access control (RBAC) policies.
• All staff with access to personal data undergo background checks and are bound by confidentiality agreements.
• We maintain a documented data breach response plan and will notify affected players within 72 hours of discovering a significant breach.

11. Your Data Protection Rights

As a player on the crs88 platform, you hold meaningful rights over your personal data. We are committed to facilitating the exercise of these rights in a timely and transparent manner. You may submit a data rights request at any time by contacting our support team at [email protected].

11.1 Right of Access

You have the right to request a copy of all personal data we hold about you, including account information, transaction history, KYC records, and communication logs. We will provide this information within 30 days of a verified request, free of charge.

11.2 Right to Rectification

If any personal data we hold about you is inaccurate, incomplete, or outdated, you have the right to request correction. You may update basic account details directly through your account settings. For changes to KYC-verified information (such as legal name or date of birth), additional documentation will be required.

11.3 Right to Erasure ("Right to Be Forgotten")

You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent (where consent was the legal basis). Note that we may be legally required to retain certain data (particularly financial and KYC records) for the periods specified in Section 9, even after account closure.

11.4 Right to Restrict Processing

You may request that we restrict processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or while a complaint is under review. During a restriction, we will store your data but not actively process it beyond what is legally required.

11.5 Right to Data Portability

You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format (such as JSON or CSV), and to transmit that data to another service provider where technically feasible.

11.6 Right to Object

You may object to processing of your personal data based on legitimate interests (as described in Section 6). We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights, or processing is necessary for legal claims.

11.7 Right to Withdraw Consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent for essential processing may require account closure.

To exercise any of the above rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and fulfill it within 30 days. We may require identity verification before processing requests to protect against unauthorized data access.

12. Children's Privacy

crs88 strictly prohibits the use of our platform by individuals under 21 years of age. We do not knowingly collect personal data from minors. Age verification is a core component of our registration and KYC processes.

If we become aware that personal data has been collected from a player who does not meet our minimum age requirement, we will immediately suspend the account, refund any deposits where appropriate, and permanently delete all associated personal data from our systems.

If you are a parent or guardian and believe your child has registered on crs88 without authorization, please contact us immediately at [email protected] so that we can take prompt corrective action.

13. International Data Transfers

crs88 operates servers and engages service providers in multiple countries. As a result, your personal data may be transferred to and processed in countries outside Indonesia. When such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses (SCCs) approved by recognized data protection authorities
• Data processing agreements (DPAs) with all third-party processors requiring compliance with equivalent data protection standards
• Selection of service providers located in jurisdictions recognized as providing adequate levels of data protection

Your data is never transferred to countries without adequate protections in place. All international processing remains governed by the standards and commitments described in this Privacy Policy.

14. Changes to This Privacy Policy

crs88 reserves the right to update this Privacy Policy at any time to reflect changes in our practices, service offerings, legal requirements, or regulatory guidance. When we make material changes, we will:

• Post the revised policy on this page with an updated "Last Updated" date
• Send a notification to your registered email address at least 14 days before major changes take effect
• Display a prominent notice on the platform during the notice period

Your continued use of the platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you must discontinue use and contact us to close your account before the effective date.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please reach out through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the crs88 platform
• Response Time: Data protection inquiries are acknowledged within 3 business days and resolved within 30 days
• Support Languages: English and Bahasa Indonesia
• Operating Hours: Customer support is available 24 hours a day, 7 days a week including all Indonesian public holidays, operating on Western Indonesia Time (WIB, UTC+7)