Privacy Policy —
How indo178 Handles Your Data

1 Introduction

Indo178 (hereinafter "the Company", "we", "us", "our") operates the online gaming and sports betting platform accessible at https://indo178.cam (the "Platform"). This Privacy Policy describes how indo178 collects, uses, stores, shares, and protects the personal data of Users who access or use the Platform.

This Policy applies to all registered Members and visitors of the indo178 Platform, including Malaysian users accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other regions within Malaysia.

By registering an account or using any part of the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you must not use the Platform.

2 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

3 Data We Collect

Indo178 collects the following categories of personal data from Users, depending on the nature of their interaction with the Platform:

3.1 Registration and Identity Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (used to verify minimum age eligibility of 21 years)
• Email address
• Mobile phone number
• Residential address
• Username and password (stored in encrypted form)

3.2 Identity Verification (KYC) Data

• Scanned copy or photograph of valid government-issued photo identification (Malaysian NRIC / MyKad, Passport, or Driver's Licence)
• Proof of address document (utility bill, bank statement, or official correspondence dated within three months)
• Selfie photograph holding your identification document
• Documentation confirming your registered payment method, where applicable

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction records (amounts, timestamps, payment method used)
• Payment method identifiers (e-wallet account reference, bank account last four digits — full account numbers are not stored by indo178)
• Bonus and promotional credit records
• Betting history and gaming activity records

3.4 Technical and Usage Data

• IP address and approximate geolocation at time of access
• Device type, operating system, and browser information
• Session duration and navigation patterns within the Platform
• Error logs and performance data relevant to platform stability

3.5 Communication Data

• Records of live chat, email, and other support communications between you and indo178's customer support team
• Communication preference settings (e.g., opt-in or opt-out of promotional emails)

4 How We Collect Your Data

Indo178 collects personal data through the following channels:

• Directly from you — during account registration, KYC document submission, deposit or withdrawal requests, form submissions, and support communications.
• Automatically via the Platform — through cookies, session tracking, and server logs when you access or interact with any part of the Platform.
• From third-party service providers — including KYC verification services that confirm the authenticity of identity documents, and payment processors including GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, and major Malaysian banks (Maybank, CIMB, Public Bank, Hong Leong).
• From fraud prevention and compliance services — where indo178 receives data screening results from authorised third-party providers to assist with anti-money laundering (AML) and fraud detection obligations.

5 How We Use Your Data (Data Processing)

Indo178 processes your personal data solely for defined, specific, and legitimate purposes. We do not process your data for any purpose incompatible with those stated in this Policy. The primary purposes for which we process your personal data are:

6 Legal Basis for Processing

Indo178 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity — Processing necessary to fulfil our obligations under the account agreement with you, including account administration and payment processing.
• Legal obligation — Processing required to comply with applicable AML, KYC, and data retention legal requirements.
• Legitimate interests — Processing necessary to pursue indo178's legitimate interests in fraud prevention, platform security, and service improvement, where these interests are not overridden by your privacy rights.
• Consent — Processing based on your freely given, specific, and informed consent — particularly in relation to optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Data Sharing and Disclosure

Indo178 does not sell, rent, or disclose your personal data to third parties for their own independent marketing or commercial purposes. We may share your data with third parties only in the following circumstances:

• Payment Service Providers: Personal data necessary to process your deposits and withdrawals is shared with payment processors including GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, and banking partners such as Maybank, CIMB, and Public Bank. These processors are bound by contractual data protection obligations.
• KYC and Identity Verification Services: Identity documents submitted for KYC verification are processed by authorised third-party verification service providers under strict data processing agreements.
• Fraud Prevention and AML Services: Relevant transaction and identity data may be screened against authorised fraud prevention and AML databases in compliance with applicable regulatory requirements.
• Cloud Infrastructure and Technology Providers: Platform data, including encrypted user records, is stored on secure cloud infrastructure provided by reputable hosting services under contractual security obligations.
• Legal and Regulatory Authorities: Indo178 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or regulatory direction.

8 Data Retention

Indo178 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation.

• Active Accounts: Personal data associated with an active Account is retained for the duration of the Account's existence.
• Closed Accounts: Following Account closure, certain categories of personal data — including identity verification records and transaction history — are retained for a minimum of five (5) years in accordance with AML and financial record-keeping obligations.
• Marketing Data: Communication preference data and related marketing records are retained until you withdraw consent, following which they are deleted within thirty (30) days.
• Technical Logs: Server logs and technical usage data are retained for a rolling period of twelve (12) months for security and performance monitoring purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with indo178's internal data lifecycle procedures.

9 Your Rights as a Data Subject

As a User of the indo178 Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with your full name, registered email address, and a description of your request.

• Right of Access: You have the right to request a copy of the personal data indo178 holds about you, together with information about how it is being processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure: In certain circumstances — for example where data is no longer necessary for its original purpose or where consent is withdrawn — you may request deletion of your personal data. Note that this right may be limited where retention is required by law.
• Right to Restriction of Processing: You have the right to request that indo178 restricts the processing of your personal data in specific circumstances, such as while a rectification request is under review.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another data controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including profiling. You also have an unconditional right to object to the use of your data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent — including marketing communications — you may withdraw that consent at any time via your Account settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Indo178 will respond to all data subject requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further sixty (60) days, of which we will notify you in writing.

10 Cookies & Tracking Technologies

Indo178 uses cookies and similar tracking technologies to enable core Platform functionality, improve the user experience, and gather anonymised analytics data. The categories of cookies used on the indo178 Platform are as follows:

• Essential Cookies: Required for the Platform to function correctly, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing core functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how users navigate and interact with the Platform, helping indo178 identify performance issues and prioritise improvements.
• Functional Cookies: Store user preferences such as language settings, interface configurations, and last-viewed sections to personalise the Platform experience.
• Security Cookies: Help indo178 detect and prevent fraudulent activity, including suspicious login attempts and duplicate account creation.

You may configure your browser to refuse or delete cookies at any time. Note that disabling essential cookies will affect your ability to access certain parts of the Platform, including account login and deposit functions.

11 Data Security

Indo178 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encryption of sensitive personal data at rest within our storage infrastructure
• Role-based access controls limiting employee access to personal data on a need-to-know basis
• Multi-factor authentication options for Account access
• Real-time transaction monitoring and anomaly detection systems
• Regular internal security reviews and infrastructure patching procedures

While indo178 takes every reasonable precaution to protect your data, no digital system can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account login credentials and for notifying indo178 immediately if you suspect any unauthorised access to your Account.

12 Third-Party Services and Links

The indo178 Platform integrates with third-party payment service providers to facilitate deposits and withdrawals, including GrabPay, Touch 'n Go eWallet, Boost, DuitNow, and FPX (via Maybank, CIMB, Public Bank, and Hong Leong). These providers maintain their own privacy policies, which govern the processing of your data in the course of payment transactions. Indo178 is not responsible for the privacy practices of third-party service providers.

All third-party Data Processors engaged by indo178 are required to enter into data processing agreements confirming that they will process personal data only in accordance with indo178's written instructions and applicable data protection standards.

13 Minors and Age Verification

The indo178 Platform is strictly for individuals aged 21 years and above. Indo178 does not knowingly collect or process personal data from individuals under the age of 21.

All Users are required to confirm their age at the time of registration, and are required to complete KYC verification — which includes submission of a valid government-issued identification document — before withdrawals are enabled. Accounts found to belong to individuals under the age of 21 will be closed immediately, and any personal data collected in connection with such accounts will be securely deleted, subject to any minimum retention obligations required by law.

14 Changes to This Privacy Policy

Indo178 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform services. When material changes are made, we will notify registered Users by email to the address on file and/or via a prominent notice on the Platform.

The "Last Updated" date at the top of this page will always indicate when the most recent revision was made. We encourage you to review this page periodically to remain informed of how indo178 handles your personal data. Your continued use of the Platform following the posting of an updated Privacy Policy constitutes your acceptance of the revised terms.

15 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by indo178, please contact our support team through the following channels:

• Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week via the in-platform chat widget.
• Service Region: Malaysia — Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and surrounding areas.

Indo178 endeavours to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response or resolution within thirty (30) calendar days, except where complexity necessitates an extension as provided under applicable law.