Privacy Policy

This Privacy Policy ("Policy") describes how gan89 ("we", "us", "our") collects, uses, stores, shares, and protects personal data provided by or collected about users ("you", "your") of the gan89 platform accessible at gan89.one. This Policy applies to all products and services offered through the Platform, including sports betting, live casino, slot games, and any other gaming or support services. By registering an account or continuing to use the Platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.

In this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data held by gan89.
• "Processing" means any operation performed on personal data — including collection, storage, retrieval, use, disclosure, transfer, or deletion.
• "Controller" means gan89, which determines the purposes and means of processing personal data collected through the Platform.
• "Processor" means a third-party service provider that processes personal data on behalf of and under the instruction of gan89 (e.g., KYC verification vendors, payment processors).
• "KYC" means Know Your Customer — the identity and age verification process mandatory for all players before a withdrawal is processed.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, analytics, and personalization.
• "Platform" means the gan89 website at gan89.one, its mobile-optimized pages, and any future application made available to registered users.

gan89 collects personal data across several categories depending on how you interact with the Platform. The table below provides a clear summary:

We collect personal data through the following channels:

• Direct Submission: Data you provide when completing the registration form, the KYC verification process, the cashier (deposit/withdrawal) forms, or when contacting our support team via live chat, email, or WhatsApp.
• Automated Technologies: Technical and usage data collected automatically when you browse the Platform, including via cookies, web beacons, server logs, and session-recording technologies. See Section 8 (Cookies & Tracking) for full details.
• Third-Party Verification Services: During KYC, we may receive identity and address verification results from licensed third-party verification partners. These results are used solely to confirm the accuracy of the information you have submitted.
• Payment Processors: When you initiate a deposit or withdrawal, our payment processing partners (who handle BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja transactions) may share limited transaction metadata with gan89 for reconciliation and fraud-prevention purposes.
• Game Studios: Licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Pocket Games Soft) may share aggregated game session data with gan89 for platform analytics, bonus eligibility tracking, and responsible gaming monitoring. Individual hand or spin outcomes are not shared in a personally identifiable format.

gan89 processes personal data only for defined, legitimate purposes, each resting on a recognized lawful basis. The primary purposes are set out below:

• Account Creation and Management — To register your player account, authenticate your identity at login, and maintain your account profile. Lawful basis: performance of contract.
• KYC and Age Verification — To verify that you are at least 21 years of age, a resident of Indonesia, and that your identity matches your payment methods. Lawful basis: legal obligation and legitimate interest.
• Payment Processing — To process deposits and withdrawals via your chosen local bank or e-wallet, and to maintain accurate financial records. Lawful basis: performance of contract and legal obligation.
• Fraud Prevention and AML Compliance — To detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct. Lawful basis: legal obligation and legitimate interest.
• Platform Operation and Security — To monitor Platform performance, detect technical issues, and maintain the security and integrity of our systems. Lawful basis: legitimate interest.
• Customer Support — To respond to your support requests, resolve disputes, and maintain records of communications. Lawful basis: performance of contract and legitimate interest.
• Responsible Gaming — To monitor betting patterns and account activity for signs of problem gambling, to enforce self-exclusion requests, and to apply deposit or time-out limits you have set. Lawful basis: legal obligation and legitimate interest.
• Marketing and Promotions — To send you personalized bonus offers, seasonal promotions (including those aligned with Indonesian cultural events such as Ramadhan, Idul Fitri, and Indonesian Independence Day on 17 August), and platform updates — but only where you have given explicit consent. Lawful basis: consent. You may withdraw consent at any time.
• Analytics and Improvement — To analyze aggregated usage data to improve the Platform's design, game offering, and user experience. Lawful basis: legitimate interest.

gan89 does not sell your personal data to third parties. We share personal data only with the categories of recipients listed below, and only to the extent strictly necessary for the stated purpose:

• KYC and Identity Verification Partners: Licensed identity verification service providers who process document scans and return verification outcomes. These partners operate under strict data-processing agreements and are prohibited from using your data for any purpose other than the verification task.
• Payment Processing Partners: Third-party payment service providers who facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. Only the data strictly necessary to execute the transaction is shared.
• Licensed Game Studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft (PGSoft), Spribe, and other licensed studios receive the minimum session data needed to deliver their games and return results to the Platform.
• IT and Infrastructure Providers: Cloud hosting, content delivery network (CDN), and cybersecurity service providers who process data on our behalf under contractual data-protection agreements.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or the conditions of our international operating license, gan89 may disclose personal data to relevant regulatory bodies, financial intelligence units, or law enforcement agencies.
• Professional Advisers: Lawyers, auditors, and compliance consultants who are bound by professional confidentiality obligations and who require access to data in the context of providing services to gan89.

gan89 retains personal data for no longer than is necessary to fulfill the purposes for which it was collected, subject to any overriding legal, regulatory, or licensing obligations that require longer retention periods. The following general retention guidelines apply:

• Account Data and KYC Documents: Retained for the lifetime of your account and for a minimum of five (5) years following permanent account closure, in accordance with anti-money laundering record-keeping requirements applicable under our international operating license.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, to satisfy financial audit and AML compliance obligations.
• Customer Support Communications: Retained for three (3) years from the date of the last communication, to allow for dispute resolution and complaint escalation.
• Technical and Usage Logs: Retained for a maximum of twelve (12) months in raw form, after which they are aggregated and anonymized for analytics purposes. Anonymized, non-personally-identifiable analytics data may be retained indefinitely.
• Marketing Preferences and Consent Records: Retained for the duration of your account and for two (2) years after account closure, to demonstrate compliance with consent requirements in the event of a complaint.

When personal data is no longer required, it is securely deleted or rendered permanently anonymous through industry-standard data destruction procedures.

gan89 implements a layered security architecture to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. Our technical and organizational measures include:

• TLS/SSL Encryption: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher. This applies to every page on the Platform, including login, cashier, and KYC document upload flows.
• Encryption at Rest: Sensitive personal data (including KYC document images, identity numbers, and financial records) is stored in encrypted form on our servers. Encryption keys are managed separately from the data they protect.
• Access Controls: Access to personal data within gan89's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data-protection training.
• Two-Factor Authentication (2FA): Where available, we encourage all players to enable 2FA on their accounts. Internal system access by gan89 staff requires 2FA as a mandatory control.
• Penetration Testing: Our Platform undergoes periodic security testing by independent third-party specialists to identify and remediate vulnerabilities before they can be exploited.
• Payment Data Isolation: Full bank account numbers and e-wallet credentials are never stored on gan89 servers. Payment data is handled directly by our PCI-DSS compliant payment processors; only tokenized references are retained by the Platform.

The gan89 Platform uses cookies and similar tracking technologies to deliver core functionality, analyze performance, and personalize your experience. The categories of cookies we use are described below:

• Strictly Necessary Cookies: These cookies are required for the Platform to function. They maintain your login session, remember your game preferences, and enable secure navigation between pages. You cannot opt out of these cookies while using the Platform.
• Analytics Cookies: These cookies allow us to understand how players use the Platform — which pages are most visited, how long sessions last, and where players navigate to after landing on a particular page. This data is aggregated and used to improve Platform design and content. Analytics processing is carried out by gan89's internal analytics infrastructure; we do not use third-party analytics services that transmit your data to advertising networks.
• Functional Cookies: These cookies remember optional settings you have configured — such as your preferred language setting, notification preferences, and display options within the Platform — so that you do not need to re-set them each visit.
• Security Cookies: These cookies support fraud prevention and account security features, including detecting unusual login locations and flagging suspicious session behavior for review by our security team.

You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies; however, disabling strictly necessary cookies will impair your ability to use the Platform, including the login and cashier functions. Clearing session cookies will require you to log in again.

As a user of the gan89 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our support team at [email protected] or via live chat inside your account dashboard. We will acknowledge your request within 72 hours and respond substantively within 30 days.

• Right of Access: You may request a copy of all personal data gan89 holds about you in a structured, commonly used, machine-readable format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and there is no other lawful basis), or where processing has been unlawful. Note that this right may be limited where retention is required by our legal or regulatory obligations — for example, AML record-keeping requirements may override an erasure request in respect of financial transaction data.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data, pending verification.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes. Upon receiving such an objection, we will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Lodge a Complaint: If you believe that gan89 has processed your personal data in violation of this Policy or applicable data-protection law, you have the right to lodge a complaint with the relevant supervisory authority or with gan89's compliance team directly.

The gan89 platform is strictly intended for adults aged 21 years and over. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes a mandatory date-of-birth declaration, and KYC verification is used to confirm age before any withdrawal is processed.

If you are a parent or guardian and believe that a minor has registered an account or provided personal data to gan89 without your consent, please contact us immediately at [email protected]. Upon receiving a verified report, gan89 will suspend the account, investigate the matter, and permanently delete all personal data associated with that account as quickly as technically practicable, subject to any minimum retention requirements imposed by our AML obligations.

As an internationally licensed platform serving players in Indonesia, some personal data processed by gan89 may be transferred to and stored in servers or processed by service providers located outside Indonesia. Such transfers occur in the following contexts:

• Cloud infrastructure hosting, where server facilities may be located in jurisdictions including Singapore, Hong Kong, or European Union member states.
• KYC verification partners operating global identity verification infrastructure.
• Game studio servers operated by Pragmatic Play, Evolution Gaming, NetEnt, and other licensed providers, which may be based in Malta, Gibraltar, Isle of Man, or other jurisdictions with established gaming regulatory frameworks.

Where personal data is transferred internationally, gan89 ensures that appropriate safeguards are in place — including contractual data-protection clauses and, where applicable, transfers to jurisdictions that maintain an adequate level of data protection as recognized by international standards. We do not transfer personal data to jurisdictions that lack adequate data-protection frameworks without implementing additional contractual protections.

gan89 reserves the right to update this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or regulatory guidance. When material changes are made, we will notify registered players via email or via an in-platform notification at least seven (7) days before the updated Policy takes effect. The revised Policy will display a new "Last Updated" date at the top of this page.

Your continued use of the Platform after the effective date of an amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the amended terms, you must stop using the Platform and may request account closure by contacting our support team. Your data will be handled in accordance with the version of the Policy in force at the time of collection until it is deleted or anonymized in line with the retention schedule in Section 6.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by gan89, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line so your message is routed to the correct team.
• Live Chat: Available 24/7 inside your account dashboard after login. Select "Privacy & Data" from the support topic menu.
• WhatsApp: Contact details are provided inside your account dashboard after login.

Our support team operates around the clock, including during Indonesian public holidays such as Idul Fitri, Nyepi, and Indonesian Independence Day (17 August). We aim to acknowledge all privacy-related requests within 72 hours and to provide a full response within 30 calendar days. Where a request is complex or involves a high volume of data, we may extend the response period by a further 30 days — in which case we will notify you of the extension and the reason for it within the initial 30-day window.