Privacy Policy

1. Introduction & Scope

This Privacy Policy ("Policy") is issued by ns38 ("we", "us", "our", "Operator", "Company"), the operator of the online gaming platform accessible at https://ns38.cam. This Policy applies to all Users ("you", "your", "User", "Member", "Player") who access or use any part of our website, mobile platform, or related services (collectively, "Services"), regardless of the device or connection method used.

ns38 is committed to protecting the personal data of all Users, with particular attention to the rights and expectations of Indonesian players. We process personal data in accordance with internationally recognized data protection principles, including purpose limitation, data minimization, storage limitation, integrity, confidentiality, and accountability. By creating an account and using our Services, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the binding agreement between you and ns38.

2. Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly. This includes names, email addresses, phone numbers, device identifiers, IP addresses, and Indonesian National ID (KTP) numbers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Controller" means ns38, which determines the purposes and means of processing your Personal Data.
• "Processor" means any third party that processes Personal Data on behalf of ns38 under written instruction (e.g., payment processors, KYC verification services, cloud hosting providers).
• "Consent" means a freely given, specific, informed, and unambiguous indication by which you agree to the processing of your Personal Data for a stated purpose.
• "Data Subject" means any identified or identifiable natural person whose Personal Data is processed by ns38 — in practical terms, this refers to you, the User.

3. Information We Collect

3.1 Information You Provide Directly

When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in promotions, you provide us with Personal Data. This includes, but is not limited to:

• Identity Data: Full legal name, date of birth (used to confirm you are 21+), gender, nationality, and a scanned copy or photograph of your Indonesian National ID (KTP) or passport.
• Contact Data: Email address, mobile phone number (Indonesian +62 prefix preferred), and residential mailing address within Indonesia.
• Account Credentials: Username and hashed (encrypted) password. We never store your password in plain text.
• Financial Data: Bank account details (bank name, account number, account holder name) for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, or Bank Permata; and e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja.
• KYC Documents: Copies of identity documents, proof-of-address documents (utility bills, bank statements), and selfie verification photographs submitted during identity verification.
• Communications Data: Content of messages, emails, live chat transcripts, and WhatsApp communications you send to our support team.

3.2 Information Collected Automatically

When you use our platform, we automatically collect certain technical and behavioral data to ensure platform security, personalize your experience, and improve our Services:

• Device & Technical Data: IP address, browser type and version, operating system, device type (mobile, tablet, desktop), screen resolution, and device language settings.
• Usage Data: Pages visited, games played, bet history, session duration, click-paths, search queries, and in-platform navigation patterns.
• Transaction Data: Deposit and withdrawal amounts, timestamps, payment method used, transaction reference numbers, and balance history.
• Location Data: Approximate geographic location derived from your IP address, used to verify you are accessing from Indonesia and to deliver regionally appropriate content. We do not collect precise GPS coordinates.
• Log Data: Server logs recording access times, error codes, and security-relevant events such as failed login attempts.

3.3 Information from Third Parties

We may receive Personal Data about you from trusted third-party sources, including:

• Identity Verification Partners: Third-party KYC service providers who cross-reference your submitted documents against official databases to confirm your identity and age.
• Payment Processors: Confirmation of transaction status from Indonesian banks and e-wallet providers.
• Fraud Prevention Services: Risk scores and fraud signals from anti-fraud partners to protect against unauthorized account access and financial fraud.
• Anti-Money Laundering (AML) Databases: Sanctions screening and politically exposed persons (PEP) checks conducted by compliance partners.

4. How We Use Your Information

ns38 uses your Personal Data only for legitimate, clearly defined purposes. We do not process your data in ways incompatible with the purposes for which it was originally collected. Specific uses include:

• Account Management: Creating, maintaining, and securing your ns38 account; authenticating your identity at login; enabling account recovery.
• Service Delivery: Processing bets and game transactions across all available product categories, including football betting (bandar bola), togel (traditional Indonesian lottery draws), live casino, slots, and crash games; crediting winnings; processing deposits and withdrawals in Indonesian Rupiah (IDR).
• KYC & Compliance: Verifying your age (21+), identity, and source of funds to comply with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations applicable to internationally licensed gaming operators.
• Customer Support: Responding to your inquiries, resolving complaints, and providing technical assistance via live chat, WhatsApp, email, and in-platform messaging.
• Promotions & Bonuses: Administering welcome bonuses, reload offers, cashback promotions, VIP loyalty programs, and other incentives; ensuring fair eligibility and preventing bonus abuse.
• Responsible Gaming: Monitoring gambling patterns to identify signs of problem gambling; enforcing self-exclusion, deposit limits, and time-out requests; delivering responsible gaming prompts and reality checks.
• Fraud & Security: Detecting and preventing unauthorized access, money laundering, multi-accounting, collusion, and other prohibited activities; maintaining platform integrity.
• Analytics & Improvement: Analyzing aggregated usage data to improve platform performance, user experience, game selection, and promotional offerings. No individual profiling is used for decisions with legal or significant effects without your explicit consent.
• Marketing Communications: Sending promotional emails, SMS messages, or push notifications about offers and new games, only where you have opted in to receive such communications. You may opt out at any time.
• Legal Obligations: Retaining records as required by applicable anti-money laundering regulations, responding to lawful requests from regulatory or law enforcement authorities.

5. Legal Basis for Processing

We process your Personal Data on the following legal grounds:

• Contract Performance: Processing necessary to fulfill the ns38 Terms & Conditions you agreed to when creating your account, including service delivery, payment processing, and account management.
• Legal Obligation: Processing required for compliance with applicable laws and regulations, including AML/CTF obligations, KYC verification requirements, and data retention mandates.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming enforcement, where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications and optional analytics, where you have provided explicit consent. You may withdraw consent at any time without penalty.

6. Cookies & Tracking Technologies

ns38 uses cookies and similar tracking technologies (web beacons, pixel tags, local storage) to enhance your experience and gather analytical data. Cookies are small text files stored on your device by your browser. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function. These enable login sessions, maintain your account state, remember your bet slip contents, and enable security features such as CSRF protection. These cookies cannot be disabled without breaking core platform functionality.
• Analytical Cookies: Used to understand how Users interact with ns38, which pages are most visited, which games are most popular, and where technical errors occur. Data is aggregated and anonymized where possible.
• Functional Cookies: Remember your preferences, such as preferred language (Bahasa Indonesia or English), display settings, and deposit method. These improve your experience without tracking cross-site behavior.
• Marketing Cookies: Used only with your consent to deliver relevant promotions and measure the effectiveness of our marketing campaigns. These may track activity across sessions.

You can control cookie settings through your browser preferences. Note that disabling strictly necessary cookies will impair the functionality of ns38. For analytical and marketing cookies, you may adjust your consent preferences by contacting our support team.

7. Data Sharing & Disclosure

ns38 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share your data only in the following circumstances and only to the minimum extent necessary:

• Service Providers (Processors): We engage trusted third-party processors to support our Services, includ ing payment processing, KYC identity verification, cloud hosting, fraud detection, and customer support tools. All processors are bound by written data processing agreements requiring them to handle your data securely, only for the specified purpose, and in accordance with applicable data protection standards.
• Payment Partners: Your financial data (bank account details, e-wallet identifiers, transaction amounts) is shared with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposits and withdrawals.
• Identity Verification Partners: Your KYC documents and personal identifiers are shared with licensed identity verification service providers to confirm your age (21+), identity, and residential status as required by our compliance obligations.
• Fraud Prevention & AML Partners: We may share limited Personal Data with anti-fraud and AML compliance services to screen against sanctions lists, PEP databases, and known fraud networks. This is a legal obligation for internationally licensed gaming operators.
• Regulatory & Law Enforcement Authorities: We will disclose Personal Data to competent regulatory, governmental, or law enforcement authorities when required by law, court order, or other binding legal process. We will notify you of such disclosure where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. You will be notified of any such change in ownership.
• With Your Consent: We may share your data with additional third parties where you have provided explicit, informed consent to do so.

8. Data Retention

ns38 retains your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations. Our standard retention periods are as follows:

• Account Data: Retained for the duration of your active account relationship with ns38, and for a period of 5 years following permanent account closure, to satisfy AML record-keeping requirements and to defend against potential legal claims.
• Transaction Records: All deposit, withdrawal, and betting transaction records are retained for a minimum of 5 years from the date of the transaction, in compliance with anti-money laundering regulations applicable to internationally licensed gaming operators.
• KYC Documents: Identity verification documents are retained for a minimum of 5 years following account closure or the end of our business relationship. Copies are stored in encrypted form with access restricted to authorized compliance personnel.
• Customer Support Communications: Chat transcripts, email correspondence, and WhatsApp records are retained for 3 years to facilitate dispute resolution and quality assurance.
• Marketing Preferences: Records of your marketing consent and opt-out choices are retained indefinitely to ensure we honor your communication preferences.
• Technical & Log Data: Server logs and security event records are retained for 12 months for fraud investigation and platform stability monitoring purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in accordance with our internal data destruction procedures. Anonymized, aggregated data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

9. Data Security

ns38 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, loss, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using industry-standard TLS 1.2 or higher (256-bit SSL). This applies to all account activity, payment processing, and customer support communications.
• Encryption at Rest: Sensitive Personal Data stored on our servers, including KYC documents, financial data, and account credentials, is encrypted using AES-256 encryption at rest.
• Access Controls: Access to Personal Data is restricted to authorized ns38 personnel on a strict need-to-know basis. All staff with data access privileges are subject to background checks, confidentiality agreements, and regular security training.
• Two-Factor Authentication (2FA): ns38 supports and encourages the use of two-factor authentication on all User accounts to prevent unauthorized access even in the event of password compromise.
• Intrusion Detection & Monitoring: Our systems are monitored 24/7 for suspicious activity, unauthorized access attempts, and anomalous data flows using automated intrusion detection systems (IDS).
• Penetration Testing: We commission independent third-party penetration tests on our platform infrastructure on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, we will notify affected Users promptly — and in any case within 72 hours of becoming aware of the breach — with details of what data was affected, the likely consequences, and the measures we have taken in response.

10. Your Rights & Choices

As a User of ns38, you hold meaningful rights over your Personal Data. We are committed to honoring these rights promptly and transparently. Depending on applicable data protection law, your rights may include:

• Right of Access: You have the right to request a copy of the Personal Data we hold about you, along with information about how it is being used. We will provide this within 30 days of a verified request.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update most account information directly through your account settings or by contacting our support team.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing was unlawful. Note that we may be required to retain certain data by law (e.g., AML transaction records) even after an erasure request.
• Right to Restriction: You may request that we restrict processing of your Personal Data in certain circumstances — for example, while we investigate a dispute about its accuracy.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including direct marketing. If you object to marketing, we will stop processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without penalty. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

To exercise any of these rights, please contact our Data Privacy team at [email protected] with the subject line "Privacy Rights Request". We will verify your identity before processing any request and will respond within 30 days. Complex requests may take up to 60 days, in which case we will notify you of the extension and the reason.

11. Children's Privacy

ns38 is strictly an adults-only platform. We do not knowingly collect, process, or store Personal Data belonging to any person under the age of 21 years. Our registration process requires all Users to confirm they are 21 or older, and our KYC verification process cross-checks date of birth against submitted identity documents.

If we become aware that Personal Data has been collected from an individual under 21 — whether through a falsified date of birth, a fraudulent document, or any other means — we will immediately suspend the associated account, delete all related Personal Data, and void any transactions associated with that account. If you are a parent or guardian and believe your child has registered an account with ns38, please contact us immediately at [email protected].

12. International Data Transfers

ns38 operates as an internationally licensed platform, and some of our service providers and processors are located outside of Indonesia. As a result, your Personal Data may be transferred to, stored in, or processed in countries other than Indonesia. These countries may have data protection laws that differ from those in Indonesia.

Where such transfers occur, we ensure that appropriate safeguards are in place to protect your Personal Data, including:

• Binding contractual clauses with processors that impose data protection obligations equivalent to those described in this Policy.
• Transfers only to countries or processors that provide an adequate level of data protection, as determined by applicable regulatory standards.
• Regular review of transfer mechanisms to ensure ongoing compliance as international data protection frameworks evolve.

By using ns38 and accepting this Privacy Policy, you acknowledge and consent to the transfer of your Personal Data to countries outside Indonesia where necessary for the delivery of our Services.

13. Changes to This Policy

ns38 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or business operations. We will indicate the date of the most recent revision at the top of this page. For material changes — those that significantly affect your rights or how we use your data — we will provide at least 14 days' advance notice via email or a prominent notice on our platform before the changes take effect.

Your continued use of ns38 after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not agree with the changes, you should cease using our Services and may request account closure and data deletion in accordance with Section 10.

We encourage you to review this Policy periodically to stay informed about how ns38 protects your Personal Data. The most current version of this Policy will always be accessible at https://ns38.cam/privacy-policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your Personal Data, please reach out to our dedicated Data Privacy team through any of the following channels:

• Email: [email protected] (subject line: "Privacy Policy Inquiry")
• WhatsApp: +62 812-3456-7890 (text only, no calls)
• Live Chat: Available 24/7 directly on our website
• Response Time: We aim to respond to all privacy inquiries within 5 business days (Jakarta time, WIB UTC+7).

By using ns38, you confirm that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your Personal Data as described herein.