Privacy Policy

sa138 operates Indonesia's premier online casino and sportsbook platform, serving players across Jakarta, Surabaya, Bandung, Medan, Bali, and every other corner of the archipelago. As a platform trusted by hundreds of thousands of Indonesian members, we recognise that the personal data you share with us carries real significance — it enables us to open your account, process your transactions in Indonesian Rupiah, and provide personalised support around the clock.

This Privacy Policy has been drafted to meet internationally recognised data protection standards. We are committed to handling your data with the same care and professionalism you would expect from any globally operating online entertainment brand. In this document, "sa138", "we", "us", and "our" refer to the operators of the sa138 Platform; " you", "your", and "Member" refer to any individual who accesses or uses the sa138 Platform.

If you have any questions about this Privacy Policy or wish to exercise any of your data rights, please contact our dedicated privacy team at [email protected] or via WhatsApp at +62 811 0000 138.

sa138 collects only the personal data that is necessary to deliver, secure, and continuously improve our services. The categories of personal data we collect include:

sa138 collects personal data through the following channels:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion, you directly provide us with personal data.
• Automated technologies: When you browse or use the sa138 Platform, we automatically collect technical and usage data through cookies, web beacons, server logs, and similar tracking technologies (see Clause 7 for full details).
• Third-party sources: We may receive data about you from our KYC verification partners, payment processors (including Indonesian banks and e-wallet providers), fraud detection services, and licensed game studios where relevant to delivering our services.
• Publicly available sources: In limited circumstances — primarily for anti-fraud and AML compliance — we may cross-reference data against publicly available sanctions lists, politically exposed person (PEP) databases, or court records.

sa138 processes your personal data on one or more of the following legal grounds:

The personal data sa138 collects is used exclusively for the purposes set out below. We do not sell your personal data to third parties under any circumstances.

• Account management: Creating, verifying, maintaining, and securing your Member account, including password resets and two-factor authentication.
• Transaction processing: Executing IDR deposits and withdrawals via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja) accurately and without delay.
• KYC & AML compliance: Verifying your identity and payment method ownership as required under our international gaming licence and applicable anti-money laundering standards.
• Gameplay delivery: Personalising your gaming experience across live casino, slots, sportsbook, togel (Indonesia's traditional numbers lottery), and sabung ayam (traditional Indonesian cockfighting) markets.
• Customer support: Responding to account queries, payment disputes, technical issues, and responsible gaming requests through live chat, email, and WhatsApp.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour and enforcing deposit limits, cooling-off periods, and self-exclusions in accordance with our Responsible Gaming policy.
• Fraud and security: Detecting and preventing fraudulent transactions, account takeovers, collusion, bonus abuse, and other forms of prohibited activity on the Platform.
• Marketing (with consent): Sending promotional offers, seasonal campaigns (such as Idul Fitri bonus offers, Independence Day promotions, or Ramadhan specials), and platform news to Members who have opted in to marketing communications.
• Platform analytics: Aggregated, anonymised analysis of Platform usage to improve game offerings, interface design, payment options, and support quality.
• Legal compliance: Retaining records as required by applicable law and responding to lawful requests from regulatory or licensing authorities.

sa138 does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment processors: Your financial data is shared with Indonesian bank payment gateways and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit and withdrawal transactions. These providers operate under their own privacy and security frameworks.
• KYC verification partners: Your identity documents and verification data are transmitted to our regulated KYC partner (subject to data processing agreements) to fulfil our AML obligations.
• Licensed game studios: Technical session data (not your full identity) is shared with licensed game providers — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — to deliver their games through the sa138 Platform.
• Fraud prevention services: Technical and transaction data may be shared with third-party fraud detection platforms to protect you and the integrity of the Platform.
• Regulatory and licensing authorities: We may be required to disclose Member data to our international gaming licence authority, or to respond to legally valid requests from law enforcement or government bodies with jurisdiction over our operations.
• Corporate transactions: In the event of a merger, acquisition, or sale of assets involving sa138, Member data may be transferred to the acquiring entity, subject to equivalent privacy protections.

The sa138 Platform uses cookies and similar technologies to ensure the Platform functions correctly, to remember your preferences, and to provide a more personalised experience. A cookie is a small text file placed on your device when you visit a website.

You can manage or delete cookies at any time through your browser settings. Please note that disabling strictly necessary cookies will affect the functionality of the sa138 Platform and may prevent you from logging in or completing transactions.

sa138 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting obligations.

• Active account data: Retained for the full duration of your membership and for a minimum of 5 years after account closure, in compliance with AML record-keeping requirements under our international gaming licence.
• Transaction records: Financial transaction logs, including IDR deposit and withdrawal histories, are retained for a minimum of 5 years from the date of each transaction.
• KYC documents: Identity verification documents are retained for a minimum of 5 years after the end of the customer relationship, or longer if required by applicable law.
• Support communications: Live chat logs, support emails, and WhatsApp correspondence are retained for up to 3 years from the date of the last interaction.
• Marketing consent records: Records of your consent to (or withdrawal from) marketing communications are retained for 3 years from the date of the most recent consent event.
• Anonymised analytics data: Aggregated, anonymised usage data that cannot be linked back to any individual may be retained indefinitely for product research purposes.

When your personal data is no longer required, sa138 will securely delete or anonymise it in accordance with our internal data destruction procedures.

sa138 has implemented a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction.

• 256-bit SSL/TLS encryption: All data transmitted between your device and the sa138 Platform is encrypted using industry-standard 256-bit SSL/TLS certificates. You will always see HTTPS in your browser address bar when visiting sa138.com.
• Data encryption at rest: Sensitive Member data — including KYC documents and financial identifiers — is encrypted at rest using AES-256 encryption on our secure servers.
• Access controls: Access to Member personal data within sa138's internal systems is strictly role-based. Only personnel who require access to perform their specific job functions are authorised to view Member data, and all such access is logged and auditable.
• Payment data isolation: Full payment credentials (bank account numbers, e-wallet identifiers) are never stored on sa138's own servers beyond the minimum period required. They are processed through PCI-DSS compliant payment channels and tokenised wherever possible.
• Intrusion detection and monitoring: The sa138 Platform is continuously monitored by automated intrusion detection systems. Any suspicious activity triggers an immediate internal security review.
• Staff training: All sa138 personnel with access to personal data undergo regular training on data protection obligations and information security best practices.

As a Member of the sa138 Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please submit a written request to [email protected]. sa138 will respond to all verified data rights requests within 30 days of receipt.

• Right of access: You have the right to request a copy of the personal data sa138 holds about you, along with information about how that data is processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. For identity and KYC data, corrections may require re-submission of verification documents.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected. This right is subject to overriding legal retention obligations — for example, we cannot delete AML-required transaction records during the mandatory retention period.
• Right to restriction: You may request that sa138 restricts processing of your personal data in certain circumstances, such as while a dispute over data accuracy is being resolved.
• Right to data portability: You may request a structured, commonly used, machine-readable copy of the personal data you have directly provided to sa138, in order to transfer it to another service provider.
• Right to object: You have the right to object to processing based on legitimate interests (including profiling) and to withdraw consent for any processing conducted on a consent basis (including marketing communications) at any time.
• Right not to be subject to automated decisions: Where sa138 uses automated processing to make decisions that significantly affect you (for example, automated account suspension on fraud detection), you have the right to request human review of that decision.

The sa138 Platform is strictly intended for adults aged 21 years and over. sa138 does not knowingly collect, process, or retain any personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an account or use the Platform in any way.

If sa138 discovers or is notified that personal data has been collected from an individual under 21 years of age, we will immediately suspend the relevant account, void all associated wagers, and delete the minor's personal data from our systems without delay, subject to any overriding legal obligations.

Parents and guardians in Indonesia who are concerned about minors accessing online gambling platforms are encouraged to use internet filtering tools and parental control software. sa138 actively supports the use of such tools and cooperates with all legitimate requests from guardians to verify or remove a minor's account.

As an internationally licensed online gaming platform, sa138 may transfer your personal data to third-party service providers located outside Indonesia, including KYC verification partners, licensed game studios (such as Pragmatic Play, Evolution Gaming, and Microgaming), and fraud prevention services operating in various jurisdictions.

Whenever personal data is transferred outside Indonesia, sa138 takes the following safeguards to ensure an equivalent level of protection:

• Transfers to recipients in jurisdictions recognised as providing adequate data protection are permitted without additional safeguards.
• Transfers to other jurisdictions are governed by appropriate data processing agreements incorporating standard contractual clauses or equivalent data transfer mechanisms.
• All third-party recipients are required to maintain data security standards at least equivalent to those described in Clause 9 of this Privacy Policy.

You may request further information about the specific safeguards in place for any international transfer of your data by contacting [email protected].

sa138 reserves the right to update or amend this Privacy Policy at any time in response to changes in law, regulation, business practices, or Platform features. When material changes are made, we will update the "Last updated" date at the top of this page and, where reasonably practicable, notify active Members via email or an in-Platform notification prior to the changes taking effect.

Your continued use of the sa138 Platform following the posting of a revised Privacy Policy constitutes your acceptance of the updated terms. We recommend that you review this Privacy Policy periodically to stay informed of how sa138 protects your data. If you disagree with any changes to the Privacy Policy, you may request account closure in accordance with our Terms & Conditions.

For all privacy-related enquiries, data rights requests, or concerns about how sa138 processes your personal data, please reach out to our team through any of the following channels:

• Email: [email protected] — for formal data rights requests, privacy complaints, and KYC queries. We aim to acknowledge all privacy-related emails within 48 hours and provide a substantive response within 30 days.
• WhatsApp: +62 811 0000 138 — for real-time support in English or Indonesian, available 24 hours a day, 7 days a week.
• Live Chat: Available directly on the sa138 Platform once you are logged in — the fastest channel for general queries and account-level support.

Indonesian-speaking support agents are available on every shift. All formal privacy complaints will receive a written acknowledgement and a full response within the timeframe stated above. sa138 is committed to resolving every legitimate data concern promptly and transparently.