Privacy Policy

This Privacy Policy ("Policy") describes how bcl138 ("bcl138", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("Members", "Users", "you") who access or use the bcl138 online gaming platform at bcl138.cam and its associated applications and services. This Policy forms part of and should be read alongside our Terms & Conditions.

By registering an account on bcl138 or by continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and you consent to the collection and use of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the platform and close your account.

Introduction

bcl138 is committed to maintaining the highest standards of data privacy and information security. We recognise that our Members — predominantly English-preference players based across Indonesia, including major cities such as Jakarta, Surabaya, Bandung, Medan, Bali, Semarang, Yogyakarta, and Makassar — entrust us with sensitive personal and financial information. That trust is something we take seriously and protect rigorously.

This Policy is structured to give you a clear and comprehensive understanding of our data practices. We have written it in plain English rather than impenetrable legal jargon, while still maintaining the formal precision expected of a legal document. Where Indonesian terms are relevant to the context — such as payment methods, local banks, or regulatory concepts — we have included them with an English explanation for clarity.

We periodically review and update this Policy to reflect changes in our data practices, applicable law, or the products and services we offer. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of bcl138 following the publication of a revised policy constitutes your acceptance of the updated terms.

Definitions

In this Privacy Policy, the following terms have the meanings set out below:

Data We Collect

bcl138 collects personal data from you in a number of ways: directly through your account registration and use of the platform, automatically through technical tracking mechanisms, and in some cases from third-party sources such as payment providers and fraud-detection services. The categories of data we collect are as follows:

3.1 Registration & Account Data

• Full legal name (as it appears on your government-issued identification)
• Date of birth (for age verification — bcl138 is a 21+ platform)
• Email address and mobile phone number
• Residential address in Indonesia
• Username and hashed password
• Security questions and answers (where applicable)

3.2 Identity Verification (KYC) Data

• Scan or photograph of a valid Indonesian National Identity Card (KTP) or passport
• Proof of address documents (recent utility bill, bank statement, or equivalent)
• Bank account details (account name, number, and provider — BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, or Bank Danamon) or e-wallet account details (OVO, DANA, GoPay, ShopeePay, or LinkAja)
• In high-value cases or where enhanced due diligence is required: source of funds documentation

3.3 Transactional & Gaming Data

• Deposit and withdrawal history, amounts, timestamps, and payment methods used
• Wagering history, game activity, bet selections, and outcomes
• Bonus claims, promotional participation records, and wagering requirement progress
• Account balance history and session logs

3.4 Technical & Device Data

• IP address and approximate geographic location (country, city, and ISP)
• Browser type and version, operating system, device type, screen resolution
• Session timestamps, page navigation paths, and feature usage patterns
• Cookie identifiers and similar tracking technologies (see Section 7)

3.5 Communications Data

• Records of live chat conversations with our support team
• Email correspondence submitted to [email protected]
• Formal complaints and dispute records
• Responsible gaming self-exclusion and limit requests

How We Use Your Data

bcl138 uses your personal data for the following specific purposes:

Legal Basis for Processing

bcl138 processes your personal data on one or more of the following legal bases, depending on the specific purpose for which the data is being used:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to at registration — including account creation, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable KYC, AML, and fraud-prevention regulations that govern internationally operating online gaming platforms.
• Legitimate Interests: Processing that serves bcl138's legitimate business interests — such as fraud detection, platform security, and service analytics — provided those interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — most commonly for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Data Sharing & Disclosure

bcl138 does not sell, rent, or otherwise commercially disclose your personal data to third parties. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for each stated purpose:

6.1 Payment Processors & Financial Institutions

To facilitate deposits and withdrawals, we share relevant transactional and identity data with your chosen Indonesian payment provider. This may include banks such as BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, and Bank Danamon, as well as e-wallet services including OVO, DANA, GoPay, ShopeePay, and LinkAja. These entities process your data solely to complete the requested transaction and are bound by their own regulatory obligations regarding data security.

6.2 Technology & Platform Service Providers

We engage third-party technology providers for services including cloud hosting, cybersecurity monitoring, fraud detection, game content delivery (such as Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, and Microgaming), and customer support software. These providers act as data processors under written agreements and are prohibited from using your data for any purpose beyond the specific service they provide to bcl138.

6.3 Law Enforcement & Regulatory Authorities

bcl138 may disclose personal data to law enforcement agencies, regulators, or other government bodies when required to do so by a valid legal order, court directive, or where disclosure is necessary to prevent imminent harm, investigate fraud, or cooperate with an anti-money laundering investigation. Where permitted by law, we will notify the affected Member of such a disclosure.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of bcl138's business, personal data held by bcl138 may be transferred to the acquiring entity as part of that transaction. Members will be notified via email and through a prominent notice on the platform in advance of any such transfer, and the acquiring entity will be bound by terms no less protective than those described in this Policy.

Cookies & Tracking Technologies

bcl138 uses cookies and similar tracking technologies (such as local storage, session storage, and pixel tags) to operate the platform effectively, remember your preferences, and understand how Members interact with the site. The cookies we deploy fall into the following categories:

Most web browsers allow you to control cookie behaviour through their settings. You can choose to block or delete cookies at any time. Please note that disabling non-essential cookies will not affect the storage or transmission of your personal data in other ways — it will only limit certain platform convenience features. Detailed instructions for managing cookies in your specific browser are available in your browser's help documentation.

Data Retention

bcl138 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The following retention schedule provides general guidance:

• Active Account Data: Retained for the duration of your membership and for a minimum of five (5) years after account closure, to satisfy KYC and AML record-keeping requirements.
• Transaction Records: Deposit, withdrawal, and wagering records are retained for a minimum of five (5) years from the date of each transaction.
• KYC Documents: Identity and address verification documents are retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Support Communications: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction.
• Marketing Consent Records: Records of consent given or withdrawn for marketing communications are retained for three (3) years from the date of the last consent action.
• Technical Logs: Server access logs and session data are retained for up to twelve (12) months before being automatically purged or anonymised.

When data is no longer required for any of the above purposes, bcl138 will securely delete or permanently anonymise it so that it can no longer be linked to any individual Member. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

Data Security

bcl138 implements a comprehensive set of technical, organisational, and procedural security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes, but is not limited to, the following controls:

• Encryption in Transit: All data transmitted between your browser or device and bcl138's servers is protected by 256-bit TLS (Transport Layer Security) encryption. The bcl138.cam domain operates exclusively over HTTPS.
• Encryption at Rest: Personal data and financial records stored in our databases are encrypted using AES-256, an industry-standard symmetric encryption algorithm. Encryption keys are managed separately from the encrypted data.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All internal staff with data access privileges are subject to confidentiality agreements and undergo regular data-protection training.
• Multi-Factor Authentication (MFA): All administrative access to bcl138's internal systems requires multi-factor authentication. We strongly recommend Members enable available two-step verification features on their accounts.
• Penetration Testing & Audits: bcl138 engages independent cybersecurity specialists to conduct regular penetration tests and security audits of our platform infrastructure.
• Incident Response: In the event of a confirmed data breach that is likely to result in a risk to the rights and freedoms of affected Members, bcl138 will notify impacted users without undue delay and take immediate remedial action to contain the breach and prevent recurrence.

International Data Transfers

bcl138 is an internationally operated platform. As a result, your personal data may be transferred to, stored in, or processed in countries other than Indonesia — including countries where data protection laws may differ from those applicable in your home jurisdiction.

Where such international transfers occur, bcl138 takes appropriate safeguards to ensure that your personal data continues to be protected to a standard consistent with this Privacy Policy. These safeguards may include:

• Entering into standard contractual clauses with the recipient entity that impose data protection obligations equivalent to those described in this Policy.
• Transferring data only to countries or organisations that have been assessed as providing an adequate level of data protection.
• Applying additional technical safeguards such as end-to-end encryption for cross-border data flows.

By using bcl138 and providing your personal data, you acknowledge and consent to the international transfer of your data as described in this section, subject to the protections described above.

Your Rights

As a Member of bcl138, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team via live chat on the platform or by emailing [email protected] (plain text — not a clickable link). bcl138 will respond to all verified rights requests within 30 calendar days.

bcl138 may request proof of identity before processing a data rights request, to ensure the security and privacy of Member data. We will not charge a fee for routine rights requests; however, manifestly unfounded or excessive requests may attract a reasonable administrative fee.

Children & Minors

bcl138 is strictly an adult platform. The minimum age for registration and use of all bcl138 services is 21 years of age. We do not knowingly collect personal data from any person under the age of 21.

If bcl138 discovers or is notified that personal data has been collected from a person under 21, we will immediately suspend the associated account, delete all personal data collected from that individual, and where appropriate, notify the relevant authorities. Parents or guardians who believe that a minor may have registered an account on bcl138 should contact us immediately at [email protected] (plain text — not a clickable link).

Changes to This Policy

bcl138 reserves the right to modify or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory guidance, or the products and services we provide. All revisions will be published on this page with an updated "Last Updated" date.

Where changes are material — meaning they significantly affect your rights or the way we use your personal data — we will notify you proactively via email to the address registered on your account and via a prominent notice on the platform upon your next login. The notification will clearly describe the nature of the changes and the date on which they take effect.

Your continued use of bcl138 after the effective date of any revised Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the platform and close your account before the changes take effect.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 11, or wish to raise a complaint about bcl138's data practices, please contact us through the following channels. All privacy-related correspondence is handled by our dedicated data protection team.

• Live Chat: Available 24/7 directly within the bcl138 platform. Fastest response channel — average first response under 1 minute.
• Email: [email protected] — please use the subject line "Privacy Request — [Your Username]" for data rights requests, or "Privacy Complaint — [Your Username]" for complaints.

bcl138 will acknowledge receipt of all privacy-related requests within 48 hours and will aim to provide a substantive response within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by an additional 30 days, in which case we will notify you of the extension and the reason for the delay.

If you are not satisfied with bcl138's handling of your privacy complaint after following our internal process, you have the right to escalate your complaint to an appropriate supervisory authority or to pursue the matter through applicable dispute resolution channels as outlined in the Terms & Conditions.