Privacy Policy — rafa88

rafa88 is an internationally licensed online gaming and sports betting platform serving players across Indonesia and other eligible markets. We understand that the personal data you share with us — from your name and date of birth through to your banking details and betting history — is sensitive. We take our obligations as a data controller seriously.

This Policy has been written to be clear and direct. We have deliberately avoided impenetrable legal language where plain English serves equally well. Where legal terminology is unavoidable, we explain it. Our aim is for every Member to understand what happens to their data and to feel confident that rafa88 handles it with integrity.

If you have any questions about this Policy that are not answered below, please contact our Data Privacy team directly at [email protected]. We aim to respond to all privacy enquiries within 5 business days (WIB).

rafa88 collects the following categories of personal data, grouped by the context in which they arise:

3.1 Registration Data

• Full legal name (as it appears on your government-issued ID)
• Date of birth
• Email address
• Country and city of residence (e.g., Jakarta, Surabaya, Bandung, Bali)
• Mobile phone number
• Username and hashed account password

3.2 KYC & Verification Data

• Photograph of government-issued photo ID (KTP Nasional or passport)
• Selfie photograph taken at the time of submission
• Proof of residential address (utility bill, bank statement, or official letter)
• Payment method ownership confirmation documents where required

3.3 Financial & Transaction Data

• Bank account numbers and account holder names (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Deposit and withdrawal transaction records including amounts (IDR), dates, and payment references
• Wagering history — bets placed, markets selected, outcomes, and account balance changes

3.4 Technical & Device Data

• IP address and geolocation (country/city level)
• Device type, operating system, and browser version
• Session timestamps and page interaction logs
• Cookies and similar tracking technologies (see Section 8)

3.5 Communications Data

• Live chat transcripts and email correspondence with the rafa88 support team
• WhatsApp message records where the Member has initiated contact via that channel
• Feedback, complaints, and dispute records

rafa88 collects personal data through the following channels:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or participate in a promotional offer.
• Automatically through your use of the Platform: Technical data (IP address, device fingerprint, session logs) is captured automatically by our web infrastructure when you access any page of rafa88.
• From payment providers: When a deposit or withdrawal is processed via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, or ShopeePay, the payment provider shares transaction confirmation data with rafa88 to credit or debit your account balance.
• From KYC verification partners: Third-party identity verification services may return a verification result and risk score to rafa88 following document submission. They do not retain copies of your documents beyond their contractual processing period.
• From fraud detection and AML screening systems: Automated screening tools may match your registration data against publicly available watchlists and sanctions databases as part of our regulatory compliance obligations.

rafa88 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

rafa88 uses the personal data we hold about you for the following specific purposes:

• Account administration: Creating and maintaining your Member account, authenticating your identity on login, and managing account settings and preferences.
• KYC & compliance: Verifying your age (21+ requirement), identity, and residential address as required by our licensing conditions and international AML standards.
• Payment processing: Executing deposit credits and withdrawal payments to your verified Indonesian bank account (BCA, BRI, BNI, Mandiri, or others) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Customer support: Responding to enquiries, resolving disputes, investigating complaints, and providing live chat assistance around the clock.
• Fraud prevention & security: Detecting unauthorized access, unusual betting patterns, multi-accounting, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: Monitoring for problem gambling indicators and reaching out proactively to Members whose activity patterns may suggest that intervention support would be beneficial.
• Platform improvement: Analyzing anonymized usage data to improve site performance, navigation, game selection, and the overall Member experience.
• Marketing communications (consent-based): Sending promotional offers, bonus notifications, and seasonal campaigns — such as those tied to Idul Fitri, Ramadhan, or major football events like BRI Liga 1 or the Champions League — to Members who have opted in to receive them.
• Legal & regulatory reporting: Fulfilling statutory reporting obligations, responding to lawful requests from competent authorities, and maintaining records as required by applicable law.

rafa88 does not sell, rent, or trade your personal data. We share personal data only where strictly necessary, with the following categories of recipients:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data required to process your transactions — typically your account identifier and transaction amount.
• KYC & identity verification partners: Specialist third-party verification services receive your KYC documents solely for the purpose of identity validation. These partners operate under binding data processing agreements and are prohibited from using your data for any other purpose.
• Fraud detection & AML screening services: Automated compliance tools may process your name, date of birth, and nationality against sanctions lists and politically exposed person (PEP) databases as required by our AML obligations.
• Cloud infrastructure & hosting providers: Our platform data is hosted on secure cloud infrastructure. Hosting providers act as data processors under contract and do not have independent access to Member data.
• Legal & regulatory authorities: rafa88 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction when required to do so by a valid legal order, court warrant, or equivalent regulatory directive.
• Professional advisors: Lawyers, auditors, and insurers may access data on a strictly need-to-know basis and are bound by professional confidentiality obligations.

In the event of a merger, acquisition, or sale of all or part of rafa88's business, Member data may be transferred to the acquiring entity as part of that transaction. You will be notified by email if such a transfer affects the way your data is processed.

rafa88 uses cookies and similar tracking technologies on its website. The following categories of cookies are in use:

rafa88 does not deploy third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. You may manage optional cookie preferences through your browser settings. Please note that disabling functional cookies may affect your experience on the platform.

rafa88 applies a layered security architecture to protect your personal data against unauthorized access, loss, alteration, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers.
• AES-256 encryption at rest for all stored KYC documents, financial records, and sensitive account data.
• Two-factor authentication (2FA) available to all Members and mandatory for all administrative accounts.
• Role-based access controls ensuring that rafa88 staff can only access Member data to the extent required by their specific job function.
• 24/7 intrusion detection monitoring with automated alerting for anomalous access patterns.
• Regular third-party penetration testing and security audits conducted by independent cybersecurity specialists.
• Secure data centers with physical access controls, redundant power systems, and fire suppression infrastructure.

While rafa88 employs industry-leading security practices, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a risk to Member rights and freedoms, rafa88 will notify affected Members by email without undue delay and will take all reasonably practicable steps to contain and remediate the breach.

rafa88 retains your personal data for as long as your account is active and for the periods required by applicable regulatory and legal obligations after account closure. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymized so that it can no longer be associated with any identifiable individual.

As a Member of rafa88, you have the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 3 business days and provide a substantive response within 30 days.

Where your request relates to data that rafa88 is legally required to retain (for example, KYC documents or financial transaction records subject to AML retention periods), we will explain the legal basis for continued retention while fulfilling all other aspects of your request.

rafa88 operates globally and your personal data may be processed on servers located outside of Indonesia. Where personal data is transferred to countries that do not provide a level of data protection equivalent to international standards, rafa88 implements appropriate safeguards to ensure that your data remains protected. These safeguards include:

• Standard contractual clauses (SCCs) incorporated into agreements with all Data Processors located outside of Indonesia.
• Binding corporate rules for intra-group data transfers where applicable.
• Transfer impact assessments conducted prior to any new cross-border data sharing arrangement to evaluate the legal environment in the destination country.

By using rafa88 and accepting this Policy, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia as described in this section, subject to the safeguards described above.

rafa88 is strictly an adults-only platform. We do not knowingly collect personal data from any individual under the age of 21. Our registration process includes a mandatory date-of-birth declaration, and KYC verification is required before any financial transaction is processed.

If rafa88 becomes aware that personal data has been collected from a person under 21 years of age, we will immediately close the associated account, void any wagers placed, and delete the personal data collected, subject to any statutory retention obligations. Any deposits made will be returned to the source payment method to the extent technically feasible.

The rafa88 platform may contain references to third-party services such as payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay) or game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, Spribe). While we take care in selecting our partners, rafa88 has no control over the privacy practices of third-party websites or applications that you may access independently.

This Privacy Policy applies solely to data processed by rafa88. We encourage you to review the privacy policies of any third-party service you use in connection with your membership, particularly your chosen payment provider. rafa88 accepts no responsibility for the privacy practices of third parties.

rafa88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Material changes — those that significantly affect how we use your data or the rights you hold — will be communicated to Members by email to their registered address at least 14 days before the change takes effect.

The "Last Updated" date displayed at the top of this page reflects the most recent revision. Where we make non-material clarifications or administrative corrections, we may update the Policy without issuing individual notifications, though the revision date will always be updated.

Your continued use of rafa88 after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with any amendment, please contact us to discuss your options, including account closure and data deletion.

For all privacy-related enquiries, data rights requests, or complaints about how rafa88 handles your personal data, please contact our Data Privacy team using the details below:

• Email: [email protected] — use subject line "Privacy Enquiry" or "Data Rights Request" for fastest routing.
• Live Chat: Available 24/7 in the Member dashboard — our agents can escalate privacy matters to the Data Privacy team on your behalf.
• Response Time: We acknowledge all privacy enquiries within 3 business days (WIB) and aim to provide a full substantive response within 30 calendar days.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. rafa88 will cooperate fully with any investigation conducted by a competent supervisory authority.