Privacy Policy

1. Introduction

hero88 is committed to handling your personal data with transparency, proportionality, and care. We operate a platform that primarily serves adult players (21 years and above) resident in Indonesia, and we recognize that trust is the foundation of every meaningful relationship between a gaming platform and its members. This Policy is designed to give you full visibility into our data practices so that you can make informed decisions about using our services.

This Privacy Policy should be read alongside our Terms & Conditions, which govern the contractual relationship between you and hero88. The Terms & Conditions incorporate this Policy by reference, making both documents part of the same binding agreement.

We reserve the right to update this Policy from time to time in response to regulatory changes, new services, or improved data practices. Any material changes will be communicated to registered Players via email to their registered address before the revised Policy takes effect. Your continued use of the platform following such notification constitutes acceptance of the updated terms.

2. Definitions

The following terms carry the meanings set out below wherever they appear in this Policy, whether in singular or plural form.

3. Personal Data We Collect

hero88 collects only the personal data that is necessary and proportionate to deliver our services, meet our compliance obligations, and protect the security of the platform. The categories of data we collect are described below.

3.1 Registration & Account Data

• Full legal name (as it appears on government-issued identification)
• Date of birth (to verify you are 21 years of age or older)
• Email address and Indonesian mobile telephone number
• Username and hashed (encrypted) password credential
• Residential address in Indonesia
• Preferred language and communication preferences

3.2 Identity Verification (KYC) Data

• National Identity Card (KTP) number and scan/photograph
• Passport or driver's license (where provided as an alternative)
• Proof of address documentation (utility bill, bank statement)
• Selfie photographs taken during live identity verification
• Bank account details or e-wallet registration details for payment method verification (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja)

3.3 Financial Transaction Data

• Deposit and withdrawal amounts, dates, and transaction reference numbers
• Payment method identifiers (e.g., last four digits of a bank account)
• Player balance history and transaction logs retained for audit purposes
• Currency: Indonesian Rupiah (IDR / Rp)

3.4 Gaming Activity Data

• Game sessions played, wager amounts, results, and win/loss history
• Bonus offers accepted, wagering progress, and bonus expiry records
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion records)
• Customer support interactions and dispute records

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, browser type and version
• Session timestamps, login history, and authentication events
• Cookies and similar tracking technologies (see Section 11)

4. How We Collect Your Data

hero88 collects personal data through the following channels and mechanisms:

4.1 Directly From You

The majority of personal data we hold is provided directly by you during account registration, KYC verification, deposit and withdrawal requests, customer support interactions, and when you update your account profile. You are under no obligation to provide this data, but without it we are unable to open or maintain your account or process financial transactions on your behalf.

4.2 Automatically During Platform Use

When you access the platform, our servers and analytics systems automatically record technical data including your IP address, browser fingerprint, session duration, pages visited, and the sequence of actions taken within the platform. This data is collected using server logs, cookies, and similar technologies and is used primarily for security monitoring, fraud prevention, and platform performance optimization.

4.3 From Third-Party Verification Partners

Where hero88 engages accredited third-party identity verification or anti-money laundering screening services to assist with KYC compliance, those partners may return verification outcomes, risk scores, and watchlist-screening results to us. These results are held securely alongside your account record and are used solely for compliance purposes.

4.4 From Payment Service Providers

When you initiate a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the payment service provider may share transaction confirmation data with hero88 to reconcile your account balance. We do not receive or store your full bank account credentials; we receive only the information necessary to confirm and record the transaction.

5. Purposes of Processing

hero88 processes your personal data only for defined, legitimate purposes. The table below maps each category of data to its primary processing purpose and the legal basis on which we rely.

6. Legal Basis for Processing

hero88 relies on the following legal bases when processing your personal data. We apply the most appropriate basis for each specific processing activity, as summarized in the table in Section 5.

• Contract Performance: Processing necessary to fulfill our obligations under the Terms & Conditions you agreed to when registering your account — including operating your account, settling wagers, and processing payments.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) screening, age verification, regulatory reporting, and record-retention obligations imposed by our international gaming license.
• Legitimate Interest: Processing that serves a genuine business interest of hero88 which does not override your fundamental privacy rights — such as fraud prevention, platform security, responsible gaming pattern analysis, and analytics that help us improve the platform for all Players.
• Consent: Processing for purposes beyond what is strictly necessary for service delivery, such as sending you promotional offers, bonus notifications, and seasonal campaigns related to events like Idul Fitri, Ramadhan, or Indonesian Independence Day promotions. You may withdraw consent at any time without penalty.

7. Data Sharing & Disclosure

hero88 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data only in the limited circumstances described below, and only to the extent necessary for each stated purpose.

7.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process personal data on our behalf under binding data processing agreements. These include identity verification and KYC platform providers, payment processing gateways, cloud hosting and infrastructure providers, fraud detection and analytics vendors, and customer support software platforms. All processors are required to implement security measures equivalent to those described in Section 10 of this Policy.

7.2 Payment Partners

To process your deposits and withdrawals, hero88 shares the minimum necessary transaction data with the relevant payment service provider — which may include local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) or e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). The data shared is limited to what is required to authorize, execute, and record the transaction. Each payment partner operates under its own privacy policy, which we encourage you to review.

7.3 Game Content Suppliers

Certain game studios integrated within the platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive anonymized or pseudonymized session data necessary to render game content and calculate results. These suppliers do not receive your full name, contact details, or financial data, and are contractually prohibited from using session data for any purpose other than game delivery.

7.4 Regulatory and Law Enforcement Authorities

hero88 will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where we are required to do so by applicable law, court order, or lawful demand. We will, where permitted by law, notify you of any such disclosure request before complying, unless doing so would prejudice a law enforcement investigation or be prohibited by the terms of the demand itself.

7.5 Corporate Transactions

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of hero88's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified by email of any such transfer and of any material change in data-controller identity before the transfer takes effect.

8. International Data Transfers

hero88 operates on a globally distributed infrastructure. Your personal data may therefore be transferred to and stored on servers located outside Indonesia. Where such transfers occur, hero88 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections afforded within Indonesia. These safeguards include contractual data transfer agreements with receiving entities, technical security controls such as encryption in transit and at rest, and access controls that restrict data to authorized personnel only.

Players who have questions about the specific safeguards applied to cross-border transfers of their data are welcome to contact our Data Protection contact at [email protected].

9. Data Retention

hero88 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The following retention periods apply as a general guide:

Once a retention period has elapsed, personal data is securely deleted or anonymized so that it can no longer be associated with any individual. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes.

10. Security Measures

hero88 implements a multi-layered security framework designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to, the following controls:

• TLS/SSL Encryption: All data transmitted between your device and the platform is encrypted using industry-standard TLS 1.2 or higher, preventing interception during transit.
• Encryption at Rest: Sensitive personal data — including KYC documents and financial identifiers — is encrypted at rest using AES-256 encryption on our storage infrastructure.
• Password Hashing: Account passwords are never stored in plaintext. We use a modern, computationally intensive hashing algorithm (bcrypt) with per-user salting to protect credential data.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts for an additional layer of login security.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff with data access privileges undergo regular privacy and security training and are bound by confidentiality obligations.
• Penetration Testing: The platform undergoes regular independent security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: hero88 maintains a documented data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected Players and relevant authorities within the timeframes required by applicable regulations.

11. Cookies & Tracking Technologies

hero88 uses cookies and similar tracking technologies to ensure the platform functions correctly, to keep you logged in between sessions, to remember your preferences, and to gather analytics data that helps us improve the player experience. The types of cookies we use are described below.

11.1 Strictly Necessary Cookies

These cookies are essential for the platform to operate. They manage your authenticated session, maintain your account state during gameplay, and enable core security features such as CSRF protection. You cannot opt out of strictly necessary cookies without ceasing to use the platform.

11.2 Functional Cookies

Functional cookies remember your preferences — such as your chosen language, preferred deposit method, and display settings — so that you do not need to re-enter them each time you visit. These cookies improve convenience and are enabled by default but can be disabled via your browser settings.

11.3 Analytics Cookies

We use analytics cookies to understand how Players interact with the platform — which pages are visited most frequently, where Players encounter friction, and how navigation flows can be improved. Data collected by analytics cookies is aggregated and does not identify individual Players. You may opt out of analytics cookies at any time via your account preferences.

11.4 Managing Cookies

Most browsers allow you to control cookies through their settings, including blocking all third-party cookies or clearing existing cookies. Please note that disabling certain cookies may affect the functionality of the platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

12. Your Data Subject Rights

hero88 respects your rights in relation to the personal data we hold about you. Subject to applicable law and certain regulatory exceptions (for example, where retaining data is required for AML compliance), you have the following rights:

• Access You have the right to request a copy of the personal data we hold about you and to be informed about how it is being processed.
• Rectification You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Erasure You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and where no overriding legal obligation requires its retention.
• Restriction You have the right to request that we restrict processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Portability Where processing is based on your consent or on contract performance, you have the right to receive a structured, machine-readable copy of the personal data you have provided to us.
• Objection You have the right to object to processing carried out on the basis of legitimate interest, including profiling for direct marketing purposes.
• Withdraw Consent Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the rights above, please submit a written request to [email protected] from your registered email address, clearly stating the right you wish to exercise and the data to which your request relates. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days and will notify you accordingly.

13. Minors & Age Restriction

If you are a parent or guardian and believe that a person under 21 years of age has accessed or registered on the platform, please contact us immediately at [email protected] so that we can take prompt corrective action. hero88 takes underage access extremely seriously and cooperates fully with any inquiry from a parent, guardian, or regulatory authority on this matter.

14. Third-Party Services & Links

The hero88 platform integrates with a number of third-party services to deliver a complete gaming experience. These include payment gateways connecting to local Indonesian banks and e-wallets, game content providers, and identity verification partners. While hero88 carefully selects its third-party partners and requires them to uphold strong data protection standards, each third-party service operates under its own privacy policy, which governs how that party collects and uses your data independently of hero88.

hero88 is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any payment provider or service you interact with directly — including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja — to understand how your data is handled on their respective platforms.

Where the platform contains links to external websites or resources, those links are provided purely for informational convenience. hero88 does not endorse, control, or accept responsibility for the content or privacy practices of any external website. Clicking an external link means you are leaving the hero88 platform, and you do so at your own discretion.

15. Changes to This Privacy Policy

hero88 reviews this Privacy Policy periodically and updates it whenever necessary to reflect changes in our data practices, service offerings, or applicable legal and regulatory requirements. The most recent version of this Policy is always published at https://hero88.cam/privacy-policy, with the "Last Updated" date displayed at the top of the page.

Where a proposed change is material — meaning it significantly alters the way we collect, use, or share your personal data — we will notify you by email to your registered address at least 14 days before the change takes effect. For minor clarifications or corrections that do not affect the substance of your rights or our obligations, the updated Policy will take effect immediately upon publication.

Your continued use of the platform after an updated Privacy Policy has taken effect constitutes your acknowledgment and acceptance of the revised terms. If you do not agree with any material change, you are entitled to close your account and withdraw your available balance before the effective date of the change, in accordance with the account closure procedure described in our Terms & Conditions.

16. Contact & Data Protection Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way hero88 handles your personal data, please reach out to our dedicated support and compliance team using the contact details below. All details are presented as plain text; please copy them into your preferred communication application.

• Email: [email protected]
• Live Chat: Available 24/7 via the platform interface
• Response Time: Email responses within 6–12 hours; live chat within 2 minutes
• Support Hours: Around the clock, 24/7, in both Indonesian (Bahasa Indonesia) and English, covering WIB (Western Indonesia Time, UTC+7) and WITA (Central Indonesia Time, UTC+8) zones.