Privacy Policy

This Privacy Policy describes how jos88 ("we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "Player") who visit or use the Platform at jos88.app, including all associated sub-pages, features, mobile-optimised views, and services offered therein.

Jos88 takes data privacy seriously and operates in accordance with internationally recognised data-protection standards. This policy applies to all personal data collected through:

• Account registration and ongoing account management;
• Identity verification (KYC) processes;
• Deposit and withdrawal transactions processed via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, Bank Danamon, OCBC NISP) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Customer support interactions via live chat and email;
• Your browsing and gaming activity on the Platform;
• Marketing communications, where you have opted in to receive them.

This policy does not apply to third-party websites or services that may be referenced on the Platform. Jos88 is not responsible for the privacy practices of any external party.

Jos88 collects personal data in the following categories, depending on your level of engagement with the Platform:

Jos88 does not intentionally collect Sensitive Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data beyond what is necessary for identity verification, or health data) unless it is directly relevant to a responsible gaming or account security matter and you have provided explicit consent.

Jos88 uses the personal data we collect for the following purposes:

• Account management: To create, maintain, and administer your jos88 account, including processing your login credentials and account preferences.
• Identity verification (KYC): To verify your identity and age (21+) in compliance with our obligations as an internationally licensed gaming operator, and to prevent fraud and underage access.
• Transaction processing: To process deposits and withdrawals via Indonesian banks and e-wallets, reconcile your account balance, and maintain accurate financial records.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance via live chat and email support.
• Platform security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, bonus abuse, money laundering, and other prohibited conduct.
• Legal and regulatory compliance: To fulfil our obligations under applicable AML regulations, gaming licence conditions, and internationally recognised data-protection standards, including retaining records for the mandatory periods required by our licence authority.
• Responsible gaming: To monitor player activity and intervene proactively where our systems identify patterns that may indicate problem gambling behaviour, in line with our Responsible Gaming commitments.
• Platform improvement: To analyse aggregate usage patterns, identify technical issues, test new features, and improve the overall quality and performance of the Platform.
• Marketing communications: To send you promotional offers, bonus notifications, and seasonal campaign messages via email or SMS — only where you have opted in to receive such communications. You may withdraw consent at any time via your account settings or by contacting support.

Jos88 processes your personal data on one or more of the following recognised legal bases:

• Contractual necessity: Processing is required to perform the contract between you and jos88 — specifically, to operate your account, process transactions, and deliver gaming services.
• Legal obligation: Processing is necessary to comply with applicable AML laws, age-verification requirements, gaming licence conditions, and financial record-keeping obligations imposed on jos88 as a licensed operator.
• Legitimate interests: Processing is necessary for the legitimate business interests of jos88, including fraud prevention, platform security, dispute resolution, and service improvement — provided those interests are not overridden by your fundamental privacy rights.
• Consent: For marketing communications, non-essential cookies, and any other processing that is not strictly required to deliver core platform services, jos88 relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Jos88 does not sell, rent, or trade your personal data to any third party. We share your data only in the following limited and controlled circumstances:

• KYC and identity verification partners: Regulated third-party identity verification services that assist us in confirming your identity and age. These partners are contractually prohibited from using your data for any purpose beyond the verification service they provide to jos88.
• Payment processors and banking partners: Indonesian banks (including BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the transactional data necessary to process your deposits and withdrawals. Each payment partner operates under its own privacy framework and applicable Indonesian financial regulations.
• Game software providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive limited technical data (such as a pseudonymous player ID and session token) necessary to deliver game content. These providers do not receive your full identity data.
• Fraud prevention and AML screening services: Third-party compliance tools used to screen transactions and player activity against sanctions lists and fraud databases. All such tools are contractually bound to process data only on our instruction.
• Legal and regulatory authorities: Jos88 will disclose personal data to law enforcement agencies, gaming regulators, financial intelligence units, or courts where required to do so by applicable law, a valid legal process, or a regulatory order. Where permissible, we will notify you of such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the assets of jos88, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any changes to this Privacy Policy that result from it.

Jos88 uses cookies and similar technologies (such as local storage, session tokens, and device fingerprinting) to enable core platform functionality and to monitor platform security. The categories of cookies we use are as follows:

• Strictly necessary cookies: Required for the Platform to function correctly, including maintaining your login session, remembering your account preferences, and enabling secure payment flows. These cookies cannot be disabled without impairing platform functionality.
• Performance and analytics cookies: Used to collect aggregate, anonymised data about how Players navigate and use the Platform. This information helps us identify pages with high error rates, optimise page load speeds, and improve the overall user experience. No individual player is identified through these analytics.
• Security cookies: Used by our fraud-detection systems to identify unusual browsing patterns, detect bot traffic, and protect the Platform against automated attacks and credential-stuffing attempts.

Jos88 does not use third-party advertising cookies, retargeting pixels, or social media tracking tags. You can manage cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies may prevent you from logging in or using certain features of the Platform.

Jos88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, and in compliance with applicable regulatory retention obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of your account's active status on the Platform.
• Post-closure account data: Following account closure, identity data, transaction records, and KYC documentation are retained for a minimum of 5 years in compliance with AML regulations and gaming licence conditions.
• Customer support records: Live chat transcripts and email correspondence are retained for 2 years from the date of the interaction, or longer if related to an open dispute or legal matter.
• Marketing data: If you have opted in to marketing communications, your preferences and contact details for that purpose are retained until you withdraw consent, at which point they are removed from active marketing lists within 30 days.
• Technical and usage data: Anonymised aggregate analytics data may be retained indefinitely for platform improvement purposes. Raw IP address logs are retained for a maximum of 12 months.

When personal data is no longer required and the applicable retention period has expired, it is securely deleted or anonymised using industry-standard data destruction methods.

As a jos88 account holder, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team via live chat or at [email protected]. All verified requests will be responded to within 30 days.

Jos88 will not discriminate against you for exercising any of these rights. We may need to verify your identity before processing a data subject request to ensure we do not disclose personal data to an unauthorised party.

Jos88 operates as an international gaming platform and may transfer your personal data to servers, data centres, or service partners located outside of Indonesia. Where such transfers occur, jos88 takes appropriate steps to ensure that your data receives a comparable level of protection to that provided under internationally recognised data-protection standards.

Safeguards applied to international transfers may include:

• Contractual clauses requiring the recipient to process data only in accordance with our instructions and to maintain equivalent security standards;
• Use of service providers who operate under independently audited data-security certifications (such as ISO 27001 or SOC 2 Type II);
• Pseudonymisation or anonymisation of data prior to transfer, wherever the purposes of the transfer allow.

If you would like further information about the specific safeguards in place for any given international transfer, please contact our support team at [email protected].

The jos88 Platform is strictly intended for adults aged 21 years and older. Jos88 does not knowingly collect, process, or store personal data relating to individuals under the age of 21. Age verification is a mandatory step in the account registration process, and we employ additional KYC checks to confirm that all Players meet the minimum age requirement.

If jos88 becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data and permanently close the associated account. If you have reason to believe that a minor has registered an account on the Platform, please notify our support team immediately at [email protected].

Jos88 implements a layered, defence-in-depth approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme includes:

• Transport Layer Security (TLS 1.3): All data in transit between your browser or device and our servers is encrypted using current industry-standard protocols.
• AES-256 encryption at rest: Sensitive data stored on our systems — including identity documents, payment details, and account credentials — is encrypted using AES-256, widely regarded as the gold standard for symmetric encryption.
• Multi-factor authentication (MFA): Internal administrative access to systems containing personal data requires multi-factor authentication. We encourage all Players to enable available account security features on their own accounts.
• Regular penetration testing: Our infrastructure and application stack are subjected to regular third-party penetration tests and vulnerability assessments to identify and remediate security weaknesses proactively.
• Access control and least privilege: Internal access to personal data is strictly limited to employees and contractors who need it to perform their specific role. All internal data access is logged and audited.
• Incident response: Jos88 maintains a documented data-breach response procedure. In the event of a security incident that poses a risk to your personal data, we will notify affected Players and take all reasonable steps to contain and remediate the breach without undue delay.

Jos88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, regulatory guidance, or Platform features. When material changes are made, we will notify you by displaying a prominent notice on the Platform homepage or by sending an email to the address registered on your account, no less than seven (7) days before the changes take effect.

The "Last updated" date at the top of this document reflects when the current version was published. We recommend that you review this Privacy Policy periodically to stay informed of how jos88 handles your personal data. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

All previous versions of this Privacy Policy are archived and available upon request by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way jos88 handles your personal data, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly through the Platform. Native Indonesian-speaking agents are available on every shift.
• Email: [email protected] — please include "Privacy Request" in your subject line. We aim to respond to all privacy-related enquiries within 5 business days and will complete any data subject request within 30 days of identity verification.

If you are not satisfied with our response to a privacy concern or data subject request, you have the right to escalate your complaint to the relevant supervisory or regulatory authority applicable to our licensing jurisdiction. Details of the appropriate authority will be provided upon request.

Document Version: January 2026. This Privacy Policy supersedes all previous versions. The current version is always available at jos88.app/privacy-policy.