se328 Privacy Policy

se328 ("the Platform", "we", "us", "our") is committed to protecting the privacy of every individual who accesses or uses our online gaming platform at se328.pro. This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which we process that data, the parties with whom we may share it, the security measures we apply, and the rights available to you as a data subject.

This Policy applies to all personal data collected through the se328 website, mobile-browser interface, live chat support system, payment processing flows, and any other channel through which you interact with se328. It should be read together with the se328 Terms & Conditions, which govern your use of the Platform as a whole.

By registering an account or continuing to use se328 after this Policy has been published or updated, you acknowledge that you have read, understood, and agreed to the data processing practices described herein. If you do not agree to this Policy, you must not use the Platform and should contact us to request account closure.

The following terms carry specific meanings throughout this Policy:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, residential address, email address, phone number, IP address, device identifier, financial account details, and transaction records.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" — se328, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — a third-party service provider engaged by se328 to process Personal Data on its behalf, subject to a data processing agreement.
• "Member" / "You" — any natural person who has completed registration on se328 and holds an active account.
• "Sensitive Data" — a subset of Personal Data warranting heightened protection, including financial account details, government-issued identity document numbers, and any health-related information voluntarily provided in the context of responsible gaming requests.
• "Cookies" — small text files stored on your device by the se328 website to enable core functionality, session management, analytics, and personalisation features.
• "KYC" — Know Your Customer verification procedures, encompassing identity verification, address verification, age confirmation, and source-of-funds checks conducted in accordance with applicable compliance obligations.

se328 collects Personal Data across several categories. The table below sets out each category, the specific data points within it, and the primary reason for collection:

We do not collect any Personal Data that is not reasonably necessary for the purposes listed above. We do not collect biometric data, political opinions, religious beliefs, or criminal record information unless specifically required by a regulatory directive applicable to us.

se328 collects Personal Data through the following channels:

• Direct submission: Information you provide when completing the account registration form, submitting KYC documents, making a deposit or withdrawal request, contacting support via live chat or email, or responding to a promotion.
• Automated technical collection: Data gathered automatically when you browse or interact with the Platform, including IP address, device fingerprint, cookie data, and session logs. This data is collected whether or not you are logged in to an account.
• Payment providers: When you initiate a deposit or withdrawal through a local Indonesian bank (such as BCA, BRI, BNI, or Mandiri) or an e-wallet (such as OVO, DANA, or GoPay), our payment processing partners transmit transaction confirmation data to se328, including the originating account reference and transaction amount.
• Third-party identity verification services: During KYC checks, se328 may use certified third-party verification providers to confirm the authenticity of identity documents and cross-reference data against public records. These providers process only the minimum data necessary for the verification task.
• Responsible gaming interactions: If you activate a deposit limit, cooling-off period, or self-exclusion, the details of that request — including the type, scope, and timestamp — are recorded and processed as part of your account record.

se328 processes your Personal Data for the following specific purposes:

1. Account management: To create, maintain, and administer your se328 account, including verifying your identity, managing your balance, and processing your gameplay activity.
2. Payment processing: To facilitate deposits and withdrawals through Indonesian banks and e-wallets, to reconcile transaction records, and to investigate payment disputes.
3. KYC and AML compliance: To verify that you meet the eligibility criteria set out in our Terms & Conditions (including the 21+ age requirement), to confirm your identity, and to detect and prevent money laundering, fraud, and other financial crimes.
4. Security and fraud prevention: To monitor for suspicious account activity, unauthorised access attempts, multi-accounting, bonus abuse, and any other behaviour that may compromise the integrity of the Platform or the safety of other members.
5. Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and maintain records of support interactions for quality assurance purposes.
6. Responsible gaming: To monitor your gaming patterns for indicators of problem gambling behaviour, to enforce self-imposed limits and exclusions you have activated, and to contact you proactively if our monitoring systems identify concern.
7. Service improvement and personalisation: To analyse usage patterns in aggregate and at the individual level in order to improve Platform performance, personalise game recommendations, and tailor promotional offers to your activity profile — subject to your marketing preferences.
8. Marketing communications: To send you information about promotions, bonuses, and new features at se328, where you have given your consent to receive such communications. You may withdraw this consent at any time by contacting support.
9. Legal and regulatory obligations: To comply with applicable laws, regulatory directives, court orders, and law enforcement requests, and to maintain records required by our licensing obligations.

Each processing activity carried out by se328 rests on one or more of the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Member agreement — including account operation, payment processing, and KYC verification — is carried out on the basis that it is necessary for the contract between you and se328.
• Legal obligation: Processing required to comply with applicable AML regulations, licensing conditions, tax reporting requirements, and responses to lawful regulatory or law enforcement requests.
• Legitimate interests: Processing carried out to protect the Platform against fraud and security threats, to monitor for responsible gaming concerns, to improve our services, and to maintain the integrity of the gaming environment — provided that these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for direct marketing communications, and any processing of Sensitive Data beyond what is strictly required for KYC, where we have obtained your explicit prior consent. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

se328 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We may share your data only in the following circumstances and only to the extent strictly necessary:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the transaction data required to execute your deposits and withdrawals. These providers operate under their own privacy policies and are bound by Indonesian banking regulations.
• KYC and identity verification providers: Certified third-party verification services receive identity document images and personal details solely for the purpose of completing the verification check. They are contractually prohibited from using this data for any other purpose.
• Game studios and software providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a pseudonymous player identifier and bet data necessary to operate the game session. They do not receive your full name, contact details, or financial account information.
• Regulatory and law enforcement authorities: Where required by applicable law, a court order, or a lawful request from a regulatory body or law enforcement authority, se328 will disclose Personal Data to the extent mandated. We will notify you of such a disclosure where we are legally permitted to do so.
• Professional advisers: Lawyers, auditors, and compliance consultants engaged by se328 may access Personal Data as strictly necessary to provide their professional services, subject to professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the assets of se328, your Personal Data may be transferred to the successor entity, provided that the successor is bound by data protection obligations no less protective than those in this Policy.

se328 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following standard retention periods apply:

• Account data and KYC documents: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, in accordance with standard AML record-keeping requirements.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial compliance obligations.
• Support communications: Retained for two (2) years from the date of last interaction, or longer where a dispute or regulatory enquiry remains unresolved.
• Technical and usage data: Session logs and IP address records are retained for up to twelve (12) months for security and fraud investigation purposes. Aggregated analytics data, which contains no personally identifiable information, may be retained indefinitely.
• Self-exclusion records: Retained indefinitely to ensure that a self-excluded individual cannot circumvent their exclusion by re-registering. Where a temporary exclusion has expired and the member has not requested permanent exclusion, the record is retained for five (5) years thereafter.

Once the applicable retention period expires and no legal obligation requires further retention, se328 will securely delete or irreversibly anonymise the relevant Personal Data.

se328 applies a layered, defence-in-depth approach to protecting your Personal Data. The technical and organisational measures we maintain include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the se328 Platform, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Encrypted data storage for Sensitive Data at rest, including identity documents, financial account references, and KYC records stored within our infrastructure.
• Access controls and role-based permissions to ensure that only authorised se328 personnel with a legitimate operational need can access identifiable Personal Data. Access is logged and subject to regular audit.
• Multi-factor authentication requirements for all internal administrative access to systems that hold Personal Data.
• Continuous security monitoring including intrusion detection, anomaly alerting, and regular third-party penetration testing of the Platform's infrastructure.
• Data breach response procedures: In the event of a Personal Data breach that poses a risk to your rights and freedoms, se328 will notify the relevant regulatory authority within 72 hours of becoming aware of the breach and will notify affected members without undue delay where required.

While se328 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect any unauthorised access to your account.

se328 uses cookies and similar tracking technologies to deliver core platform functionality and to improve your experience. The categories of cookies we deploy are as follows:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, security tokens, and load-balancing identifiers. You cannot opt out of these cookies while using the Platform.
• Functional cookies: Store your preferences such as language settings and last-visited game category to personalise your experience across sessions.
• Analytics cookies: Collect anonymised or pseudonymised data about how members interact with the Platform — pages visited, session duration, click paths — to help us identify areas for improvement. This data is processed in aggregate and is not used to profile you individually for commercial purposes.
• Security and fraud-detection cookies: Used to detect and prevent fraudulent behaviour, multi-accounting, and bot traffic. These cookies collect device fingerprinting signals and behavioural patterns that are analysed by our fraud prevention systems.

se328 does not deploy third-party advertising or retargeting cookies. We do not use your browsing activity outside of se328.pro to deliver targeted advertising through external ad networks.

Most browsers allow you to control cookie settings through their built-in privacy preferences. Disabling certain categories of cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled without rendering the Platform inoperable.

As a data subject, you hold the following rights in relation to your Personal Data held by se328. To exercise any of these rights, contact us at the details provided in Section 15:

• Right of access: You may request a copy of the Personal Data se328 holds about you, along with information about how it is being processed.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that we correct or complete it.
• Right to erasure: In certain circumstances — for example, where data is no longer necessary for the purpose it was collected — you may request that we delete your Personal Data. Note that this right is subject to overriding legal obligations that require retention (see Section 8).
• Right to restriction of processing: You may request that we pause processing your Personal Data in certain circumstances, for example while a rectification request is under review.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that we provide your Personal Data to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests. se328 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

se328 will respond to all valid rights requests within 30 days of receipt. Complex or high-volume requests may require an extension of up to a further 60 days, in which case we will notify you within the initial 30-day window and provide a reason for the delay.

The se328 Platform is strictly intended for adults aged 21 and over. se328 does not knowingly collect, store, or process Personal Data belonging to individuals under the age of 21. Age verification is a mandatory component of the KYC process for all new members, and accounts found to belong to underage individuals are immediately closed with all deposits returned.

If you are a parent or guardian and believe that a minor has accessed or registered on se328, please contact us immediately at the details provided in Section 15. Upon confirmation, we will promptly close the account, delete all associated Personal Data, and return any deposited funds to the originating payment method.

se328 is primarily focused on serving players in Indonesia, and the majority of data processing takes place within or in connection with jurisdictions that maintain adequate data protection frameworks. In cases where Personal Data is transferred to a third-party Data Processor located outside Indonesia — for example, a certified identity verification provider or a game studio's session management infrastructure — se328 ensures that appropriate safeguards are in place before the transfer occurs.

These safeguards include contractual data processing agreements that impose data protection obligations on the recipient equivalent to those described in this Policy, and — where applicable — adherence to internationally recognised data transfer frameworks. se328 does not transfer Personal Data to any jurisdiction that does not offer an adequate level of protection without first implementing the contractual safeguards described above.

se328 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or operational changes to the Platform. Material changes — those that meaningfully affect your rights or how your data is used — will be communicated to registered members via email at least 7 days before taking effect, and a prominent notice will be displayed on the Platform during that notice period.

Non-material changes (such as clarifications of existing language, corrections of typographical errors, or reorganisation of sections without substantive change) may be made without prior notice, though the updated effective date at the top of this Policy will always reflect the most recent revision. We encourage you to review this Policy periodically.

Your continued use of the se328 Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you object to any changes, you must cease using the Platform and contact us to request account closure before the revised Policy takes effect.

If you wish to exercise any of your data subject rights, raise a concern about how se328 processes your Personal Data, or ask any question about this Privacy Policy, please contact our Data Protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link; reference "Privacy Request" in your subject line)
• Live Chat: Available 24/7 via the support chat widget on the Platform, staffed by Indonesian-speaking agents who can escalate privacy requests to the appropriate team
• Response Time: se328 acknowledges all privacy-related requests within 72 hours and provides a substantive response within 30 days (WIB business hours)