Privacy Policy

This Privacy Policy ("Policy") is published by wow388 ("Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://wow388.cam ("Platform"). This Policy governs the collection, use, storage, sharing, and protection of personal data relating to all individuals ("Users", "Players", "you") who access or use the Platform, regardless of their device or geographic location.

wow388 primarily serves players based in Indonesia and therefore gives particular consideration to the data-protection expectations of Indonesian residents. Our Platform and all natural-language content are presented in English; however, our data-handling practices are designed to meet internationally recognised privacy standards applicable to the jurisdictions in which we hold our gaming licences.

This Policy should be read alongside our Terms & Conditions, which form the complete agreement governing your use of the Platform. By registering an Account or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood how we process your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

This Policy covers data collected through: (a) the wow388 website and all subdomain pages; (b) live-chat and email communications with our support team; (c) payment and identity-verification processes; and (d) automated technical systems such as cookies and server logs. It does not cover data practices of third-party websites linked from the Platform — those third parties operate their own independent privacy policies for which wow388 bears no responsibility.

For the purposes of this Policy, the following terms have the meanings assigned below:

wow388 collects the following categories of Personal Data, limited to what is necessary for the purposes described in Clause 5:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric data (beyond what is inherent in KTP-based facial verification), or health data, except where you voluntarily disclose health-related information in the context of a responsible-gaming self-exclusion request, in which case such data is processed solely for the purpose of activating and maintaining protective account restrictions.

wow388 collects Personal Data through the following channels and mechanisms:

1. Direct Submission: Data you provide voluntarily when registering an Account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or responding to a promotional survey.
2. Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device fingerprint, browser metadata, pages visited, time on page, and session duration. This data is collected via server logs, cookies, and similar tracking technologies described in Clause 10.
3. Payment Processors: Transaction confirmation data received from our payment partners when you deposit via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, Bank Danamon, OCBC NISP) or e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja). Payment processors do not share your full card or bank credentials with us — we receive only the transaction reference, amount, and status.
4. KYC Verification Partners: Confirmation data and fraud-risk signals returned by third-party identity-verification services we engage to validate KTP documents and selfie photographs. These partners process your documents under strict data-processing agreements with wow388.
5. Anti-Fraud & AML Systems: Behavioural signals generated by automated monitoring tools that analyse betting patterns, deposit velocity, and device characteristics for the purpose of detecting money laundering, bonus abuse, and account fraud.
6. Publicly Available Sources: In limited circumstances, our Compliance team may reference publicly available information (such as sanctions lists or court records) to verify that a User is not subject to any legal restriction that would prevent them from using the Platform.

We process your Personal Data only for the specific, legitimate purposes listed below. We do not use your data for any purpose incompatible with those for which it was originally collected without first obtaining your explicit consent:

For each processing activity described in Clause 5, wow388 relies on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions, including account creation, payment processing, bet settlement, and KYC verification.
• Legal Obligation: Processing required to comply with applicable laws and our gaming licence conditions, including AML record-keeping, sanctions screening, and responding to lawful requests from competent authorities.
• Legitimate Interests: Processing for fraud prevention, platform security, IT infrastructure management, and aggregated analytics, where our legitimate business interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications and non-essential cookies, where you have given a clear, freely provided, specific, and informed opt-in. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

wow388 does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. We share your data only in the following strictly controlled circumstances:

1. Payment Service Providers: We share the minimum necessary financial data with Indonesian bank partners and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) to execute deposits and withdrawals. These providers are contractually prohibited from using your data for any purpose beyond the payment transaction.
2. KYC & Identity Verification Partners: We transmit your KYC documents to licensed identity-verification service providers under data-processing agreements. These partners validate document authenticity and return a verification result to wow388; they do not retain your documents beyond their stated processing window.
3. Anti-Fraud Technology Providers: Anonymised or pseudonymised device and behavioural data may be shared with fraud-detection technology partners to identify patterns consistent with prohibited conduct. Full identity data is not shared for this purpose.
4. Legal and Regulatory Authorities: We will disclose Personal Data to law-enforcement agencies, regulatory bodies, or courts of competent jurisdiction when required to do so by a legally valid order, warrant, or statutory obligation. Where permitted by law, we will notify affected Users of such disclosures.
5. Corporate Transactions: In the event of a merger, acquisition, or sale of all or a material portion of the Company's assets, your Personal Data may be transferred to the acquiring entity, provided that entity agrees to be bound by this Policy or a substantially equivalent privacy standard. You will be notified of such a transfer in advance where practicable.
6. Professional Advisors: We may share limited Personal Data with external legal counsel, auditors, or compliance consultants under strict confidentiality obligations, where necessary to obtain professional advice or conduct audits of our operations.

wow388 operates servers and engages service providers located in multiple jurisdictions. As a result, your Personal Data may be transferred to and processed in countries outside Indonesia. Whenever such transfers occur, we take steps to ensure that your data receives a level of protection equivalent to the standards described in this Policy, including:

• Executing standard contractual clauses or data-processing agreements with all recipient entities that impose binding data-protection obligations consistent with internationally recognised frameworks.
• Engaging only service providers that maintain recognised security certifications (such as ISO/IEC 27001) or operate under equivalent data-protection regimes.
• Applying technical safeguards — including encryption in transit and at rest — to all cross-border data transfers, ensuring that data cannot be intercepted or accessed by unauthorised parties during transmission.

By using the Platform, you acknowledge that your Personal Data may be transferred internationally as described above. If you have concerns about cross-border data transfers, please contact our DPO using the details in Clause 15.

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised so that it can no longer be associated with an identified individual. Where deletion is requested by a User prior to the expiry of a mandatory retention period, we will restrict active processing of the data while retaining it in archive form solely to meet the applicable legal obligation.

The wow388 Platform uses cookies and similar technologies to deliver a functional, personalised, and secure experience. The following categories of cookies are in use:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session-authentication tokens, anti-CSRF tokens, and load-balancing cookies. They cannot be disabled without significantly impairing Platform functionality. No consent is required for these cookies.
• Functional Cookies: Used to remember your preferences, such as your default time-zone display (WIB/WITA/WIT) and preferred odds format. These persist across sessions and improve your experience on return visits.
• Analytics Cookies: Used to collect aggregated data about how Users navigate the Platform — which pages attract the most visits, where users exit, and how long sessions last. This data is used to improve Platform design and content. Analytics data is processed in aggregate form and is not linked to individual identities.
• Anti-Fraud & Security Cookies: Used by our fraud-detection systems to identify devices and flag anomalous behaviour patterns. These cookies help protect your Account against unauthorised access and abuse.

You can manage cookie preferences through your browser settings. Disabling functional or analytics cookies will not prevent you from using the Platform but may limit certain personalisation features. Strictly necessary and security cookies cannot be disabled via browser settings without preventing Platform access.

wow388 implements a layered security architecture designed to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. Our technical and organisational safeguards include:

1. Encryption in Transit: All data transmitted between your device and the wow388 servers is protected by TLS 1.2 or higher (256-bit SSL encryption). The Platform enforces HTTPS across all pages; non-secure connections are automatically redirected.
2. Encryption at Rest: Sensitive data fields — including KYC document files, bank account details, and password hashes — are encrypted at rest using AES-256 or equivalent standards on all storage media.
3. Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. Staff members are granted only the minimum permissions required for their role. All access to production data systems is logged and audited.
4. Network Security: The Platform is protected by enterprise-grade firewalls, intrusion-detection systems (IDS), and regular vulnerability scanning. Distributed denial-of-service (DDoS) mitigation is applied at the network perimeter.
5. Secure Development Practices: Our engineering team follows security-first development practices including code review, penetration testing, and dependency auditing to minimise the risk of software vulnerabilities.
6. Staff Training: All employees with access to Personal Data receive mandatory data-protection and security-awareness training on a regular basis. Personnel handling KYC documents are subject to enhanced background screening.
7. Incident Response: In the event of a confirmed data breach affecting your Personal Data, wow388 will notify affected Users within 72 hours of becoming aware of the breach, consistent with internationally recognised breach-notification standards, and will take immediate remediation steps.

Despite these measures, no online platform can guarantee absolute security. We strongly recommend that you use a strong, unique password for your wow388 Account, enable any available two-factor authentication, and never share your login credentials with any third party.

As a User of the wow388 Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact our DPO using the details in Clause 15. We will respond to all valid requests within 30 days:

Please note that exercising certain rights — particularly erasure and restriction — may affect your ability to continue using the Platform. Where data is required to operate your Account or meet our legal obligations, we will explain this to you before taking any action on your request.

The wow388 Platform is strictly intended for adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. Our registration process includes age-declaration requirements and is backed by mandatory KYC verification designed to identify and prevent underage access.

If we discover or have reasonable grounds to believe that an Account has been created by or on behalf of a person under 21 years of age, we will immediately: (a) suspend the Account; (b) initiate an age-verification review; (c) withhold any balance pending the outcome of the review; and (d) permanently close the Account and return any confirmed real-money deposits to the originating payment method upon confirmation of underage registration, with all winnings forfeited.

Parents and guardians who believe their child may have accessed the Platform are urged to contact our DPO at [email protected] (plain text — not a clickable link) immediately. We will treat all such reports as a priority and respond within 24 hours.

wow388 reserves the right to amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable laws, or business operations. Where amendments are material and affect your rights or the ways in which we use your data, we will provide reasonable advance notice by one or more of the following methods:

• Posting a prominent notification on the Platform homepage for a minimum period of 14 days before the change takes effect;
• Sending an email to the address registered on your Account with a summary of the key changes;
• Displaying an in-platform pop-up or banner notification upon your next login following publication of the amended Policy.

Non-material changes — such as typographical corrections, clarifications that do not alter the substance of our commitments, or updates to contact details — may be made without advance notice. In all cases, the "Last Updated" date at the top of this Policy will be revised to reflect the date of the most recent amendment.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the amended terms, you must cease using the Platform and may request Account closure and data deletion by contacting our DPO, subject to our mandatory retention obligations described in Clause 9.

If you have any questions about this Privacy Policy, wish to exercise any of your data-subject rights, or have a concern about how your Personal Data has been handled, please contact our Data Protection Officer using the following contact details. All contact information is provided as plain text — please do not attempt to click as hyperlinks:

• Data Protection Officer Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data-Rights Requests: "Privacy Request — [Your Name] — [Request Type: Access / Rectification / Erasure / etc.]"
• Response Time: We aim to respond to all data-protection enquiries within 5 business days and to fully resolve valid requests within 30 days.
• Escalation: If you are not satisfied with our response or believe we have not adequately addressed your concern, you have the right to lodge a complaint with the data-protection supervisory authority in the jurisdiction where you reside.

When contacting our DPO, please include sufficient detail to allow us to identify your Account and understand the nature of your request. For security purposes, we may require you to verify your identity by providing the email address and date of birth registered on your Account, or by responding to a verification email sent to your registered address.