Privacy Policy

1. Introduction

hobi68 ("we", "us", "our") operates the online gaming platform accessible at https://hobi68.cam (the "Platform"). We are the data controller responsible for the personal information you provide to us when registering an account, placing wagers, communicating with our support team, or otherwise interacting with the Platform.

This Privacy Policy has been prepared in accordance with internationally recognised data protection principles, including the concepts enshrined in the General Data Protection Regulation (GDPR) as a global best-practice standard, and with due regard to the data protection framework applicable to operators serving players in Indonesia. By accessing the Platform or creating an account, you acknowledge that you have read, understood, and agreed to the practices described in this Policy.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming page, which together form the complete framework governing your use of hobi68.

2. Definitions

3. Data We Collect

hobi68 collects Personal Data across several categories. We collect only what is necessary for the specific purposes described in Section 5 of this Policy. The categories of data we process are:

3.1 Identity Data

• Full legal name as it appears on your government-issued identity document;
• Date of birth (to verify the 21+ age requirement);
• Nationality and country of residence;
• Indonesian National Identity Card (KTP) number or passport number, collected during KYC verification;
• A photograph or scan of the identity document itself.

3.2 Contact Data

• Email address;
• Indonesian mobile phone number;
• Residential address (city and province level, at minimum).

3.3 Financial Data

• Bank account details (bank name, account number, and account holder name) for BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, and other supported institutions;
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja accounts used for deposits or withdrawals;
• Transaction history, including deposit amounts, withdrawal amounts, dates, and reference numbers;
• Source-of-funds declarations where requested during enhanced due diligence reviews.

3.4 Account & Gameplay Data

• Account username and encrypted password;
• Betting and gaming history, including wager amounts, game types, outcomes, and timestamps;
• Bonus claims, wagering progress, and promotion participation records;
• Responsible gaming preferences, including any deposit limits, loss limits, or self-exclusion periods you have set.

3.5 Technical & Usage Data

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, browser type and version;
• Session duration, pages visited, click-stream data, and feature interaction logs;
• Cookie and tracking technology data as described in Section 10.

3.6 Communications Data

• Content of live chat, WhatsApp, and email communications with our support team;
• Survey responses and feedback submissions;
• Records of any responsible gaming self-assessment tools you complete.

4. How Data Is Collected

We collect Personal Data through the following channels:

• Direct submission: information you provide when registering an account, completing KYC verification, submitting a withdrawal request, or contacting our support team;
• Automated technologies: cookies, session tracking scripts, server access logs, and analytics tools that record your interactions with the Platform automatically when you browse or play;
• Payment processors: confirmation data returned by your bank (BCA, BRI, BNI, Mandiri, etc.) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) following a transaction;
• Third-party identity verification providers: data returned by independent KYC and fraud-screening services that cross-reference the documents you submit;
• Game studios and data feed providers: gameplay outcome data generated by our partner studios (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, Microgaming, and others) when you participate in their games.

5. Purpose & Legal Basis for Processing

Every instance of processing your Personal Data is tied to a documented purpose and a recognised legal basis. The table below maps our principal processing activities:

We do not use your Personal Data for automated decision-making that produces significant legal effects without human oversight, except in cases of immediate fraud or security risk management where automated blocking is necessary to protect the Platform and other users.

6. Data Sharing & Disclosure

6.1 We Do Not Sell Your Data. hobi68 does not sell, rent, or trade your Personal Data to any third party for their independent marketing or commercial purposes. Full stop.

6.2 Service Providers. We share data with carefully selected Data Processors who assist in delivering the Platform's services. All processors operate under written data processing agreements that bind them to confidentiality and restrict their use of your data to the specific services they provide. These include:

• Payment processing partners and banking intermediaries;
• KYC and identity verification service providers;
• Fraud detection and AML screening services;
• Cloud hosting and infrastructure providers;
• Customer support platform providers (live chat and CRM systems);
• Game studios and RNG certification bodies (anonymised game outcome data only).

6.3 Legal Disclosures. We may disclose Personal Data to regulators, law enforcement agencies, or courts where we are required to do so by applicable law, a valid court order, or where disclosure is necessary to protect the rights, property, or safety of hobi68, our players, or the public.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of substantially all of the assets of hobi68, your Personal Data may be transferred to the successor entity. You will be notified of any such transfer and of any material changes to the privacy practices applicable to your data.

6.5 Aggregated & Anonymised Data. We may share aggregated, anonymised statistical data (e.g., "Platform users in Jakarta account for X% of total wagers") with business partners and in public reports. This data cannot be used to identify any individual playe r.

7. International Data Transfers

7.1 Cross-Border Processing. As an internationally operated platform, hobi68 may transfer your Personal Data to servers or service providers located outside of Indonesia. Where such transfers occur, we ensure that appropriate safeguards are in place to maintain a level of data protection consistent with the standards described in this Policy.

7.2 Transfer Safeguards. International transfers of Personal Data are governed by one or more of the following mechanisms:

• Standard contractual clauses approved by recognised data protection authorities, incorporated into our agreements with overseas processors;
• Transfers to jurisdictions that maintain an adequate level of data protection as assessed against internationally recognised benchmarks;
• Binding corporate rules where data is transferred within a group of affiliated entities;
• Your explicit consent, where required and obtained prior to the transfer.

7.3 Your Rights Unaffected. Regardless of where your Personal Data is processed geographically, the rights described in Section 11 of this Policy remain fully available to you. You may exercise those rights at any time by contacting us as described in Section 14.

8. Data Retention

8.1 Retention Principles. hobi68 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. When data is no longer required, it is securely deleted or anonymised in accordance with our internal data lifecycle procedures.

8.2 Retention Schedule. Our standard retention periods are as follows:

8.3 Self-Exclusion Records. Where a player has requested self-exclusion, we retain sufficient data to enforce that exclusion for its full duration and to prevent re-registration during the exclusion period. Permanent self-exclusion records are retained indefinitely for this purpose.

9. Security Measures

9.1 Technical Safeguards. hobi68 implements industry-standard technical security controls to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. These controls include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• AES-256 encryption for Personal Data and financial records stored in our databases;
• Multi-factor authentication requirements for administrative access to systems that hold Personal Data;
• Continuous intrusion detection and prevention systems (IDS/IPS) monitoring our network perimeter;
• Regular third-party penetration testing and vulnerability assessments conducted by independent security firms;
• Segregated network architecture to isolate systems processing financial data from general web-facing infrastructure.

9.2 Organisational Safeguards. Technical controls alone are not sufficient. Our organisational security measures include:

• Role-based access control, ensuring staff members can only access the Personal Data necessary for their specific job function;
• Mandatory data protection training for all personnel with access to Personal Data;
• Binding confidentiality obligations in employment and contractor agreements;
• A documented incident response plan, with procedures for containing breaches, assessing impact, and notifying affected players within 72 hours where required.

9.3 Your Responsibility. The security of your Account also depends on you. You are responsible for keeping your login credentials confidential, using a strong and unique password, and logging out of the Platform when using shared devices. If you suspect unauthorised access to your Account, please contact us immediately at [email protected].

10. Cookies & Tracking Technologies

10.1 What Are Cookies. Cookies are small text files stored on your device when you visit the Platform. They allow us to recognise your browser, remember your preferences, maintain your session, and gather analytics data about how the Platform is used.

10.2 Categories of Cookies We Use.

10.3 Managing Cookies. You can control or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to use the Platform. For detailed guidance on managing cookies in popular browsers (Chrome, Firefox, Safari, Edge), please consult your browser's help documentation.

10.4 Other Tracking Technologies. In addition to cookies, we may use web beacons, pixel tags, and local storage objects for analytics and security purposes. These function similarly to cookies and are subject to the same management controls described above.

11. Your Privacy Rights

As a player on the hobi68 Platform, you hold the following rights in relation to your Personal Data. We will respond to verified requests within 30 days. In complex cases, we may extend this period by a further 30 days, with written notice to you explaining the reason for the delay.

• Right of Access: You may request a copy of all Personal Data we hold about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to overriding legal obligations — for example, we are required to retain KYC and financial records for statutory periods even after account closure.
• Right to Restriction: You may request that we restrict processing of your Personal Data in certain circumstances, such as while a dispute regarding accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you may request your Personal Data in a structured, machine-readable format suitable for transfer to another service provider.
• Right to Object: You may object to processing based on our legitimate interests, including direct marketing communications. Objection to marketing will be honoured immediately and without question.
• Right to Withdraw Consent: Where we rely on your consent as the legal basis for processing (e.g., marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". We may ask you to verify your identity before processing the request to protect against unauthorised disclosure.

12. Minors & Age Verification

12.1 Strict 21+ Policy. The hobi68 Platform is intended exclusively for adults aged 21 years and older. We do not knowingly collect, process, or retain Personal Data belonging to persons under the age of 21. All new accounts are subject to age verification as part of the registration and KYC process.

12.2 Discovery of Underage Account. If we discover or are notified that an Account belongs to a person under 21, we will immediately suspend the Account, void any pending transactions, return deposited funds (less any winnings derived from underage play) to the originating payment method, and permanently delete the Personal Data associated with that Account to the extent permitted by law.

12.3 Parental Controls. If you are a parent or guardian and believe that your child has registered on the hobi68 Platform without your knowledge, please contact us immediately at [email protected]. We will investigate and act promptly. We also recommend using third-party parental control software to restrict access to gambling websites on shared or family devices.

13. Changes to This Privacy Policy

13.1 Right to Update. hobi68 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. The "Last Updated" date at the top of this page will always reflect when the most recent revision took effect.

13.2 Notification of Material Changes. Where a change is material — meaning it significantly affects how we collect, use, or share your Personal Data — we will notify registered players by email at least 14 days before the change takes effect. For non-material updates (such as clarifications of existing language), the revised Policy will be published on this page without prior notice.

13.3 Continued Use as Acceptance. Your continued use of the Platform after any amendment takes effect constitutes your acknowledgment and acceptance of the revised Privacy Policy. If you do not agree with the updated Policy, you should cease using the Platform and request Account closure.

14. Contact & Complaints

14.1 Privacy Enquiries. For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact our dedicated privacy team:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: "Privacy Policy Enquiry" or "Privacy Rights Request"
• Response time: Within 4 business hours for general enquiries; within 30 days for formal rights requests
• Live Chat: Available 24/7 through the Platform interface, with native Indonesian-speaking agents

14.2 Complaints. If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter. We encourage you to contact us first so that we have the opportunity to resolve the issue directly. If we are unable to resolve your complaint to your satisfaction, you may seek independent dispute resolution through an appropriate authority in your jurisdiction.

14.3 Related Policies. For a complete picture of your rights and our obligations as your gaming provider, we encourage you to also review our Terms & Conditions and our Responsible Gaming page.