Privacy Policy — coy88

coy88 ("we", "us", "our") operates the online sports betting and casino platform accessible at https://coy88.app (the "Platform"). This Privacy Policy describes how coy88 collects, processes, stores, discloses, and protects personal data submitted by or collected from individuals who access or use the Platform ("you", "Member", "User").

This Privacy Policy applies to all products and services offered through the Platform, including but not limited to sports betting (including mix parlay accumulator markets and bandar bola — Indonesia's informal football-betting tradition), live casino, slot games, fish shooting arcade, virtual sports, and togel (Indonesia's traditional numbers lottery) draw markets.

By registering for an Account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and you consent to the data practices described herein. If you do not agree with any part of this policy, you should discontinue use of the Platform immediately and contact us to close your Account.

coy88 acts as the data controller for all personal data processed in connection with your Account and use of the Platform. As data controller, coy88 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.

coy88 is an internationally licensed and regulated online gaming operator. Our platform is designed and maintained to meet internationally recognised data protection standards, including data minimisation, purpose limitation, storage limitation, and integrity and confidentiality principles.

For all data-related inquiries, requests, or complaints, you may contact our Data Protection team directly at: support @ coy88.app — clearly marking your communication "Privacy / Data Request" in the subject line. We acknowledge all privacy requests within 24 hours and issue a substantive written response within 30 calendar days.

coy88 collects personal data only to the extent necessary for the purposes described in Section 4 of this policy. The categories of personal data we collect are as follows:

3.1 Registration and Identity Data

• Full legal name as it appears on your government-issued ID;
• Date of birth (used to verify that you are at least 21 years of age);
• Valid Indonesian mobile number;
• Email address;
• Username and password (stored as a hashed value — never in plain text).

3.2 KYC Verification Data

• Scanned or photographed copy of your Indonesian National Identity Card (KTP), passport, or driving licence (SIM);
• Proof of residential address dated within the last 3 months (e.g., a bank statement from BCA, BRI, BNI, Mandiri, or a utility bill);
• Source-of-funds documentation where required by our compliance obligations;
• Facial selfie or liveness check image, where applicable for enhanced verification.

3.3 Financial and Transaction Data

• Bank account details for Indonesian bank transfers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata);
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Deposit and withdrawal history, amounts, dates, and reference numbers;
• Wagering history, including stakes, markets selected, and settlement outcomes.

3.4 Technical and Usage Data

• IP address and approximate geographic location (city and region level — not GPS coordinates);
• Device type, operating system, and browser version;
• Pages visited, features used, session duration, and click-stream data;
• Cookie identifiers and similar tracking technologies (see Section 9).

3.5 Communications Data

• Records of live chat conversations, WhatsApp messages, and emails exchanged with our support team;
• Responses to promotional communications, bonus offers, and surveys where you choose to participate.

coy88 processes your personal data on the following lawful bases and for the following purposes:

Where coy88 relies on your consent as the lawful basis for processing (e.g., sending promotional email or WhatsApp messages), you have the right to withdraw that consent at any time by contacting our support team or using the unsubscribe mechanism in any promotional communication. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal.

coy88 does not sell, rent, or trade your personal data to third parties for their own commercial use. We may share your data with carefully selected third parties only in the following limited circumstances:

• Licensed Game Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive minimal technical data (session tokens, bet parameters) necessary to operate their games within the Platform. They do not receive your identity or financial data;
• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the data required to execute the requested financial transaction;
• KYC and Identity Verification Services: Specialist verification providers receive the identity documents you submit during the KYC process for the sole purpose of authenticating your identity. These providers are contractually bound to process your data exclusively for this purpose;
• Fraud Prevention and AML Screening Services: We may share data with anti-fraud and anti-money-laundering screening providers where we have a legitimate obligation or interest to detect and prevent financial crime;
• Regulatory and Law Enforcement Authorities: coy88 will disclose personal data to the extent required by law, court order, or a lawful request from a competent authority. We will notify you of such a request where legally permitted to do so;
• Group Companies and Successors: In the event of a corporate restructuring, merger, or acquisition, your data may be transferred to a successor entity, subject to the same privacy protections described in this policy.

All third-party service providers with whom coy88 shares personal data are required to process that data solely for the purposes specified in their service agreement with us, to maintain appropriate technical and organisational security measures, and to comply with applicable data protection law.

coy88 retains personal data only for as long as it is necessary for the purposes set out in this policy, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

coy88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and our Platform is protected by 256-bit TLS (Transport Layer Security) encryption. Our SSL certificate is maintained and renewed continuously;
• Encryption at Rest: Sensitive personal data stored on our servers — including KYC documents, payment details, and password hashes — is encrypted at rest using AES-256;
• Password Hashing: Member passwords are stored exclusively as salted cryptographic hashes. Plain-text passwords are never stored or transmitted by coy88 systems;
• Access Controls: Access to personal data within coy88's internal systems is restricted on a strict need-to-know basis. All internal access events are logged and reviewed regularly;
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA on their Accounts for an additional layer of protection. coy88 internal systems require 2FA for all staff with access to Member data;
• Penetration Testing: coy88 engages independent security firms to conduct regular penetration tests of our Platform infrastructure and code base;
• Incident Response: In the event of a personal data breach that poses a risk to Members' rights and freedoms, coy88 will notify affected Members within 72 hours of becoming aware of the breach, consistent with internationally recognised breach notification standards.

As a Member of coy88, you have the following rights with respect to your personal data. These rights may be exercised by submitting a verified written request to support @ coy88.app with the subject line "Data Rights Request":

coy88 will respond to all data rights requests within 30 calendar days of receipt of the verified request. Where a request is particularly complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason within the initial 30-day window.

Please note that certain rights are subject to limitations under applicable law. For example, we are unable to erase data that we are required to retain for AML compliance or regulatory audit purposes, even upon request. We will explain any such limitation clearly in our response to your request.

coy88 uses cookies and similar tracking technologies (collectively, "Cookies") to operate the Platform, remember your preferences, measure site performance, and deliver relevant promotional content. The following categories of Cookies are used on the Platform:

You can manage or disable non-essential Cookies at any time through your browser settings. Please note that disabling analytics or marketing Cookies will not affect your ability to access the Platform or place wagers, but it may result in promotional communications that are less relevant to your preferences.

coy88 does not use third-party advertising networks or ad-exchange cookies. All marketing tracking on the Platform is first-party, meaning it is operated directly by coy88 and not shared with external ad-tech providers.

coy88 operates server infrastructure in multiple geographic regions to ensure fast, reliable platform performance for Members across Indonesia — including those connecting from Jakarta (WIB, UTC+7), Bali (WITA, UTC+8), and other regions. As a result, your personal data may be stored on or transferred to servers located outside the Republic of Indonesia.

Where personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to internationally recognised standards, coy88 implements appropriate safeguards including contractual data processing agreements containing standard clauses that impose data protection obligations on the receiving party. These safeguards ensure that your rights remain protected regardless of where your data is physically stored.

All payment data handled by Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) is processed within Indonesia in accordance with Bank Indonesia and OJK (Otoritas Jasa Keuangan) regulations governing electronic transaction data.

The coy88 Platform is strictly for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the Account registration process, and coy88 reserves the right to request documentary proof of age at any time.

If coy88 discovers that personal data has been collected from an individual who was under 21 at the time of registration, the Account will be immediately suspended, all wagers placed will be voided, and any deposited funds will be returned to the verified payment source. The data collected will be deleted as soon as the investigation is concluded, subject only to data that must be retained for fraud-prevention and regulatory compliance purposes.

With your consent, coy88 may send you promotional communications via email, WhatsApp, or in-Platform notifications. These communications may include information about new games from studios such as Pragmatic Play, Evolution Gaming, or Spribe; sportsbook promotions tied to events such as the BRI Liga 1 season, the AFF Cup, or the FIFA World Cup; seasonal bonus offers during Ramadhan, Idul Fitri, or Indonesian Independence Day (17 August); and personalised deposit-match or cashback offers based on your activity on the Platform.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any promotional email;
• Replying "STOP" to any promotional WhatsApp message;
• Adjusting your notification preferences in your Account dashboard;
• Contacting our support team directly and requesting removal from all marketing lists.

Opting out of marketing communications will not affect transactional messages (e.g., deposit confirmations, withdrawal notifications, Account security alerts), which are sent as a necessary part of operating your Account.

coy88 uses transaction and usage data to support its Responsible Gaming programme. This includes monitoring deposit frequency and amounts, session duration, and betting pattern changes that may indicate problem gambling behaviour. Where our systems identify patterns of concern, our Responsible Gaming team may proactively reach out to the Member via their registered contact details.

This processing is conducted on the basis of coy88's legitimate interests and legal obligations as a licensed gaming operator. The data used for Responsible Gaming monitoring is never shared with third-party advertisers or used for marketing profiling. For full details on our Responsible Gaming tools — including deposit limits, session timers, cooling-off periods, and self-exclusion — please visit our dedicated Responsible Gaming page.

coy88 reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this policy — changes that significantly affect how we collect, use, or share your personal data — we will notify you via the email address registered on your Account at least 7 days before the changes take effect.

Non-material clarifications, corrections of typographical errors, and editorial improvements take effect immediately upon publication on this page. The "Last Updated" date at the top of this document reflects the date of the most recent revision of any kind. Your continued use of the Platform after any change constitutes your acceptance of the updated Privacy Policy.

Previous versions of this Privacy Policy are archived and available upon written request to our Data Protection team.

For any question, concern, or formal complaint related to this Privacy Policy or coy88's handling of your personal data, please contact our Data Protection and Privacy team using the details below. Our Indonesian-speaking agents are available 24 hours a day, 7 days a week.

If you are not satisfied with our response to your privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. coy88 will cooperate fully with any such investigation.