At bro128, your privacy is not a formality — it is a core operating principle. This Privacy Policy explains precisely what personal data we collect, why we collect it, how we use and protect it, and what rights you hold as a Member of our platform. Please read this document carefully alongside our Terms & Conditions.
We collect only the personal data that is strictly necessary to operate your bro128 Account, process transactions, and comply with our regulatory obligations. We do not collect data speculatively.
All personal data stored by bro128 is encrypted at rest using AES-256 standards. All data transmitted between your device and our servers is protected by TLS 1.3 (SSL) encryption.
bro128 does not sell, rent, or trade your personal data to third-party marketers or data brokers under any circumstances. Your information exists to serve your Account — nothing else.
You may request a full copy of the personal data we hold about you, and you may request its deletion, at any time — subject to our legal retention obligations outlined in Clause 9 of this Policy.
bro128 operates with full awareness of the Indonesian personal data protection landscape. Our practices are designed to align with internationally recognized data protection principles, including those reflected in Indonesia's Personal Data Protection Law (UU PDP).
All marketing communications from bro128 — including promotional emails, SMS, and platform notifications — include a clear, functional one-click opt-out mechanism. We honor all opt-out requests within 48 hours.
1.1 For the purposes of this Privacy Policy, the data controller responsible for your personal data is bro128, the operator of the Platform at https://bro128.cam. Where the term "we", "us", or "our" is used in this Policy, it refers to bro128 in its capacity as data controller.
1.2 bro128 operates as an offshore platform serving Members primarily located in Indonesia. Our data processing infrastructure is maintained internationally, and personal data may be stored on servers located outside the territory of Indonesia. See Clause 12 (International Transfers) for further detail.
1.3 Our designated Data Protection contact can be reached at the email address set out in Clause 14 of this Policy. All privacy-related correspondence should be directed to that address and clearly marked in the subject line as a privacy inquiry.
| Term | Meaning in This Policy |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person — including name, national ID number, IP address, device identifiers, and financial account details. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, use, transmission, alteration, restriction, or deletion. |
| "Member" / "You" | Any individual who has registered a bro128 Account or who visits the Platform without registration. |
| "KYC Data" | Identity verification documents submitted by a Member, including government-issued photo ID (KTP Nasional), proof of address, and selfie verification images. |
| "Third-Party Providers" | External service providers engaged by bro128 to deliver platform functionality, including payment processors, game content studios, cloud hosting providers, and fraud detection services. |
| "Cookies" | Small text files placed on your device by the Platform or Third-Party Providers for the purposes of session management, analytics, and personalization. |
3.1 Registration Data. When you create a bro128 Account, we collect: your full legal name, date of birth, email address, mobile phone number, and residential address (including city and province within Indonesia). This information is required to establish and administer your Account.
3.2 Identity Verification (KYC) Data. To comply with our anti-money laundering (AML) obligations and to verify your eligibility to participate on the Platform (see Terms & Conditions, Clause 4), we collect: copies of your Indonesian National ID Card (KTP Nasional — front and back), proof of residential address, and selfie verification images. KYC Data is processed by our compliance team and is not used for any marketing purpose.
3.3 Financial Data. To process deposits and withdrawals, we collect: your bank account name and number (for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, or Bank Permata transfers), e-wallet account identifiers (for OVO, DANA, GoPay, ShopeePay, and LinkAja), and transaction history records. We do not store full card numbers or CVV codes.
3.4 Activity Data. In the ordinary course of platform operation, we record: all wagers placed (including game type, stake amount in IDR, odds, and outcome), login timestamps and session durations, device information (browser type, operating system, screen resolution), and IP address at the time of login and each significant Account action.
3.5 Communications Data. If you contact our customer support team — whether via live chat, email, or any in-platform messaging tool — we retain a record of that correspondence. This data is used to resolve your query, to train our support team, and to maintain an audit trail of complaints and resolutions.
3.6 Technical & Analytics Data. The Platform automatically collects certain technical data from all visitors, including registered Members and unregistered visitors: page views, click paths, referral URL, session duration, and error logs. This data is collected in aggregated or pseudonymized form wherever technically practicable.
bro128 processes your personal data on one or more of the following legal bases, depending on the nature of the processing activity:
| Legal Basis | Processing Activities Covered |
|---|---|
| Contractual Necessity | Account registration and management; processing deposits and withdrawals; settling wagers; providing customer support. |
| Legal Obligation | KYC/AML verification; fraud investigation; responding to lawful requests from competent authorities; financial record retention. |
| Legitimate Interests | Fraud prevention and platform security; abuse detection; improving Platform performance; analytics to enhance user experience. |
| Consent | Marketing communications (email, SMS, push notifications); placement of non-essential cookies; personalized promotional targeting. |
Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.
The personal data we collect is used exclusively for the following purposes:
6.1 Third-Party Service Providers. bro128 shares personal data with carefully selected Third-Party Providers who assist us in delivering the Platform's services. All such providers are contractually bound to process your data only on our documented instructions and to maintain security standards equivalent to our own. Current categories of Third-Party Providers include:
6.2 Legal Disclosure. bro128 may disclose personal data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where we are legally compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of bro128, its Members, or the general public. We will notify affected Members of such disclosures where legally permitted to do so.
6.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of bro128's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.
6.4 No Sale of Data. bro128 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. This prohibition is absolute and applies regardless of the value of the data concerned.
7.1 What We Use. The bro128 Platform uses cookies and similar tracking technologies (including local storage objects and session tokens) to operate core Platform functionality and to improve your experience as a Member.
7.2 Categories of Cookies. We deploy the following categories of cookies:
| Category | Purpose | Consent Required? |
|---|---|---|
| Strictly Necessary | Session authentication, security tokens, load balancing. Without these, the Platform cannot function. | No — essential |
| Functional | Remembering your display preferences, language settings, and game lobby configuration between sessions. | No — functional |
| Analytics | Measuring page views, session duration, click paths, and error rates to improve Platform performance. | Yes |
| Marketing | Tracking which promotions you have viewed or clicked to deliver relevant offers and measure campaign effectiveness. | Yes |
7.3 Managing Cookies. You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary or functional cookies may impair your ability to use certain Platform features, including Account login and game loading. Instructions for managing cookies in common browsers are available through each browser's own help documentation.
7.4 Do Not Track. Some browsers transmit a "Do Not Track" signal to websites. bro128 currently does not alter its data collection practices in response to Do Not Track signals, as no universally accepted standard for responding to such signals exists. We will review this position as standards develop.
8.1 Technical Measures. bro128 implements a layered set of technical security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:
8.2 Organizational Measures. In addition to technical controls, bro128 maintains organizational policies governing data access, handling, and disposal. All staff and contractors who handle personal data are subject to confidentiality obligations and receive regular data protection training.
8.3 Data Breach Response. In the event of a personal data breach that poses a risk to the rights and freedoms of affected Members, bro128 will notify affected individuals without undue delay, and in any case within 72 hours of becoming aware of the breach, providing details of what data was affected and what steps we have taken to mitigate the impact.
9.1 Active Accounts. We retain your personal data for as long as your bro128 Account remains active and for a period thereafter as required by our legal and regulatory obligations.
9.2 Closed Accounts. Upon Account closure — whether at your request or at bro128's discretion — we retain the following categories of data for the periods indicated:
| Data Category | Retention Period After Closure |
|---|---|
| Registration & KYC Data | 5 years — required for AML compliance and audit purposes. |
| Financial Transaction Records | 5 years — required for financial reporting and fraud investigation purposes. |
| Wagering History | 3 years — retained for dispute resolution and responsible gaming monitoring purposes. |
| Customer Support Records | 3 years — retained for quality assurance and complaints handling purposes. |
| Marketing Consent Records | 3 years from the date of consent or withdrawal, whichever is later. |
| Analytics & Technical Logs | 12 months — retained in pseudonymized form for platform improvement analysis. |
9.3 Deletion. Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our internal data disposal procedures. Anonymized data (from which you cannot be identified) may be retained indefinitely for aggregate statistical analysis.
As a Member of bro128, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us using the details in Clause 14. We will respond to all verified requests within thirty (30) calendar days.
Request a copy of all personal data we hold about you, along with information on how it is being processed.
Request correction of any inaccurate or incomplete personal data held in your Account records.
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Request that we restrict processing of your data in certain circumstances, such as while a dispute regarding its accuracy is being resolved.
Request a structured, machine-readable copy of the personal data you have provided to us, for transfer to another service provider.
Object to processing of your personal data based on our legitimate interests, including direct marketing and profiling for promotional purposes.
Withdraw consent to any processing activity based on consent at any time, without affecting the lawfulness of prior processing.
If you believe your privacy rights have been violated, you may lodge a complaint with us directly or with a competent data protection authority in your jurisdiction.
11.1 The bro128 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in our KYC process, and any Account found to belong to a person under 21 will be immediately suspended and all associated personal data reviewed in accordance with our obligations.
11.2 If you are a parent or guardian and you believe that a minor has registered an Account on the Platform using your or their own details, please contact us immediately at the email address in Clause 14. We will investigate and take prompt remedial action, including closing the Account and deleting any personal data collected, where legally permissible.
11.3 bro128 recommends that adults sharing devices with minors use browser-level parental control software and maintain the confidentiality of their bro128 login credentials to prevent unauthorized access.
12.1 As an internationally operated platform, bro128 may transfer your personal data to, and process it in, countries outside Indonesia. These countries may not have data protection laws that are equivalent in scope to those applicable in Indonesia.
12.2 Where such transfers occur, bro128 implements appropriate safeguards to ensure that your personal data receives a level of protection consistent with the standards described in this Privacy Policy. These safeguards include: contractual data protection clauses with all recipient entities; transfer only to jurisdictions with recognized adequacy standards; and technical encryption of all transferred data in transit.
12.3 By registering an Account and using the bro128 Platform, you acknowledge and consent to the international transfer of your personal data on the terms described in this Clause.
13.1 bro128 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, or Platform features. Material changes will be communicated to registered Members via email to the address on file, with a minimum notice period of fourteen (14) days before the revised Policy takes effect.
13.2 The date of the most recent revision is stated at the top of this document ("Last Updated: January 2026"). We recommend that you review this Policy periodically. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated terms.
13.3 Where a proposed change materially affects the legal basis on which we process your data, or introduces a new category of processing for which we require your consent, we will seek that consent explicitly before the change takes effect rather than relying on continued use as deemed acceptance.
If you have any questions about this Privacy Policy, wish to exercise any of your data rights set out in Clause 10, or wish to raise a privacy-related complaint, please contact us using the following details:
14.1 Complaints to Authorities. If you are dissatisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data protection authority in your jurisdiction. bro128 will cooperate fully with any such investigation.
Explore our full Terms & Conditions for the complete rules governing your bro128 Account, or visit our FAQ for quick answers to common privacy and security questions.