sun388 Privacy Policy

In this Privacy Policy, the following terms shall carry the meanings set out below:

• "sun388" / "we" / "us" / "our" — the sun388 online gaming platform operated at https://sun388.cam and its licensed parent entity.
• "Platform" — the sun388 website, all sub-domains, mobile-optimised interfaces, and any related software services.
• "User" / "you" / "your" — any individual who accesses, browses, registers on, or transacts through the Platform.
• "Personal Data" — any information that identifies or could reasonably be used to identify you as a natural person, including your name, date of birth, Indonesian National Identity Card (KTP) number, email address, phone number, bank account details, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — sun388, which determines the purposes and means of processing your Personal Data.
• "Third-Party Service Provider" — any external company engaged by sun388 to provide services necessary to operate the Platform (e.g., payment processors, KYC verification services, fraud prevention providers).
• "Cookie" — a small text file placed on your device by the Platform to support functionality, security, and analytics.

Sun388 collects the minimum Personal Data necessary to operate a safe, compliant, and functional gaming platform. The categories of data we collect include:

We do not collect special category data (such as health data, racial or ethnic origin, religious beliefs, or biometric data beyond what is strictly required for KYC identity verification) unless you explicitly provide such information.

We collect Personal Data through the following means:

• Direct provision: When you complete the account registration form, submit KYC documents, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion.
• Automated collection: When you access the Platform, our servers automatically log Technical Data including your IP address, browser type, device information, and pages visited. This occurs via cookies, web beacons, and similar tracking technologies.
• Third-party sources: We may receive identity verification data from our KYC service provider, fraud risk scores from our fraud prevention provider, and payment confirmation data from our banking and e-wallet partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay).
• Gameplay activity: Your wagers, game choices, session durations, and related gaming activity are recorded automatically as part of normal Platform operation.

Sun388 processes your Personal Data for the following clearly defined purposes:

• Account management: To create, maintain, verify, and administer your player account, including authentication and password recovery.
• Transaction processing: To facilitate deposits and withdrawals through your chosen Indonesi an bank or e-wallet, verify payment ownership, and maintain accurate financial records.
• Identity verification (KYC): To confirm your identity and age (21+ requirement) in compliance with responsible gaming obligations and anti-money laundering standards.
• Legal compliance: To meet obligations under applicable international gaming regulations, anti-money laundering (AML) frameworks, and fraud prevention requirements.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance.
• Responsible gaming: To monitor gameplay patterns, apply deposit and loss limits you have set, administer self-exclusion requests, and identify potential problem gambling behaviour.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, unauthorised account access, cheating, and abuse of promotional offers.
• Platform improvement: To analyse usage data and technical data in aggregate form to improve the Platform's performance, content, and user experience.
• Marketing communications: To send you promotional offers, bonus notifications, and relevant product updates — only where you have provided consent or where we have a legitimate interest, and always with a clear opt-out mechanism.

Sun388 will not use your Personal Data for any purpose incompatible with those listed above without providing prior notice and, where required, obtaining your consent.

Sun388 processes your Personal Data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you accepted at registration, including operating your account, processing wagers, and handling deposits and withdrawals.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC verification, AML reporting, and age verification obligations.
• Legitimate interests: Processing necessary for our legitimate business interests, including fraud prevention, Platform security, abuse detection, and aggregate analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent as the legal basis — primarily for direct marketing communications — you may withdraw that consent at any time by contacting support or updating your account preferences, without affecting the lawfulness of processing carried out before withdrawal.

Sun388 does not sell, rent, or trade your Personal Data. We may share your data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay receive the financial data necessary to process your deposits and withdrawals. These partners are bound by their own privacy and security standards.
• KYC and identity verification providers: Third-party KYC services process your identity documents to verify your name, age, and photograph. All such providers are contractually required to handle your data securely and only for the specified verification purpose.
• Fraud prevention and security providers: Risk-scoring and anti-fraud platforms may receive Technical Data and account activity data to identify suspicious patterns. No personally identifiable financial information is shared beyond what is strictly required.
• Game content providers: Software studios such as Pragmatic Play, Evolution Gaming, and Microgaming may receive your player session identifiers to deliver game content. These providers do not receive your full identity data.
• Regulatory and law enforcement authorities: We may disclose Personal Data when required by law, court order, or government authority, or where necessary to prevent imminent harm or criminal activity.
• Corporate transactions: In the event of a merger, acquisition, or sale of assets, your Personal Data may be transferred to the relevant party, subject to equivalent privacy protections being maintained.

All Third-Party Service Providers engaged by sun388 are required to sign data processing agreements that bind them to confidentiality obligations and restrict their use of your data to the specific purpose for which it was shared.

Sun388 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal retention requirements. The following retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to you. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.

Sun388 implements a layered approach to data security designed to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our technical and organisational security measures include:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and our servers.
• AES-256 encryption at rest for sensitive data fields including payment credentials and KTP document scans.
• Role-based access controls ensuring that only authorised personnel with a business need can access Personal Data.
• Multi-factor authentication for staff accessing administrative systems containing player data.
• Regular penetration testing and vulnerability assessments conducted by independent third-party security specialists.
• Secure, geographically redundant data centres with physical access controls, 24/7 monitoring, and automatic failover capabilities.
• Incident response protocols enabling rapid detection, containment, and notification in the event of a data breach.

Despite these measures, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. If you suspect unauthorised access to your account, contact us immediately at [email protected].

The sun388 Platform uses cookies and similar technologies to maintain functionality, improve user experience, and gather aggregate analytics. The cookies we use fall into the following categories:

• Strictly necessary cookies: Essential to the operation of the Platform. These enable login session management, fraud detection, and core security features. They cannot be disabled without materially impairing your ability to use the Platform.
• Functional cookies: Remember your preferences such as language settings, display options, and previously visited game categories to personalise your experience.
• Analytics cookies: Collect anonymised data on how users navigate and interact with the Platform. This data helps us identify usability issues and improve content. No personally identifiable information is collected by analytics cookies.
• Marketing cookies: Used to deliver relevant promotional offers based on your activity on the Platform. These are only placed where you have provided consent.

You may manage cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will impair Platform functionality. Disabling analytics and marketing cookies will not affect your ability to place wagers or manage your account.

As a sun388 player, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

Please note that certain rights may be limited where retention of your data is required by law (e.g., AML financial records retention) or where deletion would impair our ability to investigate fraud or resolve open disputes.

The sun388 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step during account registration, and we conduct ongoing KYC checks to enforce this requirement.

If you are a parent or guardian and believe that a minor has provided us with Personal Data or created an account without your knowledge, please contact us immediately at [email protected]. We will take prompt steps to verify the claim, close the account, and delete any associated Personal Data from our systems, subject to any overriding legal retention obligations.

We strongly encourage parents and guardians to install device-level parental control software to prevent minors from accessing online gaming websites.

Sun388 operates internationally, and your Personal Data may be transferred to and stored on servers located outside Indonesia. In all cases, we take appropriate safeguards to ensure that your data receives a level of protection consistent with internationally recognised data protection standards.

Safeguards we apply to international transfers include:

• Contractual data processing agreements with all Third-Party Service Providers that include standard data protection clauses.
• Restriction of transfers to jurisdictions with adequate data protection frameworks or to providers who can demonstrate equivalent protections.
• Technical security measures (encryption in transit and at rest) applied uniformly regardless of the location of data storage.

By creating a sun388 account and accepting these terms, you acknowledge and consent to the international transfer of your Personal Data as described in this section.

Sun388 reserves the right to amend this Privacy Policy at any time to reflect changes in our practices, legal obligations, or the services we offer. When material changes are made, we will notify you via email to your registered address and display a prominent notice on the Platform.

The "Effective Date" at the top of this document indicates when the current version came into force. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following notification of an amendment constitutes your acceptance of the revised policy.

Historical versions of this Privacy Policy are available on request by contacting us at [email protected].

If you have any questions about this Privacy Policy, wish to exercise a data right, or want to raise a complaint about how sun388 handles your Personal Data, please contact our Data Protection team:

Email: [email protected]
Subject line for data requests: "Data Rights Request"
Subject line for privacy complaints: "Privacy Complaint"
Response time: We aim to respond to all privacy-related requests within 14 business days (WIB business hours, Monday–Friday).

We take all privacy complaints seriously and will work with you in good faith to resolve any concerns. If you are not satisfied with our response, you may escalate the matter to the relevant data protection supervisory authority in your jurisdiction.