Privacy Policy

1.1 Identity. The data controller responsible for the personal data of stm88 members is the entity operating the stm88 platform at https://stm88.bio. For all data-related inquiries, members may contact the stm88 Data Protection contact point at [email protected].

1.2 Scope. This Privacy Policy applies to all personal data collected from individuals who visit, browse, register, or actively use the stm88 platform — including prospective members who begin the registration process but do not complete it. It applies to all product verticals offered on the platform, including the sportsbook, live casino, slot titles, virtual sports, crash games, and togel (Indonesia's traditional numbers lottery) markets.

1.3 Related Documents. This Privacy Policy should be read in conjunction with the stm88 Terms & Conditions available at /terms-conditions. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a data-protection matter, this Privacy Policy shall prevail.

stm88 collects the following categories of personal data from its members and platform visitors:

2.1 Sensitive Data. stm88 does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetic or biometric data, or health information beyond what is strictly necessary for responsible gaming compliance (e.g., self-reported problem gambling status for self-exclusion purposes).

3.1 Directly From You. The majority of personal data held by stm88 is provided directly by you during the registration process, during KYC verification, when making deposits or withdrawal requests, when contacting our support team, or when responding to promotional campaigns.

3.2 Automatically via the Platform. When you access the stm88 platform, our servers and analytics systems automatically collect certain technical data including your IP address, device identifiers, browser information, and clickstream navigation data. This data is collected via server logs, cookies, and similar tracking technologies (see Clause 09 for full details).

3.3 From Third-Party Payment Processors. When you initiate a deposit or withdrawal via a supported Indonesian bank (BCA, BRI, BNI, Mandiri, and others) or e-wallet service (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processing partners may share transaction confirmation data with stm88 to reconcile your account balance. stm88 does not receive or store your full bank account password or full card number.

3.4 From Identity Verification Providers. Where required for KYC compliance, stm88 may engage specialist identity-verification service providers to authenticate documents submitted by members. These providers may independently verify data against government databases where legally permitted.

stm88 processes your personal data for the following purposes:

1. Account Creation and Management: To register your account, authenticate your identity, and maintain your member profile throughout your active membership with stm88.
2. Service Delivery: To provide you with access to all stm88 products — sportsbook, live casino, slots, virtual sports, crash games, and togel markets — and to process your wagers, calculate results, and credit winnings.
3. Payment Processing: To process deposits and withdrawals via your nominated Indonesian bank account or e-wallet, and to maintain accurate financial records of all transactions.
4. KYC and Fraud Prevention: To verify your identity, confirm your age (minimum 21 years), prevent the creation of duplicate accounts, detect fraudulent activity, and comply with anti-money-laundering obligations.
5. Responsible Gaming Compliance: To monitor for indicators of problem gambling behaviour, enforce self-exclusion orders and deposit limits that you have voluntarily activated, and to flag accounts that may require intervention.
6. Customer Support: To respond to your enquiries, resolve account disputes, process complaints, and improve the quality of our support service by reviewing interaction records.
7. Legal and Regulatory Compliance: To meet our obligations under applicable laws, to respond to lawful requests from regulatory authorities or law enforcement agencies, and to maintain records as required by anti-money-laundering regulations.
8. Platform Improvement: To analyse aggregated and anonymised usage data to identify improvements to the stm88 platform, enhance game performance, and optimise the user experience for Indonesian players.
9. Marketing Communications (with consent): To send you promotional emails about new games, bonus offers, seasonal promotions (including those tied to Indonesian cultural occasions such as Idul Fitri, Ramadhan, and Indonesian Independence Day), and platform updates — where you have provided explicit consent to receive such communications.

stm88 processes your personal data on the following legal bases:

6.1 Service Providers. stm88 shares personal data with carefully selected third-party service providers who assist in delivering the stm88 platform. These include payment processing partners (supporting BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), KYC and identity-verification providers, cloud hosting and infrastructure providers, game software providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft), and customer support tooling providers. All such providers operate under binding data-processing agreements that restrict use of your data to the specific service they provide.

6.2 Legal and Regulatory Disclosure. stm88 may disclose your personal data to competent authorities, law enforcement agencies, financial intelligence units, or courts where required to do so by applicable law, court order, or where stm88 has a good-faith belief that such disclosure is necessary to prevent or investigate financial crime, fraud, or serious harm.

6.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of stm88's business, your personal data may be transferred to the successor entity as part of that transaction. stm88 will notify affected members of any such transfer via their registered email address and will ensure that the successor entity is bound by equivalent privacy protections.

6.4 No Sale of Data. stm88 does not sell, license, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes under any circumstances.

7.1 Retention Principles. stm88 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. We apply the principle of data minimisation — data that is no longer required is securely deleted or anonymised.

7.2 Retention Schedule. The following retention periods apply as a general guide:

• Active Account Data: Retained for the duration of your active membership plus a minimum of five years following account closure, to meet anti-money-laundering record-keeping requirements.
• Transaction and Financial Records: Retained for a minimum of five years from the date of the transaction, in accordance with financial record-keeping obligations.
• KYC Verification Documents: Retained for a minimum of five years following the completion of the verification process or the closure of the account, whichever is later.
• Support Communications: Retained for three years from the date of the interaction, unless the communication relates to an ongoing dispute, in which case it is retained until the dispute is fully resolved.
• Marketing Consent Records: Retained for the duration of your active consent plus three years, to demonstrate compliance with consent requirements.
• Technical and Log Data: Typically retained for 12 months from collection, after which it is anonymised or deleted.

7.3 Extended Retention. Where stm88 is subject to a legal hold, regulatory investigation, or active litigation relating to your account, the relevant data will be retained beyond the standard periods described above until the matter is concluded.

8.1 Technical Safeguards. stm88 implements the following technical security measures to protect member personal data against unauthorised access, loss, alteration, or destruction:

• TLS/SSL encryption for all data in transit between your device and stm88 servers.
• AES-256 encryption for sensitive data at rest, including financial records and KYC document stores.
• Bcrypt hashing for all account passwords — stm88 never stores passwords in recoverable plain text.
• Multi-factor authentication options for member account access.
• Intrusion detection and prevention systems monitoring platform infrastructure around the clock.
• Regular penetration testing conducted by independent third-party security professionals.
• Strict access controls ensuring that stm88 staff may only access member data on a need-to-know basis, with full audit logging of all internal data access events.

8.2 Organisational Safeguards. stm88 maintains internal data protection policies, provides mandatory data-security training to all personnel who handle member data, and conducts periodic reviews of our data processing activities and vendor security posture.

8.3 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected members, stm88 will notify affected members without undue delay via their registered email address, describing the nature of the breach, the data categories affected, and the steps being taken to remediate the incident and prevent recurrence.

8.4 Your Responsibility. While stm88 takes all reasonable steps to protect your data, the security of your account also depends on you maintaining the confidentiality of your login credentials. Do not share your password with any third party and ensure you log out after each session, particularly when accessing stm88 from a shared device.

9.1 What Are Cookies. Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits and to store certain preferences or session information. stm88 uses cookies and similar technologies (including local storage and session storage) to operate and improve the platform.

9.2 Types of Cookies Used.

9.3 Managing Cookies. You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will impair or prevent your use of the stm88 platform. For marketing cookies, you may withdraw consent at any time by contacting [email protected].

As a stm88 member, you have the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected]. stm88 will respond within 30 days of receiving a valid, verifiable request. Identity verification will be required before any data action is completed.

11.1 Age Restriction. The stm88 platform is strictly restricted to persons aged 21 years and older. stm88 does not knowingly collect personal data from any individual under the age of 21. If stm88 discovers that personal data has been collected from a minor, that data will be permanently deleted and the associated account will be immediately closed.

11.2 Parental Notification. If you believe that a minor under your care has accessed or registered on the stm88 platform, please contact [email protected] immediately. stm88 will investigate and take appropriate action without delay.

11.3 Age Verification. stm88 applies mandatory age-verification checks at account registration and prior to processing the first withdrawal. Members who cannot satisfy age-verification requirements will have their accounts suspended pending review. Falsifying age information constitutes fraud and may be reported to relevant authorities.

12.1 Cross-Border Processing. To deliver the stm88 platform, your personal data may be processed by stm88 infrastructure or by third-party service providers located in countries outside Indonesia. These transfers may include data centres, cloud providers, and game software servers operating in multiple international jurisdictions.

12.2 Transfer Safeguards. Where personal data is transferred outside Indonesia, stm88 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Indonesia. Safeguards may include contractual protections (data processing agreements incorporating international transfer clauses), hosting with providers that hold internationally recognised security certifications (e.g., ISO 27001, SOC 2), and technical measures including end-to-end encryption of data in transit.

12.3 Further Information. If you require further details about the international transfer safeguards applicable to your data, please contact [email protected] with a written request.

13.1 Right to Update. stm88 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, regulatory guidance, or operational practice. The "Last Updated" date at the top of this page will be revised whenever a change is made.

13.2 Notification of Material Changes. Where stm88 determines that a change to this Privacy Policy materially affects your rights or the way your data is processed, stm88 will provide reasonable advance notice via your registered email address prior to the change taking effect.

13.3 Continued Use. Your continued use of the stm88 platform following the posting of an updated Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any change to this Privacy Policy, you must close your account in accordance with the account closure procedure described in the stm88 Terms & Conditions.

For all privacy-related inquiries — including data access requests, rectification requests, erasure requests, consent withdrawal, and general questions about this Privacy Policy — please contact the stm88 Data Protection team using the details below.

When contacting us regarding a data subject rights request, please include: (a) your registered username or email address; (b) a clear description of the right you wish to exercise and the specific data it relates to; and (c) a copy of a valid government-issued photo ID for identity verification purposes. stm88 will not action data requests where identity cannot be reasonably confirmed.

All written communications regarding this Privacy Policy should be directed to [email protected]. Please do not send sensitive identity documents via unencrypted channels — our support team will provide a secure upload link upon request.