spiv8 Privacy Policy

Introduction

spiv8 operates the online betting and casino platform available at https://spiv8.net. In the course of delivering our services to Members — particularly those based in Indonesia — we collect and process certain personal data. We take our data protection obligations seriously and are committed to handling all personal information with integrity, transparency, and appropriate security controls.

This Privacy Policy sets out, in plain and accessible language, the categories of personal data spiv8 collects, the purposes for which that data is used, the circumstances in which it may be shared with third parties, how long it is retained, and the rights available to you as a data subject. We have structured this document to be as clear and comprehensive as possible so that you can make informed decisions about your engagement with the spiv8 platform.

This policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which contain additional provisions relevant to your use of the Platform.

Data Controller

For the purposes of this Privacy Policy, spiv8 acts as the data controller in respect of all personal data collected through the Platform. As data controller, spiv8 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully and in accordance with applicable data protection standards.

Where spiv8 engages third-party service providers to process personal data on its behalf — for example, payment processors, identity verification providers, or analytics platforms — those providers act as data processors under written agreements that impose binding confidentiality and security obligations consistent with this Privacy Policy.

Data We Collect

spiv8 collects personal data across several categories depending on the nature of your interaction with the Platform. The table below summarises the main categories of data collected and the context in which each arises.

spiv8 does not collect special categories of sensitive personal data (such as health information, religious beliefs, or political opinions) except where voluntarily disclosed in the context of a responsible gaming self-exclusion request, in which case such information is handled with the highest level of confidentiality and used solely to administer your responsible gaming settings.

How We Collect Data

spiv8 collects personal data through the following channels:

• Direct submission: Information you actively provide when registering your account, completing KYC verification, submitting deposit or withdrawal requests, contacting customer support, or responding to promotions and surveys.
• Automated technical collection: Data gathered automatically when you access the Platform, including IP addresses, device identifiers, browser fingerprints, and session logs, collected via server logs, cookies, and similar tracking technologies.
• Third-party payment processors: Transaction confirmation data passed to spiv8 by our payment partners (Indonesian banks and e-wallet providers) when you initiate a deposit or withdrawal.
• Identity verification providers: Verification results and risk scores returned by our third-party KYC service providers following document and liveness checks.
• Fraud prevention and analytics platforms: Aggregated device and behavioural signals provided by fraud-detection partners to assist spiv8 in identifying and preventing abuse of the Platform.

Lawful Basis for Processing

spiv8 processes your personal data on one or more of the following lawful bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to enter into and perform the Member agreement with you, including account creation, payment processing, game delivery, and withdrawal fulfilment.
• Legal obligation: Processing required to comply with applicable anti-money laundering obligations, fraud prevention requirements, and financial record-keeping standards applicable to internationally licensed gaming operators.
• Legitimate interests: Processing carried out for spiv8's legitimate business interests where those interests are not overridden by your fundamental rights and freedoms — including security monitoring, fraud detection, responsible gaming analytics, platform performance optimisation, and internal business reporting.
• Consent: Processing based on your freely given, specific, and informed consent — in particular, the delivery of marketing communications and promotional notifications. You may withdraw consent at any time by contacting support or adjusting your account communication preferences.

Use of Your Data

spiv8 uses the personal data it collects for clearly defined purposes. We do not use your data in ways that are incompatible with the original purpose of collection. The primary purposes for which we process personal data are as follows:

• Creating, maintaining, and administering your spiv8 Account, including verifying your identity and eligibility to use the Platform.
• Processing deposits and withdrawals in Indonesian Rupiah (IDR/Rp) via your registered bank account or e-wallet.
• Delivering the games, betting markets, and other services available through the Platform — including sportsbook markets covering BRI Liga 1, EPL, Champions League, and Timnas Indonesia fixtures, as well as casino titles from Pragmatic Play, PG Soft, Evolution Gaming, and other studios.
• Conducting KYC identity verification to comply with anti-money laundering obligations and to confirm your eligibility under our 21+ age policy.
• Detecting and preventing fraud, collusion, bonus abuse, money laundering, and other prohibited activities.
• Administering bonuses, promotions, and loyalty programmes in accordance with applicable promotion terms.
• Providing customer support via live chat and email, including responding to enquiries, processing complaints, and administering responsible gaming tools such as deposit limits, time-outs, and self-exclusion requests.
• Sending you transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts — which are necessary for the performance of our services.
• Sending marketing and promotional communications where you have provided consent, including notifications about new games, seasonal promotions (including offers timed around Idul Fitri, Ramadhan, and Indonesian Independence Day), and personalised bonus offers.
• Analysing platform usage patterns to improve product performance, user experience, and game selection.
• Meeting our legal and regulatory record-keeping obligations.

Data Sharing & Disclosure

spiv8 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

• Payment processors and banking partners: We share the minimum financial and identity data required to process transactions with our Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• KYC and identity verification providers: We share identity document images and related data with our certified third-party KYC providers for the purpose of verifying your identity and age in connection with withdrawal eligibility.
• Fraud prevention and security vendors: We share device signals and behavioural data with fraud-detection platforms to identify and prevent prohibited activity. These partners process data solely under our instructions and are contractually prohibited from using it for any other purpose.
• Game studio providers: Game providers such as Pragmatic Play, PG Soft, Evolution Gaming, NetEnt, and Microgaming may receive pseudonymised session identifiers necessary to deliver their game content and validate RNG outcomes. No directly identifiable personal data beyond an anonymised session token is shared for this purpose.
• Legal and regulatory authorities: spiv8 will disclose personal data to competent authorities where required to do so by a valid legal obligation, court order, or regulatory requirement. We will notify affected Members where we are legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of spiv8's assets, your personal data may be transferred to the acquiring entity. Members will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

Data Retention

spiv8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

Once a retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. Anonymised data may be retained indefinitely for statistical and analytical purposes.

Security Measures

spiv8 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key measures include:

• SSL/TLS encryption: All data transmitted between your browser and the spiv8 Platform is encrypted using industry-standard TLS 1.2 or higher. The padlock indicator in your browser confirms that your connection is secure at all times.
• Encryption at rest: Sensitive data fields — including financial identifiers and KYC documents — are encrypted at rest using AES-256 or equivalent strong encryption standards.
• Access controls: Strict role-based access controls ensure that spiv8 staff can access personal data only on a need-to-know basis. All internal access to personal data is logged and subject to periodic audit.
• Two-factor authentication (2FA): Members are encouraged to enable 2FA on their accounts. spiv8's internal systems also require multi-factor authentication for staff accessing production environments.
• Penetration testing and vulnerability management: spiv8 conducts regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data security incident that poses a risk to your rights and freedoms, spiv8 will notify affected Members without undue delay and will take immediate steps to contain and remediate the breach.

Cookies & Tracking Technologies

The spiv8 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure user experience. A cookie is a small text file placed on your device by the Platform's server when you visit. Cookies do not contain executable code and cannot access other data on your device.

spiv8 uses the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function correctly. They maintain your login session, remember your language and currency preferences, and enable secure payment flows. These cookies cannot be disabled without materially impairing your ability to use the Platform.
• Functional cookies: Remember your personalisation choices — such as your preferred deposit method or notification settings — across sessions, so that you do not need to re-enter them on each visit.
• Analytics cookies: Collect anonymised data about how Members navigate and interact with the Platform (pages visited, time on page, click paths) to help spiv8 identify usability issues and improve the product. This data does not identify you individually.
• Fraud detection and security cookies: Assist in identifying unusual access patterns, multiple-account activity, and other security risks by associating device fingerprint signals with known fraud patterns.

You may manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will affect Platform functionality and may prevent you from logging in or completing transactions. Please refer to your browser's help documentation for instructions on managing cookie preferences.

Your Rights

As a data subject, you hold a number of rights over your personal data. spiv8 is committed to facilitating the exercise of these rights in a timely and transparent manner. The rights available to you include:

• Right of access: You may request a copy of the personal data spiv8 holds about you, along with information about how it is processed. We will provide this within 30 days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. For account details such as email address or payment method, you may update these directly through your account settings where available.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other lawful basis for processing. Note that certain data must be retained for legal compliance purposes (see Section 8) and cannot be deleted upon request alone.
• Right to restriction of processing: You may request that spiv8 restrict the processing of your data in specific circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to the processing of your personal data where that processing is based on spiv8's legitimate interests. spiv8 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Minors & Age Verification

The spiv8 Platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and spiv8 will not activate or maintain any account where the holder is found to be under 21 years of age.

If spiv8 discovers or has reasonable grounds to suspect that an account is held by a person under 21, the account will be immediately suspended, all balances will be returned to the originating payment method, and the personal data associated with the underage account will be securely deleted in accordance with our data retention obligations. The matter will also be escalated to our compliance team.

If you are a parent or guardian and believe that a minor under your care has registered an account with spiv8, please contact our support team immediately via live chat or at the email address in Section 14. We will investigate promptly and take the appropriate action.

Policy Changes

spiv8 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify Members by posting a prominent notice on the Platform and, where practical, by sending an email notification to the address registered to your account. The updated effective date will always be displayed at the top of this page.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the revised terms. If you object to any change, you should cease using the Platform and request account closure by contacting support. We encourage you to review this page periodically to remain informed of how spiv8 protects and manages your personal data.

Contact & Privacy Enquiries

For all privacy-related enquiries, data subject rights requests, or concerns about how spiv8 handles your personal data, please contact our support and compliance team. Our agents are available 24/7 via live chat on the Platform in both Bahasa Indonesia and English.

Written privacy correspondence should be addressed to spiv8 at the support email address shown below. The address is displayed as plain text only and is not a clickable link:

spiv8 treats all privacy communications with the strictest confidentiality. If you are not satisfied with our response to a privacy concern, you may escalate the matter to the relevant supervisory authority in your jurisdiction. spiv8 will cooperate fully with any such authority in connection with a legitimate investigation.