Privacy Policy

1. Introduction

grab89 ("we", "us", "our", or "the Company") is committed to protecting and respecting the privacy of every player who uses our Platform at https://grab89.cam. This Privacy Policy explains in plain, transparent language what personal data grab89 collects when you visit our website, register an Account, make deposits or withdrawals, or contact our customer support team, as well as how that data is used, stored, protected, and shared.

This Policy applies to all users of the grab89 Platform, including residents of Jakarta, Surabaya, Medan, Bandung, Bali, and all other regions of Indonesia, as well as any other jurisdiction from which our services are accessed. By registering an Account or continuing to use our services, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein.

This document should be read together with our Terms & Conditions and our Responsible Gaming Policy. If you do not agree with any part of this Privacy Policy, you should discontinue use of the grab89 Platform immediately.

2. Definitions

• "Personal Data" means any information that identifies or can reasonably identify a living individual — including name, date of birth, email address, phone number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, and transfer.
• "Data Controller" means grab89, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of grab89, under a contractual obligation to handle data securely and only as instructed.
• "Platform" refers to the grab89 website at https://grab89.cam, all associated web pages, mobile-optimized interfaces, APIs, and digital features.
• "KYC" (Know Your Customer) refers to the identity verification process required under international anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
• "Cookies" means small text files placed on your device when you access the Platform, used to maintain session state, remember preferences, and gather analytics data.

3. Data We Collect

grab89 collects Personal Data in two primary ways: information you provide directly, and information collected automatically when you use the Platform.

3.1 Data You Provide Directly

3.2 Data Collected Automatically

When you access the grab89 Platform, we automatically collect certain technical and behavioral data to ensure platform security, detect fraud, and improve the user experience:

• Device & Technical Data: IP address, browser type and version, operating system, screen resolution, device identifiers, and time zone settings.
• Usage Data: Pages visited, games played, betting history, session duration, click patterns, and navigation paths within the Platform.
• Transaction Logs: Deposit amounts, withdrawal requests, bonus claims, and bet placement records. These logs are retained for regulatory and audit purposes.
• Geolocation Data: Approximate geographic location inferred from your IP address. We do not collect GPS-level location data without explicit consent.
• Cookie Data: Session identifiers, preference settings, and analytics events. See Section 7 (Cookies) for a full breakdown.

4. How We Use Your Data

grab89 processes your Personal Data only for specific, legitimate purposes. We do not process your data for any purpose incompatible with those listed below:

1. Account Management: To create, maintain, and secure your Account; to authenticate your identity at login; and to communicate account-related updates.
2. Transaction Processing: To process deposits and withdrawals in Indonesian Rupiah through your preferred payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and others).
3. Regulatory Compliance: To comply with our international gaming license obligations, anti-money laundering (AML) requirements, Know Your Customer (KYC) regulations, and Curacao eGaming Authority directives.
4. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, duplicate account creation, and other security threats.
5. Customer Support: To respond to inquiries submitted via live chat, email, or WhatsApp; to resolve disputes; and to improve service quality through support interaction analysis.
6. Responsible Gaming: To implement and maintain player protection tools including deposit limits, session reminders, cooling-off periods, and self-exclusion requests.
7. Platform Improvement: To analyze aggregated usage data (anonymized where possible) for the purpose of improving game selection, payment flows, and user interface design.
8. Marketing Communications: With your explicit opt-in consent only, to send promotional offers, bonus notifications, and event updates related to grab89. You may withdraw this consent at any time by contacting [email protected].

5. Legal Basis for Processing

grab89 processes Personal Data under the following legal bases:

• Contractual Necessity: Processing required to fulfil our agreement with you — including running your Account, processing payments, and providing gaming services.
• Legal Obligation: Processing required to comply with our obligations under Curacao gaming regulations, international AML/CTF standards, and applicable financial reporting requirements.
• Legitimate Interests: Processing undertaken to detect fraud, maintain platform security, prevent underage gambling, and conduct internal analytics — where these interests are not overridden by your fundamental rights.
• Consent: Processing of data for optional purposes — such as receiving marketing communications — that you have freely and specifically opted into. You may withdraw consent at any time without penalty.

6. Data Sharing and Disclosure

grab89 does not sell, rent, or trade your Personal Data to any third party. We may share your information only in the following limited and controlled circumstances:

• Payment Processors: We share financial information (bank account details, transaction amounts) with licensed Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing deposits and withdrawals.
• KYC and Identity Verification Partners: We engage licensed third-party verification services to authenticate government-issued documents submitted during the KYC process. These partners operate under strict data processing agreements and are prohibited from using your data for any purpose other than identity verification.
• Regulatory and Law Enforcement Authorities: We will disclose Personal Data to competent authorities when required to do so by law, court order, or regulatory directive — including disclosures required under our Curacao gaming license obligations.
• Fraud Prevention Agencies: We may share data with recognized fraud prevention databases and blacklists to protect the Platform from abuse, cheating, and financial crime.
• Corporate Transactions: In the event of a merger, acquisition, asset sale, or corporate restructuring involving grab89, your data may be transferred to the succeeding entity, subject to the same privacy protections outlined in this Policy.

All third parties with whom grab89 shares Personal Data are contractually required to implement appropriate technical and organizational security measures and to process your data only for specified purposes.

7. Cookies and Tracking Technologies

grab89 uses cookies and similar tracking technologies to operate the Platform, maintain session continuity, and understand how users interact with our services. The following categories of cookies are used:

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not preven t you from using the Platform, although some features and preference settings may not function as expected. Please note that clearing cookies will log you out of your Account and reset any saved preferences.

8. Data Retention

grab89 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply:

• Account Data: Retained for the lifetime of your Account, plus a minimum of five (5) years following Account closure, in compliance with international AML record-keeping requirements.
• KYC Documents: Retained for five (5) years from the date of submission, or longer if required by our regulatory obligations under the Curacao eGaming Authority.
• Transaction Records: All deposit, withdrawal, and betting records are retained for a minimum of seven (7) years to satisfy financial audit requirements.
• Support Correspondence: Chat logs and email records are retained for three (3) years following the close of each support interaction, for quality assurance and dispute resolution purposes.
• Marketing Data: Retained until you withdraw your consent to marketing communications. Upon withdrawal of consent, your data is removed from marketing lists within 30 business days.
• Analytics Data: Anonymized and aggregated analytics data may be retained indefinitely, as it no longer constitutes Personal Data once de-identified.

When Personal Data is no longer required, grab89 will securely delete or anonymize it using industry-standard methods, including cryptographic erasure for data stored in encrypted databases and secure overwriting for file-based records.

9. Data Security

grab89 implements a comprehensive, layered security framework to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 (Transport Layer Security), the same standard used by major global financial institutions.
• At-Rest Encryption: Sensitive data stored in our databases — including financial details and identity documents — is encrypted at rest using AES-256 encryption.
• Password Security: User passwords are hashed and salted using bcrypt, a computationally expensive hashing algorithm that makes brute-force attacks impractical. No grab89 employee can read your password in plain text.
• Access Controls: Access to Personal Data within our organization is restricted on a strict need-to-know basis. Staff with access to sensitive data undergo background checks and regular security training.
• Penetration Testing: Our Platform undergoes regular independent security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• PCI-DSS Compliant Payment Processing: All payment transactions are handled through PCI-DSS Level 1 compliant payment gateways. grab89 does not store full bank account numbers or card details on our servers.
• Fraud Monitoring: Automated systems monitor all transactions and login events in real time to detect anomalous behavior and trigger security reviews where necessary.

10. Your Privacy Rights

As a user of grab89, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 calendar days.

• Right of Access You may request a copy of all Personal Data grab89 holds about you, including the categories of data, processing purposes, and any third parties with whom it has been shared.
• Right to Rectification If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update basic Account details directly through your Account dashboard.
• Right to Erasure You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. Note that we may be legally obligated to retain certain data (e.g., KYC records, transaction logs) for a specified period regardless of an erasure request.
• Right to Restriction of Processing You may request that we restrict how we process your Personal Data while a dispute or rectification request is being resolved.
• Right to Data Portability You may request that we provide your Personal Data in a structured, machine-readable format (JSON or CSV) so that you can transfer it to another service provider.
• Right to Object You may object to processing carried out on the basis of legitimate interests, or to the use of your data for direct marketing purposes. Objections to marketing will be actioned immediately; other objections will be assessed on a case-by-case basis.
• Right to Withdraw Consent Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11. Minors and Age Verification

grab89 strictly prohibits access to our Platform by individuals under the age of 21. We do not knowingly collect Personal Data from minors. As part of our Account registration process, all users are required to confirm their age and to complete identity verification (KYC) by submitting a valid government-issued identification document.

If grab89 discovers or reasonably suspects that a user is under the age of 21, we will immediately suspend the Account, freeze any associated funds pending investigation, and permanently delete all Personal Data associated with that Account, to the extent permitted by our regulatory record-keeping obligations. Any winnings generated by an underage player will be forfeited.

If you are a parent or guardian and believe your child has accessed or registered on grab89 without your knowledge, please contact us immediately at [email protected]. We will investigate and act on all such reports as a matter of priority.

12. Changes to This Privacy Policy

grab89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or business operations. When material changes are made, we will update the "Effective Date" at the top of this document and, where practicable, notify registered users via email or an in-Platform notification.

Your continued use of the grab89 Platform following the posting of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how we protect your Personal Data. If you disagree with the changes, you should close your Account and cease using our services.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way grab89 handles your Personal Data, please contact our Data Protection team using the details below. We are committed to resolving all privacy-related inquiries promptly and transparently.

• Email: [email protected] (Subject: "Privacy Policy Inquiry" or "Privacy Rights Request")
• Live Chat: Available 24/7 through the Platform — our Indonesian-speaking support agents can assist with privacy questions in real time.
• Response Time: We aim to acknowledge all privacy-related inquiries within 5 business days and to resolve them within 30 calendar days.

Our Privacy Commitments at a Glance