top189 Privacy Policy

This Privacy Policy ("Policy") applies to all personal data collected, processed, and stored by top189 in connection with your use of the top189 platform, accessible at top189.asia, and any related services, tools, or communications we provide to you.

top189 principally serves players based in Indonesia, including residents of Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and other Indonesian cities. Wherever you are located in Indonesia, this Policy governs how your data is handled when you interact with top189.

By registering an account, making a deposit, or continuing to use the top189 platform after this Policy has been made available to you, you confirm that you have read and understood its contents. If you do not agree with any part of this Policy, you should discontinue use of the platform and contact support to close your account.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming policy, which together form the complete framework governing your relationship with top189.

For the purposes of this Policy, top189 — the operator of the top189.asia platform — acts as the data controller in respect of personal data collected from players and site visitors. As data controller, top189 determines the purposes and means by which your personal data is processed.

Where top189 engages third-party service providers to process personal data on its behalf (for example, payment processors, identity verification providers, and game content providers), those providers act as data processors under contractual arrangements that require them to process data only on top189's instructions and in accordance with this Policy.

If you have any questions about how top189 processes your personal data, or if you wish to exercise any of the rights described in Section 11 of this Policy, you may contact the top189 privacy team at any time via the contact details set out in Section 15.

top189 collects the following categories of personal data, depending on how you interact with the platform:

top189 collects personal data through the following channels and methods:

• Direct submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your profile settings.
• Automated collection: Technical and device data collected automatically when you visit or interact with the top189 platform, including through cookies, web beacons, and server log files (see Section 8 for detailed cookie information).
• Payment processors: Financial transaction confirmation data received from local Indonesian bank transfer gateways and e-wallet providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) when you complete a deposit or withdrawal.
• Identity verification providers: Confirmation data returned by top189's KYC verification partners following review of identity documents you submit. These providers do not store your documents longer than the verification process requires, under contractual obligation to top189.
• Fraud and security monitoring systems: Automated risk-scoring signals generated by top189's internal and third-party fraud detection tools based on your account activity patterns, login behaviour, and device fingerprints.

top189 uses your personal data for the following purposes:

• Account management: Creating, maintaining, and operating your top189 account, including authentication, profile management, account security, and communication of account-related notifications.
• Payment processing: Verifying deposit sources, processing withdrawals to your registered payment method, conducting reconciliation, and maintaining transaction records in compliance with financial record-keeping obligations.
• Identity and age verification (KYC): Confirming that you are at least 21 years of age and verifying your identity in accordance with top189's anti-money-laundering (AML) obligations before processing your first withdrawal and at intervals thereafter.
• Delivering gaming services: Providing access to top189's sportsbook, live casino, slot games, and togel (Indonesia's traditional numbers lottery) products; calculating and crediting winnings; processing bonus awards and wagering tracking.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling indicators; enforcing deposit limits, loss limits, session limits, and self-exclusion requests you have set or requested; complying with player protection obligations.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account takeover attempts, collusion, bonus abuse, and other prohibited conduct described in the Terms & Conditions.
• Legal compliance: Meeting top189's obligations under its international gaming licence, AML regulations, and any other applicable legal requirements, including responding to lawful requests from regulatory authorities.
• Customer support: Responding to your enquiries, resolving disputes, and providing assistance through top189's 24/7 live support channel (with Indonesian-speaking agents available at all hours).
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may opt out at any time via account settings or by contacting support.
• Platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, user experience, and the quality of top189's services.

top189 processes your personal data on the following legal bases:

top189 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share your data only in the circumstances described below, and only to the extent necessary for the stated purpose:

• Payment service providers: We share transaction data (your name, bank account or e-wallet details, and transaction amount) with Indonesian payment processors and banking partners including BCA, BRI, BNI, Mandiri, and e-wallet providers OVO, DANA, GoPay, ShopeePay, and LinkAja, strictly for the purpose of processing your deposits and withdrawals.
• KYC / identity verification providers: We share identity documents with our contracted identity verification partners for the purpose of completing your KYC check. These providers process data under strict data processing agreements and are prohibited from using it for any other purpose.
• Game content providers: Technical session data (account ID, game round ID, wager amount, and outcome) is shared with Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe, and other licensed game studios to the extent necessary to deliver the game and resolve any disputes about game outcomes.
• Fraud and security vendors: Anonymised or pseudonymised technical and behavioural data may be processed by top189's contracted fraud detection and cybersecurity vendors to identify and prevent prohibited activity.
• Regulatory and law enforcement bodies: top189 will disclose personal data to regulators, law enforcement agencies, or courts where required to do so by applicable law or by a valid legal order. Where permitted, top189 will notify you of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of top189's business, player account data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and of any changes to this Privacy Policy that result from it.

top189 uses cookies and similar tracking technologies (web beacons, pixel tags, local storage) to operate the platform, maintain your session, and understand how players use the site. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without disrupting the platform's core functionality.
• Performance and analytics cookies: Used to collect anonymised data about how players navigate the platform — which pages are visited most frequently, average session duration, and error rates — to help top189 improve platform performance and user experience. This data is aggregated and not used to identify individual players.
• Functional cookies: Remember your preferences such as language settings, last-visited game category, and notification preferences, so you do not need to re-enter them each session.
• Marketing and attribution cookies: Used to track which marketing channels (if any) referred you to top189, so we can measure the effectiveness of our promotional campaigns. These cookies do not track your activity on other websites. If you have opted out of marketing communications, marketing cookies will not be used to serve you personalised promotional content.

You may control cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in and using the platform. Disabling other cookie categories will not affect your ability to play but may reduce the platform's personalisation features.

top189 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the lifetime of your account and for a minimum of five (5) years from the date of your last account transaction or login, whichever is later, to comply with AML record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of submission, in line with international AML best practice and top189's licensing obligations.
• Transaction records: Retained for a minimum of five (5) years from the transaction date.
• Support communications: Retained for three (3) years from the date of the communication, unless the matter is subject to an ongoing dispute, investigation, or legal proceeding, in which case records are retained until the matter is fully resolved.
• Marketing consent records: Retained for the duration of your account and for one (1) year following account closure, to demonstrate compliance with applicable consent requirements.
• Closed accounts: Following account closure, top189 retains the minimum personal data required to satisfy legal obligations and to prevent re-registration by self-excluded players. Data not required for these purposes is deleted or anonymised within 90 days of account closure.

top189 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Encryption in transit: All data transmitted between your device and the top189 platform is encrypted using TLS 1.2 or higher (256-bit SSL). Every page of the platform is served over HTTPS.
• Encryption at rest: Sensitive data stored in top189's databases — including KYC document images, financial data, and account credentials — is encrypted at rest using AES-256 encryption.
• Password hashing: Account passwords are never stored in plain text. They are hashed using a strong, salted one-way hashing algorithm. top189 staff cannot retrieve your password; if you forget it, a reset link is sent to your registered contact address.
• Access controls: Access to personal data within top189's internal systems is restricted to staff with a legitimate operational need to access it, enforced through role-based access controls and multi-factor authentication for administrative systems.
• Security audits: top189 conducts regular internal security reviews and periodic third-party penetration testing of the platform and supporting infrastructure.
• Incident response: top189 maintains a documented data breach response procedure. In the event of a security incident that poses a significant risk to your personal data, top189 will notify affected players promptly and take immediate remediation steps.

While top189 takes all reasonable precautions to secure your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials (see the Account Security section of the Terms & Conditions).

As a top189 player, you have the following rights in respect of your personal data. To exercise any of these rights, contact the top189 privacy team using the details in Section 15. top189 will respond to verified data subject requests within 30 days.

top189 is strictly an adults-only platform. No person under the age of 21 is permitted to register an account, make a deposit, or participate in any game or betting activity on the top189 platform.

top189 does not knowingly collect, process, or retain personal data from individuals under the age of 21. If top189 discovers or reasonably suspects that a registered account belongs to a person under 21, the account will be immediately suspended, all activity on that account will be reviewed, and any funds deposited will be returned to the source payment method. KYC verification serves as the primary mechanism by which top189 enforces this age restriction.

If you believe that a person under the age of 21 has registered or used a top189 account, please contact our support team immediately so that the matter can be investigated and resolved without delay.

The top189 platform may contain references to third-party services (for example, payment method providers such as OVO, DANA, GoPay, and banking institutions such as BCA, BRI, BNI, and Mandiri) in the context of describing payment options available to players. These references are informational; top189 does not control the privacy practices of these third parties.

When you interact directly with a third-party payment provider or bank to initiate a transfer, you are subject to that provider's own privacy policy and terms of service. top189 is not responsible for the privacy practices of any third-party service, and this Privacy Policy does not extend to cover any third-party platforms or services.

top189 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or business operations. When a material change is made, top189 will notify active account holders via their registered email address or via a prominent notice on the platform at least 7 days before the updated Policy takes effect.

Your continued use of the top189 platform following the effective date of an updated Privacy Policy constitutes your acceptance of the changes. The effective date at the top of this document reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how top189 protects your data.

If you object to any changes in the updated Policy, you must stop using the platform and contact support to close your account before the effective date. top189 will process the return of your remaining balance in accordance with the standard withdrawal procedure.

If you have any questions about this Privacy Policy, wish to exercise any of the data rights described in Section 11, or want to report a potential privacy concern, please contact the top189 privacy team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, from your top189 account dashboard. This is the fastest channel for urgent matters. Indonesian-speaking agents are available at all times for players who prefer to communicate in Bahasa Indonesia, though all formal privacy responses will be provided in English.
• Email: [email protected] — use this address for formal data subject access requests, deletion requests, and portability requests. Please include your registered username, account ID, and a description of your request. top189 will verify your identity before processing any data subject request and will respond within 30 days of receiving a complete and verified request.