Your Privacy Matters to grep89

This Privacy Policy ("Policy") describes how grep89 ("we", "us", "our") collects, uses, discloses, and safeguards the personal data of individuals ("you", "Player") who access or use the grep89 platform at https://grep89.com. By registering an account or otherwise using any part of the grep89 platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

This Policy should be read alongside the Terms & Conditions and the Responsible Gaming page, both of which form part of the overall agreement between you and grep89.

Definitions

The following definitions apply throughout this Privacy Policy unless the context clearly requires otherwise.

Data Controller

grep89 acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, grep89 determines the purposes for which personal data is processed and takes responsibility for ensuring that processing activities comply with applicable data protection principles.

Where grep89 engages third-party service providers — such as payment processors, game studios, or identity verification vendors — those parties act as Data Processors under written agreements that bind them to process personal data solely on grep89's documented instructions and to implement appropriate technical and organisational security measures.

Data We Collect

grep89 collects personal data through multiple channels in the ordinary course of operating the Platform. The categories of data we collect are set out below.

3.1 Registration & Account Data

When you create an account on grep89, we collect your full legal name, date of birth, Indonesian national identity number (NIK), current residential address, active mobile telephone number, and a valid email address. This data is collected to create and administer your account, verify your eligibility, and communicate important account information to you.

3.2 KYC & Identity Verification Data

To comply with our anti-money-laundering (AML) obligations and to confirm that all players meet the 21+ age requirement, grep89 collects copies or photographs of government-issued identity documents (KTP, passport, or SIM), proof of address documents, and — where required — source-of-funds declarations. This data is handled with the highest level of care and access is restricted to authorised personnel and vetted third-party verification providers.

3.3 Financial & Transaction Data

grep89 records details of all deposits, withdrawals, and in-game wagering transactions associated with your account. This includes the amount, timestamp, payment channel used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja), transaction reference numbers, and account balance history. Full card numbers or bank account credentials are never stored on grep89 servers; they are handled directly by our PCI-compliant payment processing partners.

3.4 Usage & Behavioural Data

As you interact with the Platform, grep89 automatically collects technical data including your IP address, device type and operating system, browser type and version, pages visited, time spent per page, click-stream data, game sessions played, and bet history. This data is used to improve Platform performance, personalise the gaming experience, and detect and prevent fraud or problem gambling indicators.

3.5 Communications Data

grep89 retains records of all communications between you and our support team, whether conducted via live chat, email, or other messaging channels. These records are used to resolve disputes, maintain service quality, and meet our compliance obligations.

3.6 Cookies & Tracking Data

grep89 uses cookies and similar tracking technologies as described in Section 8 of this Policy. The data collected through cookies may include session identifiers, preference settings, referral source information, and device fingerprinting data used for fraud prevention.

Purposes & Legal Basis for Processing

grep89 processes personal data only where a lawful basis exists for doing so. The table below summarises each primary processing purpose, the data categories involved, and the corresponding legal basis.

Data Sharing & Disclosure

grep89 does not sell your personal data. We share personal data with third parties only in the circumstances described below, and only to the minimum extent necessary for each purpose.

5.1 Service Providers & Data Processors

grep89 engages third-party service providers to support the operation of the Platform. These include payment processors (including the local Indonesian banking and e-wallet infrastructure behind BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja integrations), identity verification vendors, game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Pocket Games Soft), cloud hosting providers, and customer support tooling providers. Each provider operates under a binding data-processing agreement that restricts them from using your data for any purpose other than delivering services to grep89.

5.2 Legal & Regulatory Disclosure

grep89 may disclose personal data to law enforcement agencies, regulatory bodies, financial intelligence units, or courts where we are legally required to do so, or where disclosure is necessary to protect the safety, rights, or property of grep89, our players, or the public. grep89 will notify affected account holders of such disclosures wherever legally permitted to do so.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of grep89's assets, personal data held by grep89 may be transferred to the acquiring entity. We will notify active account holders via registered email prior to any such transfer, and the acquiring entity will be required to honour the commitments made in this Privacy Policy.

Data Retention Periods

grep89 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected or to meet our legal and regulatory obligations. The retention schedule below applies to all active and closed accounts.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be linked to any identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.

Security Measures

grep89 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Transport Layer Security (TLS 1.2+): All data in transit between your browser or app and grep89 servers is encrypted using current TLS standards. Connections are enforced via HTTPS on all Platform endpoints.
• AES-256 Encryption at Rest: Sensitive personal data stored in our databases — including KYC documents, identity numbers, and payment references — is encrypted at rest using AES-256.
• Access Controls: Access to personal data is restricted to employees and contractors who require it to perform their job functions. Role-based access controls, multi-factor authentication (MFA) for administrative systems, and comprehensive audit logs are maintained.
• Penetration Testing & Vulnerability Management: grep89 commissions regular third-party penetration tests and maintains a structured vulnerability management programme to identify and remediate security weaknesses proactively.
• Fraud Detection Systems: Automated systems monitor account activity, login patterns, and transaction behaviour in real time to detect and flag anomalous activity consistent with unauthorised access or financial fraud.
• Staff Training: All grep89 personnel with access to personal data are trained in data protection responsibilities and information security practices on at least an annual basis.

Cookies & Tracking Technologies

grep89 uses cookies and similar technologies (including pixel tags, local storage objects, and device fingerprinting) to operate and improve the Platform. The categories of cookies used are described below.

You can manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary or fraud prevention cookies may impair your ability to use the Platform. Removing all cookies will log you out of your session.

Your Data Rights

As a data subject whose information is processed by grep89, you hold a number of rights with respect to your personal data. These rights are described below. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Request — [Right Type]". We will respond within 30 calendar days of receiving a verified request.

grep89 may need to verify your identity before processing certain rights requests to prevent unauthorised access to another person's data. Where a request is manifestly unfounded or excessive, grep89 reserves the right to charge a reasonable administrative fee or decline to act on the request, with written reasons provided.

Minors & Age Restriction

The grep89 Platform is strictly intended for adults who are 21 years of age or older. grep89 does not knowingly collect, process, or store personal data belonging to any individual under the age of 21. Registration on the Platform constitutes a warranty from you that you are at least 21 years of age.

Where grep89 reasonably suspects that an account is held by a person under 21, we will suspend the account immediately, conduct a KYC age-verification check, and — if the suspicion is confirmed — close the account, void any winnings, and securely delete the personal data of the minor in accordance with our retention obligations.

International Data Transfers

grep89 primarily stores and processes personal data on servers located within the Asia-Pacific region to ensure low-latency access for players in Indonesia. However, certain service providers and technology partners may process data on servers located outside Indonesia — for example, in Singapore, Hong Kong, or the European Union.

Where personal data is transferred to a country that does not offer an equivalent level of data protection, grep89 ensures that appropriate safeguards are in place. These safeguards may include standard contractual clauses, binding corporate rules, or reliance on an adequacy decision covering the destination country. A list of the countries to which data may be transferred and the corresponding safeguards is available upon written request submitted to our support email address.

Marketing Communications

grep89 may send you promotional communications — including bonus offers, free spin promotions, seasonal campaigns aligned with events such as Idul Fitri, Ramadhan, and Indonesian Independence Day (17 August), and personalised game recommendations — by email or in-Platform notification. Such communications are sent only where you have provided explicit consent during the registration process or at a subsequent opt-in point.

You may withdraw your consent to marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email.
• Updating your communication preferences from within your account settings.
• Contacting the support team at [email protected] with the subject line "Unsubscribe".

Withdrawal of marketing consent does not affect transactional communications — for example, deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — which are sent on the basis of contractual necessity and cannot be opted out of while your account remains active.

Policy Amendments

grep89 reviews this Privacy Policy at least annually and updates it whenever our data practices change in a material way. When we make significant changes, we will notify active account holders via their registered email address and update the "Last Updated" date displayed at the top of this page. The most current version of this Policy is always accessible at https://grep89.com/privacy-policy.

Your continued use of the Platform after the effective date of a revised Policy constitutes your acknowledgement of the changes. If you do not agree with any change, you have the right to close your account before the revised Policy takes effect by contacting the support team. Closure of your account does not affect the lawfulness of any processing carried out prior to closure.

Contact & Complaints

If you have questions about this Privacy Policy, wish to exercise a data subject right, or want to raise a concern about how grep89 handles your personal data, please reach out using the details below:

If you are not satisfied with grep89's response to a privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. grep89 will cooperate fully with any such supervisory authority investigation.