Privacy Policy — tgl158

This Privacy Policy applies to all personal data collected, processed, stored, or shared by tgl158 in connection with the operation of the tgl158 Platform accessible at https://tgl158.net (the "Platform"), including all subdomains, Progressive Web App (PWA) installations, and any digital interfaces operated under the tgl158 brand.

For the purposes of applicable data protection law, the data controller is tgl158 — the internationally licensed operator of the Platform. By registering an Account on the tgl158 Platform, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

This Privacy Policy should be read alongside the tgl158 Terms & Conditions, which govern the overall contractual relationship between tgl158 and its Members. In the event of any conflict between the two documents in respect of data-related matters, this Privacy Policy takes precedence.

tgl158 collects personal data across several categories, depending on how you interact with the Platform. The following table summarises the categories of data we collect and their primary sources:

tgl158 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data for identification purposes, except where expressly required for identity verification purposes under applicable law.

tgl158 collects personal data through the following channels:

• Direct submission by you: When you register an Account, complete your profile, submit KYC documents, make deposits or withdrawals, contact our support team, or respond to promotions, you directly provide us with personal data.
• Automated technical collection: As you navigate and use the Platform, our servers automatically collect technical data including your IP address, device identifiers, browser fingerprint data, and session behaviour. This occurs via server-side logging, cookies, and similar tracking technologies described in Section 8.
• Third-party identity verification providers: To comply with our KYC obligations, tgl158 may share identity information with licensed identity verification service providers, who in turn may return verification results or risk scores to us. These providers operate under strict data processing agreements with tgl158.
• Payment processors and banking partners: When you initiate a deposit or withdrawal via local bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processing partners share transaction confirmation data with us to credit or debit your Account accordingly.
• Fraud and risk intelligence feeds: tgl158 subscribes to commercially available fraud and risk intelligence services. These services may provide data points — such as known fraudulent IP ranges or device fingerprint risk scores — that are combined with your Account data to protect the integrity of the Platform.
• Game providers: Third-party game studios such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, Microgaming, and Spribe provide us with game session result data and, in live casino environments, may capture limited technical telemetry for game integrity purposes.

tgl158 processes your personal data only where a legitimate purpose and — where required — an appropriate legal basis exists. The following table maps our processing purposes to their corresponding legal basis:

Where tgl158 relies on your consent as the legal basis for any processing activity, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Consent withdrawal requests should be submitted via Account settings or by contacting our support team.

tgl158 does not sell your personal data. We share personal data with third parties only in the following circumstances, and only to the extent necessary for each specific purpose:

• Service Providers (Data Processors): We engage a limited number of trusted third-party service providers who process personal data on our behalf, under written data processing agreements that prohibit them from using your data for any purpose other than performing services for tgl158. These providers include KYC verification services, cloud infrastructure providers, fraud detection vendors, customer support platform operators, and email delivery services.
• Payment Partners: To facilitate deposits and withdrawals, we share the minimum necessary financial data with our banking and e-wallet partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja). These partners process your payment data under their own privacy policies and are independently regulated financial institutions.
• Game Providers: In delivering third-party game content, limited technical session data is shared with game studios (Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, Microgaming, Spribe) to enable game functionality, display real-time results, and calculate payouts. These studios do not receive your identity data beyond an anonymised session token.
• Regulatory Authorities and Law Enforcement: tgl158 may disclose personal data to governmental authorities, regulatory bodies, or law enforcement agencies where required by applicable law, a valid court order, or a binding regulatory directive. We will notify you of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of tgl158's business, personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.
• Dispute Resolution: Where a dispute is referred to our independent dispute resolution service as described in the Terms & Conditions, we may share relevant Account data with that service to enable a fair and informed resolution.

tgl158 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or our regulatory obligations under our international operating licence. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your membership and for a minimum of five (5) years following permanent account closure, in accordance with anti-money-laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, in compliance with international KYC and AML standards applicable to our operating licence.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction to support audit, compliance, and dispute resolution requirements.
• Gaming & Betting Logs: Retained for a minimum of three (3) years from the date of each game session or wager to support dispute resolution and responsible gaming monitoring.
• Support Communications: Retained for three (3) years from the date of the last communication in a support thread, unless the thread relates to a formal complaint or legal matter, in which case the retention period matches the applicable legal or regulatory requirement.
• Cookie and Technical Data: Session cookies are deleted when you close your browser. Persistent cookies and server log data are retained for periods of 13 months to 3 years depending on their category and purpose, as described in Section 8.

When personal data is no longer required for any legitimate purpose, tgl158 will securely delete or anonymise it. Anonymised data — from which you can no longer be identified — may be retained indefinitely for aggregate statistical analysis and platform improvement purposes.

tgl158 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our key technical and organisational security measures include:

• Transport Encryption: All data transmitted between your browser or device and the tgl158 Platform is encrypted using TLS 1.2 or higher with 256-bit encryption. Our SSL certificate is maintained at all times and any lapsed certificate is treated as a critical incident.
• Encrypted Data Storage: Sensitive data fields — including password hashes, payment account identifiers, and KYC document files — are stored in encrypted form using AES-256 or equivalent encryption standards in access-controlled server environments.
• Role-Based Access Control: Internal access to personal data is governed by a strict role-based access control (RBAC) model. Only personnel whose specific job function requires access to a given data category are granted that access, and all permissions are reviewed quarterly.
• Two-Factor Authentication (2FA): tgl158 strongly encourages all Members to enable 2FA on their Accounts via the security settings panel. 2FA is mandatory for all tgl158 internal staff with access to production systems containing Member data.
• Penetration Testing: The tgl158 Platform undergoes regular third-party penetration testing and vulnerability assessments. Critical and high-severity findings are remediated within defined SLA timeframes.
• Incident Response: tgl158 maintains a documented data breach response procedure. In the event of a personal data breach that poses a material risk to affected Members, we will notify impacted individuals as promptly as practicable following our discovery and assessment of the incident.

The tgl158 Platform uses cookies and similar tracking technologies to enable core functionality, maintain session state, detect fraud, and improve the Member experience. The following categories of cookies are deployed on the Platform:

tgl158 does not use third-party advertising cookies or retargeting pixels. We do not deploy cookies that track your browsing activity on other websites outside the tgl158 Platform domain.

You can manage cookie preferences through your browser's settings. Note that disabling strictly necessary or fraud detection cookies may impair your ability to log in, access your Account Balance, or place wagers on the Platform. tgl158 accepts no liability for diminished Platform functionality resulting from cookie restrictions applied by the Member.

As a Member of the tgl158 Platform, you hold the following rights in respect of the personal data we process about you. tgl158 is committed to facilitating the exercise of these rights promptly and without undue friction:

• Right of Access: You may request a copy of all personal data tgl158 holds about you, along with information about the purposes for which it is processed, the categories of data held, and the recipients with whom it has been shared. We will respond within 30 days of receiving a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For straightforward corrections (e.g., email address update), you may make changes directly via your Account profile settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to our legal retention obligations — for example, KYC records and financial transaction logs must be retained for a minimum of five years and cannot be deleted on request during that period.
• Right to Restriction: You may request that we restrict the processing of your personal data — meaning we store it but do not actively process it — where you contest its accuracy, where processing is unlawful but you oppose erasure, or where we no longer need the data but you require it for legal claims.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).
• Right to Object: You may object at any time to processing based on tgl158's legitimate interests. You also have an unconditional right to object to processing of your data for direct marketing purposes, and we will cease such processing immediately upon receiving your objection.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time via your Account settings or by contacting our support team. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request", including your registered username or email address for account identification. We may request additional verification before processing your request to protect against fraudulent access to Member data.

The tgl158 Platform is strictly intended for adults aged 21 years and over. tgl158 does not knowingly collect personal data from any individual under the age of 21. The 21+ minimum age threshold is enforced through our KYC verification process, which requires all Members to submit valid government-issued identity documentation confirming their date of birth before their Account is fully activated.

If tgl158 discovers, at any point, that personal data has been collected from an individual who was under 21 at the time of registration, we will immediately:

• Suspend the Account pending review;
• Initiate a refund of any real-money Balance to the source payment method where practicable;
• Permanently close the Account and delete all associated personal data, except where retention is required by law;
• Report the incident to our compliance team and, where required, to relevant regulatory authorities.

Parents and guardians are strongly encouraged to implement internet filtering and parental control tools on shared devices to prevent minors from accessing gambling websites. If you believe a minor has registered or attempted to register an Account on tgl158, please contact our support team immediately at [email protected].

The tgl158 Platform integrates third-party services to deliver game content, process payments, and maintain platform security. While tgl158 selects its third-party partners with care and requires all data processors to operate under contractual data protection obligations, tgl158 cannot accept responsibility for the independent data practices of these third parties in respect of data they collect directly from you outside the tgl158 Platform.

Key third-party integrations include:

• Game Studios: Pragmatic Play, Evolution Gaming, Pocket Games Soft (PG Soft), NetEnt, Microgaming, and Spribe provide game content via API integration. Game session data flows through tgl158's servers; however, these studios may maintain their own session logging for game integrity audit purposes.
• Payment Networks: Bank transfer and e-wallet integrations with BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja involve the respective financial institutions' own data processing activities, governed by their individual privacy policies.
• Identity Verification: Our KYC provider processes identity documents and returns a verification result to tgl158. Documents submitted for KYC are handled under strict data processing agreements and are not retained by the KYC provider beyond the period necessary to complete the verification.

tgl158 encourages Members to review the privacy policies of any third-party service they interact with directly, particularly their bank or e-wallet provider, to understand how those entities handle their personal data independently of the tgl158 Platform.

As an internationally licensed platform, tgl158 may process and store your personal data on servers located outside Indonesia. Where personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to the standards applicable in Indonesia, tgl158 will implement appropriate safeguards to protect the data during transfer and storage, including:

• Contractual data processing agreements incorporating standard data protection clauses;
• Transfer impact assessments where required to evaluate the risks associated with a specific transfer;
• Encryption of data in transit and at rest throughout the transfer chain.

By accepting this Privacy Policy, you acknowledge that your personal data may be transferred to, and processed in, countries outside Indonesia as described above. tgl158 is committed to ensuring that such transfers are conducted lawfully, securely, and with appropriate protections in place for your data.

tgl158 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulatory guidance, or improvements to our platform operations. The "Last Updated" date displayed at the top of this page will be revised each time a material change is made.

Where a change is material — meaning it affects the nature, scope, or legal basis of how we process your personal data in a way that could meaningfully affect your rights or expectations — tgl158 will provide advance notice of the change via a prominent on-platform notification and, where we hold a valid email address for your Account, by email to that address. The notice period for material changes will be a minimum of 14 days prior to the updated policy taking effect.

For non-material changes — such as corrections of typographical errors, clarifications of existing language, or administrative updates that do not alter the substance of our data practices — the updated policy will take effect immediately upon publication, without advance notice.

Your continued use of the tgl158 Platform after the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy. If you do not agree with the amended policy, you should cease using the Platform and may request Account closure by contacting our support team.

An archive of previous versions of this Privacy Policy is available on request by contacting [email protected] with the subject line "Privacy Policy Archive Request".

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way tgl158 processes your personal data, please do not hesitate to contact our dedicated privacy team using the details below:

• Email: [email protected] — please use the subject line "Privacy Enquiry" for fastest routing to our privacy team.
• Live Chat: Available 24/7 directly on the tgl158 Platform, with Indonesian-speaking agents available across all time zones (WIB, WITA, and WIT), including on public holidays such as Idul Fitri, Nyepi, and Indonesian Independence Day.

We aim to acknowledge all privacy-related enquiries within 2 business days and to provide a substantive response within 30 days of receiving a verified, complete request. For complex requests involving large volumes of data or requiring legal review, we may extend the response period by a further 30 days and will notify you accordingly.