air168 Privacy Policy

1 Introduction

air168 is an internationally licensed online betting and casino platform serving English-preference players across Indonesia. As part of delivering our services — including sports betting, live casino, togel (Indonesia's traditional numbers-prediction lottery) draw markets, and slot games — we necessarily process certain personal data relating to the players who use our platform.

We take this responsibility seriously. air168's data handling practices are designed to be proportionate, transparent, and limited to what is genuinely necessary for the purposes set out in this Policy. We do not treat your personal data as a commercial asset, and we will never sell or rent it to third parties.

This Policy applies to all personal data collected through the air168 website, mobile-optimised web application, customer support channels, and any other point of contact between you and air168. It should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference into the overall agreement governing your use of the platform.

2 Definitions

In this Privacy Policy, the following terms have the meanings given below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means air168, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of air168 under a contractual arrangement.
• "Account" means the individual player account you hold on the air168 platform.
• "KYC" (Know Your Customer) means the identity and address verification process applied to all registered players before withdrawals are permitted.
• "Cookies" means small text files placed on your device by the air168 platform to support session management, analytics, and functional preferences.
• "WIB" means Western Indonesia Time (UTC+7), the default time zone used by air168 for operational and customer service purposes.

3 Data We Collect

3.1 Data You Provide Directly

When you register, verify your identity, make deposits or withdrawals, contact support, or participate in promotions, you provide us with data including:

• Identity data: full legal name, date of birth, nationality, and government-issued ID number (as appearing on your KTP, passport, or driving licence).
• Contact data: residential address in Indonesia, email address, and mobile phone number.
• Financial data: bank account details (bank name, account number, account holder name) for payment methods such as BCA, BRI, BNI, Mandiri, CIMB Niaga, and OCBC NISP; e-wallet registration details for OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC documents: scanned copies or photographs of your national identity card (KTP), passport, driving licence, and/or proof-of-address documents.
• Support correspondence: messages, emails, and chat transcripts exchanged between you and the air168 customer support team.

3.2 Data We Collect Automatically

When you access and use the air168 platform, we automatically collect certain technical and behavioural data, including:

• Device and access data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage data: pages visited, features accessed, time and duration of sessions, game history, betting activity, deposit and withdrawal transactions, and navigation paths.
• Location data: approximate geographic location derived from your IP address, used to apply jurisdiction-based access controls and display relevant local payment methods.
• Cookie and tracking data: session tokens, authentication cookies, and analytics identifiers as described in Section 7 of this Policy.

3.3 Data from Third Parties

In limited circumstances, air168 may receive Personal Data about you from third parties, including:

• Identity verification providers used for KYC screening, who may confirm or supplement the identity data you provide at registration.
• Payment processors and local Indonesian banking partners who confirm transaction status and flag potentially fraudulent activity.
• Fraud prevention and anti-money-laundering (AML) databases that may indicate whether an individual appears on sanctions lists or watchlists.

4 How We Use Your Data

air168 uses the personal data it collects for the following purposes, each of which is supported by a lawful basis described in Section 5:

• Account management: creating and maintaining your Account, authenticating your identity at login, and managing your profile and preferences.
• Transaction processing: facilitating deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and other supported Indonesian payment methods.
• KYC and age verification: confirming that you are at least 21 years of age and a resident of Indonesia, and verifying that your identity matches the payment methods used on your Account.
• Fraud prevention and AML compliance: monitoring transactions and account activity for patterns consistent with fraud, money laundering, or other prohibited conduct.
• Responsible gaming: monitoring play patterns to identify potential problem gambling behaviours, applying self-imposed limits and restrictions, and contacting players who may benefit from support resources.
• Customer support: responding to enquiries, resolving disputes, and processing formal complaints.
• Platform improvement: analysing aggregated, anonymised usage data to improve platform performance, game offerings, and user experience.
• Marketing communications: where you have provided explicit consent, sending you promotional offers, bonus notifications, and product updates by email or SMS. You may withdraw consent at any time by contacting support.
• Legal compliance: fulfilling obligations under applicable laws and regulatory requirements, including record-keeping obligations imposed by air168's licensing authority.

5 Legal Basis for Processing

air168 processes your personal data on one or more of the following legal bases, depending on the specific purpose:

• Contractual necessity: processing required to perform the contract between you and air168 (i.e., operating your Account, processing bets, and handling deposits and withdrawals).
• Legitimate interests: processing necessary for air168's legitimate business interests, including fraud prevention, platform security, and improving service quality, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: processing required to comply with applicable laws, including KYC, AML, and record-keeping obligations mandated by air168's licensing authority.
• Consent: where we rely on your consent (principally for direct marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing & Third Parties

air168 does not sell your personal data. We share it only in the circumstances described below and only to the extent strictly necessary:

6.1 Service Providers (Data Processors)

We engage third-party service providers who process personal data on our behalf under written data processing agreements. These include:

• KYC and identity verification providers.
• Payment processing partners facilitating transactions via Indonesian banks and e-wallets.
• Cloud hosting and infrastructure providers on whose servers the platform operates.
• Customer support software providers that host chat and ticket management systems.
• Analytics providers whose tools generate aggregated, anonymised usage reports (no individually identified data is shared for analytics purposes).

All service providers are contractually prohibited from using your personal data for any purpose beyond the specific service they deliver to air168.

6.2 Regulatory and Legal Disclosures

air168 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required or permitted by law, including in response to valid legal process or to fulfil obligations under anti-money-laundering regulations applicable under air168's international gaming licence.

6.3 Business Transfers

In the event that air168 undergoes a merger, acquisition, or sale of all or substantially all of its assets, player personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the applicable privacy terms via email and/or a prominent notice on the platform before the transfer takes effect.

7 Cookies & Tracking Technologies

air168 uses cookies and similar tracking technologies to operate the platform, maintain your session, and understand how players interact with our services. The table below summarises the categories of cookies we use:

Category	Purpose	Retention	Type
Session Cookies	Maintain your login state across pages during a single browsing session.	Deleted on browser close	Essential
Authentication Tokens	Remember your login credentials if you select "Stay signed in" to avoid re-entering details at each visit.	Up to 30 days	Essential
Security Cookies	Detect and prevent fraudulent login attempts, cross-site request forgery, and automated account access.	Session / persistent	Essential
Preference Cookies	Remember your display preferences such as language selection, odds format, and game lobby filters.	Up to 12 months	Functional
Analytics Cookies	Collect anonymised data on page views, session duration, and feature usage to improve platform performance and content.	Up to 24 months	Analytics
Responsible Gaming Cookies	Track session duration locally to support time-limit reminders and responsible gaming tools set by you.	Session / persistent	Functional

Essential cookies cannot be disabled as they are required for the platform to function. Functional and analytics cookies may be declined by adjusting your browser settings or by contacting air168 support to update your preferences. Disabling analytics cookies will not affect your ability to place bets, make deposits, or access any other core platform feature.

8 Data Retention

air168 retains personal data only for as long as is necessary for the purpose for which it was collected, subject to any legal or regulatory retention obligations that may require a longer retention period. Our general retention schedules are as follows:

• Account data and KYC documents: retained for the duration of your Account's active life, plus a minimum of five (5) years following Account closure, to comply with AML record-keeping requirements applicable under our licensing terms.
• Transaction records: retained for a minimum of five (5) years from the date of each transaction, consistent with financial record-keeping obligations.
• Support correspondence: retained for three (3) years from the date of the last interaction, unless the correspondence relates to a formal complaint or legal matter, in which case it is retained for the duration of that matter plus two (2) years.
• Marketing consent records: retained for the duration of active consent plus two (2) years following withdrawal of consent, as evidence of compliance.
• Analytics data: aggregated and anonymised within twenty-four (24) months of collection; anonymised data may be retained indefinitely as it no longer constitutes personal data.

At the end of the applicable retention period, personal data is either securely deleted from air168 systems or, where deletion is not technically practicable in the short term, rendered inaccessible and scheduled for deletion at the next practicable opportunity.

9 Your Rights

As a data subject, you hold a number of rights with respect to the personal data that air168 processes. These rights are summarised below. To exercise any of them, contact the air168 support team with the subject line "Data Rights Request — [your Account username]". We will respond within thirty (30) calendar days.

10 Security Measures

air168 implements a layered set of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Transport encryption: all data transmitted between your browser or device and our servers is encrypted using TLS 1.2 or higher (256-bit SSL), regardless of whether you are using a desktop browser or a mobile connection.
• Data-at-rest encryption: sensitive data fields — including KYC documents, payment method details, and identity numbers — are encrypted using AES-256 at the database level.
• Access controls: internal access to personal data is restricted on a strict need-to-know basis. Staff access is logged, reviewed regularly, and revoked immediately upon role change or departure.
• Two-factor authentication: air168 supports and encourages two-factor authentication (2FA) for all registered Accounts as an additional layer of login security.
• Penetration testing and vulnerability scanning: the platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: air168 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players and the relevant authority within the timeframes required by applicable law.

While air168 takes all reasonable precautions, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own Account credentials. If you suspect that your Account has been compromised, contact air168 support immediately.

11 Children's Privacy

The air168 platform is strictly for adults aged 21 and over. We do not knowingly collect or process personal data from any individual under the age of 21. If we discover or are notified that an Account has been created by a person under 21, we will immediately suspend that Account, void any associated activity, and delete or securely return any personal data collected in connection with it.

If you believe that a minor has registered an Account on air168, please notify us immediately at the contact details provided in Section 14. We treat all such reports as urgent and will act on them without delay.

12 International Data Transfers

air168 operates on infrastructure hosted in data centres that may be located outside Indonesia. Where personal data is transferred to a country that does not provide a level of data protection equivalent to the standards applied by air168, we ensure that appropriate safeguards are in place prior to the transfer. These safeguards include contractual clauses that bind the recipient to data protection obligations consistent with those set out in this Policy.

By registering an Account and using the air168 platform, you acknowledge that your personal data may be transferred to and processed in countries other than Indonesia for the purposes described in this Policy, subject always to the safeguards described above.

13 Amendments to This Policy

air168 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make a material change to this Policy, we will notify you by email to the address registered on your Account and/or by a prominent notice on the platform at least seven (7) days before the change takes effect.

The date at the top of this Policy indicates when it was last updated. Your continued use of the air168 platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you may close your Account by contacting support.

14 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a potential data breach or a minor's Account, please reach out to the air168 team through the following channels:

For information on how to set deposit limits, request self-exclusion, or access other responsible gaming tools, please visit our Responsible Gaming page.