Privacy Policy

Introduction & Scope

1.1  pik168 is committed to protecting the privacy and personal data of every Member. This Policy applies to all personal data processed in connection with your use of the pik168 Platform, including the website at https://pik168.app, any associated mobile application, live chat services, and all communications between you and pik168's customer support team.

1.2  This Policy should be read alongside the pik168 Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions regarding data privacy matters, this Policy shall take precedence.

1.3  pik168 primarily serves Members based in Indonesia. Where Indonesian data protection law imposes obligations on pik168 in its capacity as a data controller, pik168 will comply with those obligations to the extent applicable.

Data Controller

2.1  For the purposes of this Policy, pik168 acts as the data controller in respect of the personal data it collects directly from Members through the Platform and through its customer support channels.

2.2  Where pik168 engages third-party service providers — such as payment processors, identity verification bureaus, or fraud prevention services — those parties process data as data processors acting under pik168's instructions. pik168 remains responsible for ensuring that such processors maintain standards of data protection equivalent to those described in this Policy.

2.3  For all data-related enquiries, Members may contact pik168 directly at [email protected].

Data We Collect

3.1  pik168 collects the following categories of personal data from Members:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification.
• Date of birth (used for mandatory 21+ age verification).
• Residential address in Indonesia (street, city, province, postal code).
• Email address and any secondary contact details you provide.
• Phone number, where provided voluntarily or as required for account verification.

3.2 Financial Data

• Indonesian bank account details used for deposits and withdrawals (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI).
• E-wallet identifiers associated with OVO, DANA, GoPay, ShopeePay, or LinkAja accounts registered in your name.
• Transaction history, including deposit amounts, withdrawal requests, and bonus credits, all denominated in Indonesian Rupiah (IDR).

3.3 Identity Verification (KYC) Data

• Copies of government-issued photo identification (KTP, passport, or SIM).
• Proof of address documents (utility bills, bank statements, government correspondence).
• Selfie or liveness-check images where required by our verification provider.

3.4 Technical & Usage Data

• IP address and approximate geolocation derived from it.
• Device type, operating system, and browser version.
• Pages visited, features used, session duration, and clickstream data.
• Login timestamps, session identifiers, and authentication logs.

3.5 Communications Data

• Content of live chat transcripts, support emails, and any other written correspondence with pik168 staff.
• Survey responses, feedback submissions, and promotional opt-in records.

How We Collect Data

4.1  pik168 collects personal data through the following means:

• Direct submission: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or responding to a promotion.
• Automated collection: Technical and usage data collected automatically via server logs, session cookies, analytics pixels, and similar technologies when you browse or interact with the Platform.
• Third-party sources: Identity and fraud-screening data received from KYC bureaus, payment processors, and anti-money-laundering databases where pik168 is legally required or contractually authorised to verify your information through such channels.

How We Use Your Data

5.1  pik168 uses personal data for the following purposes:

5.2  pik168 will not use your personal data for any purpose that is materially different from those listed above without first obtaining your explicit consent or establishing an alternative legal basis as described in Section 6.

Legal Basis for Processing

6.1  pik168 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the Account agreement with you — including registration, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering obligations, age verification requirements, and financial record-keeping duties.
• Legitimate interests: Processing carried out for pik168's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your rights and interests.
• Consent: Processing carried out solely on the basis of your freely given, specific, and informed consent — principally for marketing communications and certain non-essential analytics. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Data Sharing & Third Parties

7.1  pik168 does not sell, rent, or otherwise commercially exploit your personal data. Data may be shared with the following categories of third-party recipients, strictly on a need-to-know basis and subject to data processing agreements:

• Payment processors: Indonesian bank transfer intermediaries and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate IDR transactions.
• KYC and identity verification providers: Third-party bureaus that verify government-issued identification documents and perform liveness checks as part of the KYC process.
• Fraud and AML screening services: Providers that screen transactions and Member profiles against sanctions lists and fraud databases.
• Cloud infrastructure and hosting providers: Parties that store and process data on pik168's behalf under strict data processing agreements and security controls.
• Customer support platforms: Live chat and ticketing software providers used to manage Member communications.
• Legal and regulatory authorities: Where pik168 is required by law, court order, or regulatory directive to disclose Member data.

7.2  All third-party processors engaged by pik168 are required to implement technical and organisational security measures consistent with those applied by pik168 itself and to process data solely in accordance with pik168's documented instructions.

International Data Transfers

8.1  As an international online gaming platform serving Members in Indonesia, some of the third-party processors described in Section 7 may be located outside Indonesia. Where personal data is transferred internationally, pik168 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by a recognised data protection authority.
• Transfers to countries or organisations that the relevant data protection authority has determined provide an adequate level of protection.
• Binding corporate rules where the recipient is part of the same corporate group as pik168.

8.2  You may request details of the safeguards in place for any specific international transfer by contacting [email protected].

Data Retention

9.1  pik168 retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account data: Retained for the full duration of your Account membership and for a minimum of five (5) years following Account closure, to satisfy AML and financial record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years following Account closure or the date of the relevant transaction, in accordance with applicable anti-money-laundering regulations.
• Transaction records: Retained for a minimum of five (5) years following the date of each transaction.
• Support communications: Retained for three (3) years following the resolution of the relevant support interaction, unless a longer period is required by law.
• Marketing consent records: Retained for the duration of your marketing consent and for two (2) years following withdrawal of consent, as evidence of the original consent.
• Technical and session logs: Retained for up to thirteen (13) months for security monitoring and performance analysis purposes, then deleted or anonymised.

9.2  When personal data is no longer required, pik168 will securely delete or anonymise it so that it can no longer be associated with any identifiable individual.

Cookies & Tracking Technologies

10.1  pik168 uses cookies and similar tracking technologies on the Platform. The following categories of cookies may be active during your visit:

• Strictly necessary cookies: Essential for the Platform to function. These include session management tokens, authentication cookies, and security cookies. These cannot be disabled without materially impairing Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, display options, and game history, to provide a more personalised experience.
• Analytics cookies: Used to collect anonymised data about how Members use the Platform — which pages are visited most frequently, where users encounter errors, and how navigation flows are completed. This data is aggregated and does not identify individual users.

10.2  You may manage or disable non-essential cookies through your browser settings at any time. Disabling analytics or functional cookies will not prevent you from using the Platform's core services but may limit certain personalisation features.

Security Measures

11.1  pik168 implements a layered security architecture to protect Member data against unauthorised access, accidental loss, disclosure, or destruction. Key technical and organisational measures include:

• 256-bit TLS encryption on all data in transit between your device and pik168 servers.
• AES-256 encryption for sensitive data stored at rest, including financial records and KYC documents.
• Multi-factor authentication (MFA) required for all pik168 administrative access to production systems.
• Role-based access controls ensuring that staff can only access the Member data necessary for their specific job function.
• Regular independent security audits and penetration testing of the Platform infrastructure.
• Automated anomaly detection and real-time alerting for suspicious login activity or unusual transaction patterns.

11.2  While pik168 takes all reasonable precautions, no online platform can guarantee absolute security. In the event of a data breach that poses a significant risk to your rights and interests, pik168 will notify affected Members and relevant authorities within the timeframe required by applicable law.

11.3  Members are strongly encouraged to use a unique, strong password for their pik168 Account and to enable two-factor authentication where available. If you suspect that your Account has been compromised, contact [email protected] immediately with the subject line "URGENT — Account Security".

Your Rights

12.1  Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data pik168 holds about you:

• Right of Access: You may request a copy of the personal data pik168 holds about you, along with information about how it is processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated. You can update basic account information (email address, contact number) directly via your Account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful — subject to pik168's legal obligations to retain data for AML and regulatory compliance.
• Right to Restriction: You may request that pik168 temporarily restrict processing of your data where you contest its accuracy, where processing is unlawful but you oppose erasure, or where pik168 no longer needs the data but you require it for legal claims.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a structured, machine-readable copy of the personal data you provided to pik168.
• Right to Object: You may object at any time to processing based on legitimate interests, including profiling for direct marketing purposes. If you object to marketing, pik168 will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

12.2  To exercise any of the rights described above, submit a written request to [email protected]. pik168 will respond within thirty (30) calendar days of receiving a verifiable request. In complex or high-volume cases, we may extend this period by a further thirty (30) days, with notice to you.

12.3  pik168 will not charge a fee for exercising your rights unless a request is manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable administrative fee or decline to act on the request.

Children & Minors

13.1  The pik168 Platform is strictly intended for individuals who are 21 years of age or older. pik168 does not knowingly collect personal data from any person under the age of 21.

13.2  If pik168 becomes aware that an Account has been registered by or on behalf of a person under 21, the Account will be suspended immediately, all Bonus balances will be forfeited, and any deposited funds will be returned to the original payment source following identity verification of the account holder.

13.3  If you have reason to believe that a minor has registered with pik168 using false information, please notify us immediately at [email protected].

Amendments to This Policy

14.1  pik168 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. The revised Policy will be published at https://pik168.app/privacy-policy with an updated effective date.

14.2  Where changes are material — meaning they significantly affect how we process your personal data or the rights available to you — pik168 will notify active Members by email at least fourteen (14) days before the changes take effect. Your continued use of the Platform after the effective date of any amended Policy constitutes acceptance of the revised terms.

14.3  We encourage you to review this page periodically. The current effective date is always displayed at the top of the Policy.

Contact & Complaints

15.1  For any questions, concerns, or requests relating to this Privacy Policy or the way pik168 processes your personal data, please contact our support team:

15.2  If you are unsatisfied with pik168's response to a privacy concern, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.

This Privacy Policy was last updated on 1 January 2026. For related policies, please see our Terms & Conditions, Responsible Gaming Policy, and FAQ.