Privacy Policy

In this Privacy Policy, the following terms carry the meanings assigned to them below. Where a term is already defined in the gsc108 Terms & Conditions, it carries the same meaning here unless this Policy expressly states otherwise.

• "Platform" means the gsc108 website accessible at gsc108.asia, including all sub-pages, account dashboards, game lobbies, and any associated mobile-optimised interfaces.
• "Member" / "you" means any natural person who has registered a Member Account on the Platform or who browses the Platform without a registered account.
• "Personal Data" means any information that identifies or can reasonably be used to identify you as an individual, including your name, email address, mobile number, national identity number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data — including collection, storage, use, disclosure, transfer, and deletion.
• "Third-Party Processor" means any external company that processes Personal Data on behalf of gsc108 under a binding data processing agreement, including payment providers, identity verification services, and game studios.
• "Cookies" means small text files placed on your device by the Platform to enable session management, preference storage, and analytics functions.
• "KYC" means Know Your Customer — the identity verification procedures gsc108 applies in accordance with applicable anti-money-laundering and responsible gaming obligations.

gsc108 operates as the data controller in respect of all Personal Data collected through the Platform. As data controller, gsc108 determines the purposes and means of Processing your Personal Data and is responsible for ensuring that such Processing is carried out lawfully, fairly, and transparently.

All data protection enquiries, access requests, and complaints should be directed to the gsc108 support team using the contact details provided in Clause 14 of this Policy. gsc108 will acknowledge all data-related enquiries within 24 hours and respond substantively within five business days.

gsc108 collects Personal Data through several channels: directly from you when you register or interact with the Platform, automatically through your use of the Platform, and from third-party sources where permitted by applicable law. The categories of data we collect are set out below.

3.1 Registration & Account Data

When you create a Member Account, we collect the information you provide in the registration form, including:

• Full legal name (as it appears on your national identity document);
• Date of birth (used to verify that you meet the 21+ age requirement);
• Residential address in Indonesia;
• Email address;
• Mobile phone number registered with an Indonesian carrier;
• Username and encrypted password.

3.2 KYC & Identity Verification Data

To comply with our anti-money-laundering obligations and to protect Members from fraud, we collect identity documents as part of the KYC process, which may include:

• National Identity Card (KTP) — front and back scan or photograph;
• Passport data page, where KTP is unavailable;
• Selfie photograph for liveness verification;
• Bank account or e-wallet statement confirming ownership of the payment method registered on your Account.

3.3 Financial Transaction Data

When you make a deposit or withdrawal, we record details of the transaction, including the payment channel used (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja), the transaction amount in IDR, the timestamp, and any reference numbers assigned by your bank or e-wallet provider. We do not store full bank account passwords, card PINs, or e-wallet PINs.

3.4 Gameplay & Wagering Data

We maintain records of all bets placed, games played, game session durations, win/loss outcomes, and bonus redemptions. These records are required for bet-settlement audit purposes, responsible gaming monitoring, and regulatory compliance.

3.5 Technical & Device Data

When you access the Platform, our servers automatically log certain technical data, including:

• IP address and approximate geolocation (city-level, derived from IP);
• Device type, operating system, and browser version;
• Pages visited, time on page, and navigation path through the Platform;
• Session start and end times;
• Referring URL (the page you visited immediately before arriving at gsc108.asia).

3.6 Communications Data

We retain records of communications between you and gsc108, including support chat transcripts, emails, and any complaint or dispute correspondence. These records are used to resolve disputes, train support staff, and improve service quality.

gsc108 uses the Personal Data we collect for the following purposes. Each purpose is matched to a legal basis, as detailed in Clause 5.

• Account Management: Creating and maintaining your Member Account, authenticating your identity at login, and communicating essential account notices (e.g., password-reset emails, deposit confirmations, withdrawal status updates).
• Transaction Processing: Facilitating deposits and withdrawals through your chosen IDR payment channel and maintaining accurate financial records of all transactions on your Account.
• KYC & Compliance: Verifying your identity and age before approving withdrawals, complying with anti-money-laundering obligations, and detecting and preventing fraud, match-fixing, and bonus abuse.
• Responsible Gaming: Monitoring gameplay patterns to identify potential signs of problem gambling, enforcing deposit limits and self-exclusion orders, and providing proactive outreach where our responsible gaming algorithms flag a Member as at-risk.
• Customer Support: Responding to your enquiries, resolving disputes, and processing formal complaints through our internal complaints procedure.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the layout, performance, and content of the Platform, and to develop new products and features that better serve Indonesian players.
• Marketing Communications: Sending you promotional offers, bonus notifications, and seasonal campaign emails — but only where you have given your prior consent to receive such communications. You may withdraw consent at any time (see Clause 10).
• Security: Detecting and investigating suspicious login activity, account takeover attempts, and any other security threats to the Platform or to individual Member accounts.

gsc108 processes your Personal Data under one or more of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and gsc108 (i.e., the Terms & Conditions you accept at registration), including account creation, transaction processing, and KYC verification.
• Legal Obligation: Processing required to comply with applicable law, including anti-money-laundering obligations, responsible gaming regulations, and any lawful data request from a competent authority.
• Legitimate Interests: Processing necessary for gsc108's legitimate business interests, including fraud prevention, platform security, and service improvement — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent, including the sending of marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

gsc108 does not sell or rent your Personal Data to third parties. We share data only in the limited circumstances described below, and always under strict controls designed to protect your privacy.

6.1 Payment Processors

To facilitate IDR deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja, gsc108 must transmit certain transaction data — including your name, account number, and transaction amount — to the relevant payment processor. These providers operate under their own privacy policies and are bound by applicable Indonesian banking and e-money regulations.

6.2 Identity Verification Providers

gsc108 works with certified third-party KYC service providers to automate and streamline the identity verification process. These providers receive your identity document images and biometric liveness data solely for the purpose of verifying your identity. They are prohibited from using this data for any other purpose.

6.3 Game Studios

Third-party game studios integrated into the Platform (including Evolution Gaming, Pragmatic Play, PG Soft, Microgaming, Habanero, and Spribe) receive a pseudonymous player identifier and session token to render game sessions. They do not receive your full name, national identity number, or financial account details.

6.4 Law Enforcement & Regulatory Authorities

gsc108 will disclose Personal Data to law enforcement agencies, financial intelligence units, or other competent authorities when required to do so by law, court order, or in response to a lawful investigation into suspected money laundering, fraud, or other criminal activity. We will notify you of such disclosure where legally permitted to do so.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a substantial part of gsc108's business assets, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change to the way your data is processed as a result.

gsc108 uses cookies and similar technologies (including local storage tokens and session pixels) to operate the Platform effectively and to improve your experience. The types of cookies we use are described below.

Most web browsers allow you to control cookie storage through their settings menus. Clearing cookies will log you out of the Platform and reset your functional preferences. gsc108 does not use cookies for cross-site behavioural advertising.

gsc108 retains your Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The general retention periods applicable to each category of data are summarised in the table in Clause 3 above.

Where you request deletion of your Personal Data (see Clause 10), gsc108 will action the request within 30 days, subject to the following exceptions:

• Data that gsc108 is legally obliged to retain (e.g., financial transaction records required for AML compliance) will be retained for the full statutory retention period regardless of a deletion request.
• Data required to resolve an open dispute or complaint will be retained until the dispute is closed and the applicable appeal period has elapsed.
• Anonymised or aggregated data that cannot be linked back to any individual will not be subject to deletion requests, as it falls outside the definition of Personal Data.

gsc108 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our key security measures include:

• TLS/SSL Encryption: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher. Our SSL certificate is publicly verifiable via your browser's padlock indicator.
• Encryption at Rest: Sensitive Personal Data stored in our databases — including identity document images, KYC records, and financial transaction data — is encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to Personal Data within gsc108 is restricted on a strict need-to-know basis. Staff members are granted the minimum level of data access necessary for their role. All data access is logged and subject to periodic audit.
• Password Security: Member passwords are stored as salted hashes using a bcrypt or equivalent one-way hashing algorithm. gsc108 staff cannot retrieve your plaintext password; they can only reset it.
• Incident Response: gsc108 maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights, we will notify affected Members without undue delay and implement all reasonable steps to contain and remediate the breach.
• Third-Party Security Audits: Our Platform and infrastructure undergo periodic security assessments by independent third-party security specialists. Critical findings are remediated on a priority basis.

As a Member of gsc108, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request" and a description of the right you wish to exercise. We will respond within five business days.

• Right of Access: You have the right to request a copy of the Personal Data gsc108 holds about you, together with an explanation of how it is being used.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held in your Account. For certain data fields (such as your registered name), a supporting document may be required to process the correction.
• Right to Erasure: You have the right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. Erasure requests are subject to statutory retention requirements as described in Clause 8.
• Right to Restriction: You have the right to request that gsc108 restrict the Processing of your Personal Data in certain circumstances — for example, while a rectification request is being assessed, or where you contest the legal basis for Processing.
• Right to Data Portability: Where Processing is based on your consent or on a contractual necessity, you have the right to receive a copy of your Personal Data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).
• Right to Object: You have the right to object to Processing carried out on the basis of gsc108's legitimate interests. Upon receiving an objection, gsc108 will cease Processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where Processing is based on your consent (e.g., receipt of marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of Processing carried out before the withdrawal.

The gsc108 Platform is strictly for adults aged 21 years and above. gsc108 does not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory step in the registration and KYC process, and gsc108 employs automated systems to detect and flag accounts that may be held by or on behalf of minors.

If gsc108 discovers or is notified that Personal Data has been collected from a person under the age of 21, the relevant Account will be closed immediately, all funds will be handled in accordance with our terms for underage account closure, and all Personal Data associated with the account will be deleted from our systems as expeditiously as possible.

gsc108 operates with infrastructure and third-party service providers that may be located outside of Indonesia. When your Personal Data is transferred to a jurisdiction outside of your country of residence, gsc108 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that applied within Indonesia.

Safeguards used for international transfers include:

• Binding contractual clauses incorporated into all data processing agreements with Third-Party Processors located outside Indonesia;
• Transfers limited exclusively to jurisdictions with internationally recognised data protection frameworks;
• Encryption of all data in transit across international network boundaries.

In all cases, the volume of data transferred internationally is limited to the minimum necessary for the specific processing purpose. Identity documents and full KYC records are stored on servers located within the Region, wherever technically feasible.

gsc108 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, Platform functionality, data processing practices, or regulatory guidance. When material changes are made, we will notify Members by displaying a prominent notice on the Platform and, where practicable, by sending a notification to your registered email address.

The revised Policy will take effect from the date indicated in the "Last Updated" notice at the top of this page. Your continued use of the Platform after that date constitutes your acknowledgement of the revised Policy. We encourage you to review this page periodically so that you remain informed of how gsc108 protects your Personal Data.

For any questions, concerns, or requests relating to this Privacy Policy or to the Personal Data gsc108 holds about you, please contact our support team using the details below. All data protection enquiries are handled by trained staff and will be acknowledged within 24 hours.