Privacy Policy
Your Data, Our Responsibility

This Privacy Policy applies to all personal data collected, processed, and stored by grap89 in connection with the operation of the grap89 platform accessible at grap89.bet. It covers data collected through the website, mobile-optimized versions of the platform, live chat interactions, email correspondence, and any other channel through which you communicate with or provide information to grap89.

For the purposes of this Policy, grap89 acts as the data controller — the entity that determines the purposes and means of processing your personal data. grap89 is licensed and regulated internationally as a remote gaming operator. The platform is directed primarily at players located in Indonesia, and this Policy reflects the data protection standards appropriate to that market context.

This Policy does not apply to third-party websites or services that may be referenced on the platform. grap89 is not responsible for the privacy practices of any third-party game studio (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) whose game content is accessible through the platform, though grap89 conducts due diligence on all technology partners to ensure adequate data protection standards are maintained.

grap89 collects personal data through several channels during the course of account registration, gameplay, and customer support interactions. The categories of data collected are described below:

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you access the grap89 platform, certain technical data is collected automatically by our servers and analytics systems:

• Device & Technical Data: IP address, device type, operating system version, browser type and version, screen resolution, and time zone setting.
• Usage Data: Pages visited, games played, betting history, session duration, click-path data, and feature interactions within the platform.
• Location Data: General geographic location inferred from IP address (country and city level). grap89 does not use GPS-level precise location data.
• Cookie & Tracking Data: Session cookies, persistent cookies, and similar tracking technologies as described in Section 9 of this Policy.

grap89 uses your personal data for the following specific purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent or updating this Privacy Policy with adequate notice.

• Account management: Creating, maintaining, and securing your grap89 account; verifying your identity at registration and during KYC; processing password reset requests; and communicating account-related updates via email.
• Transaction processing: Processing deposits and withdrawals via Indonesian bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Danamon) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); reconciling balances; and maintaining auditable transaction records.
• Regulatory compliance: Fulfilling Know Your Customer (KYC) and anti-money laundering (AML) obligations required under grap89's international gaming license; retaining records as required by applicable law; and responding to lawful requests from competent authorities.
• Fraud prevention and security: Detecting and preventing fraudulent transactions, multi-accounting, bonus abuse, collusion, unauthorized account access, and other forms of Prohibited Conduct as defined in the Terms & Conditions.
• Platform improvement: Analyzing aggregated usage data and gameplay patterns to improve platform performance, user experience, game selection, and the responsiveness of the live betting interface.
• Responsible gaming: Monitoring betting patterns to identify indicators of problem gambling; delivering reality-check notifications; and administering deposit limits, loss limits, self-exclusion, and time-out tools in accordance with grap89's responsible gaming commitments.
• Customer support: Responding to support queries submitted via live chat or email; resolving disputes; and maintaining a record of communications for quality assurance and dispute resolution purposes.
• Marketing communications: Sending you promotional emails about bonuses, seasonal offers (including those tied to Idul Fitri, Ramadhan, and Indonesian Independence Day), and new game launches — but only where you have opted in to receive such communications. You may unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting support.

grap89 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

grap89 does not sell or trade your personal data. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors: To process deposits and withdrawals, grap89 shares the minimum necessary financial identifiers with licensed payment gateway providers that handle transactions for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja. All payment processors used by grap89 are contractually bound to process your data solely for payment purposes and to maintain equivalent data security standards.
• KYC and identity verification providers: grap89 may use licensed third-party identity verification services to assist with document authentication and age verification checks. These providers process your KYC documents only for verification purposes and are prohibited from using your data for any other purpose.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a pseudonymous player identifier and session token for the purpose of delivering game content and maintaining game-session integrity. They do not receive your full name, contact details, or financial information.
• Regulatory and licensing authorities: grap89 may be required to disclose player data to its licensing authority or to financial intelligence units as part of AML/CFT reporting obligations. Such disclosures are made only where legally required and to the minimum extent necessary.
• Law enforcement and legal proceedings: grap89 will disclose personal data in response to a valid court order, subpoena, or other lawful legal process. Where legally permitted, grap89 will notify the affected player before making such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of grap89's assets, your personal data may be transferred to the acquiring entity. grap89 will provide at least 30 days' notice via email before any such transfer occurs, and the acquiring entity will be required to honor the commitments made in this Privacy Policy.

grap89 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and our licensing obligations. The specific retention periods that apply to different categories of data are as follows:

Upon expiry of the applicable retention period, grap89 will securely delete or anonymize your personal data so that it can no longer be associated with you as an individual. Where complete deletion is not immediately technically feasible (for example, data held in encrypted backup archives), the data will be isolated from active processing and queued for deletion at the next scheduled backup purge cycle, which occurs no less frequently than every 90 days.

If you request Account closure, grap89 will cease all active processing of your data for marketing and profiling purposes immediately. Your identity and financial data will be retained for the regulatory periods described above but will not be used for any operational purpose beyond compliance and legal obligations during that period.

grap89 implements a comprehensive, layered security framework to protect your personal data against unauthorized access, accidental loss, destruction, and disclosure. Our key security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or mobile device and grap89's servers is encrypted in transit using TLS 1.3. Connections using older, deprecated protocols (SSL, TLS 1.0, TLS 1.1) are rejected at the server level.
• AES-256 encryption at rest: Sensitive data stored in grap89's databases — including identity documents, financial identifiers, and account credentials — is encrypted at rest using AES-256 with regularly rotated encryption keys managed through a dedicated key management service.
• Hashed and salted passwords: User passwords are never stored in plaintext. grap89 uses a modern adaptive hashing algorithm (bcrypt with a cost factor of at least 12) combined with a unique per-user salt to protect account credentials against brute-force and rainbow-table attacks.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their grap89 accounts. When enabled, a one-time code is required in addition to the password at each login, significantly reducing the risk of unauthorized access even if credentials are compromised.
• Access controls: Access to production systems and player data is restricted to authorized grap89 personnel on a strict need-to-know basis. All internal access is logged, monitored, and subject to regular access review. No single employee has unrestricted access to both personal data and financial systems simultaneously.
• Intrusion detection and DDoS protection: grap89's infrastructure is protected by a Web Application Firewall (WAF), real-time intrusion detection systems (IDS), and distributed denial-of-service (DDoS) mitigation services to maintain platform availability and detect anomalous access patterns.
• Penetration testing and security audits: grap89 commissions independent third-party penetration tests and security audits at least annually. Critical vulnerabilities identified through these exercises are remediated on a priority basis within defined SLA windows.
• Data breach response: In the event of a personal data breach that poses a risk to player rights and freedoms, grap89 will notify affected players without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with applicable data protection requirements. The notification will describe the nature of the breach, the data affected, and the steps being taken to mitigate harm.

As a grap89 player, you have the following rights with respect to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". grap89 will verify your identity before processing any data rights request, and will respond within 30 calendar days.

grap89 uses cookies and similar tracking technologies to operate the platform, maintain your session, remember your preferences, and analyze usage patterns. The following categories of cookies are used:

grap89 does not use third-party advertising cookies or behavioral tracking cookies that follow you across external websites. The analytics cookies used by grap89 collect data exclusively within the grap89.bet domain and are not shared with advertising networks.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will prevent the grap89 platform from functioning correctly, as these cookies are required for session authentication and security enforcement. Instructions for managing cookies are available in the help documentation of your specific browser.

grap89 is strictly an adults-only platform. The minimum age to register and play on grap89 is 21 years. This requirement applies to all players regardless of their location within Indonesia.

grap89 does not knowingly collect, process, or store personal data from individuals under the age of 21. Age verification checks are performed during the KYC process, which is required before a player may make their first withdrawal. Where grap89 has reasonable grounds to suspect that an account holder may be under 21, the account will be suspended pending verification, and any balance in the account will be held pending the outcome of the age verification review.

If grap89 discovers or is notified that it has inadvertently collected personal data from an individual under 21, grap89 will:

• Immediately suspend the relevant account and freeze all associated balances pending investigation.
• Permanently close the account and delete all personal data associated with the underage individual, subject only to any mandatory retention obligations under AML/CFT law.
• Refund any deposits made by the underage individual to the original payment source, net of any winnings generated, in accordance with applicable responsible gaming and licensing requirements.

Parents and guardians in Indonesia are encouraged to make use of parental control software to prevent minors from accessing online gambling websites. If you believe a minor has registered on grap89 using false age information, please report this immediately to [email protected].

grap89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the structure of our business. The most current version of this Policy is always available at grap89.bet/privacy-policy and is identified by the "Last updated" date at the top of this document.

Where grap89 makes a material change to this Privacy Policy — meaning a change that meaningfully affects your rights or the way we handle your personal data — we will notify you by email to your registered address at least 14 calendar days before the change takes effect. For non-material clarifications and formatting updates, the revised Policy will be published without advance notice, though the updated date will always be reflected.

Your continued use of the grap89 platform after the effective date of any revision to this Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you have the right to close your account before the change takes effect by contacting support at [email protected].

grap89 recommends that all players review this Privacy Policy periodically to stay informed about how their data is being protected. A version history summarizing the key changes made in each revision is available upon request from the support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way grap89 handles your personal data, please contact us through the following channels:

• Data Rights & Privacy Requests: Email [email protected] with subject line "Data Rights Request". Response within 30 calendar days.
• General Privacy Inquiries: Email [email protected] with subject line "Privacy Inquiry". Response target: within 2 business days.
• Data Breach Reports: If you believe your grap89 account has been compromised or you have discovered a potential security vulnerability, email [email protected] with subject line "Security Report" for priority handling.
• Live Chat: Available directly on the platform 24/7. Native Indonesian-speaking agents are available at all times for players based in Jakarta, Surabaya, Medan, Bandung, Bali, and across Indonesia.

All formal legal notices regarding data protection matters must be submitted in writing to [email protected] with the subject line "Legal Notice — Privacy". grap89 will acknowledge receipt of all formal legal notices within 3 business days.