Privacy Policy — bro28

1Introduction

This Privacy Policy ("Policy") applies to all personal data processed by bro28 ("we", "us", "our", or "the Platform") in connection with the operation of the online betting and gaming platform accessible at https://bro28.cam ("the Platform"). It applies to all registered Members, visitors, and prospective users who interact with the Platform in any capacity.

bro28 acts as the data controller in respect of all personal data collected and processed in connection with the Platform. By registering an Account on bro28, accessing the Platform, or otherwise providing us with personal data, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read in conjunction with bro28's Terms and Conditions, which govern your use of the Platform more broadly. Where there is any inconsistency between this Policy and the Terms and Conditions on a privacy matter, this Policy shall prevail.

2Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, residential address, financial account details, IP address, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, alteration, retrieval, use, disclosure, transmission, and deletion.
• "Data Controller" means bro28, which determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Subject" means the individual to whom Personal Data relates — in this context, any Member or visitor of the Platform.
• "KYC Data" means Personal Data submitted by a Member for the purpose of Know Your Customer identity and age verification procedures, including copies of government-issued identification, proof of address, and selfie photographs.
• "Cookies" means small text files placed on a user's device by the Platform for the purposes of session management, preference storage, analytics, and fraud prevention.
• "Third-Party Service Provider" means any third-party organization engaged by bro28 to provide services in connection with the Platform, including payment processors, identity verification providers, game software providers, and analytics services.

3Personal Data We Collect

bro28 collects the following categories of Personal Data from Members and Platform visitors:

bro28 does not collect Special Category data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data for identification purposes) except where a Member voluntarily discloses such information in a support communication.

4How We Collect Your Data

bro28 collects Personal Data through the following means:

• Direct Provision: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting our support team, or responding to promotional communications.
• Automated Technologies: Technical Data collected automatically when you access the Platform, including IP address, device identifiers, browser information, and session activity data captured via cookies and server logs.
• Third-Party Sources: Identity verification data received from KYC service providers; fraud risk signals received from payment processors and anti-fraud networks; device fingerprint data from security partners.
• Payment Providers: Transaction confirmation data from BCA, BRI, BNI, Bank Mandiri, OVO, DANA, GoPay, ShopeePay, and other payment service providers in connection with deposit and withdrawal processing.

5Lawful Basis for Processing

bro28 processes Personal Data on the following lawful bases:

• Contractual Necessity: Processing required to perform the contract between bro28 and a Member — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable legal obligations, including anti-money-laundering (AML) requirements, age verification obligations, and fraud prevention duties.
• Legitimate Interests: Processing undertaken to pursue bro28's legitimate business interests, including platform security, fraud detection, service improvement, and responsible gaming monitoring — where those interests are not overridden by the individual Member's privacy rights.
• Consent: Processing for direct marketing communications, non-essential cookies, and personalization features — where you have given explicit, freely revocable consent.

6How We Use Your Personal Data

bro28 uses the Personal Data it collects for the following purposes:

• To register and manage your Account on the Platform, including verifying your identity, age, and eligibility in accordance with bro28's Terms and Conditions.
• To process deposits and withdrawals via your chosen payment method, including BCA, BRI, BNI, Bank Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, Visa, and Mastercard.
• To operate and deliver the Platform's gaming and betting services, including sports betting markets, togel (Indonesia's traditional numbers lottery) draws, slot games, and live casino products.
• To conduct KYC identity and age verification in accordance with bro28's internal compliance standards.
• To detect and prevent fraudulent activity, money laundering, and other forms of Platform abuse.
• To operate bro28's responsible gaming monitoring systems, including automatic detection of patterns indicative of problem gambling, and to deliver responsible gaming tool notifications where appropriate.
• To communicate with you regarding your Account, including transaction confirmations, security alerts, and service updates — these communications are service-related and cannot be opted out of while your Account remains active.
• To send promotional communications, including bonus offers and personalized promotions, where you have given your consent. You may withdraw consent to marketing communications at any time by contacting [email protected].
• To improve, test, and develop the Platform's features and user experience through analysis of aggregated, anonymized behavioral data.
• To resolve disputes, enforce bro28's Terms and Conditions, and respond to legal claims or regulatory inquiries.

7Data Sharing and Disclosure

bro28 does not sell your Personal Data to third parties. We share Personal Data only in the following limited circumstances:

• Payment Service Providers: Financial Data is shared with payment processors (including Indonesian bank transfer networks and e-wallet providers) to facilitate deposit and withdrawal transactions.
• Identity Verification Partners: KYC Data is shared with regulated identity verification service providers to complete age and identity verification processes.
• Game Software Providers: Limited Technical and Behavioral Data may be shared with licensed game providers (such as Pragmatic Play, Evolution Gaming, Microgaming, and Spribe) to the extent necessary to deliver game services.
• Anti-Fraud and Security Partners: Technical Data including IP addresses, device identifiers, and behavioral signals may be shared with anti-fraud networks to detect and prevent Platform abuse.
• Legal and Regulatory Authorities: Personal Data may be disclosed to government authorities, law enforcement bodies, or regulatory agencies where bro28 is required to do so by applicable law, court order, or regulatory obligation.
• Business Transfers: In the event of a merger, acquisition, or sale of bro28 or its assets, Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

8Cookies and Tracking Technologies

bro28 uses cookies and similar tracking technologies to operate the Platform effectively. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that maintain your login state, security tokens, and load-balancing cookies. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences — such as language settings, preferred payment method, and responsible gaming tool configurations — to improve your experience across sessions.
• Analytics Cookies: Used to collect aggregated, anonymized data about how Members interact with the Platform, enabling bro28 to identify usage patterns and prioritize improvements. Analytics data is not linked to individual Member identities in reporting.
• Security Cookies: Used for fraud detection and bot prevention, including device fingerprinting and behavioral analysis to identify unauthorized or automated access attempts.

You may configure your browser to decline non-essential cookies. However, disabling strictly necessary cookies will prevent normal Platform functionality. bro28 does not use advertising cookies or third-party retargeting cookies that track your activity across other websites.

9Data Retention

bro28 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, subject to any overriding legal retention requirements. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of the Member's active Account and for a minimum of 5 years following Account closure, in accordance with AML record-keeping requirements.
• Financial Transaction Data: Retained for a minimum of 5 years following the relevant transaction, in compliance with applicable financial record-keeping standards.
• KYC Documents: Retained for the duration of the Account relationship and for a minimum of 5 years following Account closure.
• Technical and Behavioral Data: Retained for up to 2 years from collection unless required for longer for security or legal purposes.
• Support Communications: Retained for up to 3 years from the date of the communication, or longer where the communication relates to an unresolved dispute.
• Marketing Consent Records: Retained for the duration of the consent and for 3 years following withdrawal of consent as evidence of the consent lifecycle.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in a manner that prevents re-identification.

10Data Security

bro28 implements and maintains appropriate technical and organizational security measures to protect Personal Data against unauthorized access, accidental loss, destruction, alteration, and disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the bro28 Platform is encrypted using industry-standard TLS protocols. All data stored on bro28 servers is encrypted at rest.
• Access Controls: Access to Personal Data is restricted to authorized bro28 personnel and Third-Party Service Providers on a strict need-to-know basis. All staff with access to Personal Data undergo regular privacy and security training.
• Two-Factor Authentication: bro28 offers two-factor authentication (2FA) for Member Accounts to provide an additional layer of access protection beyond the primary password.
• Intrusion Detection: The Platform is monitored 24/7 by automated intrusion detection and anomaly alert systems.
• Penetration Testing: bro28 conducts regular third-party penetration tests and security audits to identify and remediate vulnerabilities in the Platform's infrastructure.

11Your Data Rights

As a data subject, you have the following rights in respect of your Personal Data held by bro28. To exercise any of these rights, please contact us at [email protected] or via live chat:

• Right of Access: You have the right to request a copy of the Personal Data bro28 holds about you, together with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held by bro28 without undue delay.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and there is no other lawful basis for continued processing), or where the data has been unlawfully processed. This right is subject to overriding legal retention obligations — for example, bro28 is required to retain financial transaction records and KYC data for a minimum period under AML standards and cannot delete these earlier.
• Right to Restrict Processing: You may request that bro28 restrict the processing of your Personal Data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is carried out on the basis of consent or contractual necessity by automated means, you may request your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, and to withdraw consent to processing carried out on a consent basis at any time without affecting the lawfulness of prior processing.
• Rights Related to Automated Decision-Making: bro28 uses automated systems for fraud detection, responsible gaming monitoring, and certain risk assessments. You have the right to request human review of any decision that significantly affects you and that was made solely by automated means.

bro28 will respond to all data rights requests within 30 days of receipt. Where a request is complex or numerous, the response period may be extended by a further 60 days, with prior notification to the data subject. bro28 will not charge a fee for handling rights requests unless they are manifestly unfounded or excessive.

12Children's Privacy

The bro28 Platform is strictly intended for adults aged 21 and over. bro28 does not knowingly collect Personal Data from individuals under the age of 21. If bro28 becomes aware that Personal Data has been collected from a person under 21, that Account will be immediately suspended, all associated data will be deleted (subject to any legal retention obligations), and any transactions will be voided in accordance with bro28's Terms and Conditions.

If you are a parent or guardian and believe that a minor has registered an Account on bro28, please contact us immediately at [email protected] so that the situation can be remediated promptly.

13Third-Party Links

The bro28 Platform may contain references to or integrations with third-party services — including game software providers, payment gateways, and sports data feeds. bro28 is not responsible for the privacy practices of these third-party services. Any Personal Data you provide directly to a third-party service is governed by that party's own privacy policy, not this Policy. bro28 encourages you to review the privacy policies of any third-party services you interact with in connection with your use of the Platform.

14International Data Transfers

bro28 operates as an internationally licensed platform with infrastructure and service providers located in multiple jurisdictions. As a result, Personal Data collected from Indonesian Members may be transferred to and processed in countries outside Indonesia. Where such transfers occur, bro28 ensures that appropriate safeguards are in place to protect the transferred data to a standard equivalent to the protections described in this Policy. These safeguards may include data processing agreements based on standard contractual clauses, adequacy decisions, or other legally recognized transfer mechanisms.

15Amendments to This Policy

bro28 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. Where material amendments are made, bro28 will provide advance notice to registered Members via email or a prominent Platform notice. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of and agreement to the updated Policy.

The current version of this Policy, including the date of the most recent revision, is always available at https://bro28.cam/privacy-policy. We recommend reviewing this Policy periodically to stay informed of how bro28 handles your Personal Data.

16Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or bro28's data processing practices, please contact us through the following channels. All privacy-related correspondence is handled by bro28's designated data privacy team:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the Platform
• WhatsApp: +62 812 0000 2828 (plain text — not a clickable link)

bro28 aims to acknowledge all privacy-related requests within 48 hours and to provide a full response within 30 days of receipt of a complete and valid request, in accordance with applicable data protection standards.