Privacy Policy — duet8 Data Protection

duet8 ("duet8", "we", "us", "our") operates the online betting and gaming platform accessible at duet8.net (the "Platform"). As an operator serving Players primarily located in Indonesia, duet8 recognises the importance of handling personal information responsibly and transparently.

This Privacy Policy ("Policy") describes how duet8 collects, uses, stores, discloses, and protects the personal data of individuals ("Players", "you", "your") who register accounts on, access, or interact with the Platform. It applies to all data collected through the Platform, our customer support channels, and any promotional or marketing activities associated with the duet8 brand.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. If you have questions not answered here, please contact our support team whose details are provided in Section 15.

For the purposes of this Privacy Policy, the following definitions apply:

duet8 collects the following categories of Personal Data from Players:

3.1 Registration Data

When you create an Account on duet8, we collect the information you voluntarily provide during the registration process, including:

• Full legal name (as it appears on your government-issued identification document);
• Date of birth (to verify that you meet the 21+ age requirement);
• Residential address, including province and city (e.g., Jakarta, Surabaya, Bandung, Medan, Bali);
• Email address and mobile phone number;
• Preferred currency (IDR — Indonesian Rupiah);
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

To comply with our anti-money-laundering obligations and to protect the integrity of the Platform, duet8 may request documentary evidence of your identity, which may include:

• A copy of a government-issued photo ID (e.g., KTP, passport, or driver's licence);
• A recent proof of residential address (e.g., utility bill or bank statement dated within the last three months);
• A selfie or live photo for facial-verification purposes;
• Proof of ownership of the payment method used (e.g., a screenshot of your BCA, BRI, BNI, Mandiri, DANA, or OVO account showing your registered name).

3.3 Financial Transaction Data

Each time you deposit or withdraw funds through the Platform, duet8 records:

• The payment method used (bank transfer via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon; or e-wallet via OVO, DANA, GoPay, ShopeePay, LinkAja);
• Transaction amount (in IDR), date, time, and unique transaction reference number;
• Account holder name and masked account/wallet number associated with the payment method;
• Transaction status (completed, pending, reversed) and any associated failure codes.

3.4 Gaming Activity Data

duet8 maintains a complete record of all gaming activity conducted through your Account, including:

• Game titles played, stake amounts, bet outcomes, and session timestamps;
• Sportsbook bets placed (sport, market, league — e.g., BRI Liga 1, EPL, Champions League — odds accepted, and settlement outcomes);
• Bonus and promotional offers claimed, wagering progress, and withdrawal status of bonus-derived winnings.

3.5 Technical and Device Data

When you access the Platform via a web browser or mobile device, we automatically collect certain technical information, including:

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, and browser version;
• Session duration, pages visited, and click-path data;
• Cookie identifiers and local storage tokens (see Section 10).

3.6 Communication Data

Any communications you send to duet8 — including live chat transcripts, email correspondence to [email protected], and feedback submissions — are retained as part of your account record to support dispute resolution and quality assurance.

duet8 collects Personal Data through the following channels:

• Directly from you: when you register an Account, complete KYC verification, make deposits or withdrawals, place bets, contact customer support, or respond to promotions.
• Automatically: through server logs, cookies, pixel tags, and similar tracking technologies when you access and interact with the Platform (see Section 10).
• From third-party Data Processors: including KYC verification providers who return identity-check results, payment processors who confirm transaction status, and fraud-detection services who supply risk-scoring data linked to your IP address or payment method.
• From responsible gambling databases: where applicable, duet8 may receive notifications from self-exclusion registries to enforce exclusion requests made by Players through approved third-party channels.

duet8 uses the Personal Data it collects for the following specific purposes:

duet8 will not use your Personal Data for any purpose not listed above without first obtaining your explicit consent or being required to do so by law.

duet8 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing your registration data, KYC information, and transaction records is necessary to perform the contract set out in our Terms & Conditions. Without this data, duet8 cannot create or maintain your Account or process your transactions.
• Legitimate Interests: Fraud detection, security monitoring, platform analytics, and responsible gambling oversight are carried out on the basis of duet8's legitimate interest in operating a safe, fair, and commercially viable gaming platform. These interests have been assessed and do not override your fundamental privacy rights.
• Legal Obligation: Identity verification, anti-money-laundering checks, and the retention of financial records for audit purposes are performed to comply with applicable legal obligations.
• Consent: Marketing communications are sent only where you have given explicit consent during registration or through your Account communication preferences. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

duet8 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. We may, however, share your data with the following categories of recipients under strictly controlled conditions:

7.1 Data Processors

duet8 engages third-party Data Processors who act solely on our documented instructions and are bound by data processing agreements that prohibit them from using your data for any purpose beyond the contracted service. These include:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data necessary to execute deposits and withdrawals.
• KYC & Fraud Prevention Providers: Third-party identity verification services receive the identity documents you submit during KYC and return a pass/fail result along with a risk score.
• Game Providers: Providers such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, and Microgaming receive a pseudonymous Player identifier and session token sufficient to run game sessions. They do not receive your name, address, or payment details.
• Cloud Infrastructure & Security Providers: Our hosting and DDoS-protection infrastructure providers process server logs and session data on our behalf under strict data processing agreements.

7.2 Legal Disclosures

duet8 may disclose Personal Data to law enforcement, regulatory bodies, or other governmental authorities where required by applicable law, a court order, or where duet8 believes in good faith that disclosure is necessary to prevent imminent harm, protect the rights of duet8 or third parties, or investigate suspected fraudulent or criminal activity.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring involving duet8, Player Personal Data may be transferred to the successor entity as part of the transaction. You will be notified via Platform announcement and email in advance of any such transfer, and the successor entity will be required to honour this Privacy Policy.

duet8 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. The following retention schedule applies:

Once the applicable retention period has elapsed, Personal Data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical analysis.

duet8 implements a layered set of technical and organisational security controls to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and the duet8 Platform is encrypted using industry-standard TLS 1.2 or higher protocols. You will see a padlock icon and "https://" in your browser address bar confirming the secure connection.
• Encryption at Rest: Sensitive fields — including KYC document images, payment method details, and password hashes — are encrypted at rest using AES-256 or equivalent encryption standards in our database systems.
• Access Controls: Access to production systems containing Personal Data is restricted to a small number of authorised personnel on a need-to-know basis, enforced through role-based access control and multi-factor authentication requirements.
• Intrusion Detection & DDoS Protection: duet8 employs continuous network monitoring, intrusion detection systems, and distributed denial-of-service mitigation services to protect the Platform and its underlying infrastructure.
• Regular Security Audits: Our systems and processes are subject to periodic security reviews and penetration testing by qualified independent security professionals.
• Incident Response: duet8 maintains a documented security incident response plan. In the event of a data breach that is likely to result in a risk to your rights and freedoms, duet8 will notify affected Players without undue delay.

duet8 uses cookies and similar tracking technologies on the Platform for the purposes described below. By continuing to use the Platform, you consent to the placement of cookies on your device in accordance with this Policy.

10.1 Managing Cookies

You may control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in and using core Platform features. Instructions for managing cookies in common browsers are available through the browser vendor's official help documentation. duet8 does not use third-party advertising cookies or cross-site tracking pixels.

As a Player on the duet8 Platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact our Data Protection team at [email protected]. We will respond to verified requests within 30 days.

11.1 Right of Access

You have the right to request a copy of all Personal Data duet8 holds about you, along with information about how it is being used. We will provide this information in a structured, commonly used format.

11.2 Right to Rectification

If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain information (such as your contact email address or residential address) directly through your Account settings; other corrections may require identity verification before they can be applied.

11.3 Right to Erasure

You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and there is no other lawful basis for processing, or where the data has been unlawfully processed. Please note that legal record-keeping obligations (see Section 8) may prevent full erasure of certain data categories until their mandatory retention periods have elapsed.

11.4 Right to Restriction of Processing

You may request that duet8 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested, or while you have objected to processing on grounds of legitimate interest and that objection is being assessed.

11.5 Right to Data Portability

Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, machine-readable format so that it can be transferred to another service provider of your choosing.

11.6 Right to Object

You have the right to object to processing based on legitimate interest at any time. You also have an unconditional right to object to the use of your Personal Data for direct marketing purposes. Upon receipt of a valid marketing objection, duet8 will cease all marketing communications immediately.

11.7 Withdrawing Consent

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To opt out of marketing communications, you may use the unsubscribe link in any marketing email or contact our support team directly.

The duet8 Platform is strictly intended for adults aged 21 years and above. duet8 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step of the Account registration process, and additional KYC checks may be triggered at any point to confirm age eligibility.

If duet8 becomes aware that Personal Data has been collected from a person under 21 — whether through registration, payment processing, or any other channel — the associated Account will be closed immediately, all funds will be handled in accordance with applicable law, and the data will be securely deleted to the extent legally permissible.

If you are a parent or guardian and believe your child may have created an Account on duet8, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

The duet8 Platform may reference or integrate services provided by third parties — such as game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe) and payment processors — whose own privacy policies govern the processing of any Personal Data they independently collect.

duet8 is not responsible for the privacy practices of third-party service providers beyond the scope of our Data Processor agreements with them. We encourage you to review the privacy policies of any third-party services you use in connection with the Platform. The integration of third-party game content within the Platform does not constitute endorsement of the data practices of those providers beyond the scope of our contractual arrangements.

duet8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, we will:

• Post the revised Policy on this page with an updated "Last Updated" date;
• Display a prominent notice on the Platform for a period of not less than 14 days following the update;
• Where required by law or where changes significantly affect your rights, notify registered Players by email to the address held on their Account.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any material change to this Policy, you should stop using the Platform and may request Account closure in accordance with our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by duet8, please contact our support team through the following channels:

• Live Chat: Available 24/7 directly on the duet8 Platform — the quickest way to reach a support agent for urgent privacy concerns.
• Email: [email protected] (plain text — not a clickable link; please copy and paste this address into your email client).

Our Indonesian-speaking support team is available around the clock, every day of the year. All privacy-related enquiries are handled with priority and treated as strictly confidential. We aim to acknowledge all written privacy requests within 24 hours and to provide a substantive response within 30 days.