Who This Policy Applies To: This Privacy Policy applies to all persons who access or use the grap89 platform at https://grap 89.cam, regardless of their country of residence. Our primary user base consists of English-preference players across Indonesia, including cities such as Jakarta, Surabaya, Bandung, Medan, Bali, and Yogyakarta. By registering or using our platform, you acknowledge that you have read and understood this Policy.
Introduction
1.1 grap89 ("we", "us", "our") operates the online betting and entertainment platform accessible at https://grap89.cam. We are committed to protecting the personal information of every individual who interacts with our platform, whether as a registered Member, a visitor, or a prospective user.
1.2 This Privacy Policy ("Policy") describes in full and transparent terms: (a) the categories of personal data we collect; (b) the purposes for which we process that data; (c) the legal basis for each processing activity; (d) the third parties with whom we may share data; (e) how long we retain data; and (f) the rights you have in relation to your data and how to exercise them.
1.3 This Policy forms part of and should be read alongside grap89's Terms & Conditions. Capitalised terms not defined in this Policy have the meanings given to them in the Terms & Conditions. In the event of any inconsistency between this Policy and the Terms & Conditions on a data-specific matter, this Policy prevails.
1.4 We may update this Policy periodically. The "Last Updated" date at the top of this page will reflect the most recent revision. Continued use of the grap89 platform after any update constitutes your acceptance of the revised Policy.
Language Note: This Privacy Policy is written in English, which is the governing language for all legal purposes on the grap89 platform. Our customer support team includes native Indonesian-speaking agents who can assist you in understanding any provision of this Policy upon request — please contact us via live chat at any time.
Data We Collect
2.1 grap89 collects personal data in the following categories. We only collect what is necessary and proportionate for the stated purposes.
| Category | Specific Data Points | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, Indonesian National Identity Card (KTP) number or passport number | Account registration, KYC verification, age verification (21+) |
| Contact Data | Email address, mobile phone number, residential address | Account communications, security alerts, withdrawal confirmations |
| Financial Data | Bank account name and number (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon), e-wallet ID (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history | Processing deposits and withdrawals, fraud prevention, AML compliance |
| Technical Data | IP address, device type, browser type and version, operating system, session timestamps, referring URL | Platform security, fraud detection, service optimisation |
| Usage Data | Pages visited, games played, betting history, session duration, feature interactions | Personalised experience, responsible gaming monitoring, product improvement |
| Verification Data | Photographs of identity documents, selfies where requested for liveness checks, proof-of-address documents | KYC compliance, fraud and identity theft prevention |
| Communications Data | Live chat transcripts, email correspondence, support ticket content | Service delivery, dispute resolution, quality assurance |
2.2 Sensitive Data. grap89 does not intentionally collect sensitive personal data (such as religious beliefs, political opinions, health data, or biometric data beyond liveness checks strictly required for KYC). Where any such data is incidentally disclosed during a support interaction, it will not be retained beyond what is necessary for that interaction.
How We Collect Your Data
3.1 Directly from You. The majority of personal data we hold is provided directly by you at the point of registration, during KYC verification, when making a deposit or withdrawal request, when contacting our support team, or when submitting a complaint or feedback.
3.2 Automatically. When you use the grap89 platform, certain technical and usage data is collected automatically through server logs, cookies, pixel tags, and similar tracking technologies. This includes your IP address, device identifiers, browsing behaviour within our platform, and session data. See Clause 7 for full details on cookies and tracking.
3.3 From Third Parties. grap89 may receive personal data from the following third-party sources:
- KYC / Identity Verification Partners: Third-party identity verification services that cross-reference your submitted documents against public and private databases.
- Payment Processors: Banks and e-wallet providers (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) who confirm the status and ownership of a payment method.
- Fraud Prevention Services: Risk intelligence platforms that flag IP addresses, device fingerprints, or account patterns associated with known fraud, money laundering, or abuse.
- Game Studios: Licensed game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, Pocket Games Soft) may pass session and game-result data to grap89 for settlement, dispute resolution, and responsible gaming monitoring.
Legal Basis for Processing
4.1 grap89 processes personal data under one or more of the following legal bases:
- Contractual Necessity: Processing is required to perform our contract with you — i.e., to operate your account, process bets, settle winnings, and facilitate deposits and withdrawals. Without this processing, we cannot provide our services.
- Legal Obligation: Processing is required to comply with applicable law, including anti-money-laundering (AML) regulations, know-your-customer (KYC) requirements, and fraud prevention obligations imposed on internationally licensed betting operators.
- Legitimate Interests: Processing is necessary for our legitimate business interests, including: detecting and preventing fraud; securing the platform against cyberattacks; improving the quality and reliability of our services; and monitoring for responsible gaming concerns. We always balance our interests against your rights before relying on this basis.
- Consent: Where we rely on consent as a legal basis (for example, for optional marketing communications), you have the right to withdraw that consent at any time by contacting us or updating your account preferences. Withdrawal of consent does not affect the lawfulness of processing conducted before the withdrawal.
No Consent Required for Core Services: Your consent is not required for the processing activities that are necessary to operate your account and deliver our core services. Withdrawing marketing consent, for example, will not affect your ability to use grap89's betting and gaming services.
How We Use Your Personal Data
5.1 grap89 uses your personal data for the following specific purposes:
- Account Management: Creating, maintaining, and securing your Member account, including password resets, account recovery, and access control.
- Identity & Age Verification: Confirming that you are who you say you are, and that you are at least 21 years of age. This is a non-negotiable requirement under our operating obligations.
- Transaction Processing: Facilitating deposits from and withdrawals to your Indonesian bank accounts and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and maintaining accurate financial records.
- Fraud & AML Prevention: Monitoring account activity for patterns indicative of fraud, money laundering, collusion, bonus abuse, or other prohibited conduct. Where suspicious activity is identified, we may share relevant data with law enforcement or financial intelligence authorities as required by law.
- Responsible Gaming: Monitoring gameplay patterns for indicators of problem gambling, and using that data to trigger responsible gaming interventions, including proactive outreach, limit suggestions, and self-exclusion activation. See our Responsible Gaming page for full details.
- Customer Support: Using your contact and communications data to respond to queries, resolve disputes, and deliver support across WIB, WITA, and WIT time zones via live chat and email.
- Service Improvement: Using aggregated and anonymised usage data to identify technical issues, optimise the platform experience, and develop new features.
- Legal Compliance: Retaining records as required by applicable law, responding to lawful requests from regulatory or law enforcement authorities, and defending legal claims.
- Security: Protecting the platform infrastructure from unauthorised access, cyberattacks, scraping, and other technical threats.
5.2 No Automated Solely-Determinative Decisions. grap89 uses automated systems to assist in fraud detection, KYC screening, and responsible gaming monitoring. However, no decision that produces significant legal or comparable effects on a Member is made solely by automated means without human review. Where automated flags are raised, a trained compliance or support team member reviews the case before any consequential action is taken.
Data Sharing & Disclosure
6.1 grap89 does not sell your personal data to any third party. We share personal data only in the following strictly controlled circumstances:
- KYC & Identity Verification Providers: To verify your identity and confirm your eligibility to hold a grap89 account.
- Payment Service Providers: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data required to process deposits and withdrawals on your behalf.
- Game Studios & Platform Providers: Licensed technology partners (including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, and Pocket Games Soft) receive session tokens and the minimum identifiers required to deliver their games. These partners are contractually prohibited from using your data for any purpose other than game delivery and settlement.
- Fraud Prevention & Risk Intelligence Services: Third-party risk platforms that help us identify and prevent fraud, money laundering, and platform abuse. Data shared is limited to technical identifiers and is subject to strict confidentiality obligations.
- Regulatory & Law Enforcement Authorities: Where required by law, court order, or regulatory instruction, grap89 will disclose personal data to competent authorities. We will notify affected Members where we are legally permitted to do so.
- Group Companies & Successors: In the event of a business restructuring, acquisition, or sale of assets, personal data may be transferred to a successor entity. Affected Members will be notified in advance wherever practicable.
6.2 All third-party data processors engaged by grap89 are subject to written data processing agreements that obligate them to process personal data only on grap89's documented instructions, implement appropriate technical and organisational security measures, and not sub-process personal data without grap89's prior written authorisation.
Your Data Stays Protected: Every third-party partner with access to Member personal data is bound by strict contractual obligations. grap89 conducts periodic reviews of third-party compliance to ensure your data is handled responsibly throughout the supply chain.
Cookies & Tracking Technologies
7.1 What Are Cookies. Cookies are small text files placed on your device by a website when you visit it. They serve a range of functions: keeping you logged in, remembering your preferences, detecting fraud, and measuring how the platform is used.
7.2 Types of Cookies We Use.
| Cookie Type | Description | Can You Opt Out? |
|---|---|---|
| Strictly Necessary | Required for the platform to function. These enable login sessions, security tokens, and shopping cart-equivalent features. Without them, you cannot use the platform. | No — these are essential |
| Functional | Remember your language preferences, display settings, and responsible gaming tool configurations. | Yes — via browser settings |
| Analytical / Performance | Collect anonymised data on how Members use the platform — which pages are visited, where errors occur, and how navigation flows work. Used to improve the platform experience. | Yes — via browser settings |
| Security / Fraud Detection | Track device fingerprints and session behaviours to identify suspicious activity, multi-accounting, and bot traffic. These are a core part of our security infrastructure. | No — these are essential |
7.3 Managing Cookies. You can manage or delete cookies through your browser settings. Most modern browsers allow you to block third-party cookies, clear cookies on exit, or prompt you before accepting cookies. Note that disabling strictly necessary or security cookies will impair platform functionality and may prevent you from logging in or completing transactions.
7.4 Do Not Track. Some browsers transmit a "Do Not Track" signal. grap89's platform currently does not alter its data collection practices in response to Do Not Track signals, as no universally accepted standard has been established for interpreting them.
Data Security
8.1 grap89 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security posture includes:
- 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted. Look for the padlock icon in your browser's address bar when using grap89.
- Encryption at Rest: Sensitive data stored in our databases — including financial records and identity documents — is encrypted at the storage layer.
- Access Controls: Personal data is accessible only to grap89 personnel on a strict need-to-know basis. Access is controlled through role-based permissions, two-factor authentication, and audit logging.
- Regular Security Assessments: We conduct periodic vulnerability assessments and penetration testing to identify and remediate security weaknesses before they can be exploited.
- Incident Response: grap89 maintains a documented data breach response plan. In the event of a breach that poses a risk to your rights, we will notify affected Members promptly and take all necessary remediation steps.
8.2 While grap89 takes all reasonable precautions, no data transmission over the internet or electronic storage method is 100% secure. We cannot guarantee absolute security, but we commit to treating any security incident with the utmost seriousness and acting swiftly to protect affected Members.
8.3 You are responsible for keeping your account password secure and for logging out of your account when using shared or public devices. If you suspect your account has been compromised, contact our support team immediately via live chat.
Data Retention
9.1 grap89 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to our obligations to retain certain categories of data for specified minimum periods under applicable law.
| Data Category | Standard Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years after closure | AML / legal compliance |
| Financial Transaction Records | 7 years from transaction date | Financial record-keeping requirements |
| KYC Documents | 5 years from account closure or last verification | AML regulatory obligation |
| Support & Communications Data | 3 years from last interaction | Dispute resolution and quality assurance |
| Technical / Log Data | 12 months from collection | Security monitoring and fraud prevention |
| Marketing Consent Records | Until consent is withdrawn + 2 years | Demonstrating lawful processing |
9.2 Where data is retained solely to comply with a legal obligation, it will be held in a restricted state accessible only to our compliance team. It will not be used for any operational or marketing purpose during the retention-only period.
9.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.
Your Privacy Rights
10.1 As a Member of grap89, you hold the following rights in relation to your personal data. These rights are subject to applicable legal limitations and grap89's obligations to retain certain data under law.
10.2 How to Exercise Your Rights. To submit a data subject request, contact our support team via live chat or at [email protected] (plain text — not a clickable link). We will verify your identity before processing the request and will respond within thirty (30) days. Complex requests may require up to ninety (90) days, in which case we will notify you of the extension and its reason within the initial thirty-day period.
Minors & Under-Age Protection
11.1 grap89 strictly prohibits access to its platform by anyone under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If we become aware that a registered account belongs to a person under 21, we will immediately suspend the account, initiate identity verification to confirm age, and if confirmed, permanently close the account and return any real-money balance to the verified payment method.
11.2 If you believe a minor has registered on grap89 or is using the platform through an adult's account, please contact our support team immediately. We take underage gambling concerns with the utmost seriousness and will investigate all reports promptly.
11.3 Parents and guardians are encouraged to use parental control software to restrict access to online gambling platforms on devices that minors use.
21+ Strictly Enforced: This policy applies equally across all Indonesian cities and regions — Jakarta, Surabaya, Bali, Bandung, Medan, Yogyakarta, Makassar, Semarang, and all others. Age verification is conducted at the KYC stage on every account before withdrawal is permitted. grap89 will never knowingly allow a minor to use its platform.
International Data Transfers
12.1 grap89 is an internationally operated platform. Your personal data may be stored and processed in data centres or by service providers located outside of Indonesia. Where data is transferred across borders, grap89 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that provided within Indonesia.
12.2 Safeguards for international transfers may include: contractual clauses binding the recipient to data protection standards consistent with this Policy; transfers to jurisdictions that maintain an adequate level of data protection; or other appropriate technical and organisational measures assessed on a case-by-case basis.
12.3 To obtain further information about the specific safeguards in place for any particular international transfer, please contact us at [email protected] (plain text — not a clickable link).
Third-Party Services & Links
13.1 The grap89 platform integrates third-party game content from licensed studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, and Pocket Games Soft. When you play a third-party game within grap89, limited session data is shared with the game provider for the purposes of game delivery, result settlement, and fair-play verification. These providers operate under their own privacy policies, which we recommend reviewing.
13.2 grap89 does not include external links to third-party websites on this platform. However, if you navigate to an external website independently, grap89 is not responsible for the privacy practices of that website and this Policy does not apply beyond the grap89 platform.
13.3 Payment method providers — including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja — process your transaction data under their own terms of service and privacy policies when handling deposits and withdrawals. grap89 provides only the minimum data required to initiate and confirm each transaction.
Changes to This Privacy Policy
14.1 grap89 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will notify active Members via the registered email address and/or by displaying a prominent notice on the platform for a minimum of seven (7) days before the changes take effect.
14.2 Minor amendments — such as corrections to typographical errors, clarifications that do not alter the substance of our data practices, or updates to contact details — may be made without prior notice.
14.3 The version of this Policy in force at the time of any data processing activity governs that activity. If you disagree with a material update to this Policy, you may request account closure in accordance with Clause 14 of our Terms & Conditions. Continued use of the platform after the effective date of any update constitutes acceptance.
Contact & Data Requests
15.1 For all privacy-related enquiries, data subject access requests, complaints, or questions about this Policy, please contact the grap89 data protection team through the following channels:
- Live Chat: Available 24/7 within the grap89 platform. For data subject requests, please select the "Privacy / Data Request" category when opening your chat. Indonesian-speaking agents are available on all shifts.
- Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Policy — Data Request" for faster routing. We aim to acknowledge all requests within 24 hours.
15.2 Our support team is available across all three Indonesian time zones — WIB (UTC+7, covering Jakarta, Bandung, Yogyakarta, Surabaya, Medan), WITA (UTC+8, covering Bali, Makassar, and the Kalimantan provinces), and WIT (UTC+9, covering Maluku and Papua) — to ensure accessible support regardless of your location.
15.3 grap89 will never contact you requesting your account password, full bank account number, or one-time passcode (OTP). Any communication claiming to be from grap89 and requesting such information should be treated as fraudulent and reported to our support team immediately.
Response Commitment: grap89 commits to acknowledging all data subject requests within 24 hours of receipt and providing a substantive response within 30 calendar days. If a request requires more time due to complexity, we will notify you within the initial 30-day window with a revised timeline and the reason for the extension.