we368 Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below:

• "we 368" / "we" / "our" / "us" — the operator of the we368 Platform, including its affiliates, subsidiaries, and licensed operating entities.
• "Platform" — the we368 website accessible at https://we368.one, including all sub-pages, game interfaces, account dashboards, and mobile-optimized views.
• "Player" / "you" / "your" — any individual who registers an Account on the Platform or who accesses or browses the Platform without registration.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including but not limited to full name, date of birth, email address, phone number, residential address, payment account details, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, deletion, or destruction.
• "KYC" — Know Your Customer verification, the identity and document verification process applied to Player accounts to confirm eligibility and satisfy anti-money-laundering obligations.
• "Cookies" — small text files placed on your device by the Platform to store session state, preferences, and analytics data.
• "IDR" / "Rp" — Indonesian Rupiah, the default transaction currency on the Platform.

we368 is the data controller responsible for the Personal Data you provide when accessing or using the Platform. As data controller, we368 determines the purposes for which your Personal Data is processed and the means by which that processing is carried out.

For all privacy-related inquiries, requests to exercise your data rights, or complaints regarding the handling of your Personal Data, please contact us via the channels set out in Clause 15 (Contact Us) of this Policy.

we368 collects Personal Data through several channels depending on the nature of your interaction with the Platform. The categories of data collected are described below:

3.1 Registration Data

When you create a we368 Account, we collect:

• Full legal name;
• Date of birth (to verify that you are at least 21 years of age);
• Residential address in Indonesia;
• Valid email address;
• Indonesian mobile phone number;
• Username and hashed password (we do not store passwords in plain text).

3.2 KYC Verification Data

Prior to processing your first withdrawal or upon reaching transaction thresholds, we collect:

• A copy of a valid Indonesian national identity card (KTP), passport, or driver's licence (SIM);
• A selfie photograph for facial comparison purposes;
• Proof of address (where requested), such as a recent utility bill or bank statement issued to your registered address.

3.3 Financial Data

To facilitate deposits and withdrawals via Indonesian payment channels, we collect:

• Bank account details (bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata — account holder name, and account number);
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja (typically a registered mobile phone number);
• Transaction history including deposit amounts, withdrawal amounts, and timestamps;
• Source-of-funds declarations where required for AML compliance purposes.

3.4 Gaming & Betting Activity Data

• Game session logs including game type, bet amounts (in IDR / Rp), outcomes, and session duration;
• Sports betting records including markets selected, stake amounts, odds accepted, and settlement outcomes;
• Bonus and promotion claim history;
• Responsible gaming tool settings (deposit limits, session limits, cooling-off periods, self-exclusion status).

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser version;
• Platform access timestamps and session identifiers;
• Cookie identifiers and browsing behavior within the Platform (pages visited, features used);
• Device fingerprint data used for fraud detection and duplicate account identification.

3.6 Communications Data

• Records of live chat conversations with our support team;
• Email correspondence sent to or received from our support address;
• Feedback, complaints, and dispute submissions.

we368 processes your Personal Data for the following purposes:

we368 processes your Personal Data on the following legal bases:

1. Contractual Necessity: The majority of processing described in Clause 4 is necessary to perform the contract between you and we368 — specifically, the Terms & Conditions you accept upon registration. Without this processing, we would be unable to operate your Account, process transactions, or deliver gaming services;
2. Legal Obligation: Certain processing — particularly KYC verification and AML transaction monitoring — is required by applicable law. we368 must fulfill these obligations regardless of individual consent;
3. Legitimate Interests: we368 processes technical and device data for fraud prevention and Platform security on the basis of our legitimate interest in protecting the integrity of the Platform and the security of all players. We have assessed that this interest is not overridden by your privacy rights;
4. Consent: Promotional and marketing communications are sent only where you have expressly opted in. You may withdraw this consent at any time without affecting the lawfulness of prior processing or your ability to continue using the Platform.

we368 does not sell, rent, or otherwise transfer your Personal Data to third parties for their own commercial purposes. We may share your Personal Data with the following categories of recipients, strictly to the extent necessary for the stated purpose:

• Payment Processors: Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to execute your deposit or withdrawal transaction;
• KYC Verification Partners: Third-party identity verification service providers who perform document authentication and facial comparison on our behalf under contractual data processing agreements;
• Game Technology Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive session identifiers and stake data necessary to deliver game content and verify bet outcomes. These providers operate under their own privacy frameworks and are individually responsible for data they independently collect through their game interfaces;
• IT Infrastructure Providers: Cloud hosting, content delivery network (CDN), and cybersecurity providers who process data solely on we368's instructions under binding data processing agreements;
• Legal and Regulatory Authorities: we368 will disclose Personal Data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, valid legal process, or to protect the rights, property, or safety of we368 or its players;
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets involving we368, Personal Data held by we368 may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. Players will be notified of any such transfer via their registered email address.

The we368 Platform uses cookies and similar technologies (including local storage objects and session tokens) to enable core Platform functionality, maintain session security, and gather anonymized analytics data. The categories of cookies used are as follows:

we368 does not use advertising cookies, cross-site tracking cookies, or any third-party cookie that enables behavioral profiling for commercial marketing purposes. You may configure your browser to block or delete cookies; however, disabling strictly necessary cookies will prevent you from logging in to or using the Platform.

we368 applies a multi-layered security framework to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure. Our security measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and the Platform is protected using TLS 1.2 / TLS 1.3 (256-bit encryption). Pages are served exclusively over HTTPS;
• Encryption at Rest: Sensitive data stored on our servers — including KYC documents and financial records — is encrypted at rest using AES-256;
• Password Security: Passwords are never stored in plain text. we368 uses bcrypt hashing with per-user salts, ensuring that even an internal database breach would not expose your password;
• Access Controls: Personal Data is accessible only to we368 personnel and authorized processors who require it to perform their assigned functions. Access is controlled via role-based permissions and multi-factor authentication for all staff with administrative access;
• Regular Audits: we368 conducts periodic security assessments, including penetration testing and vulnerability scanning of the Platform infrastructure;
• Incident Response: In the event of a confirmed data breach that poses a material risk to your rights and freedoms, we368 will notify affected players via their registered email address within a reasonable timeframe and will take immediate steps to contain and remediate the breach.

we368 retains Personal Data only for as long as is necessary to fulfill the purposes described in this Policy, to maintain accurate financial and gaming records, and to comply with applicable legal obligations. The general retention periods applied are:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with any individual. Where deletion is subject to a pending legal hold or active dispute, data will be retained until the matter is fully resolved before deletion proceeds.

As a Player on the we368 Platform, you hold the following rights over your Personal Data. Requests to exercise any of these rights should be submitted via the contact channels in Clause 15:

1. Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is being processed. we368 will respond to verified access requests within 30 calendar days;
2. Right to Rectification: If you believe any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected. Some corrections — such as changes to your registered legal name — will require supporting documentation;
3. Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data. we368 will fulfill erasure requests where we no longer have a legal basis to retain the data. Note that we368 is required by AML law to retain certain financial and identity records for a defined period following Account closure; such data cannot be erased before the statutory retention period expires;
4. Right to Restriction of Processing: In certain circumstances (e.g., where you contest the accuracy of data or have objected to processing), you may request that we368 restrict active processing of your Personal Data while the matter is under review;
5. Right to Data Portability: You may request a copy of your Personal Data in a structured, commonly used, machine-readable format (such as CSV or JSON) for the categories of data processed on the basis of your consent or contractual necessity;
6. Right to Object: You may object to the processing of your Personal Data for marketing purposes at any time. You may also object to processing carried out on the basis of legitimate interests, after which we368 will assess whether its legitimate interests override your individual rights in the specific circumstances;
7. Right to Withdraw Consent: Where processing is based on your consent (specifically, marketing communications), you may withdraw that consent at any time via your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing that took place prior to withdrawal.

The we368 Platform is operated by an international entity. Your Personal Data may be transferred to and processed on servers located outside Indonesia, including in jurisdictions that may not provide the same level of data protection as Indonesian law.

Where such transfers occur, we368 ensures that appropriate safeguards are in place to protect your Personal Data, including:

• Contractual data processing agreements incorporating standard data protection clauses with all third-party processors outside Indonesia;
• Transfers to jurisdictions that we368's licensing authority has determined offer an adequate level of data protection;
• Technical and organizational security measures equivalent to those applied to data processed within Indonesia.

By registering an Account and using the Platform, you acknowledge that your Personal Data may be transferred internationally in accordance with the safeguards described above. If you would like further information about the specific safeguards applicable to a transfer of your data, please contact us via the details in Clause 15.

The we368 Platform is strictly intended for adults aged 21 years and older. we368 does not knowingly collect, process, or store the Personal Data of any individual under the age of 21. By registering an Account, you represent and warrant that you are at least 21 years of age.

If we368 becomes aware that Personal Data has been collected from an individual under the age of 21, we will immediately suspend the associated Account, delete the data, and — where relevant — report the matter to appropriate authorities. If you have reason to believe that a minor has registered an Account on the Platform, please notify our support team immediately via live chat or email.

The we368 Platform may display content delivered by third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others). When you access a game delivered by one of these providers, the game interface may operate within the provider's own technical environment, which is governed by the provider's own privacy policy.

we368 is not responsible for the privacy practices of third-party game studios, payment networks, or any other external service referenced on the Platform. we368 recommends that you review the privacy policies of any third-party services you interact with in connection with your use of the Platform.

we368 reserves the right to update or amend this Privacy Policy at any time to reflect changes in Platform operations, applicable law, or data processing practices. When material changes are made, we368 will:

• Update the "Last Updated" date at the top of this page;
• Notify registered Players via their registered email address at least 7 days before the changes take effect (for material changes);
• Display a notice on the Platform's homepage for a minimum of 7 days prior to the effective date.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of and agreement to the updated terms. If you do not agree to the revised Policy, you must cease using the Platform and may request Account closure by contacting our support team.

We recommend reviewing this Privacy Policy periodically. The current version always supersedes all prior versions and is identified by the "Last Updated" date shown at the top of this page.

For any questions, concerns, or requests related to this Privacy Policy or the processing of your Personal Data by we368, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the we368 Platform. Average response time: under 5 minutes. Native Indonesian-speaking agents are available at all times for players who prefer to communicate in Bahasa Indonesia.
• Email: [email protected] — please include your registered username, Account ID, and a clear description of your privacy request in the subject line (e.g., "Data Access Request — [Account ID]" or "Erasure Request — [Account ID]"). Email responses are provided within 24 hours (WIB).

we368 aims to respond to all data rights requests within 30 calendar days of receipt. Where a request is complex or we have received a high volume of requests, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

Effective Date: This Privacy Policy is effective as of 1 January 2026 and supersedes all prior versions. By continuing to use the we368 Platform after this date, you confirm your acknowledgment of this Policy in full.