256-Bit Encryption
All data transmitted between your device and top508 servers is secured with bank-grade SSL encryption at all times.
No Data Selling
top508 never sells your personal data to third-party marketers or advertisers. Your information is used solely to deliver and improve our services.
You Stay in Control
Access, correct, or request deletion of your personal data at any time by contacting our dedicated data team.
KYC Compliance
Identity data is collected only to the extent required by our international licensing obligations and anti-money-laundering standards.
Transparent Cookies
We clearly explain every cookie category we use. You can manage non-essential cookie preferences through your browser settings at any time.
Prompt Responses
Data access and deletion requests are acknowledged within 48 hours and resolved within 30 calendar days of receipt.
Scope of This Policy: This Privacy Policy applies to all personal data processed by top508 in connection with its online gaming platform at top508.cam, including data collected from players based in Indonesia. By registering an account or continuing to use the top508 platform, you acknowledge that you have read and understood this Privacy Policy in its entirety.
1Introduction
top508 ("the Company", "we", "us", "our") operates the online gaming platform accessible at top508.cam, providing casino entertainment, live dealer games, sports betting, and related services to players across Indonesia and other eligible jurisdictions.
In the course of delivering these services, top508 processes personal data relating to registered players, prospective players, and visitors to the Platform. This Privacy Policy sets out in clear, plain English exactly what data we collect, the legal grounds on which we process it, how long we retain it, and the specific rights available to you as a data subject.
This Policy should be read in conjunction with our Terms & Conditions, which govern your overall contractual relationship with top508, and our Responsible Gaming policy, which describes how gaming-behaviour data is used to protect player welfare.
If you have any questions about this Policy or wish to exercise any of your data rights, please contact us at the details provided in Section 16 of this document.
2Definitions
The following terms carry the meanings assigned below throughout this Privacy Policy.
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably be used to identify a living individual, either alone or in combination with other data. |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion. |
| "Data Controller" | top508, the entity that determines the purposes and means of processing your personal data. |
| "Data Processor" | A third party that processes personal data on behalf of top508 under contractual instruction (e.g., payment processors, game providers). |
| "Player" / "You" | Any individual who registers an account with top508 or interacts with the Platform in any capacity. |
| "Platform" | The top508 website, mobile interface, applications, and all associated digital services accessible at top508.cam. |
| "Cookies" | Small text files placed on your device by the Platform to enable functionality, remember preferences, and collect usage analytics. |
| "Sensitive Data" | Special categories of personal data including government-issued identification numbers, financial account details, and payment instrument information. |
3Data We Collect
top508 collects the minimum amount of personal data necessary to operate its platform, comply with applicable regulatory obligations, and deliver a secure and personalised experience to players. The categories of data we collect are described below.
3.1 Account Registration Data
- Full Legal Name: As it appears on your government-issued identification document.
- Date of Birth: Collected to verify that you meet the 21+ age requirement applicable in the Indonesian market.
- Email Address: Used for account communications, security alerts, and — where opted into — promotional correspondence.
- Mobile Phone Number: Used for two-factor authentication and account recovery.
- Residential Address: Collected for identity verification and compliance with anti-fraud protocols.
- Username and Encrypted Password: Used to authenticate your access to the Platform.
3.2 Identity Verification (KYC) Data
- Government-Issued Photo ID: Indonesian National Identity Card (KTP), passport, or SIM (driver's licence).
- Proof of Address Documents: Utility bills, bank statements, or government correspondence dated within the last three months.
- Payment Method Evidence: Screenshots or statements showing BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja account registration matching your identity.
- Source of Funds Documentation: For high-volume accounts, additional documents may be requested to confirm the lawful origin of deposited funds.
3.3 Financial Transaction Data
- Deposit Records: The amount, date, time (in WIB), and payment method of every deposit made to your Account.
- Withdrawal Records: The amount, date, time (in WIB), and destination account of every withdrawal from your Account.
- Account Balance History: A ledger of all transactions affecting your Real Money Balance and Bonus Funds.
- Payment Instrument Identifiers: The last four digits of bank account numbers or e-wallet identifiers used for transactions.
3.4 Gaming Behaviour Data
- Game Session History: Details of games played, including stakes, time of play, outcomes, and session duration.
- Betting History: Records of sports bets placed, including markets, odds, and settlement outcomes across football (including BRI Liga 1 and Champions League), basketball, badminton, and other sports.
- Responsible Gaming Controls: Deposit limits, time-out periods, and self-exclusion records configured on your Account.
- Device and Network Information: IP address, device type, operating system, browser type, and approximate geographic location (based on IP).
4How Data Is Collected
top508 collects personal data through the following distinct channels.
- Direct Provision by You: Data you actively provide when registering an account, completing KYC verification, contacting customer support, configuring responsible gaming controls, or responding to surveys.
- Automated Collection: Data collected automatically via cookies, server logs, and similar tracking technologies when you visit or interact with the Platform, including device identifiers and usage patterns.
- Payment Processors: Confirmation data from payment providers verifying that a deposit or withdrawal has been successfully processed.
- Game Providers: Game result data supplied by licensed software providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Pocket Games Soft, which confirm the outcomes of your gameplay.
- Fraud and Security Tools: Data generated by security monitoring systems that detect unusual activity, unauthorised access attempts, or behaviour consistent with money-laundering patterns.
5Purpose of Processing
top508 processes your personal data for the following specific, documented purposes. We will not process your data for any purpose incompatible with these stated purposes.
| Purpose | Data Category Used |
|---|---|
| Account Creation & Management | Registration data, login credentials |
| Identity Verification (KYC) | Photo ID, proof of address, financial data |
| Transaction Processing | Financial transaction data, payment identifiers |
| Anti-Money Laundering Compliance | Financial data, gaming behaviour data, device information |
| Fraud Prevention & Account Security | Device information, IP address, gaming behaviour |
| Game Delivery & Fairness | Gaming behaviour data, game session history |
| Responsible Gaming Protection | Gaming behaviour data, limit and exclusion records |
| Customer Support | Account data, transaction records, communication logs |
| Marketing Communications (Optional) | Email address, name, gaming preferences |
| Platform Improvement | Usage analytics, device information |
6Legal Basis for Processing
As top508 is an internationally licensed offshore platform that does not target jurisdictions requiring a single uniform statutory data-processing basis, we rely on the following internationally recognised lawful bases for processing your personal data. Each basis is applied only to the processing activity it supports.
- Performance of a Contract: Processing required to establish and operate your player Account, process deposits and withdrawals, and deliver the gaming services you have requested.
- Legal and Regulatory Obligation: Processing necessary to comply with anti-money-laundering (AML), counter-terrorist-financing (CTF), and KYC obligations arising under our international gaming licence.
- Legitimate Interest: Processing necessary to prevent fraud, protect the security and integrity of the Platform, and improve user experience. Where we rely on this basis, we balance our legitimate interests against your privacy rights.
- Consent: Processing for optional marketing communications, non-essential cookies, and promotional offers is based on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
7Data Sharing & Disclosure
top508 does not sell, rent, or otherwise trade your personal data to third parties. We disclose personal data only in the following limited circumstances.
- Licensed Game Providers: to Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft, to the extent necessary to deliver game content and record results for your Account.
- Payment Processors and Banks: to deposit and withdrawal processors, including the networks of BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja, strictly to execute and reconcile your transactions.
- Regulatory Authorities: where disclosure is required by applicable law, regulation, or a legally binding request from a competent authority in the Company's licensing jurisdiction or your jurisdiction of residence.
- Professional Advisers: to auditors, legal counsel, and insurers, where such disclosure is necessary for the operation and governance of top508.
- Corporate Transactions: where top508 undergoes a merger, acquisition, or asset transfer, your data may be transferred to the successor entity under duties of confidentiality equivalent to this Policy.
- Fraud Prevention Services: to industry-standard fraud-screening and identity-verification providers operating under strict data-processing agreements.
All third parties or data processors engaged by top508 are contractually bound to process your personal data solely on documented instructions and are required to implement appropriate technical and organisational safeguards.
8International Data Transfers
top508 operates its gaming servers in data centres located outside Indonesia. As your data is transferred from Indonesia to third countries, we apply appropriate safeguards to ensure your data receives an adequate level of protection equivalent to that described in this Policy.
- All transferred data is encrypted in transit using TLS 1.3 and at rest using AES-256.
- International transfers are supported by applicable data-protection agreements between top508 and its data processors, ensuring contractual protections for your personal data regardless of where the data is stored.
- Where the Company is required to comply with a lawful request from a government in a destination country, it will transfer the minimum data necessary and will resist requests that are clearly overbroad, unlawful, or incompatible with the principles of this Policy.
- By using the top508 platform and providing your personal data, you acknowledge and consent to the processing of that data in jurisdictions outside Indonesia.
9Data Retention
top508 retains personal data only for as long as it is necessary for the purposes described in this Policy, subject to legal and regulatory retention obligations. The retention periods applied are as follows.
| Data Category | Retention Period |
|---|---|
| Account Registration Data | For the lifetime of the Account, plus 12 months after closure |
| KYC Verification Documents | At least 5 years after Account closure, or as required by applicable AML law |
| Financial Transaction Records | At least 5 years from the date of each transaction |
| Gaming & Betting History | 2 years from the date of the last activity |
| Customer Support Communications | 2 years from the date of the final communication |
| Marketing Consent Records | Until consent is withdrawn, then deleted within 30 days |
| Responsible Gaming Records | At least 5 years from Account closure |
| Security & Fraud Logs | 18 months, unless required for an ongoing investigation |
Once the applicable retention period expires, personal data is securely erased, anonymised, or de-identified in accordance with industry best practice. Where data is retained solely for legal evidence purposes beyond these periods, access will be restricted to authorised personnel only.
10Security Measures
top508 employs industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include the following.
- Encryption: All data in transit is protected with TLS 1.3 encryption, and all stored data is protected with AES-256 encryption at rest.
- Access Control: Access to personal data is restricted on a least-privilege basis to authorised personnel who require it to perform their duties. All access is logged and audited.
- Two-Factor Authentication: The Company strongly encourages players to enable two-factor authentication on their Accounts for an additional security layer.
- PCI-DSS Compliant Payment Handling: Financial transaction processing is handled through certified payment providers operating to payment-card-industry security standards.
- Monitoring and Auditing: Continuous automated monitoring of Platform activity and regular independent security audits to detect and respond to threats.
- Staff Training: All top508 personnel who handle personal data receive data-protection and security awareness training on a recurring basis.
11Cookies & Tracking Technologies
top508 uses cookies and similar technologies to enable Platform functionality, remember your preferences, and understand how the Platform is used. The following categories of cookies are used.
| Cookie Category | Purpose |
|---|---|
| Essential Cookies | Required for core Platform functionality, including login sessions, security authentication, and balancing. These cannot be disabled. |
| Functionality Cookies | Remember your language preference and other user interface settings to personalise your experience. |
| Analytics Cookies | Help us understand how players interact with the Platform through aggregated, anonymised usage statistics. |
| Marketing Cookies | Used to measure the effectiveness of campaigns, where you have given consent. Set only with your express consent. |
Essential cookies are always active. Non-essential cookies are placed only with your consent. Most browsers allow you to manage cookie preferences through their settings, though disabling essential cookies may prevent the Platform from functioning correctly.
12Your Data Protection Rights
As a data subject, you hold the following rights over the personal data that top508 processes about you. These rights may be exercised free of charge.
Right to Access
Request a copy of all personal data top508 holds about you, together with details of how it is processed.
Right to Rectification
Request correction of any inaccurate or incomplete personal data held about you.
Right to Erasure
Request deletion of your personal data where there is no valid legal basis for continued retention.
Right to Object
Object to processing based on legitimate interest, or withdraw consent to marketing at any time.
Right to Data Portability
Receive your personal data in a structured, commonly used, machine-readable format.
Right to Lodge a Complaint
Submit a complaint regarding our data-processing practices to our Data Protection Officer.
- Requests will be acknowledged within 48 hours and fully resolved within 30 calendar days.
- top508 may request additional proof of identity before processing a data-right request to protect against unauthorised access to personal data.
- We may refuse a request where it is manifestly unfounded, excessive, or where granting it would conflict with mandatory legal retention obligations.
13Minors & Age Restriction
top508 is strictly an 18+ platform. All players must be at least 21 years of age for the Indonesian market. The Platform is not directed at, and top508 does not knowingly collect personal data from, minors below the applicable age threshold.
- If we become aware that a person below the applicable age has registered an Account, we will immediately close the Account and delete all associated personal data without delay.
- Deposited funds associated with a minor's Account will be returned to the originating payment method.
- Parents or guardians who suspect that a minor has registered with top508 should contact us immediately at the support address in Section 16.
14Third-Party Links
The top508 Platform may contain links to third-party websites, including those of licensed game providers and payment processors. This Privacy Policy applies only to the top508 platform. We accept no responsibility for the privacy practices, content, or data-processing policies of external websites, and we encourage you to review the privacy policy of any third-party site you visit.
15Policy Amendments
- top508 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, technology, or legal obligations.
- Material changes will be notified to registered players by email at least 7 calendar days before the new version takes effect. The "Last Updated" date at the top of this page identifies the current version.
- Continued use of the top508 platform after a revised Policy takes effect constitutes your acceptance of the revised Privacy Policy.
16Contact & Complaints
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to lodge a complaint regarding the handling of your personal data, please contact the top508 Data Protection Officer through the following channel.
Data Protection Email: [email protected]
Response Standard: Requests are acknowledged within 48 hours and fully resolved within 30 calendar days. Support operates 24/7 in Indonesian and English (WIB, UTC+7).
When contacting us, please state the nature of your enquiry and include your Account username (if applicable) and the email address registered to your Account so we can locate and verify your identity promptly.
Have Questions About Your Data?
For more information on how you can manage your account, review our Terms & Conditions, or explore the support and protection measures available on our FAQ and Responsible Gaming pages.