Privacy Policy

The following definitions apply throughout this Privacy Policy and all associated jago28 data processing notices, consent forms, and communications:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to that person's physical, economic, or social identity.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" refers to jago28 — the entity that determines the purposes and means by which Personal Data is processed on this Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of jago28, strictly in accordance with jago28's documented instructions and applicable data protection obligations.
• "Player" or "You" or "Data Subject" refers to any natural person who registers on, accesses, or interacts with the jago28 Platform.
• "Platform" means the jago28 website at https://jago28.cam, including all sub-pages, account management portals, game interfaces, and support systems.
• "KYC Data" means identity verification documents and associated information submitted by a Player as part of the Know Your Customer process, including but not limited to: government-issued photo ID (KTP), proof of address, and selfie photographs.
• "Sensitive Data" means a subset of Personal Data that requires a higher level of protection due to its nature, including financial information, identity documents, and data used for security or authentication purposes.
• "Consent" means a freely given, specific, informed, and unambiguous indication by the Data Subject of their agreement to the processing of their Personal Data for a stated purpose.

jago28 collects Personal Data across the following categories. We collect only what is genuinely necessary for the purposes described in Section 4 of this Policy.

jago28 collects Personal Data through the following channels and mechanisms:

• Directly from You: When you register an Account, complete the KYC process, make a deposit or withdrawal, contact our support team, submit a complaint, or interact with any feature of the Platform that requires you to enter or upload information.
• Automatically via Technology: When you visit or use the Platform, our servers and analytics systems automatically log Technical Data and Usage Data using cookies, session tokens, server-side logging, and similar technologies. Please refer to Section 11 (Cookies & Tracking) for full details.
• From Third-Party Verification Partners: As part of our KYC and AML compliance obligations, jago28 may receive identity verification results and risk-score information from licensed third-party KYC providers. This data is used solely for verification purposes and is not shared further.
• From Payment Processors: When you make a deposit or request a withdrawal, our payment processing partners (who handle transactions through BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja) transmit transaction confirmation data and, where required for fraud prevention, limited account reference data to jago28.
• From Game Studio Providers: Licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may share session metadata (game round IDs, round timestamps, and RNG certification data) with jago28 for dispute resolution and audit purposes. Studios do not share personally identifiable information beyond what is necessary for these purposes.

jago28 processes your Personal Data for the following specific, documented purposes. We do not process Personal Data for any purpose that has not been listed here without first obtaining your explicit consent or updating this Policy with appropriate notice.

• Account Management: To create, maintain, authenticate, and administer your player account, including managing your Real Money Balance, Bonus Balance, and account preferences.
• Identity Verification (KYC): To verify your identity and age (21+) in compliance with our international licensing obligations and internal AML policy. This is a mandatory process without which withdrawals cannot be processed.
• Payment Processing: To execute deposit and withdrawal transactions through your chosen Indonesian banking or e-wallet method, and to maintain an accurate record of all financial activity associated with your account for audit and reconciliation purposes.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, bonus abuse, and other prohibited conduct. This includes automated risk-scoring and periodic manual review of flagged accounts.
• Legal & Regulatory Compliance: To comply with our international gaming license conditions, anti-money laundering (AML) requirements, and any applicable data retention obligations imposed by the regulatory framework under which jago28 operates.
• Customer Support: To respond to your queries, complaints, and disputes via live chat, email, or other support channels in a timely and informed manner. Support communications are logged to maintain a complete interaction history.
• Platform Improvement: To analyse aggregated usage patterns and identify opportunities to improve the Platform's performance, navigation, game selection, and user experience. This analysis uses anonymized or pseudonymized data where possible.
• Responsible Gaming: To administer the responsible gaming tools you have activated (deposit limits, self-exclusion, cooling-off periods, session time limits), and to identify players whose usage patterns suggest potential harm, in accordance with our commitment to player welfare.
• Promotional Communications: To send you relevant promotions, bonus offers, and Platform updates via email or in-app notification, but only where you have provided your consent to receive such communications. You may withdraw consent at any time.

jago28 relies on one or more of the following legal bases when processing your Personal Data. The applicable basis depends on the specific processing activity and the category of data involved.

• Contractual Necessity: The majority of our core data processing — including account creation, KYC, payment processing, and customer support — is necessary for the performance of our contract with you (i.e., the Terms & Conditions you accepted at registration). Without this processing, we cannot deliver the Platform services you have requested.
• Legal Obligation: Certain processing activities — particularly those related to AML compliance, KYC record-keeping, and financial transaction logging — are required by the regulatory framework under which jago28 is licensed. We process this data not by choice, but because we are obligated to do so by our licensing conditions.
• Legitimate Interests: We process Technical Data, Usage Data, and fraud-prevention data on the basis of our legitimate interests in operating a secure, commercially viable, and technically robust platform. We conduct a balancing test before relying on this basis and do not use it where your interests or rights override our legitimate interests.
• Consent: Where processing is not covered by the above bases — most notably for promotional communications — we rely on your freely given, specific, and informed consent. You have the right to withdraw consent at any time, and withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

jago28 does not sell, rent, or trade your Personal Data. We share your data only with the carefully vetted third parties listed below, and only to the extent strictly necessary for the purposes described in this Policy. All third-party Data Processors are bound by contractual data protection obligations that meet or exceed the standards applied by jago28 itself.

• Payment Service Providers: Indonesian bank transfer networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data required to process your deposits and withdrawals. These institutions operate under their own regulatory frameworks and privacy policies.
• KYC & Identity Verification Partners: Licensed identity verification service providers receive your KYC documents (KTP image, proof of address, selfie) to perform automated and manual identity checks. Results are returned to jago28 as a pass/fail determination and a risk score; raw document images are handled in accordance with the verification partner's accredited data security protocols.
• Game Studio Providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive a pseudonymized player session token to enable gameplay, track round history for dispute resolution, and generate RNG audit logs. They do not receive your name, contact details, or financial data.
• IT Infrastructure & Cloud Service Providers: jago28 uses enterprise-grade cloud infrastructure to host the Platform. Our infrastructure providers process Technical Data and Usage Data as part of delivering hosting, content delivery, DDoS protection, and monitoring services. They act as Data Processors under strict contractual instructions.
• Legal & Regulatory Authorities: jago28 will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by law, court order, or valid legal process. We will notify affected players of such disclosures where we are legally permitted to do so.
• Professional Advisors: Our legal counsel, auditors, and compliance consultants may access limited Personal Data in the course of providing professional services to jago28. All such advisors are bound by professional confidentiality obligations.

As an internationally licensed online gaming platform, jago28 may store and process your Personal Data in jurisdictions outside Indonesia. This is a necessary aspect of operating a globally distributed platform and working with international service providers such as game studios and cloud infrastructure partners.

• Where Personal Data is transferred outside your country of residence, jago28 takes appropriate safeguards to ensure that the data continues to be protected to an equivalent standard. These safeguards include contractual data protection clauses incorporated into all Data Processor agreements.
• jago28's primary data infrastructure is located in secure, ISO-27001-certified data centers. All data at rest is encrypted, and all data in transit is protected by TLS 1.3 encryption regardless of the geographic location of the receiving server.
• Where jago28 shares data with game studio providers based in Europe or other regulated jurisdictions, those providers are subject to their own data protection regulatory frameworks, which in many cases provide a higher level of statutory protection than is currently available under Indonesian law.
• If you would like further information about the specific safeguards applied to any international transfer of your Personal Data, please contact our Data Protection Officer at the address listed in Section 15 of this Policy.

jago28 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory obligations. The following retention periods apply as default standards:

At the end of the applicable retention period, Personal Data is either securely deleted using cryptographic erasure methods or irreversibly anonymized such that it can no longer be linked to any identifiable individual. Anonymized data may be retained indefinitely for statistical and analytical purposes.

jago28 implements a layered, defense-in-depth security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Our key technical and organizational security measures include the following:

• Transport Layer Security (TLS 1.3): All communication between your browser or mobile device and the jago28 Platform is encrypted using TLS 1.3. Connections attempting to use older, less secure protocol versions are rejected.
• AES-256 Encryption at Rest: All Personal Data stored on jago28 servers — including KYC documents, financial records, and account credentials — is encrypted at rest using AES-256, the current gold standard for symmetric encryption.
• Access Controls: Access to Personal Data within jago28's internal systems is governed by strict role-based access control (RBAC). Employees may only access the minimum data required to perform their specific role. All access is logged and subject to periodic audit.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. All jago28 internal system administrators are required to use 2FA without exception.
• Penetration Testing: The jago28 Platform undergoes scheduled third-party penetration testing at least twice per year. Identified vulnerabilities are triaged and remediated according to a defined severity-based patching schedule.
• DDoS Mitigation: Enterprise-grade distributed denial-of-service protection is applied to all Platform-facing infrastructure to maintain availability and prevent service disruption that could expose data.
• Staff Training: All jago28 personnel who handle Personal Data receive mandatory data protection and security awareness training upon joining the company and at least annually thereafter.

As a Player on the jago28 Platform, you hold the following rights with respect to your Personal Data. jago28 is committed to honoring these rights promptly and without charge. To exercise any of the rights below, contact our Data Protection Officer as described in Section 15.

All data rights requests are acknowledged within 5 business days and fulfilled within 30 calendar days of receipt. In complex cases, this period may be extended by a further 30 days, in which case you will be notified of the extension and the reason for it. There is no charge for exercising your rights unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may be applied.

jago28 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your login session, remember your preferences, detect fraud, and understand how Players use the Platform so that we can continually improve it.

jago28 does not use third-party advertising cookies or tracking pixels for behavioral advertising. You may manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary or security cookies may prevent you from accessing certain features of the Platform or logging into your account.

The jago28 Platform is strictly restricted to individuals who are 21 years of age or older. jago28 does not knowingly collect, process, or retain Personal Data from any individual under the age of 21.

• At the point of registration, all applicants are required to confirm that they are aged 21 or above. This declaration forms part of the binding contract between the Player and jago28.
• As part of the KYC verification process, jago28 independently verifies the date of birth of every Player against their government-issued KTP. Any account where the verified age falls below 21 is immediately suspended and all associated funds are frozen pending further review.
• If jago28 discovers — at any point during the account lifecycle — that a Player was under 21 at the time of registration or at any point during their use of the Platform, the account will be permanently closed, all winnings will be voided, and deposited funds will be returned to the originating payment method after deduction of any transaction fees incurred by jago28 in processing the original deposits.
• If you believe a minor has gained access to the jago28 Platform — whether through your account or independently — please contact us immediately at [email protected] with the subject line "Minor Access Report". We will investigate and act promptly.
• Parents and guardians are encouraged to use parental control software and to keep login credentials for all online accounts — including any jago28 account — securely out of reach of minors. jago28 accepts no liability for unauthorized access by minors resulting from a Player's failure to secure their account credentials.

The jago28 Platform integrates with a number of third-party services to deliver its core functionality. While jago28 carefully vets all service providers and contractually requires them to maintain appropriate data protection standards, each third party operates under its own privacy policy and data governance framework. jago28 is not responsible for the privacy practices of third-party services beyond the contractual obligations we impose on them as Data Processors.

• Game Providers: When you launch a game developed by a third-party studio (such as Pragmatic Play, Evolution Gaming, Spribe, Microgaming, NetEnt, or Pocket Games Soft), the game interface may be served from the studio's own servers. A pseudonymized session token is shared with the studio to enable gameplay; no personally identifiable information is transmitted beyond what is necessary for the game session to function.
• Live Casino Streaming: Live dealer games (operated primarily through Evolution Gaming) are streamed in real time from licensed studio facilities. Your interactions within the live game environment — including chat messages and game actions — are processed by the streaming provider subject to their own applicable policies. Please use discretion when communicating in live chat environments.
• Payment Gateway Partners: Deposit and withdrawal flows may redirect you temporarily to a payment gateway interface operated by one of our licensed payment processing partners. These interfaces are subject to the privacy policies of the respective financial institution or e-wallet operator. jago28 does not store your full bank account credentials; only the minimum reference data necessary to process and reconcile transactions is retained on our systems.
• Analytics & Monitoring Tools: jago28 uses server-side analytics and application performance monitoring tools. Any data processed by these tools is handled under strict Data Processor agreements, uses pseudonymized identifiers, and is not shared with any third party for commercial purposes.

jago28 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulatory guidance, new Platform features that involve Personal Data, or improvements to our data protection standards.

• When material changes are made to this Privacy Policy, jago28 will notify all registered Players via the email address on file and/or via a prominent on-Platform notification. Notification will be provided at least 14 calendar days before any material change takes effect, except where an immediate amendment is required by law or urgent security considerations.
• The "Last Updated" date displayed at the top of this page will be revised each time the Policy is amended. We encourage you to bookmark this page and review it periodically. The version of this Policy published at https://jago28.cam/privacy-policy at any given time is the version currently in effect.
• Your continued use of the Platform after any amended Policy takes effect constitutes your acknowledgment of the changes. If you do not agree with a material amendment, you have the right to close your account and request deletion of your Personal Data before the amendment takes effect, subject to our legal retention obligations described in Section 8.
• Minor, non-material amendments (such as typographical corrections, clarifications that do not change the substance of how your data is processed, or updates to contact details) may be made without advance notice and will be reflected in an updated "Last Updated" date on this page.

If you have any questions, concerns, or requests relating to this Privacy Policy or to jago28's handling of your Personal Data, please contact us using the details below. All privacy-related inquiries are handled by our dedicated Data Protection team and are treated with strict confidentiality.

• General Privacy Inquiries: Contact our support team via the Live Chat feature on the Platform for fast assistance with routine privacy questions. Live Chat is available 24 hours a day, 7 days a week, including Indonesian public holidays such as Idul Fitri, Idul Adha, and Indonesian Independence Day (17 August).
• Formal Data Rights Requests: To exercise any of the rights described in Section 10 (access, rectification, erasure, restriction, portability, objection), please email [email protected] with the subject line "Data Rights Request — [Your Request Type]". Please include your registered username and a description of your request. We will acknowledge receipt within 5 business days and respond in full within 30 calendar days.
• Data Protection Officer (DPO): jago28's Data Protection Officer is responsible for overseeing this Policy and our broader data governance framework. The DPO can be reached by emailing [email protected] with the subject line "Attention: Data Protection Officer". The DPO will handle matters relating to data audits, cross-border transfer queries, significant complaints, and regulatory correspondence.
• Security Incidents & Breach Reports: If you believe your jago28 account has been compromised, or if you have discovered a security vulnerability in the Platform, please contact us immediately at [email protected] with the subject line "Security Incident Report". Our security team monitors this channel around the clock.