Privacy Policy

This Privacy Policy ("Policy") describes how hepi8 ("hepi8", "We", "Us", "Our") collects, uses, stores, shares, and protects the personal data of individuals ("Member", "User", "You") who access or use the hepi8 platform at https://hepi8.cam. This Policy applies to all interactions with the hepi8 platform, including account registration, deposits, withdrawals, wagering activity, customer support contacts, and use of our website. By registering an account or continuing to use the hepi8 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must cease using the platform and may request account closure by contacting [email protected].

1 Definitions

• "Personal Data" means any information that directly or indirectly identifies a natural person, including name, date of birth, national identity number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means hepi8, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of hepi8 pursuant to a written data processing agreement.
• "KYC" means Know Your Customer — the identity and age verification process required under applicable regulations and hepi8's internal compliance programme.
• "Cookie" means a small text file placed on your device by the hepi8 platform to facilitate session management, security, and platform analytics.
• "Applicable Law" means all data protection laws, anti-money laundering regulations, and sector-specific gambling regulations applicable to hepi8's operations under its international licence.

2 Data Controller

hepi8 International operates as the Data Controller for all personal data collected through the hepi8 platform. hepi8 is an internationally licensed online betting and casino operator serving users in Indonesia. All data protection queries, requests, and complaints should be directed to the hepi8 Data Protection contact via email at [email protected]. We aim to acknowledge all data-related enquiries within three business days and to resolve them within 30 calendar days of receipt.

3 Data We Collect

hepi8 collects personal data through a number of channels. The categories of data collected are as follows:

hepi8 does not collect sensitive categories of personal data such as health records, biometric data beyond KYC facial verification, religious beliefs, or political opinions, except where expressly required by applicable law.

4 Purpose & Legal Basis for Processing

hepi8 processes personal data for the following purposes, each supported by a specific legal basis under applicable data protection law:

• Account Creation and Management — Legal basis: Contract performance. Processing is necessary to create and maintain your hepi8 account and deliver wagering services.
• Identity Verification (KYC) — Legal basis: Legal obligation. Processing is required to comply with anti-money laundering (AML) regulations and to verify that members are at least 21 years of age.
• Payment Processing — Legal basis: Contract performance. Financial data is processed to facilitate Rupiah deposits and withdrawals via Indonesian banks and e-wallets.
• Fraud Prevention and Security — Legal basis: Legitimate interest. Technical and transaction data is monitored to detect and prevent fraudulent activity, account takeovers, and financial crime.
• Customer Support — Legal basis: Contract performance and legitimate interest. Communications data is retained to resolve disputes and improve service quality.
• Responsible Gaming Compliance — Legal basis: Legal obligation and legitimate interest. Responsible gaming data is processed to administer self-exclusion, deposit limits, and age-restriction enforcement.
• Marketing Communications — Legal basis: Consent. Promotional emails and SMS messages are sent only where you have given explicit consent. You may withdraw consent at any time.
• Platform Improvement and Analytics — Legal basis: Legitimate interest. Aggregated, anonymised technical data is used to improve platform performance and user experience.

5 Data Sharing

hepi8 does not sell personal data to third parties. We share personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment Service Providers: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data required to process your transactions.
• KYC and Identity Verification Partners: Accredited third-party KYC service providers process identity documents and selfie photographs for age and identity verification on hepi8's behalf under strict data processing agreements.
• Fraud Detection and AML Services: Specialist third-party providers assist hepi8 in monitoring transactions for suspicious activity in compliance with applicable AML obligations.
• IT Infrastructure and Hosting Providers: Cloud infrastructure and hosting partners store and process platform data on hepi8's behalf under contractual data protection obligations.
• Regulatory and Law Enforcement Authorities: hepi8 will disclose personal data to competent authorities where required by court order, regulatory instruction, or applicable law. We will notify the affected Member wherever legally permissible to do so.
• Professional Advisers: Legal, audit, and compliance advisers may access personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.

6 International Data Transfers

hepi8 operates internationally. Personal data collected from Indonesian members may be transferred to, and processed in, countries outside Indonesia where hepi8's infrastructure providers or KYC partners are located. Such transfers are made subject to appropriate safeguards, which may include standard contractual clauses approved by the relevant data protection authority, binding corporate rules, or adequacy decisions. By using the hepi8 platform, you consent to these international transfers. If you wish to obtain information about the specific safeguards applied to a particular transfer, please contact us at [email protected].

7 Data Retention

hepi8 retains personal data for the periods set out below, after which data is securely deleted or anonymised unless a longer retention period is required by law:

• Account and Identity Data: Retained for the duration of your active account plus five years following permanent account closure, in compliance with AML record-keeping obligations.
• Financial and Transaction Data: Retained for seven years from the date of each transaction, consistent with standard financial record-keeping requirements.
• KYC Documents: Retained for five years following account closure or the conclusion of the last business relationship, whichever is later.
• Customer Support Communications: Retained for three years from the date of the last interaction, to enable dispute resolution and service improvement.
• Technical and Analytics Data: Retained in anonymised, aggregated form indefinitely for platform performance analysis. Identifiable technical logs are retained for 12 months.
• Marketing Consent Records: Retained for the duration of active consent plus three years following consent withdrawal, to demonstrate compliance with consent requirements.

8 Security Measures

hepi8 implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS encryption for all data in transit between member devices and hepi8 servers.
• AES-256 encryption for personal data stored in hepi8's databases at rest.
• Multi-factor authentication (MFA) options available to all members for account access.
• Real-time intrusion detection and DDoS mitigation systems active across all platform infrastructure.
• Role-based access controls limiting employee access to personal data to authorised personnel on a strict need-to-know basis.
• Regular third-party penetration testing and security audits of the hepi8 platform.
• A formal incident response plan that includes notification procedures in the event of a data breach.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, hepi8 will notify you without undue delay via your registered email address and will take all reasonable steps to mitigate the impact of the breach.

9 Cookies & Tracking Technologies

hepi8 uses cookies and similar technologies to operate the platform effectively and to understand how members use our services. The following cookie categories are in use:

• Strictly Necessary Cookies: Essential for platform functionality, including session management, authentication, and security. These cookies cannot be disabled without impairing your ability to use the platform.
• Performance Cookies: Collect anonymised data about how visitors interact with the platform — such as page load times and error reports — to improve platform stability. No personally identifiable information is collected via these cookies.
• Functionality Cookies: Remember your platform preferences (such as language and currency settings) to provide a consistent experience across sessions.
• Fraud Prevention Cookies: Used by hepi8's security systems to identify and block suspicious session patterns, bot activity, and multi-account attempts.

hepi8 does not use third-party advertising cookies, social media tracking pixels, or behavioral profiling cookies for commercial targeting purposes. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent normal use of the hepi8 platform.

10 Your Data Rights

Subject to applicable law, hepi8 members have the following rights in relation to their personal data:

• Right of Access: You may request a copy of the personal data hepi8 holds about you at any time. We will respond within 30 calendar days.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request correction. Account profile details may be updated directly in your account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to hepi8's legal retention obligations. Note that we are required to retain certain KYC and transaction records for regulatory compliance periods (see Section 7) even after account closure.
• Right to Restriction: You may request that hepi8 restrict the processing of your personal data in certain circumstances, such as while a rectification request is under review.
• Right to Data Portability: Where processing is based on your consent or contract performance, you may request that we provide your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interest, including the use of your data for platform analytics. You may also withdraw marketing consent at any time.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please submit a written request to [email protected]. We may need to verify your identity before processing your request. All requests will be acknowledged within three business days and fulfilled within 30 calendar days, extendable by a further 60 days for complex requests.

11 Minors

The hepi8 platform is strictly for adults aged 21 and above. hepi8 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all members. If hepi8 discovers or has reason to believe that personal data of a person under 21 has been collected, the relevant account will be immediately suspended, all data relating to the minor will be deleted, and any deposited funds will be returned to the originating payment method after mandatory review. If you believe a person under 21 has registered an account on hepi8, please notify us immediately at [email protected].

12 Third-Party Links

The hepi8 platform does not include links to third-party websites for general browsing purposes. Any third-party services integrated into the platform — such as payment gateways or KYC providers — operate under their own privacy policies, which govern their processing of your personal data. hepi8 is not responsible for the privacy practices of any third-party service provider, although we select and contract with third-party processors who meet equivalent data protection standards to those required under this Policy.

13 Policy Amendments

hepi8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or platform operations. Where changes are material, we will provide at least 14 days' advance notice via your registered email address or via a prominent notice on the hepi8 platform. The effective date at the top of this Policy will be updated to reflect the date of the most recent revision. Your continued use of the hepi8 platform following any amendment constitutes your acknowledgement of the updated Policy. The current version of this Policy is always accessible at https://hepi8.cam/privacy-policy.

14 Contact & Complaints

For all privacy-related enquiries, data subject rights requests, or complaints regarding hepi8's data processing practices, please contact us using the details below:

• Data Protection Contact: [email protected] (plain text — not a clickable link)
• Response Commitment: Acknowledgement within three business days; resolution within 30 calendar days.
• Live Chat: Available 24/7 via the hepi8 platform in Indonesian (WIB, UTC+7).

If you are not satisfied with hepi8's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction applicable to hepi8's international licence. Details of the relevant authority will be provided upon request.