Your privacy matters to hepi8. This Privacy Policy sets out exactly what personal data we collect from Indonesian players, how and why we use it, the circumstances under which it is shared, how long we retain it, and what rights you hold over your own information. Last updated: January 2026.
Six commitments that govern every data decision hepi8 makes — from the moment you register to the day you close your account.
hepi8 collects only the personal data that is strictly necessary to operate your account, verify your identity, process payments, and comply with our licensing obligations. We do not collect data speculatively or beyond what a clear purpose demands.
We tell you plainly what data we hold, why we hold it, who can access it, and for how long. There are no hidden data pipelines. If our data practices change in a material way, we will notify you before those changes take effect.
All data transmitted between your device and hepi8 is protected by 256-bit SSL/TLS encryption. Stored personal data is protected by industry-standard encryption at rest, access controls, and regular independent security audits.
You have the right to access, correct, export, restrict processing of, or request deletion of your personal data at any time. hepi8 maintains a dedicated process for handling such requests and will respond within 30 days of receipt.
hepi8 will never sell, rent, or trade your personal data to third-party advertisers, data brokers, or marketing platforms. Data sharing with third parties is limited strictly to service providers who operate under binding data processing agreements.
We do not hold personal data indefinitely. Each category of data is retained for the minimum period required by our licensing obligations and applicable law, after which it is securely deleted or anonymized. Retention schedules are published within this policy.
hepi8 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every individual who uses our services. This Privacy Policy describes the personal data we collect from members and visitors — with a particular focus on players based in Indonesia — how that data is processed, and the rights you hold under applicable data protection laws.
hepi8 serves a predominantly Indonesian player base, and we recognize the importance of handling personal data with the highest standards of care, transparency, and security. While Indonesian players access hepi8 as an internationally licensed platform, we apply data protection practices consistent with global best practices to ensure your information is treated responsibly at every stage of your membership.
If you have any questions about this Privacy Policy or how hepi8 handles your data, please contact our support team at [email protected] or via live chat on hepi8.pro.
The following terms carry the meanings set out below throughout this Privacy Policy:
hepi8 collects the following categories of Personal Data, depending on the nature of your interaction with the platform:
3.1 Registration & Identity Data
3.2 Financial & Payment Data
3.3 Usage & Behavioral Data
3.4 Technical & Device Data
hepi8 collects Personal Data through the following channels:
hepi8 uses Personal Data for the following purposes only:
hepi8 processes Personal Data on one or more of the following legal grounds:
hepi8 shares Personal Data only in the following circumstances and only to the extent strictly necessary for the stated purpose:
hepi8 is operated by an internationally licensed entity, and some of its infrastructure and service providers are located outside Indonesia. As a result, your Personal Data may be transferred to and stored in countries other than Indonesia. Where such transfers occur, hepi8 ensures that appropriate safeguards are in place, including:
By registering and using a hepi8 account, you acknowledge that your Personal Data may be processed outside Indonesia in accordance with the safeguards described above.
hepi8 retains Personal Data for the minimum period necessary to fulfill the purpose for which it was collected and to comply with applicable legal and licensing obligations. The following retention schedule applies:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | 5 years after account closure | Licensing and AML compliance obligations |
| KYC identity documents | 5 years after account closure | Identity verification and regulatory record-keeping |
| Financial transaction records | 5 years after the transaction date | AML obligations and dispute resolution |
| Game session and betting history | 3 years after account closure | Dispute resolution and responsible gaming review |
| Customer support correspondence | 2 years after the final interaction | Quality assurance and dispute history |
| Marketing consent records | Until consent is withdrawn, then 1 year | Proof of lawful marketing basis |
| Technical and device logs | 12 months from creation | Security monitoring and fraud prevention |
| Self-exclusion records | Indefinitely (or per licensing authority direction) | Responsible gaming — to prevent re-registration |
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with any individual.
hepi8 uses cookies and similar tracking technologies to operate the platform, maintain your logged-in session, remember your preferences, and analyze how the platform is used. The following categories of cookies are in use:
hepi8 does not use third-party advertising cookies or tracking pixels that share your behavior data with external advertising networks.
hepi8 implements a multi-layered security architecture to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. Our technical and organizational measures include:
While hepi8 maintains robust security standards, no internet-based platform can guarantee absolute security against all threats. You are responsible for keeping your account password confidential and for notifying hepi8 immediately if you suspect unauthorized access to your account.
As a Member, you hold the following rights in relation to your Personal Data held by hepi8. To exercise any of these rights, please contact us at [email protected] or via live chat. hepi8 will respond to all valid requests within 30 calendar days.
| Right | What It Means |
|---|---|
| Right of Access | You may request a copy of all Personal Data hepi8 holds about you, along with an explanation of how and why it is being processed. |
| Right to Rectification | You may request correction of any inaccurate or incomplete Personal Data — for example, a misspelled name or outdated address. |
| Right to Erasure | You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, subject to overriding legal or regulatory retention obligations. |
| Right to Restriction | You may request that hepi8 limits processing of your data to storage only while a dispute about its accuracy or lawfulness is resolved. |
| Right to Portability | You may request an export of your Personal Data in a structured, machine-readable format (such as JSON or CSV) to transfer to another service provider. |
| Right to Object | You may object to processing based on hepi8's legitimate interests — including direct marketing. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests. |
| Right to Withdraw Consent | Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting any prior lawful processing. |
Please note that exercising your Right to Erasure will typically require closure of your hepi8 account, as certain data must be retained for the periods specified in Section 9 to comply with licensing and AML obligations. Data subject to mandatory retention periods cannot be deleted on request, but hepi8 will delete all data not subject to such obligations.
hepi8 strictly prohibits access to its platform by individuals under the age of 21. We do not knowingly collect, store, or process Personal Data belonging to anyone under 21 years of age. Age verification is a mandatory step in the KYC process, and any account found to belong to an individual under 21 will be immediately closed and all associated funds returned or forfeited in accordance with our Terms & Conditions.
hepi8.pro does not contain outbound links to third-party websites or external platforms as part of its standard navigation or content. However, in the event that any third-party content is embedded in the platform — such as game iframes served by software providers including Pragmatic Play, Evolution Gaming, or Spribe — please be aware that those providers operate under their own privacy policies, which govern the data processed within their game environments.
hepi8 is not responsible for the privacy practices of third-party game software providers. We select partners who maintain industry-standard data protection practices and who operate under binding data processing agreements with hepi8, but we recommend reviewing the privacy policies of major providers if you have specific concerns.
hepi8 may update this Privacy Policy from time to time to reflect changes in our data processing practices, licensing requirements, or applicable law. When a material change is made, we will notify you by posting a prominent notice on hepi8.pro and, where practicable, by sending a notification to your registered email address at least 7 days before the change takes effect.
The date of the most recent revision is displayed at the top of this page. Your continued use of the hepi8 platform after the effective date of any change constitutes your acknowledgment of the updated Privacy Policy. If you do not agree to the revised policy, you must discontinue use of the platform and request account closure before the change takes effect.
For any questions, concerns, or requests relating to this Privacy Policy or hepi8's handling of your Personal Data, please reach out through one of the following channels:
If you are not satisfied with hepi8's response to your privacy concern or data subject request, you have the right to escalate your complaint to hepi8's licensing authority in accordance with its published complaint and dispute resolution procedures. Details of the relevant authority are available on request from our support team.
hepi8 takes every privacy complaint seriously. All formal complaints will be acknowledged within 5 business days and will receive a substantive written response within 30 calendar days of receipt.
hepi8 protects every Indonesian player's personal data with 256-bit encryption, strict KYC controls, and a firm no-data-sales policy. Log in securely, explore our full game library, or check the FAQ if you have questions about your account or privacy rights. 21+ only. Play responsibly.