Privacy Policy — cb99ed

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, and deletion.
• "Controller" refers to cb99ed, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means a third-party service provider that processes Personal Data on behalf of cb99ed under a written data processing agreement.
• "Data Subject" means you — the individual whose Personal Data is being processed.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" (Know Your Customer) refers to the identity verification process required before withdrawals may be processed on the platform.
• "Cookie" means a small text file placed on your device by a website to store session information and track browsing behavior.
• "IDR" / "Rp" means Indonesian Rupiah, the currency used for all transactions on the cb99ed platform.

cb99ed collects the following categories of Personal Data in the course of providing its services to Indonesian players:

We do not intentionally collect or process special categories of sensitive Personal Data (such as health, biometric, racial, or political data) unless strictly required for responsible gaming assessments (for example, where a player voluntarily discloses a gambling-related health concern to our support team). Such data is handled with the highest level of care and access restrictions.

cb99ed collects Personal Data through the following channels:

• Direct Submission: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, submitting a support ticket, or participating in a promotion.
• Automated Collection: Technical and usage data collected automatically as you browse and interact with the platform, including via cookies, web beacons, and server log files. See Clause 8 for full details on cookies.
• Third-Party Verification Partners: Identity and address verification data returned by KYC service providers when processing your submitted documents.
• Payment Processors: Transaction confirmation data shared by your bank or e-wallet provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) when a deposit or withdrawal is processed.
• Game Providers: Aggregated game session and outcome data provided by third-party studios such as Pragmatic Play, Evolution Gaming, Microgaming, Spribe, and Pocket Games Soft for settlement and auditing purposes.

cb99ed processes your Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you agreed to at registration — including account creation, transaction processing, and customer support.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, age verification obligations, and financial record-keeping duties.
• Legitimate Interests: Processing carried out for cb99ed's legitimate business interests where those interests are not overridden by your rights — including fraud prevention, platform security, duplicate account detection, and responsible gaming monitoring.
• Consent: Processing for purposes such as marketing communications and personalized promotional offers, where you have given your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing already carried out. See Clause 13 for details.

Personal Data collected by cb99ed is used exclusively for the following purposes:

1. Account Management: Creating, maintaining, and securing your registered Account, including password resets, login verification, and session management.
2. Identity & Age Verification: Confirming that you are at least 21 years of age and a legitimate player, as required by our international licensing obligations and responsible gaming commitments.
3. Payment Processing: Facilitating deposits and withdrawals in IDR via your chosen local bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), including verifying that payment methods belong to the registered Account holder.
4. Fraud Prevention & Security: Detecting and preventing unauthorized access, cheating, multi-accounting, bonus abuse, money laundering, and other prohibited activities described in the Terms & Conditions.
5. Regulatory Compliance: Meeting our AML, counter-terrorist financing (CTF), and record-keeping obligations as required by our licensing authority.
6. Responsible Gaming: Monitoring playing patterns to identify signs of problem gambling and proactively reaching out to Players who may benefit from our responsible gaming tools. See our Responsible Gaming page for full details.
7. Customer Support: Responding to your inquiries, complaints, and account-related requests submitted via live chat, email, or WhatsApp.
8. Platform Improvement: Analyzing aggregated, anonymized usage data to improve platform performance, game selection, and user experience.
9. Marketing & Promotions: Sending promotional offers, bonus notifications, and news about cb99ed — only where you have opted in to receive such communications. See Clause 13.

cb99ed does not sell your Personal Data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC & Identity Verification Providers: Third-party compliance partners who verify the authenticity of identity documents and screen names against sanction and politically exposed person (PEP) lists.
• Payment Processors: Banks and e-wallet operators (including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja) that facilitate your financial transactions. These entities process your financial data under their own privacy policies and applicable banking regulations.
• Game Technology Providers: Studios such as Evolution Gaming, Pragmatic Play, Microgaming, Spribe, and Pocket Games Soft receive anonymized player session data sufficient to render games and settle bets. They do not receive your full identity profile.
• IT & Security Service Providers: Cloud infrastructure, cybersecurity, and fraud detection vendors engaged to operate and protect the platform. All such vendors sign data processing agreements obligating them to process data only on our instructions.
• Legal & Regulatory Authorities: Law enforcement agencies, financial intelligence units, tax authorities, and our licensing regulator, where disclosure is required by law, court order, or regulatory mandate. We will notify you of any such disclosure where legally permitted to do so.
• Professional Advisers: Lawyers, auditors, and accountants bound by professional confidentiality obligations, where disclosure is necessary in connection with legal proceedings or regulatory audits.

In all cases where data is shared with third-party Processors, we require contractual commitments that the data is used only for the specified purpose, kept confidential, protected with appropriate security measures, and deleted or returned upon termination of the service relationship.

cb99ed operates internationally, and your Personal Data may be transferred to, stored in, or processed in countries outside Indonesia. This may occur, for example, where our KYC provider, cloud infrastructure partner, or game studio is based in a different jurisdiction.

Wherever Personal Data is transferred internationally, cb99ed takes all reasonable steps to ensure that the transfer is subject to adequate safeguards, which may include:

• Standard contractual clauses approved by a recognized data protection authority.
• Transfers to recipients in countries or jurisdictions recognized as providing an adequate level of data protection.
• Binding corporate rules applicable to our group of entities.

By registering an Account with cb99ed, you acknowledge that your Personal Data may be processed in jurisdictions whose data protection laws may differ from those applicable in Indonesia. We will always apply the protections described in this Policy regardless of where processing occurs.

cb99ed uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyze usage patterns. The categories of cookies we use are as follows:

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your Account and using core platform features. For full instructions on managing cookies in popular browsers, please refer to the help documentation of your browser provider.

cb99ed retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of your Account plus a minimum of 5 years following Account closure, in accordance with AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of the transaction, in compliance with financial services regulations.
• KYC Documents: Retained for the duration of your Account plus 5 years post-closure, or longer if required by regulatory direction.
• Customer Support Correspondence: Retained for 2 years from the date of the interaction, or until any related dispute is fully resolved, whichever is later.
• Marketing Preferences & Consent Records: Retained for the period during which you hold an active Account, plus 1 year to demonstrate compliance with consent obligations.
• Technical & Usage Logs: Retained for up to 12 months, after which they are aggregated and anonymized for statistical purposes.

Once the applicable retention period expires, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be linked to you as an individual.

cb99ed implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, loss, alteration, or disclosure. Key measures include:

• Encryption in Transit: All data exchanged between your browser or app and our servers is encrypted using TLS 1.3, ensuring that your credentials, financial details, and game activity cannot be intercepted in transit.
• Encryption at Rest: Sensitive stored data — including identity documents, financial account numbers, and KYC records — is encrypted using AES-256.
• Access Controls: Role-based access controls (RBAC) ensure that only authorized staff with a demonstrable operational need can access Personal Data. All staff access is logged and subject to regular audit.
• Multi-Factor Authentication (MFA): Administrative access to systems storing Personal Data requires MFA. Players are also strongly encouraged to enable two-factor authentication on their accounts.
• Penetration Testing: Our platform and infrastructure undergo regular penetration testing and vulnerability assessments by independent security specialists.
• Incident Response: cb99ed maintains a documented data breach response procedure. In the event of a breach that is likely to result in high risk to your rights, we will notify affected Players and, where required, the relevant regulatory authority, within the timeframes required by applicable law.

As a Data Subject, you hold the following rights with respect to your Personal Data processed by cb99ed. To exercise any of these rights, please contact our support team using the details in Clause 16. We will respond to all verified requests within 30 days.

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is being processed.
• Right to Rectification: You may request that inaccurate or incomplete Personal Data be corrected or updated without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request that your Personal Data be deleted where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that this right may be limited where retention is required by legal obligation (e.g., AML record-keeping).
• Right to Restriction of Processing: You may request that we limit the processing of your Personal Data in certain circumstances — for example, while a dispute about its accuracy is pending.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request that your Personal Data be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Where the objection relates to direct marketing, we will cease processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

cb99ed will not charge a fee for handling data rights requests unless they are manifestly unfounded or excessive, in which case a reasonable fee or refusal may apply. We may need to verify your identity before processing a request to protect against unauthorized access to another person's data.

cb99ed strictly prohibits use of the platform by individuals under 21 years of age. We do not knowingly collect Personal Data from anyone under 21. All Account registrations are subject to age verification as part of the KYC process described in our Terms & Conditions.

If cb99ed discovers or receives credible information that an Account is held by a person under 21, we will immediately suspend the Account, initiate a review, and — where confirmed — permanently close the Account and forfeit any associated balance in accordance with our legal obligations.

If you believe that a minor may have registered an Account on cb99ed, please notify us immediately at [email protected]. We treat all such reports with urgency and full confidentiality.

cb99ed sends promotional communications — including bonus offers, seasonal promotions tied to events such as Idul Fitri, Ramadhan, and Indonesian Independence Day, and platform news — only to Players who have explicitly opted in to receive them at the point of registration or through their Account preferences.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any promotional email.
• Updating your communication preferences in your Account dashboard.
• Contacting our support team via live chat or at [email protected].

Opting out of marketing communications will not affect transactional communications that are necessary for account operation — for example, deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These communications are sent regardless of your marketing preferences because they are necessary for the performance of our contractual obligations to you.

The cb99ed platform may contain references to or integrations with third-party services — such as game studios, payment gateways, and responsible gaming resources. Where such third-party services involve separate websites or interfaces, those services operate under their own privacy policies, and cb99ed accepts no responsibility for their data practices.

We encourage you to review the privacy policies of any third-party service you access in connection with your use of the cb99ed platform. The fact that a third-party provider is used by cb99ed does not constitute an endorsement of their privacy practices beyond the contractual obligations we impose on them as data processors.

cb99ed reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable law. When we make material changes, we will notify registered Players by email and/or by publishing a prominent notice on the platform at least 7 days before the updated Policy takes effect.

The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically. Your continued use of the platform after the effective date of any amendment constitutes your acceptance of the updated Policy.

For non-material amendments — such as typographical corrections or clarifications that do not alter any substantive right or obligation — changes may take effect immediately upon publication without prior notice.

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how cb99ed has handled your Personal Data, please contact us through any of the following channels:

• Email: [email protected] — for formal data rights requests, please use the subject line "Data Privacy Request — [Your Account Username]".
• Live Chat: Available 24/7 directly on the platform. Average response time is under 2 minutes.
• WhatsApp: Contact details are provided to registered Players upon Account creation.

cb99ed will acknowledge receipt of all formal privacy-related correspondence within 2 business days (WIB) and will provide a substantive response within 30 calendar days. In complex cases we may request a 30-day extension, in which case we will notify you of the delay and the reason.

If you are not satisfied with our response to a privacy concern, you have the right to escalate your complaint to the relevant data protection authority or regulatory body in your jurisdiction.