Privacy Policy — aksi33

Definitions

In this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person ("data subject"), including but not limited to name, email address, date of birth, national identification number, financial account details, and IP address.
• "Processing" — any operation performed on personal data, whether automated or not, including collection, recording, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is aksi33.
• "Data Processor" — any third party that processes personal data on behalf of aksi33 pursuant to a written data processing agreement.
• "Cookie" — a small text file placed on your device by a website when you visit it, used to recognize your browser and remember preferences or session state.
• "KYC Data" — identity and address verification documentation collected as part of aksi33's Know Your Customer compliance process.
• "Transaction Data" — records of deposits, withdrawals, bets placed, games played, and any other financial activity conducted through the aksi33 Platform.

Data Controller

aksi33 is the Data Controller for all personal data collected and processed in connection with the aksi33 Platform. As Data Controller, aksi33 is responsible for ensuring that personal data is handled in accordance with applicable data protection legislation and the commitments made in this Policy.

For all privacy-related inquiries, requests, or complaints, you may contact our designated Data Protection point of contact at: [email protected] (plain text — not a clickable link). Please include "Privacy" in the subject line of your email to ensure prompt routing to the appropriate team.

Personal Data We Collect

The categories of personal data that aksi33 collects vary depending on how you interact with the Platform. The following table provides an overview:

How We Collect Personal Data

aksi33 collects personal data through the following methods:

• Direct interactions: Data you provide voluntarily when registering an account, completing KYC, submitting a deposit or withdrawal request, contacting our support team, or responding to a survey or promotion.
• Automated technologies: Technical data collected automatically as you use the Platform, including via cookies, web server logs, and analytics tools. This includes IP addresses, session data, and device identifiers.
• Third-party sources: Identity and fraud-screening data from KYC verification providers, fraud detection databases, and payment processors. We may also receive updated contact or address information from payment service providers where this is necessary to complete a transaction.
• Publicly available sources: In limited circumstances, aksi33 may review publicly available information (such as regulatory watchlists or sanctions databases) as part of our anti-money-laundering compliance processes.

Legal Basis for Processing

aksi33 processes your personal data on the following legal bases:

• Contractual necessity: Processing that is necessary to perform the contract between you and aksi33 — including operating your account, processing deposits and withdrawals, settling bets, and providing customer support.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering regulations, KYC requirements, responsible gaming obligations, and tax reporting duties.
• Legitimate interests: Processing carried out for the legitimate business interests of aksi33, where those interests are not overridden by your rights. This includes fraud prevention, platform security, improving our services, and direct marketing to existing customers (where opt-out has not been exercised).
• Consent: Where none of the above bases applies, we will seek your explicit consent before processing your personal data for a specific purpose. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

How We Use Your Personal Data

aksi33 uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and closing your aksi33 account; authenticating your identity at login; managing account preferences and settings.
• Transaction processing: Processing deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja; processing withdrawal requests; recording and reconciling transaction history.
• KYC and compliance: Verifying your identity and age in accordance with our KYC obligations; screening against sanctions and PEP (Politically Exposed Persons) lists; complying with anti-money-laundering regulations.
• Responsible gaming: Monitoring gaming behavior for indicators of problem gambling; applying deposit limits, session limits, or cooling-off periods where requested or required; facilitating self-exclusion requests.
• Platform security and fraud prevention: Detecting and preventing unauthorized access, account takeovers, and fraudulent transactions; identifying bonus abuse; monitoring for collusion or other prohibited conduct.
• Customer support: Responding to your queries, complaints, and requests; resolving disputes; maintaining support records.
• Platform improvement: Analyzing usage patterns and behavioral data (in aggregated and anonymized form where possible) to improve features, performance, and user experience.
• Marketing communications: Sending you relevant promotional offers and bonuses by email or other channels, where you have not opted out. You may opt out at any time by contacting support.
• Legal proceedings: Defending or pursuing legal claims; complying with court orders, regulatory requests, or law enforcement demands.

Data Sharing with Third Parties

aksi33 does not sell your personal data. We share personal data with third parties only in the following circumstances and only to the extent strictly necessary:

• Payment service providers: Banks and e-wallet operators (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) receive financial account data necessary to process deposits and withdrawals.
• KYC verification providers: Third-party identity verification services process your KYC documentation on our behalf under data processing agreements that require them to handle your data solely as instructed by aksi33.
• Game content providers: Providers such as Evolution Gaming, Pragmatic Play, and PG Soft may receive a session token and limited account identifier to authenticate your game session. These providers do not receive your full identity or financial data.
• Analytics and fraud detection providers: Technical data (including IP addresses and device identifiers) may be shared with analytics and fraud prevention service providers operating under data processing agreements.
• Regulatory authorities and law enforcement: We may disclose personal data to regulators, tax authorities, courts, or law enforcement agencies where required to do so by applicable law, court order, or regulatory directive.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or substantially all of aksi33's assets, personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

International Data Transfers

aksi33 operates as an internationally licensed platform. Your personal data may be processed in countries outside Indonesia, including in the jurisdiction where aksi33 holds its gaming license and where our infrastructure providers are located. Some of these jurisdictions may not provide the same level of data protection as Indonesian law.

Where we transfer personal data internationally, we take appropriate safeguards to ensure your data remains protected, including:

• Transferring data only to countries or territories that provide an adequate level of data protection as determined by applicable regulatory standards;
• Requiring data processors operating in other jurisdictions to comply with contractual data protection obligations equivalent to those set out in this Policy;
• Applying technical and organizational security measures to data in transit and at rest, regardless of where processing occurs.

Data Retention Periods

aksi33 retains personal data for as long as it is necessary for the purposes described in this Policy, or as required by applicable law. The following general retention guidelines apply:

• Active account data: Retained for the duration of your account's active status, plus five (5) years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years following the date of verification, or longer where required by the laws of aksi33's licensing jurisdiction.
• Transaction records: Retained for a minimum of five (5) years following the date of each transaction, to satisfy financial audit and regulatory obligations.
• Customer support records: Retained for three (3) years following the closure of a support ticket, except where a record is relevant to ongoing legal proceedings.
• Technical/behavioral data: Session logs are retained for up to twelve (12) months; aggregated and anonymized analytics data may be retained indefinitely.
• Marketing preference data: Retained until you opt out or close your account.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification.

Security Measures

aksi33 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, loss, disclosure, or destruction. These measures include:

• Encryption: 256-bit SSL/TLS encryption for all data in transit between your device and our servers. Data at rest is stored in encrypted form with strict access controls.
• Access controls: Personal data is accessible only to aksi33 staff with a legitimate operational need. Access is governed by role-based permissions, and all access events are logged and audited.
• Two-factor authentication: Internal systems require multi-factor authentication for all staff access to systems containing personal data.
• Penetration testing: We conduct regular third-party penetration tests and vulnerability assessments of our platform infrastructure.
• Incident response: aksi33 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant authorities within the timeframes required by applicable law.
• Vendor security: All third-party data processors are subject to contractual security obligations and periodic security assessments before and during engagement.

Cookies & Tracking Technologies

aksi33 uses cookies and similar tracking technologies (including web beacons and local storage) to enable core Platform functionality, improve user experience, and support security and analytics operations. The cookies we use fall into the following categories:

• Strictly necessary cookies: Required for the Platform to function. These include session management cookies that keep you logged in during a visit, security tokens that prevent cross-site request forgery, and load-balancing cookies. These cookies cannot be disabled without rendering the Platform non-functional.
• Functional cookies: Remember your preferences, such as language, display settings, and previously used payment methods, to provide a more personalized experience on return visits.
• Analytics cookies: Collect aggregated, anonymized data about how visitors use the Platform — including pages visited, session duration, and click paths — to help us improve the design and performance of the site.
• Security and fraud-prevention cookies: Used by our fraud detection systems to identify suspicious behavior patterns across sessions, detect automated bot traffic, and flag potentially fraudulent activity for review.

You can manage or disable cookies through your browser settings. Note that disabling strictly necessary cookies will impair or prevent access to the Platform. Instructions for managing cookies are available in your browser's help documentation. aksi33 does not deploy advertising or retargeting cookies from third-party ad networks.

Your Data Rights

Subject to applicable law and certain legal exceptions, you have the following rights in relation to your personal data held by aksi33:

To exercise any of the rights listed above, please contact aksi33 at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days. Where a request is complex or voluminous, we may extend this period by a further 60 days with prior notice.

We may request proof of identity before fulfilling a data rights request to ensure personal data is not disclosed to an unauthorized party.

Minors

The aksi33 Platform is strictly for adults aged 21 and over. aksi33 does not knowingly collect personal data from any person under the age of 21. If we become aware that an account has been created by or on behalf of a person under the minimum age, we will immediately suspend the account, delete the associated personal data to the extent not required for legal compliance, and report the matter where required by law.

Parents and guardians who believe a minor may have accessed or registered on the aksi33 Platform are encouraged to contact us immediately at [email protected] so that the matter can be investigated and remediated without delay.

Changes to This Policy

aksi33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. Where changes are material, we will provide at least seven (7) calendar days' advance notice by displaying a prominent notice on the Platform and/or sending a notification to your registered email address.

The "Last Updated" date displayed at the top of this page reflects the most recent revision. We recommend reviewing this Policy periodically. Your continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgment of the revised terms.

For users located in Indonesia, we note that Indonesia's Personal Data Protection Law (UU Pelindungan Data Pribadi, enacted 2022) sets out specific rights for data subjects. Where that law imposes obligations beyond what is described in this Policy, aksi33 will comply with those obligations as they apply to the processing of Indonesian residents' personal data.

Contact & Complaints

For any privacy-related questions, requests to exercise your data rights, or to report a suspected data breach, please contact aksi33 using the following details:

• Email: [email protected] — subject line "Privacy" (plain text only; not a clickable link)
• Live Chat: Available 24/7 via the aksi33 Platform in Indonesian and English. Ask to be connected to the data privacy team.
• Response Time: Privacy inquiries are handled within 30 calendar days of receipt. We aim to resolve straightforward requests significantly faster than this.

If you are not satisfied with our handling of a privacy complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For Indonesian residents, the relevant authority is the Ministry of Communication and Information Technology (Kominfo) or any successor body established under Indonesia's Personal Data Protection Law.

For general questions about how aksi33 operates, please also visit our FAQ page or review our Terms & Conditions.