Privacy Policy — gbk99 Data Protection Commitment

The following terms carry the meanings given below throughout this Privacy Policy:

gbk99 collects the following categories of Personal Data from members and platform visitors. We collect only data that is necessary for the operational, legal, and compliance purposes described in Section 4.

2.1 Registration and Identity Data

• Full legal name (as it appears on your government-issued ID)
• Date of birth (for age verification — members must be 21 or older)
• Residential address (city, province, postal code, country — Indonesia-based members typically in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, or other cities)
• Email address (primary communication channel)
• Phone number (for account security and two-factor authentication)
• Username and encrypted password hash

2.2 Identity Verification (KYC) Documents

• Scanned or photographed copy of government-issued photo identification (Indonesian KTP, passport, or SIM)
• Proof of residential address (utility bill, bank statement, or official correspondence issued within 90 days)
• Payment method verification (bank account details in your name for BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, or OCBC NISP; e-wallet profile screenshots for OVO, DANA, GoPay, ShopeePay, or LinkAja)
• Source of funds documentation (where required by enhanced due diligence procedures)

2.3 Financial Transaction Data

• Deposit and withdrawal amounts, dates, and reference numbers
• Payment method type and associated account identifiers (partial account numbers only — full card or account numbers are never stored)
• Account balance history denominated in Indonesian Rupiah (IDR)
• Bonus credit and wagering activity records

2.4 Gaming and Betting Activity Data

• Wager history across all product verticals: casino games (slots, live dealer, Keno, Andar Bahar), sportsbook markets (BRI Liga 1, EPL, Champions League, MotoGP Mandalika, Mobile Legends MPL), and other available products
• Game session duration and frequency
• Responsible gaming tool usage (deposit limits set, cooling-off periods requested, self-exclusion status)

2.5 Technical and Device Data

• IP address and approximate geolocation (country and city level only)
• Device type, operating system, and browser version
• Session timestamps and login history
• Referral source (the URL or campaign from which you arrived at the Platform)

2.6 Communications Data

• Live chat transcripts and email correspondence with the gbk99 support team
• Survey responses and feedback submissions
• Complaint and dispute records

gbk99 collects Personal Data through the following channels:

1. Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal request, contact the support team, participate in a promotion, or complete any form on the Platform.
2. Automatically during Platform use: Through server logs, cookies, and similar tracking technologies that record technical session data each time you interact with the Platform's pages, games, or betting interfaces.
3. From third-party verification partners: gbk99 works with licensed KYC and AML screening providers who may cross-reference your submitted identity data against official databases to confirm identity, age, and sanctions status.
4. From payment processors: When you initiate a deposit or withdrawal, your bank or e-wallet provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) shares confirmation data with gbk99 necessary to credit or debit your account balance.
5. From fraud prevention services: gbk99 uses industry-standard fraud detection tools that may receive anonymised or pseudonymised data about your session behaviour to flag suspicious activity patterns.

gbk99 processes your Personal Data for the following specific purposes:

gbk99 processes Personal Data under one or more of the following legal bases, depending on the purpose:

• Contractual necessity: Processing is necessary to perform the contract between you and gbk99 — specifically, to operate your account, process your financial transactions, and deliver the gaming and betting services you have requested. Without this processing, the Platform cannot function.
• Legal obligation: Processing is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, age verification mandates, and obligations imposed by gbk99's international gaming licence authority.
• Legitimate interests: Processing is necessary for gbk99's legitimate business interests — including fraud prevention, platform security, abuse detection, and analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is not required for contractual or legal reasons — specifically, sending you personalised promotional emails, SMS messages, or push notifications — gbk99 relies on your explicit consent, which you may withdraw at any time without affecting your account status.

gbk99 does not sell or rent your Personal Data to third parties. Data is shared only in the circumstances described below, and always subject to contractual data protection obligations:

6.1 Service Providers and Data Processors

gbk99 engages specialist third-party service providers to support platform operations. These include:

• KYC and identity verification providers — to validate government-issued ID documents and confirm that members meet the 21+ age requirement.
• Payment processors and banking partners — to facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and QRIS. These providers receive only the minimum data required to process the transaction.
• Game content providers — studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive session tokens necessary to load and operate their games within the gbk99 environment. These providers do not receive your full identity profile.
• Cloud hosting and infrastructure providers — to store and serve platform data in secure, access-controlled data centres.
• Fraud detection and AML screening services — to identify suspicious transaction patterns and verify that members are not on applicable sanctions or self-exclusion lists.
• Customer support platform providers — to power the 24/7 live chat function, including Indonesian-speaking support agents, and to store chat transcripts for quality assurance and dispute resolution purposes.

6.2 Legal and Regulatory Disclosure

gbk99 may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by a valid legal order, court judgment, or regulatory instruction. In such cases, gbk99 will disclose only the minimum data required to satisfy the legal obligation and will, where legally permissible, notify the relevant member that a disclosure request has been received.

6.3 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring of the gbk99 business, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer that materially affects the processing of your data before it takes place, and you will have the option to close your account and request data deletion if you do not consent to the transfer.

The gbk99 Platform uses cookies and similar technologies to deliver core functionality, improve user experience, and support analytics. The following cookie categories are in use:

You may manage your cookie preferences through your browser settings at any time. Disabling strictly necessary cookies may impair your ability to log in or use certain platform features. Analytical and marketing cookies can be disabled without affecting account functionality.

gbk99 retains Personal Data only for as long as is necessary for the purposes for which it was collected, subject to any longer retention period required by applicable law or regulatory obligation. The following standard retention periods apply:

• Account and identity data: Retained for the duration of your membership and for a minimum of five years following account closure, in compliance with AML record-keeping requirements.
• KYC documents: Retained for a minimum of five years from the date of submission or from the date of account closure, whichever is later.
• Financial transaction records: Retained for a minimum of five years from the date of the transaction, in compliance with financial record-keeping obligations.
• Gaming activity logs: Retained for the duration of the account and for two years following account closure, for dispute resolution and responsible gaming audit purposes.
• Support communications: Retained for three years from the date of the interaction for quality assurance, dispute resolution, and regulatory audit purposes.
• Technical and session data: Retained for 13 months from the date of collection, after which it is anonymised or deleted.
• Marketing consent records: Retained for the duration of your consent and for three years following withdrawal of consent, as evidence of the consent history.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and research purposes.

gbk99 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS 1.3): All data in transit between your browser or mobile device and gbk99's servers is encrypted using TLS 1.3 with a minimum 256-bit cipher strength. The Platform's SSL certificate is maintained and renewed regularly.
• Encryption at rest: Sensitive data — including KYC documents, financial records, and password hashes — is encrypted at rest using AES-256 encryption within the hosting environment.
• Access controls: Internal access to Personal Data is restricted on a need-to-know basis. All staff access is role-based, logged, and subject to regular access rights reviews. Privileged administrative access requires multi-factor authentication.
• Penetration testing: The Platform undergoes periodic security assessments and penetration tests conducted by qualified third-party security professionals. Findings are remediated according to a risk-prioritised schedule.
• Incident response: gbk99 maintains a documented data breach response procedure. In the event of a security incident involving your Personal Data, you will be notified within 72 hours of gbk99 becoming aware of the breach, where notification is required by applicable law.
• Employee training: All gbk99 staff with access to member data receive mandatory data protection and information security training upon onboarding and annually thereafter.

As a member of gbk99, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our Data Protection team at [email protected] with your registered email address and a clear description of your request. We will respond within 30 calendar days.

• Right of access: You may request a copy of all Personal Data that gbk99 holds about you, including the categories of data, the purposes for which it is processed, and the third parties with whom it has been shared.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that we correct or update it. Identity data corrections may require re-submission of KYC documents.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to overriding legal retention obligations — for example, AML record-keeping requirements may prevent immediate erasure of financial transaction records.
• Right to restriction of processing: You may request that gbk99 restrict the processing of your data in certain circumstances — for example, while a rectification request is being assessed, or where you contest the legal basis for processing.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that gbk99 provide your Personal Data in a structured, commonly used, machine-readable format (such as JSON or CSV) so that you can transfer it to another service provider.
• Right to object: You may object at any time to processing based on gbk99's legitimate interests, including profiling for responsible gaming monitoring or marketing personalisation. gbk99 will cease such processing unless compelling legitimate grounds can be demonstrated that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time via the unsubscribe link in any marketing email, through your account dashboard, or by contacting support. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

The gbk99 Platform is strictly intended for adults aged 21 and above. gbk99 does not knowingly collect Personal Data from individuals under the age of 21. The Platform employs automated and manual age verification checks at registration and at withdrawal to enforce this requirement.

If gbk99 discovers that an account has been created by, or that Personal Data has been collected from, an individual under the age of 21, the following actions will be taken immediately:

• The account will be suspended pending investigation and then permanently closed.
• All real-money deposits will be returned to the originating payment method after deduction of any applicable transaction costs.
• All winnings derived from wagers placed while the account was active will be voided and forfeited.
• All Personal Data associated with the underage account will be securely deleted, except for the minimum records required to document the incident and prevent re-registration.

If you are a parent or guardian and believe that a minor under your care has registered on the gbk99 Platform, please contact us immediately at [email protected] so that we can investigate and take the appropriate protective action without delay.

gbk99 operates as an internationally licensed platform. As a result, your Personal Data may be transferred to, stored in, or processed in jurisdictions outside Indonesia. These transfers may involve countries whose data protection laws differ from those applicable in Indonesia.

When Personal Data is transferred internationally, gbk99 ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements with all third-party processors that impose data protection obligations equivalent to those under which gbk99 operates.
• Transfer to jurisdictions that have been assessed as providing an adequate level of data protection for the specific data categories being transferred.
• Use of recognised standard contractual clauses or equivalent transfer mechanisms where statutory adequacy decisions are not in place.

Payment data shared with Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and Indonesian e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) remains within Indonesian jurisdiction and is governed by the applicable Indonesian financial services regulatory framework.

gbk99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. The following process applies to all material amendments:

• Material changes — defined as changes that meaningfully affect how your Personal Data is collected, used, or shared — will be communicated to registered members via email at least 14 days before the revised policy takes effect. A prominent notice will also be displayed on the Platform during this notice period.
• Non-material changes — such as typographical corrections, clarifications of existing practices, or the addition of new definitions — may be published without prior notice and take effect immediately upon publication.
• The "Last Updated" date at the top of this page reflects when the most recent version was published. It is your responsibility to review this policy periodically.
• Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised terms, you must cease using the Platform and contact us to request account closure and data deletion.

Archived versions of this Privacy Policy are available upon request by contacting [email protected]. We maintain a full version history for transparency and compliance purposes.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way gbk99 handles your Personal Data, please reach out through one of the following channels:

When submitting a data subject request, please provide your registered email address and Member ID so that we can locate your account and process your request accurately. For erasure or portability requests, identity re-verification may be required before we can act on the request.