ind96 Privacy Policy

In this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including name, date of birth, email address, mobile number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Controller" means ind96, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means any third party that processes Personal Data on ind96's behalf under a contractual data processing agreement.
• "Member" or "you" means any individual who has registered or is in the process of registering a verified account on the ind96 platform.
• "KYC Data" means identity verification documents and supporting materials submitted by a Member, including KTP Nasional scans, selfies with identity documents, and proof of residential address.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including government-issued identity numbers, financial account credentials, and health-related information submitted in the context of responsible gaming applications.
• "Platform" means the ind96 website at https://ind96.cam and all associated subdomains and mobile interfaces.

2.1 This Privacy Policy applies to all Personal Data collected by ind96 in connection with the operation of the Platform, including data collected during account registration, identity verification, deposits and withdrawals, customer support interactions, and general use of the Platform's features.

2.2 This policy applies to all Members, regardless of whether they are residents of Indonesia or of other jurisdictions from which ind96 accepts registrations. Where applicable law in a Member's jurisdiction imposes additional data protection obligations beyond those set out in this policy, ind96 will endeavour to comply with such requirements.

2.3 This policy does not apply to the data practices of third-party service providers (such as game studios, payment processors, or analytics platforms) that operate their own independent privacy policies. ind96 encourages Members to review the privacy policies of any third-party services they interact with.

3.1 ind96 collects the following categories of Personal Data:

3.2 ind96 does not knowingly collect Sensitive Data beyond the categories listed above. We do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data for the purpose of unique identification, except where KTP Nasional documents incidentally contain such information as part of the standard Indonesian identity document format.

4.1 Directly from you: The majority of Personal Data we hold is provided directly by Members during account registration, the KYC process, deposit and withdrawal requests, customer support communications, and use of responsible gaming tools.

4.2 Automatically via the Platform: Technical and Usage Data is collected automatically when you access the Platform. This includes data gathered through cookies, server logs, session tracking technologies, and similar tools. Please refer to Clause 9 (Cookies & Tracking) for full details.

4.3 From third-party service providers: We may receive data from our KYC verification partners (to confirm identity document authenticity), payment processors (to confirm transaction status), and fraud detection services (to identify suspicious activity patterns). Data received from third parties is combined with data we hold about you solely for the purposes described in Clause 5.

4.4 From publicly available sources: In limited circumstances relevant to fraud prevention or AML compliance, ind96 may consult publicly available records, sanctions lists, or politically exposed persons (PEP) databases.

5.1 ind96 processes your Personal Data for the following purposes:

• Account management: Creating, maintaining, and administering your Member account, including password resets, account updates, and closure requests.
• Identity verification (KYC): Confirming that you meet the eligibility requirements set out in our Terms & Conditions — including the 21+ age requirement and the requirement to be a verified individual — before processing any withdrawal.
• Payment processing: Facilitating deposits and withdrawals in IDR via your nominated bank account or e-wallet, and maintaining transaction records for accounting and audit purposes.
• Platform security and fraud prevention: Detecting, investigating, and preventing unauthorised access, duplicate account creation, money laundering, match-fixing, bonus abuse, and other fraudulent or prohibited conduct.
• Regulatory and legal compliance: Meeting our obligations under our international gaming licence, anti-money laundering (AML) regulations, and any lawful requests from regulatory authorities or law enforcement agencies.
• Customer support: Responding to enquiries, resolving disputes, and maintaining records of support interactions for quality assurance and training purposes.
• Responsible gaming: Monitoring wagering patterns to identify potential problem gambling indicators, enforcing deposit limits and self-exclusion requests, and providing appropriate support referrals where necessary.
• Service improvement: Analysing aggregated, anonymised usage data to understand how Members interact with the Platform and to develop new features, optimise game offerings, and improve the overall user experience.
• Marketing communications: Sending you promotional offers, bonus notifications, and Platform news — but only where you have given your explicit consent or where we have a legitimate interest in contacting you about our own similar services. You may withdraw consent at any time.

5.2 ind96 will not process your Personal Data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or identifying a valid alternative legal basis.

6.1 ind96 relies on the following legal bases for processing your Personal Data:

• Contractual necessity: Processing required to perform our obligations under the Member agreement — including account creation, KYC verification, payment processing, and customer support — is carried out on the basis that it is necessary for the performance of the contract between you and ind96.
• Legal obligation: Certain processing activities — including AML checks, sanctions screening, and retention of transaction records — are required by applicable law and our licensing authority. We have no discretion to omit these.
• Legitimate interests: We process Technical Data, Usage Data, and fraud-related data on the basis of our legitimate interest in operating a secure, fair, and commercially sustainable gaming platform, provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Marketing communications and non-essential cookies are processed on the basis of your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

7.1 ind96 does not sell, rent, or trade your Personal Data to any third party for their independent marketing or commercial purposes. Data is shared only in the following circumstances and only to the extent strictly necessary:

• KYC verification providers: Identity document data is transmitted to our contracted KYC service provider for document authenticity checks and liveness verification. This provider processes data solely on our instructions under a binding data processing agreement.
• Payment processors and banking partners: Financial Data necessary to execute deposits and withdrawals is shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) to process the transaction. These entities act as independent data controllers for their own payment services.
• Fraud prevention and AML services: Technical Data and transaction patterns may be shared with contracted fraud detection and AML compliance platforms to identify suspicious activity.
• Game content providers: Certain game studios (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) may receive anonymised session identifiers necessary for game session management. These providers do not receive your Identity Data or Financial Data.
• Regulatory authorities and law enforcement: We will disclose Personal Data to our licensing authority, Indonesian or international law enforcement agencies, or judicial bodies where required to do so by law, regulation, court order, or our licensing conditions.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or substantially all of the Operator's assets, Member data may be transferred to the acquiring entity, subject to equivalent privacy protections. Members will be notified of any such transfer.

8.1 ind96 is an internationally operated platform. Personal Data collected from Members based in Indonesia may be transferred to, and processed on, servers located outside of Indonesia, including in the jurisdiction where the Operator holds its gaming licence.

8.2 Wherever Personal Data is transferred internationally, ind96 ensures that appropriate safeguards are in place, including:

• Contractual clauses with receiving entities that impose data protection obligations equivalent to those described in this policy.
• Transfer only to jurisdictions that provide an adequate level of data protection as assessed by the Operator.
• Implementation of technical security controls (encryption in transit and at rest) regardless of the receiving jurisdiction.

8.3 By registering an account on the ind96 Platform, you acknowledge that your Personal Data may be processed outside Indonesia and consent to such transfers on the basis and subject to the safeguards described in this clause.

9.1 ind96 uses cookies and similar tracking technologies (including session tokens, local storage, and pixel tags) to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and language/currency preference storage. These cookies cannot be disabled without rendering the Platform inoperable.
• Performance and analytics cookies: Used to collect anonymised data about how Members navigate the Platform — which pages are visited most, where users drop off, and how games perform. This data is used exclusively to improve the Platform and is not linked to your identity.
• Functional cookies: Enable personalisation features such as remembering your preferred deposit method or last-visited game category.
• Marketing cookies: Used, with your consent, to deliver relevant promotional offers and to measure the effectiveness of ind96's marketing campaigns. These cookies may be set by ind96 or by our contracted marketing technology providers.

9.2 You may manage your cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Disabling other cookie categories will not affect your ability to place bets or process payments.

10.1 ind96 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods imposed by our licensing and legal obligations:

10.2 Once the applicable retention period has elapsed and there is no other legal basis for continued processing, Personal Data will be securely deleted or irreversibly anonymised in accordance with ind96's data disposal procedures.

11.1 Subject to applicable law and our legitimate regulatory and contractual obligations, you have the following rights in respect of your Personal Data:

• Right of access: You may request a copy of the Personal Data ind96 holds about you, along with information about how it is processed.
• Right to rectification: You may request correction of any inaccurate or incomplete Personal Data held about you. For account contact details, you may update these directly in your account settings.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing. Note that certain data must be retained to comply with our legal and regulatory obligations and cannot be erased on request.
• Right to restriction: You may request that ind96 restrict processing of your Personal Data in certain circumstances — for example, while a dispute about data accuracy is pending.
• Right to data portability: Where processing is carried out by automated means on the basis of your consent or a contract, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests. ind96 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

11.2 To exercise any of the above rights, please contact ind96's support team at [email protected]. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Complex requests may be extended by an additional 30 days with prior notification.

11.3 ind96 will not charge a fee for handling data subject requests unless they are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

12.1 ind96 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS encryption for all data transmitted between your browser and our servers.
• Encryption at rest for all databases containing Personal Data and Financial Data.
• Role-based access controls ensuring that only authorised personnel with a documented operational need may access Member data.
• Multi-factor authentication (MFA) required for all ind96 administrative system access.
• Regular penetration testing and vulnerability assessments conducted by independent third-party security firms.
• Comprehensive security incident response procedures, including a defined breach notification protocol.
• Staff training on data protection obligations and secure handling of Personal Data.

12.2 In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, ind96 will notify affected Members without undue delay and, where required, will notify the relevant regulatory authority within the timeframe prescribed by applicable law.

12.3 While ind96 takes all reasonable precautions, no internet-based system is entirely immune from security threats. Members are reminded of their own responsibility to use strong, unique passwords and to enable two-factor authentication on their accounts.

13.1 The ind96 Platform is strictly intended for adults aged 21 and above. ind96 does not knowingly collect Personal Data from any person under the age of 21. If we become aware that Personal Data has been collected from a person who is underage, we will immediately close the relevant account, delete all associated Personal Data (subject to any mandatory retention obligations under AML law), and report the incident to our compliance team.

13.2 If you believe that ind96 may have inadvertently collected data from a person under 21, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

14.1 The ind96 Platform integrates third-party game content from providers including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft. While these integrations are embedded within the ind96 interface, each provider operates under its own privacy and data handling practices for data processed within their game systems.

14.2 ind96 is not responsible for the privacy practices of third-party game studios, payment providers, or any other external service whose products or services are accessible through or referenced by the Platform. We encourage Members to review the privacy policies of any third-party service they use in connection with the Platform.

15.1 ind96 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our licensing obligations. Material changes — those that meaningfully affect your rights or how your data is used — will be communicated to Members by email or via an in-platform notification at least 7 days before the revised policy takes effect.

15.2 The current version of this Privacy Policy is always accessible at https://ind96.cam/privacy-policy. The "Last Updated" date at the top of this page reflects the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated policy.

15.3 If you do not agree with a material amendment to this policy, you may close your account before the revised policy takes effect. Account closure requests submitted in this context will be processed promptly and any verified balance returned in full.

16.1 If you have any questions, concerns, or complaints about this Privacy Policy or about the way ind96 handles your Personal Data, please contact our support team:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: Please mark privacy-related enquiries with "Privacy Request" or "Data Subject Request" in the subject line for prompt routing.
• Response time: We will acknowledge all privacy enquiries within 5 business days and provide a full response within 30 calendar days.

16.2 ind96 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. The DPO may be contacted through the support email address above by marking your enquiry "Attention: DPO".