win39 Privacy Policy

This Privacy Policy is issued by win39 (referred to throughout as "win39", "we", "us", or "our"), the operator of the online betting platform accessible at win39.cam and any related subdomains or mobile applications.

win39 acts as the data controller in respect of the personal data of Members and site visitors. As data controller, win39 determines the purposes and means by which personal data is processed and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently in accordance with applicable international data protection standards.

Our platform is primarily designed for adult players (21+) located in Indonesia, with content, banking options, and customer support tailored to the needs of players in Jakarta, Surabaya, Bandung, Medan, Bali, Semarang, and other major Indonesian cities. This Privacy Policy reflects that context and describes our data practices in clear, accessible English so that all Members can fully understand how their information is handled.

win39 collects personal data through several channels. The categories of data collected, and the context in which each is gathered, are described below.

2.1 Registration Data
When you create a win39 Account, we collect: full name, date of birth, gender, Indonesian national identity number (NIK from your KTP), residential address (including city and province), email address, mobile phone number, and preferred currency (IDR).

2.2 Identity Verification (KYC) Data
To comply with our responsible gaming and anti-money laundering (AML) obligations, we may collect copies of: government-issued photo identification (KTP, passport, or SIM), selfie photographs for liveness verification, proof of address documents (utility bills or bank statements issued within 90 days), and bank account ownership confirmation documents from BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP, or Bank Danamon.

2.3 Financial Data
We record transaction histories including deposits, withdrawals, bonus credits, and wager records. We store your registered bank account numbers and registered e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, or LinkAja account references) for the purpose of processing withdrawals. We do not store full payment card numbers.

2.4 Behavioral and Activity Data
win39 automatically records your betting and gaming activity on the Platform, including game sessions, bet amounts, win/loss outcomes, session durations, and login timestamps. This data is used for account management, responsible gaming monitoring, fraud detection, and personalization of the Platform experience.

2.5 Technical Data
Our servers automatically collect: IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, time spent on page, and error logs. This data is collected via server logs and first-party analytics tools.

2.6 Communications Data
We retain records of all communications between you and win39, including live chat transcripts, emails, and support ticket exchanges. This data is used for quality assurance, dispute resolution, and staff training purposes.

win39 uses the personal data it collects for the following purposes. The table below maps each data category to its primary processing purpose:

In addition to the purposes listed above, win39 may use aggregated and anonymized data — which cannot be used to identify any individual — for internal business analytics, platform improvement, and product development. Anonymized data is not subject to this Privacy Policy as it does not constitute personal data.

Marketing Communications. With your prior consent, win39 may contact you via email, SMS, or in-app notification to inform you of new promotions, bonus offers, seasonal campaigns (such as Idul Fitri, Ramadhan, or Indonesian Independence Day promotions), and platform updates. You may opt out of marketing communications at any time by adjusting your notification preferences in the Account dashboard or by contacting support@win39.cam. Opting out of marketing communications does not affect transactional messages such as deposit confirmations, withdrawal notifications, and security alerts, which are sent regardless of marketing preferences.

win39 processes personal data on one or more of the following legal bases:

• Contractual Necessity: Processing that is necessary to fulfill our obligations under the Member Agreement (our Terms and Conditions) — including account management, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable legal obligations, including KYC/AML requirements under international gaming law, financial record-keeping obligations, and law enforcement requests issued by competent authorities.
• Legitimate Interests: Processing carried out for win39's legitimate business interests, provided that those interests are not overridden by your fundamental rights and freedoms. This includes fraud detection, platform security, responsible gaming monitoring, and internal analytics.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and for the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

win39 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. We share personal data with third parties only in the following strictly defined circumstances:

1. Payment Processors and Banking Partners. To process your deposits and withdrawals, win39 shares the minimum necessary financial data with Indonesian local bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). These entities operate under their own privacy policies and are contractually required to process your data solely for payment purposes.
2. Game Content Providers. win39 integrates game content from licensed third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe. These providers receive session tokens and anonymized game-play data for the purpose of game rendering and result certification. They do not receive your name, contact details, or financial data.
3. Identity Verification Services. win39 may use accredited third-party KYC service providers to assist with automated document verification and liveness checks. These providers process identity documents under a strict data processing agreement and are prohibited from using your data for any purpose other than verification.
4. IT Infrastructure and Cloud Services. win39 uses reputable cloud infrastructure providers for hosting, data storage, and content delivery. These providers act as data processors under contractual obligations and do not access personal data beyond what is required for infrastructure management.
5. Legal and Regulatory Disclosure. win39 may disclose personal data to law enforcement agencies, regulatory authorities, courts, or other government bodies where we are legally compelled to do so, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of win39, our Members, or the public.
6. Business Transfers. In the event of a merger, acquisition, or sale of all or part of win39's business assets, personal data may be transferred to the acquiring entity. Members will be notified of any such transfer and their rights in relation to the new data controller.

win39 uses cookies and similar tracking technologies on its Platform. A cookie is a small text file placed on your device by a web server. Cookies allow win39 to recognize your browser, maintain your session state, and deliver a consistent, personalized platform experience.

Types of cookies we use:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These include session cookies that keep you logged in, security tokens that protect against CSRF attacks, and cookies that remember your language or regional preferences. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Used to remember your preferences and settings, such as your preferred deposit method or notification settings, so that you do not need to reconfigure them on each visit.
• Analytical Cookies: Used to understand how Members interact with the Platform — which pages are visited most frequently, where users click, and what journeys they take through the site. win39 uses first-party analytics tools for this purpose. Analytical cookies are set only with your consent.
• Responsible Gaming Cookies: Used to monitor session duration and trigger responsible gaming reminders (e.g., "You have been playing for 60 minutes") in accordance with win39's duty of care obligations. These are treated as strictly necessary for player safety purposes.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from accessing the Platform. Disabling analytical cookies will not affect your ability to use win39 but will limit our ability to improve the Platform based on usage data.

win39 retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, subject to any legal retention obligations that require us to keep data for longer. The following retention periods apply as a general guide:

• Account and Registration Data: Retained for the duration of active membership plus five (5) years following account closure. This period reflects AML regulatory requirements applicable to gambling operators.
• KYC / Identity Documents: Retained for a minimum of five (5) years from the date of account closure or the date of the last transaction, whichever is later.
• Transaction and Financial Records: Retained for seven (7) years from the date of each transaction, in line with standard financial record-keeping requirements.
• Betting and Gaming Activity Logs: Retained for three (3) years from the date of each recorded session, unless a dispute or investigation requires retention for a longer period.
• Customer Support Communications: Retained for two (2) years from the date of the last communication, unless the communication relates to an unresolved dispute or legal proceeding.
• Marketing Consent Records: Retained for the duration of active consent plus two (2) years following withdrawal of consent, to demonstrate compliance with consent requirements.

At the end of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with any identifiable individual. Anonymized data may be retained indefinitely for statistical and analytical purposes.

win39 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security framework includes:

• Transport Encryption: All data transmitted between your device and win39 servers is encrypted using TLS 1.2 or higher. HTTPS is enforced across all Platform pages with HTTP Strict Transport Security (HSTS) enabled.
• Data-at-Rest Encryption: Sensitive data stored on win39 servers — including identity documents, financial records, and authentication credentials — is encrypted using AES-256.
• Access Controls: Access to personal data is restricted on a strictly need-to-know basis. win39 staff are granted the minimum level of data access necessary to perform their role. All staff with access to personal data undergo data protection training and are bound by confidentiality obligations.
• Password Security: Member passwords are hashed using a strong, salted cryptographic hashing algorithm. win39 staff cannot view your plaintext password at any time.
• Two-Factor Authentication (2FA): win39 offers optional two-factor authentication for Member accounts. We strongly recommend enabling 2FA via the Account security settings for an additional layer of protection.
• Intrusion Detection and DDoS Protection: win39 employs real-time intrusion detection systems, DDoS mitigation services, and web application firewalls to protect Platform infrastructure from external threats.
• Regular Security Audits: win39 conducts periodic third-party penetration testing and security vulnerability assessments. Critical vulnerabilities are remediated within 24 hours of discovery.

As a win39 Member, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at support@win39.cam with the subject line "Data Rights Request — [Your Username]". We will respond within 30 calendar days of receiving a verified request.

win39 will not charge a fee for exercising any of the above rights unless a request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply. We may need to verify your identity before processing a data rights request to ensure we do not disclose personal data to an unauthorized person.

win39 is strictly an adults-only platform. Our services are available exclusively to persons aged 21 years or older. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that a Member is under 21 years of age, we will immediately:

• Suspend the Account and freeze all associated funds.
• Conduct an age verification review.
• Delete any personal data collected from the underage individual as soon as practicable, subject to any AML or legal investigation requirements.
• Forfeit any winnings generated by the underage account in accordance with our Terms and Conditions.

If you are a parent or guardian and believe that a minor in your care has registered a win39 Account or accessed our Platform, please contact us immediately at support@win39.cam. We will investigate and take appropriate action within 24 hours of receiving your report.

win39 operates as an internationally licensed gaming platform. As a result, your personal data may be processed by win39's servers, cloud infrastructure, or third-party service providers located outside Indonesia. Where personal data is transferred internationally, win39 ensures that adequate safeguards are in place to protect your data, including:

• Transfers to jurisdictions that provide a comparable level of data protection to that in force under the applicable international standard.
• Use of contractual data transfer mechanisms (such as standard contractual clauses or binding corporate rules) with recipient entities.
• Technical security measures including encryption in transit and at rest, as described in Section 8 above.

win39's primary data processing infrastructure is designed to minimize unnecessary cross-border transfers of personal data. Indonesian Member data is, wherever technically feasible, processed within the Asia-Pacific region to minimize latency and jurisdictional risk.

win39 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. When material changes are made, we will notify Members by one or more of the following methods:

• A prominent notice displayed on the Platform homepage or within the Account dashboard upon your next login.
• An email notification sent to your registered email address summarizing the key changes.
• An updated "Effective Date" and version number at the top of this Privacy Policy document.

Your continued use of the win39 Platform following the publication of a revised Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree with the changes, you should cease using the Platform and contact support to request account closure and data deletion.

We recommend that you review this Privacy Policy periodically to stay informed about how win39 protects your personal data. The current version of this Privacy Policy is always accessible at win39.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way win39 processes your personal data, please contact our support team through any of the following channels:

• Email: support@win39.cam — please use the subject line "Privacy Inquiry — [Your Username]" for the fastest response.
• Live Chat: Available 24/7 directly within the win39 Platform after logging in to your Account.
• WhatsApp: Contact details are available in your Account dashboard after login.

win39 customer support operates 24 hours a day, 7 days a week, including Indonesian public holidays, in Western Indonesia Time (WIB, UTC+7). Native Indonesian-speaking agents are available at all times to assist Members who prefer to communicate in their first language, even though this Privacy Policy and the Platform itself operate in English.

For formal data subject access requests, deletion requests, or objection notices, please email support@win39.cam with the subject line "Data Rights Request — [Your Username]". win39 acknowledges all data rights requests within 5 business days and provides a substantive response within 30 calendar days of receipt of a verified request.