Privacy Policy — dws99

Welcome to dws99. We operate the online gaming platform accessible at dws99.app (the "Platform"), which provides Indonesian members with access to a sportsbook, live casino, slot games, esports betting, and related gaming services. dws99 is committed to protecting the privacy and personal data of every individual who visits, registers with, or otherwise interacts with our Platform.

This Privacy Policy ("Policy") sets out in clear, plain terms what personal data dws99 collects about you, why we collect it, how we use and protect it, with whom we share it, how long we keep it, and what rights you have in relation to your personal data. Please read this Policy carefully before registering a dws99 account or submitting any personal information to us.

By accessing the dws99 Platform and/or registering a member account, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the Platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions with respect to the handling of personal data, this Privacy Policy shall prevail.

For the purposes of this Privacy Policy, the following terms have the meanings assigned to them below:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to a name, identification number, location data, email address, phone number, or any factor specific to the physical, economic, or social identity of that person.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Controller" — dws99, as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Member" — any registered user who holds an active dws99 account and has provided personal data in connection with that account.
• "Visitor" — any individual who accesses the dws99 Platform without completing registration, including those who browse content, view odds, or read informational pages.
• "Third-Party Processor" — any external company or service provider that processes personal data on behalf of dws99 under a data processing agreement, including payment processors, identity verification providers, and analytics services.
• "KYC" — Know Your Customer, the identity verification process through which dws99 confirms a member's legal identity, age (21+), and payment method ownership prior to approving withdrawals.
• "Sensitive Data" — a subset of personal data requiring a higher level of protection, including government-issued identity document numbers (e.g., KTP), financial account details, and information relating to health or personal circumstances disclosed voluntarily in the context of responsible gaming.

dws99 collects personal data across several categories, depending on your relationship with the Platform. The table below summarises the categories of data we collect, typical examples within each category, and whether collection is mandatory or optional.

dws99 does not intentionally collect special categories of sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for identification purposes, or data concerning sexual orientation. If you voluntarily disclose such information — for example, in a live chat conversation — it will be used solely to assist you in that interaction and will not be used for any other purpose.

dws99 collects personal data through the following means:

1. Direct Submission: You provide data directly to dws99 when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact our customer support team via live chat, WhatsApp, or email, or complete any other form or interaction on the Platform.
2. Automated Technologies: When you access and browse the Platform, dws99 automatically collects technical and usage data through cookies, server logs, web beacons, and similar tracking technologies. See Clause 8 (Cookies & Tracking) for full details.
3. Third-Party Payment Processors: When you make a deposit or request a withdrawal via a bank transfer (BCA, BRI, BNI, Mandiri, etc.) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the payment processor may share transaction confirmation data and account name data with dws99 for the purpose of reconciling your account.
4. Identity Verification Providers: dws99 uses third-party KYC and identity verification services to confirm the authenticity of documents you submit. These providers may return a verification status and match score to dws99, along with confirmation of the data fields verified.
5. Publicly Available Sources: dws99 may supplement the information it holds about you with data obtained from publicly available sources — for example, to verify an address or to support fraud prevention investigations.

dws99 processes your personal data only for clearly defined, legitimate purposes. The primary purposes for which we use your data are as follows:

• Account Management: To create, maintain, and administer your dws99 member account, including processing your login credentials, updating account details, and managing account status (active, suspended, self-excluded).
• Identity Verification (KYC): To verify that you are at least 21 years of age and to confirm ownership of the payment methods linked to your account, in compliance with anti-money-laundering (AML) and responsible gaming obligations.
• Transaction Processing: To process deposits in IDR via your chosen Indonesian bank or e-wallet, to settle winning bets, to process withdrawal requests, and to maintain accurate financial records of all transactions.
• Service Delivery: To provide access to dws99's sportsbook (including football/*bandar bola* markets, *mix parlay* accumulators, and *voor bola* Asian handicap markets), live casino, slot games from providers such as Pragmatic Play, Evolution Gaming, and Pocket Games Soft, and esports betting markets.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, account takeovers, multi-account abuse, money laundering, and other prohibited conduct as described in the Terms & Conditions.
• Customer Support: To respond to your enquiries, complaints, and requests submitted via live chat, WhatsApp, or email, and to maintain records of those interactions for quality assurance purposes.
• Responsible Gaming: To administer deposit limits, session time reminders, self-exclusion requests, and reality checks you have activated, and to identify members whose gaming patterns may indicate problematic behaviour so that appropriate support can be offered.
• Marketing & Promotions: To send you promotional communications about dws99 bonuses, seasonal offers (Idul Fitri, Ramadhan, Imlek, Indonesian Independence Day, and others), and new product launches — but only where you have opted in to receive such communications. You may opt out at any time.
• Platform Improvement: To analyse aggregated usage data, identify technical issues, test new features, and continuously improve the user experience for Indonesian members.
• Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from competent authorities, and defend dws99's legal rights in any dispute or arbitration proceeding.

dws99 relies on the following legal bases to process your personal data, depending on the purpose of the processing:

Where dws99 relies on legitimate interests as its legal basis, we have assessed that our interests are not overridden by your privacy rights and interests. You have the right to object to processing based on legitimate interests; see Clause 11 for details of how to exercise that right.

dws99 does not sell or rent your personal data to any third party. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

1. Payment Processors: Your bank account or e-wallet details and transaction amounts are shared with the relevant Indonesian payment network (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your requested deposit or withdrawal transaction.
2. KYC & Identity Verification Providers: Identity documents and personal details are shared with our contracted KYC service provider to verify your identity and age. These providers process your data solely on dws99's behalf and are contractually prohibited from using it for any other purpose.
3. Game Content Providers: When you play a game supplied by a third-party studio (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), limited technical identifiers (an anonymised player ID and session token) are shared with the provider to facilitate gameplay. These providers do not receive your name, contact details, or financial data.
4. Technology Service Providers: dws99 uses contracted third-party providers for cloud hosting, cybersecurity monitoring, customer support software, and platform analytics. All such providers operate under data processing agreements that restrict them to processing your data only as instructed by dws99.
5. Legal Authorities: dws99 may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other competent authorities when required to do so by applicable law, a court order, or in response to a lawful request. dws99 will notify you of any such disclosure to the extent permitted by law.
6. Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of dws99's business, your personal data may be transferred to the relevant successor entity. You will be notified of any such transfer and the privacy terms applicable to your data under the new entity before the transfer takes effect.

dws99 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your login session, and gather analytics data that helps us improve the member experience. The table below describes the categories of cookies used by dws99:

You can manage cookie preferences at the browser level using the settings menu of your browser (Chrome, Firefox, Safari, Edge, or any browser installed on your device). Please note that disabling strictly necessary cookies will impair the operation of the Platform and may prevent you from logging in or completing transactions.

dws99 does not use cross-site tracking cookies to follow your browsing activity outside of the dws99 Platform. We do not use fingerprinting technologies that identify your device for purposes beyond security and fraud prevention.

dws99 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to maintain your active member account, and to comply with applicable legal obligations. The following retention periods apply as a general guide:

Following the expiry of the applicable retention period, personal data is either permanently deleted from dws99 systems or irreversibly anonymised so that it can no longer be attributed to an identifiable individual. Where data is anonymised rather than deleted, the anonymised dataset may be retained indefinitely for statistical and research purposes.

dws99 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security measures in place include:

• 256-Bit SSL/TLS Encryption: All data in transit between your browser or app and dws99 servers is encrypted using industry-standard 256-bit SSL/TLS protocols. The dws99 domain is HTTPS-only; unencrypted HTTP connections are automatically redirected.
• Password Hashing: Member passwords are never stored in plain text. They are processed using a strong one-way cryptographic hashing algorithm with per-user salt, so that even in the unlikely event of a data breach, your password cannot be recovered from stored data.
• Access Controls: Access to member personal data within dws99's internal systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of system access required to perform their specific role. All internal access is logged and regularly audited.
• Firewalls & Intrusion Detection: dws99 servers are protected by enterprise-grade firewalls and real-time intrusion detection and prevention systems (IDS/IPS) that monitor for anomalous traffic patterns and potential attacks.
• Regular Security Audits: dws99 engages independent security specialists to conduct penetration testing and vulnerability assessments on a regular basis. Critical vulnerabilities identified are remediated within defined SLA windows.
• Multi-Factor Authentication (MFA): Members are strongly encouraged to enable two-step verification on their dws99 account. Internal dws99 staff accessing member data systems are required to use MFA.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, dws99 will notify affected members as promptly as practicable, and no later than within 72 hours of becoming aware of the breach, with details of the nature of the breach, the data categories affected, and the steps dws99 is taking to mitigate the impact.

You can help us keep your account secure by choosing a strong, unique password for your dws99 account, enabling two-step verification, never sharing your login credentials with any other person, and logging out of the Platform after each session on shared or public devices.

As a dws99 member, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our customer support team using the details in Clause 15. dws99 will respond to all valid rights requests within 30 days of receipt, and will not charge a fee for handling your request unless it is manifestly unfounded or excessive.

1. Right of Access: You have the right to request a copy of the personal data that dws99 holds about you, together with information about how it is being processed. We will provide this in a clear, structured format.
2. Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. For account details such as your registered phone number or email address, you may be able to update these directly in your account settings.
3. Right to Erasure ("Right to Be Forgotten"): In certain circumstances — for example, where the data is no longer necessary for the purpose it was collected, or where you withdraw consent and there is no other legal basis for processing — you may request that dws99 delete your personal data. Note that this right is subject to overriding legal obligations; dws99 may be required to retain certain data (e.g., KYC and transaction records) for the minimum periods set out in Clause 9.
4. Right to Restrict Processing: You may request that dws99 temporarily suspend the processing of your personal data — for example, while you contest the accuracy of the data we hold, or while we assess an objection you have raised.
5. Right to Data Portability: Where processing is based on your consent or the performance of a contract and is carried out by automated means, you have the right to receive the personal data you provided to dws99 in a structured, commonly used, machine-readable format, and to transmit it to another controller of your choice.
6. Right to Object: You have the right to object at any time to processing of your personal data carried out on the basis of legitimate interests, including profiling carried out for direct marketing purposes. Upon receipt of a valid objection, dws99 will cease the processing in question unless it can demonstrate compelling legitimate grounds that override your interests.
7. Right to Withdraw Consent: Where processing is based on your consent — in particular, the sending of promotional marketing communications — you may withdraw that consent at any time by updating your preferences in account settings or by contacting customer support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The dws99 Platform is strictly intended for adults aged 21 and over. dws99 does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register an account, deposit funds, or use the Platform in any capacity.

If dws99 becomes aware, through its KYC process or otherwise, that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, retain the data only to the extent required by law or to prevent future underage access, and securely delete all other personal data associated with that account as promptly as practicable.

Parents and guardians who become aware that a minor in their care has registered a dws99 account or submitted personal data to the Platform should contact our customer support team immediately at the details provided in Clause 15. We will act on such reports promptly. We also encourage parents and guardians to make use of device-level parental control software to prevent minors from accessing online gaming platforms.

dws99 primarily processes member data on servers located in data centres that serve the Southeast Asian and Asia-Pacific region, consistent with the predominantly Indonesian member base. In certain circumstances — for example, where a KYC verification provider or game content technology partner operates infrastructure in another jurisdiction — your personal data may be transferred to and processed in a country outside Indonesia.

Where such international transfers occur, dws99 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to the protections described in this Policy. These safeguards include contractual data processing agreements that impose obligations on the receiving entity, security requirements equivalent to those described in Clause 10, and restrictions on the use of data beyond the specified purpose of the transfer.

dws99 will not transfer your personal data to jurisdictions that do not offer an adequate level of data protection without first obtaining your explicit consent or establishing an alternative lawful transfer mechanism. If you have questions about the countries to which your data may be transferred, please contact us using the details in Clause 15.

dws99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the features and services offered on the Platform. The updated Policy will be published at dws99.app/privacy-policy with a revised "Last Updated" date shown at the top of the page.

Where a proposed amendment is material — meaning it significantly alters the way in which dws99 collects, uses, or shares your personal data — we will provide you with advance notice of the change by sending a notification to your registered email address or by displaying a prominent in-platform alert at least 14 days before the amended Policy takes effect. Your continued use of the Platform after the effective date of an updated Policy constitutes your acceptance of the revised terms.

If you do not accept the terms of any updated Privacy Policy, you should cease using the Platform and may request account closure by contacting our customer support team. Upon account closure, your data will be retained only for the minimum periods required by law as set out in Clause 9.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which dws99 handles your personal data, please reach out to our dedicated Privacy & Data Protection team using any of the following channels:

• Email: [email protected] — please use the subject line "Privacy Request" and include your registered username and the nature of your request.
• WhatsApp: +62 811 9999 0000 — available 24/7. Please identify yourself as a registered member and state that your message relates to a privacy matter.
• Live Chat: Access the live chat widget from any page of the dws99 Platform. Our Indonesian-speaking and English-speaking support agents are available around the clock (24/7, covering WIB, WITA, and WIT time zones).

dws99 aims to acknowledge all privacy-related enquiries within 24 hours of receipt and to provide a substantive response within 30 days. For complex rights requests — such as a comprehensive data access request — we may require up to an additional 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

If you are not satisfied with dws99's response to your privacy enquiry or rights request, you have the right to escalate your complaint to the relevant supervisory authority or data protection regulator in your jurisdiction.