Privacy Policy — kuta4d

1Definitions

2About This Policy

2.1 kuta4d is committed to protecting the privacy of all Players who use its Platform. This Policy sets out, in transparent and accessible language, the categories of Personal Data we collect, the purposes for which we process it, the parties with whom we share it, and the rights you can exercise over your information.

2.2 kuta4d's Platform is operated primarily for players residing in Indonesia. References to regulatory compliance in this Policy reflect obligations arising under our international gaming licence and applicable anti-money-laundering frameworks. Where Indonesian law imposes additional data-protection obligations on data subjects located in Indonesia, kuta4d will respect those obligations to the extent applicable.

2.3 This Policy should be read alongside kuta4d's Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with the Platform.

3Data We Collect

3.1 kuta4d collects the following categories of Personal Data:

3.2 kuta4d does not collect or process special categories of sensitive Personal Data (such as health, biometric, racial, or religious data) unless explicitly required for responsible gaming intervention purposes, in which case such data is handled with heightened safeguards and processed only with your explicit consent.

4How We Collect Data

4.1 Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact our support team, or update your account profile.

4.2 Automatically — through cookies, web beacons, server logs, and similar technologies as you navigate and interact with the Platform. This includes pages visited, features used, session duration, and device characteristics.

4.3 From third-party service providers — identity verification agencies confirm the authenticity of KYC documents; payment processors confirm the status of transactions; fraud-detection partners flag suspicious activity signals; game studios supply session and outcome logs for dispute resolution purposes.

4.4 From publicly available sources — where permitted and necessary, kuta4d may supplement your profile with information from public registries, credit reference agencies, or sanctions screening databases to fulfil our anti-money-laundering compliance obligations.

5How We Use Your Data

5.1 kuta4d processes your Personal Data for the following purposes:

• Account management: Creating, maintaining, and administering your kuta4d account, including authentication, password resets, and account security alerts.
• Payment processing: Facilitating deposits via local Indonesian bank transfers and e-wallets, and processing withdrawal requests to your nominated payment method.
• Identity verification (KYC): Confirming your identity, age (21+), and residency to satisfy our licensing obligations and Indonesian regulatory context requirements.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, bonus abuse, money laundering, and other prohibited conduct on the Platform.
• Regulatory compliance: Meeting our obligations under our international gaming licence, anti-money-laundering frameworks, and any applicable data-protection regulations.
• Customer support: Responding to your queries, resolving disputes, and providing technical assistance via live chat, email, and WhatsApp.
• Platform improvement: Analysing aggregated usage data to improve the Platform's features, performance, game selection, and user experience for all players across Jakarta, Surabaya, Bandung, Bali, and beyond.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour and enabling access to player-protection tools including deposit limits and self-exclusion.
• Marketing communications: Sending you promotional offers, bonus notifications, and product updates relevant to your interests — but only where you have provided explicit consent or where we have a legitimate interest that is not overridden by your rights.

5.2 kuta4d will not use your Personal Data for purposes that are incompatible with those described above without providing prior notice and, where required, obtaining your consent.

6Legal Basis for Processing

6.1 kuta4d processes your Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and kuta4d — including account registration, payments, and customer support.
• Legal obligation: Processing required to comply with applicable law, including KYC, anti-money-laundering checks, and licensing requirements.
• Legitimate interests: Processing undertaken to pursue kuta4d's legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where none of the above bases apply, kuta4d will seek your explicit, freely given, and informed consent before processing your data. You may withdraw consent at any time without detriment to the core services you receive.

7Data Sharing & Disclosure

7.1 kuta4d does not sell or rent your Personal Data. We share your data only in the following circumstances and only to the minimum extent necessary:

• Payment processors and banks: To execute deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and other supported payment methods.
• Identity verification providers: To carry out KYC checks, document authentication, and age verification in line with our licensing requirements.
• Game studios and software providers: Game session data is shared with licensed studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) solely for the purpose of game delivery, outcome logging, and dispute resolution.
• Fraud detection and risk management partners: To identify suspicious patterns, prevent bonus abuse, and protect the integrity of the Platform.
• Regulatory and law enforcement authorities: Where required by law, court order, or instruction from a competent authority — including reporting obligations under anti-money-laundering regulations.
• Professional advisors: Lawyers, auditors, and compliance consultants who are bound by confidentiality obligations and engage with your data only as necessary for their professional services to kuta4d.

7.2 All third-party Data Processors engaged by kuta4d are required to enter into written data processing agreements that mandate appropriate technical and organisational security measures and prohibit the use of your data for any purpose other than that specified by kuta4d.

8Cookies & Tracking Technologies

8.1 The kuta4d Platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. The main categories of cookies we employ are:

• Strictly necessary cookies: Essential for the Platform to operate — including session authentication, security tokens, and load balancing. These cannot be disabled without impairing core functionality.
• Functional cookies: Store your preferences such as language settings, display preferences, and login state to reduce the need to re-enter information on each visit.
• Analytics cookies: Collect aggregated, anonymised data about how visitors interact with the Platform — pages viewed, features used, session duration — used solely to improve the Platform's performance and content.
• Security cookies: Help kuta4d detect and prevent fraudulent activity, bot traffic, and account takeover attempts by identifying anomalous session patterns.

8.2 You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform, including the ability to maintain a logged-in session.

8.3 kuta4d does not deploy third-party advertising or retargeting cookies on the Platform.

9Data Retention

9.1 kuta4d retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The general retention periods applied are:

• Account data and transaction records: Retained for a minimum of five (5) years from the date of account closure, in line with standard anti-money-laundering record-keeping requirements.
• KYC documentation: Retained for five (5) years from the end of the customer relationship, or longer if required by a specific regulatory authority.
• Customer support communications: Retained for three (3) years from the date of the interaction, to support dispute resolution and quality assurance.
• Technical and analytics data: Anonymised and aggregated within thirteen (13) months of collection; identifiable technical logs are purged after ninety (90) days.
• Marketing consent records: Retained for the duration of the consent plus three (3) years to demonstrate compliance with consent obligations.

9.2 Upon the expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised using industry-standard data destruction methods.

10International Data Transfers

10.1 As an internationally operated platform, kuta4d may transfer your Personal Data to servers and service providers located outside Indonesia. Where such transfers occur, kuta4d ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by a recognised data-protection authority, incorporated into agreements with the receiving party.
• Transfer to jurisdictions that have been assessed as providing an adequate level of data protection for the categories of data transferred.
• Binding corporate rules or equivalent intra-group transfer mechanisms where data is transferred among affiliated entities within the kuta4d group.

10.2 Where kuta4d relies on a Data Processor located outside Indonesia to process your data, that processor is contractually required to maintain security standards no less stringent than those described in this Policy.

11Your Data Rights

11.1 Subject to applicable law and certain conditions, you hold the following rights in respect of the Personal Data kuta4d processes about you:

11.2 To exercise any of the rights above, please contact kuta4d's Data Protection team at [email protected]. We will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days. Complex requests may require an extension of up to a further thirty (30) days, of which we will notify you.

11.3 kuta4d will not charge a fee for processing legitimate data rights requests unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may be applied or the request declined, with written reasons provided.

12Children & Minors

12.1 The kuta4d Platform is strictly intended for adults aged 21 years and over. kuta4d does not knowingly collect Personal Data from individuals under the age of 21. The minimum age of 21 reflects the responsible gaming standard applied by kuta4d for the Indonesian market.

12.2 If kuta4d discovers or has reasonable grounds to believe that Personal Data has been submitted by a person under 21 years of age, the relevant account will be immediately suspended, all associated data will be deleted without undue delay, and any deposited funds will be returned via the original payment method.

12.3 If you are a parent or guardian and believe that a minor in your care has registered on the kuta4d Platform, please contact us immediately at [email protected] so that we may take appropriate action.

13Security Measures

13.1 kuta4d implements a layered security architecture to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. Key measures include:

• Transport security: All data in transit is encrypted using TLS 1.2 or higher with 256-bit AES cipher suites.
• Data at rest: Stored Personal Data and financial records are encrypted at rest using AES-256 encryption on all production systems.
• Access controls: Role-based access control (RBAC) ensures that only authorised personnel can access specific data categories, with all access events logged and regularly audited.
• Penetration testing: The Platform undergoes independent penetration testing at least annually, with remediation of critical findings prioritised within defined SLA timescales.
• Multi-factor authentication: Internal administrative systems require multi-factor authentication for all staff with access to production data environments.
• Incident response: kuta4d maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights, affected Players will be notified without undue delay in accordance with applicable obligations.

13.2 While kuta4d takes all reasonable and industry-standard precautions to protect your data, no system connected to the internet can guarantee absolute security. You also play a role in protecting your account by using a strong, unique password and enabling any available two-factor authentication options in your account settings.

14Third-Party Services

14.1 The kuta4d Platform integrates with third-party services necessary for its operation, including licensed game studios, payment gateways, analytics platforms, and customer support tools. These integrations involve a degree of data sharing as described in Section 7.

14.2 The kuta4d Platform does not contain links to external third-party websites. However, where you access kuta4d's services via a third-party device application or operating system environment, the privacy practices of that environment are governed by the respective provider's own privacy policy, which is beyond kuta4d's control.

14.3 kuta4d conducts periodic due diligence on the data-protection standards of its key third-party service providers and requires contractual commitments to security and confidentiality from all Data Processors.

15Amendments to This Policy

15.1 kuta4d reserves the right to update this Privacy Policy at any time to reflect changes in our practices, the services we offer, or applicable legal requirements. The "Last Updated" date at the top of this page will be revised accordingly.

15.2 Where changes are material — meaning they significantly affect the way we collect or use your Personal Data — kuta4d will notify registered Players via email to their registered address at least fourteen (14) days prior to the change taking effect.

15.3 Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept a material change, you may request account closure and withdrawal of your real-money balance at any time.

16Contact & Complaints

16.1 For any questions, concerns, or requests relating to this Privacy Policy or the way kuta4d handles your Personal Data, please contact our Data Protection team through the following channels:

• Email: [email protected]
• WhatsApp: +62 811 0000 4400
• Live Chat: Available 24/7 directly on the kuta4d Platform

16.2 kuta4d's support team includes native Indonesian-speaking agents available throughout WIB (UTC+7) business hours, with multilingual coverage for overnight and weekend shifts, to ensure that all privacy enquiries are handled promptly regardless of when they are submitted.

16.3 If you believe that kuta4d has not handled your Personal Data in accordance with this Policy or applicable data-protection law, you have the right to lodge a complaint with the supervisory authority responsible for data-protection matters in your jurisdiction. kuta4d encourages Players to contact us directly in the first instance so that we may attempt to resolve the matter before escalation.