Privacy Policy

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably identify a natural person, directly or indirectly, including but not limited to a name, national ID number, location data, IP address, email address, or one or more factors specific to the physical, economic, or online identity of that person.
• "Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Controller" means bpjs99, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of and under the instructions of bpjs99.
• "KYC Data" means identity and age verification documents and records submitted by a Member as part of the Know Your Customer process, including government-issued identification, proof of address, and bank account documentation.
• "Cookies" means small text files placed on your device by the Platform when you visit, used to maintain session state, remember preferences, and gather analytics data.
• "WIB" means Western Indonesia Time (UTC+7), which is the default time zone used by bpjs99 for all operational and data-processing timestamps.

This Policy applies to all Personal Data collected by bpjs99 in connection with your use of the Platform, whether accessed via desktop browser, mobile browser, or any other interface provided by bpjs99. It applies equally to prospective Members who browse the Platform without registering and to registered Members who actively use the Platform's betting, gaming, and account management features.

This Policy does not apply to third-party websites, applications, or services that may be linked to or accessible from the Platform. bpjs99 is not responsible for the privacy practices of those third parties, and we encourage you to review their individual privacy policies before providing any personal information to them.

bpjs99 primarily serves Members who are residents of Indonesia, with a particular focus on players in major cities including Jakarta, Surabaya, Medan, Bandung, Bali, Semarang, Yogyakarta, Makassar, and Palembang. Where Indonesian data protection regulations apply, bpjs99 will comply with applicable requirements as set out in this Policy.

bpjs99 collects the following categories of Personal Data from Members and prospective Members:

bpjs99 collects Personal Data through the following means:

• Direct Submission: Information you provide when you register an account, complete KYC verification, submit a deposit or withdrawal request, contact our support team, or respond to a promotion.
• Automated Collection: Technical and usage data collected automatically when you visit or use the Platform, via server logs, cookies, and similar tracking technologies. This includes your IP address, device identifiers, and session activity records.
• Third-Party Service Providers: Data received from payment processors (such as banks and e-wallet operators), KYC verification services, and fraud detection vendors in the course of processing your transactions and verifying your identity.
• Game Providers: Game round results, stake amounts, and win/loss data transmitted from third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to record your gaming activity on the Platform.
• Public Sources: In limit ed circumstances, bpjs99 may cross-reference publicly available information (such as sanctions lists or fraud watchlists) to verify Member identity or comply with legal obligations.

bpjs99 uses your Personal Data for the following purposes:

• Account Management: To create and maintain your Member account, authenticate your identity at login, manage your account settings, and communicate essential service updates including changes to these policies.
• Transaction Processing: To process deposits made via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), to process withdrawal requests, and to maintain accurate financial records of all transactions in IDR (Rp).
• Identity Verification (KYC): To verify that you meet the minimum age requirement of 21 years, to confirm that your identity and payment method details are consistent and accurate, and to satisfy our anti-money laundering (AML) obligations.
• Platform Operation & Improvement: To monitor Platform performance, diagnose technical issues, analyze usage patterns, and develop improvements to the user experience across all device types.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, bonus abuse, multi-accounting, and other forms of prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: To monitor account activity for signs of problem gambling behavior, to apply deposit limits, loss limits, and self-exclusion settings requested by Members, and to reach out proactively to Members who display indicators of gambling harm.
• Marketing & Promotions: Where you have provided explicit consent, to send you promotional offers, bonus notifications, seasonal promotions (such as those tied to Idul Fitri, Ramadhan, or Indonesian Independence Day), and personalized content recommendations via email, SMS, or WhatsApp.
• Legal & Regulatory Compliance: To comply with applicable laws, respond to lawful requests from regulatory authorities or law enforcement, and to defend bpjs99's legal rights in dispute resolution proceedings.
• Customer Support: To respond to your inquiries, resolve account issues, and maintain records of support interactions for quality assurance and staff training purposes.

bpjs99 processes your Personal Data only where a valid legal basis exists. The primary legal bases we rely on are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between you and bpjs99 — that is, to operate your Member account, process transactions, settle wagers, and provide customer support. Without this processing, we cannot provide the Platform services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, financial record-keeping obligations, and lawful requests from regulatory authorities or courts.
• Legitimate Interests: Processing necessary for bpjs99's legitimate business interests where those interests are not overridden by your privacy rights, including fraud prevention, Platform security, improving the user experience, and exercising or defending legal claims.
• Consent: Processing for marketing and promotional communications, where you have given explicit, freely given, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal, and without affecting your ability to use the Platform.

bpjs99 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We may share your Personal Data with the following categories of recipients, strictly limited to the purposes described:

• Payment Service Providers: Indonesian banks (including BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction data necessary to process your deposits and withdrawals. These providers are bound by their own regulatory obligations and banking secrecy laws.
• KYC & Identity Verification Vendors: Third-party identity verification services may receive copies of your submitted KYC documents to perform automated or manual verification checks. These vendors are contracted to process data solely on our behalf and under strict confidentiality obligations.
• Fraud Detection & Security Services: Specialist fraud prevention platforms may receive Technical Data and Transaction Data to assess risk signals and detect anomalous activity. No unnecessary Personal Data is shared beyond what is required for fraud analysis.
• Game Technology Providers: Game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) receive the minimum data necessary (typically a pseudonymous player ID and stake/win amounts) to operate their games on the Platform. These providers do not receive your full name, contact details, or financial account information.
• IT Infrastructure & Hosting Providers: Cloud hosting and data center providers who store Platform data on servers secured with industry-standard access controls. All hosting providers are bound by data processing agreements.
• Legal & Regulatory Authorities: bpjs99 may disclose Personal Data to law enforcement agencies, courts, government regulators, or other public authorities when required by applicable law, when responding to a valid legal process (such as a court order or subpoena), or when we believe in good faith that disclosure is necessary to prevent imminent harm, fraud, or illegal activity.
• Professional Advisors: Lawyers, auditors, and accountants engaged by bpjs99 may receive limited Personal Data to the extent necessary to provide professional services, subject to professional confidentiality obligations.

bpjs99 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following retention periods apply as a general guideline:

When Personal Data is no longer required for any of the above purposes, bpjs99 will securely delete or anonymize it so that it can no longer be linked to any identifiable individual. Anonymized or aggregated data (from which all identifying information has been irreversibly removed) may be retained indefinitely for statistical and analytical purposes.

bpjs99 uses cookies and similar tracking technologies (such as pixel tags and local storage objects) to operate the Platform effectively, maintain your login session, and understand how Members use our services. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session authentication cookies that keep you logged in, security tokens that prevent cross-site request forgery (CSRF) attacks, and load-balancing cookies that ensure stable server performance. No personally identifiable information is stored in these cookies beyond a pseudonymous session identifier.
• Analytics & Performance Cookies: These cookies collect anonymous or pseudonymous data about how Members interact with the Platform — for example, which pages are visited most frequently, how long Members spend on each section, and what device and browser types are in use. This data helps us identify performance bottlenecks and prioritize improvements. We do not link analytics data to your registered identity without your consent.
• Functional Cookies: These cookies remember your preferences such as language display settings, preferred payment method, and responsible gaming notification settings. Disabling these cookies may result in a degraded experience but will not prevent you from using core Platform features.
• Marketing & Targeting Cookies: bpjs99 does not currently place third-party advertising cookies or retargeting pixels on the Platform. If this changes in future, this Policy will be updated and your consent will be sought before any marketing cookies are placed.

You can manage or disable cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to the Platform. For instructions on managing cookies in popular browsers, refer to your browser's help documentation.

bpjs99 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Transport Layer Encryption: All data transmitted between your browser or device and bpjs99 servers is encrypted using TLS 1.2 or higher (256-bit encryption). Our SSL certificate is maintained and renewed by a trusted Certificate Authority, and we enforce HTTPS across all Platform endpoints.
• Encryption at Rest: Sensitive data stored on our servers — including KYC documents, financial account details, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Staff and contractor access is governed by role-based permissions, and all access to sensitive data is logged and monitored. Privileged access accounts (such as database administrators) are subject to multi-factor authentication.
• Intrusion Detection & Monitoring: bpjs99 operates 24/7 monitoring of Platform infrastructure for anomalous activity, unauthorized access attempts, and denial-of-service attacks. Automated alerts are configured to notify our security team of suspicious events in real time (WIB, UTC+7).
• Vulnerability Management: We conduct regular security assessments, penetration tests, and code reviews to identify and remediate vulnerabilities before they can be exploited. Critical patches are applied within 48 hours of availability.
• Data Breach Response: In the event of a confirmed Personal Data breach that poses a risk to Members, bpjs99 will notify affected Members via email within 72 hours of becoming aware of the breach, describing the nature of the breach, the data categories affected, and the steps we are taking to mitigate the impact.

As a Member of bpjs99, you have the following rights in relation to your Personal Data. To exercise any of these rights, please contact us at [email protected] with a clear description of your request. We will acknowledge your request within 5 business days and aim to fulfill it within 30 calendar days.

• Right of Access: You have the right to request a copy of the Personal Data bpjs99 holds about you, along with information about how it is used, where it came from, and with whom it has been shared.
• Right to Rectification: You have the right to request correction of any Personal Data that is inaccurate, incomplete, or out of date. For example, if your registered email address or phone number has changed, you may request an update.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing. Note that this right is subject to our legal data retention obligations — we cannot delete financial records that are required by law to be retained for a specified period.
• Right to Restriction of Processing: You have the right to request that bpjs99 restrict the processing of your Personal Data in certain circumstances, for example while a rectification request is under review or while a dispute about data usage is being resolved.
• Right to Data Portability: You have the right to receive a copy of Personal Data you have provided to bpjs99 in a structured, commonly used, machine-readable format (such as CSV or JSON), and to request that this data be transmitted directly to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your Personal Data for direct marketing purposes at any time. You also have the right to object to processing based on legitimate interests where you believe your privacy rights override bpjs99's legitimate interests in a particular context.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The bpjs99 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect, solicit, or process Personal Data from any person under the age of 21. This age restriction is enforced at account registration through mandatory date-of-birth declaration and, where applicable, through KYC identity verification.

If bpjs99 becomes aware that Personal Data has been collected from a person under 21 years of age without parental or guardian consent, we will immediately suspend the relevant account, delete the collected data in full, and return any deposited funds to the source payment method. If you believe that a person under 21 has registered an account on bpjs99, please contact us immediately at [email protected] so that we can investigate and take swift corrective action.

Parents and guardians who are concerned about underage access to online gambling services are encouraged to use parental control software and internet filtering tools to restrict access to gambling-related websites. Our Responsible Gaming page provides additional guidance on preventing underage gambling.

bpjs99 is an internationally operated Platform, and your Personal Data may be stored on or transferred to servers located outside of Indonesia in connection with the operation of our hosting infrastructure, third-party service providers, and game technology partners.

Where Personal Data is transferred internationally, bpjs99 ensures that adequate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection law. Such safeguards may include:

• Data processing agreements with receiving parties that incorporate data protection clauses requiring compliance with applicable privacy standards.
• Transfers to jurisdictions that maintain an adequate level of data protection as recognized by relevant regulatory frameworks.
• Technical safeguards including end-to-end encryption of data in transit and at rest, regardless of the jurisdiction in which the data is stored.

By using the Platform and accepting this Privacy Policy, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia where bpjs99's operational infrastructure or service providers are located, subject to the safeguards described above.

The bpjs99 Platform may reference or display the names of third-party payment services (such as BCA, BRI, OVO, or GoPay), game studios, or sports data providers in the context of describing available Platform features. These references do not constitute endorsements, and bpjs99 is not responsible for the privacy practices of any third-party organization.

When you make a deposit or withdrawal using a bank transfer or e-wallet service, you are interacting directly with that financial institution's own platform and systems, which are governed by that institution's own privacy policy and terms of service. bpjs99 receives only the transaction confirmation data necessary to process your account balance — we do not have access to your full banking credentials or e-wallet login details.

bpjs99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify Members by sending an email to the registered email address on file and by displaying a prominent notice on the Platform for a period of at least seven (7) calendar days before the updated Policy takes effect.

The "Last Updated" date displayed at the top of this Policy indicates the most recent revision. Your continued use of the Platform after an updated Policy takes effect constitutes your acceptance of the revised terms. If you do not agree with any material change to this Policy, you should cease using the Platform and may request voluntary account closure by contacting our support team.

We recommend that you review this Policy periodically to remain informed about how bpjs99 collects and protects your Personal Data. Previous versions of this Policy are available on request by contacting [email protected].

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way bpjs99 handles your Personal Data, please contact our Privacy & Data Protection team using the details below. We take all privacy inquiries seriously and will respond within 14 calendar days.

• Email: [email protected]
• WhatsApp: +62 811 0000 9999
• Live Chat: Available 24/7 on-site
• Response Hours: 24/7 WIB (UTC+7)

If you have submitted a complaint and are not satisfied with our response, you may have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. bpjs99 will cooperate fully with any lawful investigation by a supervisory authority.