dewi1 Privacy Policy

dewi1 ("the Platform", "we", "us", "our") is committed to protecting and respecting the privacy of every Member who registers and plays on the dewi1 platform at dewi1.ws. This Privacy Policy sets out the basis on which any personal data we collect from you — or that you provide to us — will be processed. It applies to all pages, features, and services operated under the dewi1 brand.

This Policy is written in plain English and is intended to be fully legible to our Members across Indonesia, who access the dewi1 platform as English-preference players. If, after reading this Policy, you have any unanswered questions, our 24/7 support team is available to assist in both English and Indonesian.

By registering an Account on dewi1, or by continuing to use the Platform after any update to this Policy, you acknowledge that you have read and understood this Privacy Policy in its entirety and that you consent to the processing of your personal data as described herein. This Policy should be read alongside the dewi1 Terms & Conditions and Responsible Gaming Policy.

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number (KTP), email address, mobile phone number, bank account details, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, eras ure, and destruction.
• "Controller" — the Operator, being the legal entity that determines the purposes and means of processing Personal Data collected through the dewi1 platform.
• "Processor" — any third party that processes Personal Data on behalf of the Controller, such as a KYC verification provider, payment gateway, or cloud hosting service.
• "Member" or "You" — a natural person who holds a registered dewi1 Account.
• "KYC" — Know Your Customer, the identity verification process described in Clause 6.
• "Cookies" — small text files placed on your device by the dewi1 platform to enable core functionality, session management, and analytics.
• "Sensitive Data" — a subset of Personal Data requiring enhanced protection, including national identity numbers, biometric data, and financial account credentials.

dewi1 collects Personal Data through several channels. The categories of data we collect, and the contexts in which we collect them, are set out in the table below.

We do not collect data beyond what is necessary for the purposes described in Clause 4. We apply the principle of data minimisation at all stages of the collection process.

dewi1 uses the Personal Data it collects for the following specific, documented purposes:

• Account Management: To create, maintain, and administer your dewi1 Account, including authentication, password resets, and account security alerts.
• Identity Verification: To conduct KYC checks as required by our international gaming licence and applicable anti-money laundering (AML) regulations, confirming that Members are at least 21 years of age and are who they claim to be.
• Payment Processing: To process deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, and any other payment channels offered on the platform.
• Service Delivery: To provide access to sportsbook markets (including football betting on BRI Liga 1 matches, EPL, Champions League, and other competitions), live casino games powered by Evolution Gaming and Pragmatic Play, slot games, and lottery products.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bot activity, bonus abuse, and any other form of Prohibited Conduct as defined in the Terms & Conditions.
• Regulatory Compliance: To meet obligations imposed by our gaming licence, including mandatory reporting of suspicious transactions to relevant authorities and maintenance of AML records.
• Customer Support: To respond to queries, complaints, and support requests submitted by Members via live chat or email, and to maintain records of those interactions for quality assurance purposes.
• Marketing Communications: To send promotional offers, bonus alerts, and seasonal campaign notifications to Members who have opted in to receive such communications. Members may opt out at any time via their Account Settings or by contacting support.
• Responsible Gaming: To monitor gameplay patterns and, where necessary, reach out to Members who may be exhibiting signs of problem gambling, in line with our obligations under the Responsible Gaming Policy.
• Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving the platform's performance, user interface, and product offering.

Every instance of data processing carried out by dewi1 rests on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between dewi1 and the Member (i.e., the Terms & Conditions). This covers account creation, KYC verification, payment processing, and service delivery.
• Legal Obligation: Processing is required to comply with applicable AML, counter-terrorism financing (CTF), and gaming regulatory obligations imposed on the Operator by its international licence.
• Legitimate Interests: Processing is necessary for the Operator's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and improving the quality of the platform — provided those interests are not overridden by the Member's privacy rights.
• Consent: Where processing is not covered by the above bases (primarily marketing communications and non-essential cookies), dewi1 relies on your freely given, informed, and specific consent. You may withdraw consent at any time without detriment to your Account standing.

KYC verification is a mandatory element of the dewi1 account lifecycle. It is required before any withdrawal is processed and may be triggered at any point during a Member's use of the platform if transaction patterns warrant additional scrutiny under our AML policy.

KYC documents submitted by Members — including photographs of Indonesian National Identity Cards (KTP), selfie images, and bank statements — are treated as Sensitive Data and are subject to the following enhanced protections:

• KYC documents are stored on encrypted servers with access restricted to authorised compliance personnel only. No customer-facing support agent has access to raw KYC image files.
• Documents are processed by an automated verification system powered by a certified third-party KYC provider. Manual review is conducted only where the automated system flags an anomaly.
• KYC documents are retained for the minimum period required by the Operator's licence conditions and applicable AML regulations, after which they are securely destroyed.
• KYC data is never shared with marketing partners, game providers, or any third party whose role does not involve regulatory compliance or fraud prevention.

dewi1 processes payment data in connection with deposits and withdrawals conducted via local Indonesian bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja). The following principles govern the handling of payment data:

• dewi1 does not store full bank account credentials or e-wallet login credentials. Only the account name and masked account number required for routing and verification are retained on dewi1 servers.
• All payment data transmitted between the Member's browser and dewi1 servers is protected by TLS 1.3 encryption. Payment data at rest is encrypted using AES-256.
• Transaction records — including deposit amounts, withdrawal amounts, timestamps, and payment method identifiers — are retained as part of the Member's financial history for the period required by AML regulations and for the purpose of resolving any payment disputes.
• Payment data is shared only with the specific bank or e-wallet provider required to execute the transaction, and with the Operator's fraud-prevention and AML monitoring systems. It is never shared with game studios, marketing platforms, or any unrelated third party.

dewi1 uses cookies and similar tracking technologies to ensure the platform operates correctly and to deliver a secure, personalised experience. The cookies we use fall into the following categories:

You may manage your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies will impair the functionality of the dewi1 platform and may prevent login. Disabling analytics and marketing cookies has no effect on your ability to use the platform.

dewi1 does not sell, rent, or trade your Personal Data to any third party for commercial or marketing purposes. Personal Data is shared externally only in the following limited, controlled circumstances:

• KYC Providers: Identity document images and biometric data are shared with our certified third-party KYC verification partner solely for the purpose of identity validation. This partner is contractually bound by data processing agreements that prohibit any secondary use of Member data.
• Payment Processors: Transaction data is shared with the relevant bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) as strictly necessary to execute deposit and withdrawal instructions.
• Fraud & AML Systems: Transaction metadata and device fingerprints are shared with our fraud detection and AML monitoring systems, which may be operated by specialist third-party vendors under strict data processing agreements.
• Regulatory Authorities: The Operator may be required by law, court order, or regulatory directive to disclose Member data to competent authorities. In such cases, disclosure is limited to what is legally required and Members will be notified where legally permissible.
• Game Studios: Game studios (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) receive anonymised session tokens and bet amounts necessary to operate the games. They do not receive Members' full names, KTP numbers, bank account details, or any other directly identifying Personal Data.
• Platform Infrastructure: Cloud hosting and content delivery providers who process data on our behalf under binding data processing agreements that impose the same security standards as those applied by the Operator directly.

dewi1 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by applicable law or regulatory obligation. The following general retention schedules apply:

• Account & Registration Data: Retained for the duration of the active Account plus five (5) years following permanent Account closure, in line with standard AML record-keeping requirements.
• KYC Documents: Retained for five (5) years from the date of the last transaction on the Account, or such longer period as required by the Operator's gaming licence conditions.
• Financial Transaction Records: Retained for five (5) years from the date of each transaction.
• Gameplay Logs: Retained for three (3) years from the date of each session, after which they are anonymised and archived for aggregate statistical analysis.
• Customer Support Correspondence: Retained for two (2) years from the date of the last message in each support thread.
• Marketing Preferences: Retained until the Member withdraws consent, at which point marketing preference data is deleted within 30 days.

When data reaches the end of its retention period, it is securely erased using industry-standard data destruction methods that prevent reconstruction or recovery.

The dewi1 platform serves Members primarily in Indonesia, and where possible, data is processed on servers located in the Asia-Pacific region to minimise latency and align with the geographic proximity of our Members.

In certain cases, Personal Data may be transferred to and processed in jurisdictions outside Indonesia — for example, where our KYC verification partner, fraud monitoring system, or cloud infrastructure provider operates servers in another country. Wherever such transfers occur, dewi1 ensures that:

• The recipient country or entity provides an adequate level of data protection equivalent to the standards applied by the Operator.
• Data processing agreements incorporating standard contractual clauses are executed with all Processors prior to any data transfer.
• The transfer is limited to the minimum data necessary for the specific processing purpose.

As a dewi1 Member, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact the dewi1 Data Protection team using the details in Clause 16. We will respond to all valid requests within 30 days.

The dewi1 platform is strictly for adults aged 21 and above. We do not knowingly collect Personal Data from any person under the age of 21. If it comes to our attention that a registered Account belongs to a person under 21, that Account will be immediately closed, all Personal Data associated with it will be permanently deleted from active systems, and any funds held in the Account will be subject to regulatory review before any refund is considered.

Parents and guardians are encouraged to use internet filtering software to prevent minors from accessing online gambling platforms. If you believe a minor has gained access to a dewi1 Account, please contact our support team immediately at [email protected].

dewi1 employs a comprehensive, layered security architecture to protect your Personal Data from unauthorised access, disclosure, alteration, and destruction. Key security measures in place include:

• Encryption: All data in transit is protected by TLS 1.3. All data at rest — including KYC documents, financial records, and account credentials — is encrypted using AES-256.
• Access Controls: Internal access to Personal Data is governed by role-based access controls (RBAC). Only personnel with a documented operational need to access specific data categories are granted access, and all access events are logged.
• Password Security: Member passwords are stored as salted cryptographic hashes using a modern hashing algorithm. Plain-text passwords are never stored or transmitted.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA on their Accounts via the Account Security settings page. 2FA is mandatory for all internal administrative accounts.
• Penetration Testing: The dewi1 platform undergoes regular third-party penetration testing and security audits. Critical vulnerabilities are remediated within 24 hours of identification.
• Incident Response: In the event of a confirmed data breach that poses a risk to Members, dewi1 will notify affected Members within 72 hours of becoming aware of the breach, and will implement immediate containment measures.

dewi1 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our service offering. When material changes are made, we will update the "Last Updated" date at the top of this page and, where practicable, notify active Members by email or in-platform notification at least 7 days before the revised Policy takes effect.

We encourage Members to review this Policy periodically. Your continued use of the dewi1 platform after any update to this Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you should discontinue use of the platform and contact support to close your Account before the revised Policy takes effect.

If you have any questions, concerns, or complaints relating to this Privacy Policy or the way in which dewi1 processes your Personal Data, please contact our Data Protection team through one of the following channels. All enquiries are handled in both English and Indonesian.

• Email: [email protected] (plain text only — not a clickable link)
• Live Chat: Available 24/7 within the dewi1 platform after logging in to your Account. For privacy-related requests, ask to be connected to the Data Protection team.
• Response Time: We aim to acknowledge all privacy-related requests within 24 hours and to provide a full response within 30 calendar days. Complex requests involving large data sets may take up to 60 days; you will be informed of any extension within the initial 30-day period.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the supervisory authority in the jurisdiction of the Operator's gaming licence. Details of the relevant authority will be provided on request.