Privacy Policy

1 Introduction

3debit is Indonesia's premier online gaming platform, serving players across the Indonesian archipelago — from Jakarta and Surabaya to Medan, Bali, and Makassar. In the course of providing our services, we collect and process certain personal information about our users. We take this responsibility seriously. This Policy sets out our data practices in transparent, plain terms so that you always know exactly how your information is handled.

We are committed to processing personal data in accordance with internationally recognized data protection principles, including purpose limitation, data minimization, storage limitation, integrity, confidentiality, and accountability. Our privacy practices are designed to give you meaningful control over your information while enabling us to deliver a secure, high-quality gaming experience.

This Policy applies to all players, visitors, and prospective users who access or interact with the Platform, regardless of the device or connection method used. It covers all categories of personal data we process — from registration details and financial transaction records to device identifiers and gameplay history.

2 Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, phone number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, and deletion.
• "Data Subject" means the individual to whom Personal Data relates — in most cases, the registered Player.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — that is, 3debit.
• "Data Processor" means a third party that processes Personal Data on behalf of 3debit pursuant to a written agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "Cookies" means small text files placed on your device by the Platform to store session and preference information.
• "KYC" means Know Your Customer identity verification procedures required before processing withdrawals and for ongoing compliance.

3 Data We Collect

3debit collects the following categories of personal data:

3.1 Registration Data

When you create an account, we collect your full legal name, date of birth, Indonesian National Identity Card number (NIK) or passport number, residential address (including city, province, and postal code), email address, and mobile phone number.

3.2 Financial Data

To process deposits and withdrawals, we collect your bank account details (bank name, account number, and account holder name) or e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, or LinkAja account details). We do not store full credit or debit card numbers; card-based transactions are routed directly through PCI-compliant payment processors.

3.3 Identity Verification (KYC) Data

During the KYC process, we collect copies of government-issued identity documents (KTP or passport), proof of address documents, bank account ownership screenshots, and selfie photographs holding your ID document. These documents may contain biometric information such as facial images.

3.4 Transaction History

We record all deposit, withdrawal, wager, win, and bonus transactions associated with your account, including timestamps (recorded in WIB, UTC+7), transaction amounts in Indonesian Rupiah (IDR), and the payment method used.

3.5 Gameplay Data

We log your betting activity across all game types — sports betting (including football matches from BRI Liga 1, EPL, La Liga, and other leagues; mix parlay accumulator bets; voor bola Asian handicap markets), togel lottery predictions (Singapore, Hongkong, Sydney, Macau pools), live casino sessions (baccarat, roulette, blackjack), slot games, and sabung ayam cockfighting wagers (Meron/Wala outcomes). This includes bet amounts, odds accepted, game results, win/loss outcomes, and session duration.

3.6 Device & Technical Data

When you access the Platform, we automatically collect your IP address, device type (mobile, tablet, desktop), operating system (Android, iOS, Windows, macOS), browser type and version, screen resolution, language preferences, referrer URL, and time zone.

3.7 Communication Data

If you contact our customer support team via live chat, email, or other channels, we retain transcripts and records of those communications for quality assurance, training, and dispute resolution purposes.

3.8 Marketing Preferences

We record your consent status for marketing communications, including promotional emails about bonuses, special events (Idul Fitri, Indonesian Independence Day, Ramadhan promotions, BRI Liga 1 match specials), and loyalty rewards.

4 How We Collect Data

4.1 Direct Provision

Most personal data is collected directly from you when you fill in registration forms, submit KYC documents, enter payment information, place bets, or communicate with our support team.

4.2 Automatic Collection

Device and technical data is collected automatically via cookies, web beacons, server logs, and similar tracking technologies each time you access the Platform.

4.3 Third-Party Sources

In limited circumstances, we may receive personal data from third parties, including payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, LinkAja), identity verification services, fraud prevention databases, and public registries where verification is necessary for compliance.

5 Purpose & Legal Basis

3debit processes personal data for the following purposes, each supported by a valid legal basis:

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal. Where processing is necessary for contract performance, refusing to provide required data may prevent us from delivering the requested services.

6 Data Sharing

3debit does not sell personal data to third parties. We do, however, share personal data with the following categories of recipients under strict contractual data protection obligations:

6.1 Payment Processors

Bank transfer and e-wallet transaction data is shared with Indonesian financial institutions (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Danamon, BSI, Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to execute deposits and withdrawals.

6.2 Identity Verification Providers

KYC documents are shared with third-party identity verification and document authentication services to confirm the validity of submitted identification and address proof documents.

6.3 Fraud Prevention Services

Device fingerprints, IP addresses, and transaction patterns may be shared with specialized fraud detection and prevention platforms to identify duplicate accounts, bonus abuse, money laundering, and other prohibited activities.

6.4 Game Providers

When you play live casino games or slots, limited gameplay data is shared with third-party studio providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) to enable game operation and result validation.

6.5 Cloud Infrastructure Providers

Personal data is stored on secure cloud servers operated by reputable international infrastructure providers. These providers act as data processors under strict contractual terms that prohibit unauthorized access or use.

6.6 Legal & Regulatory Authorities

We may disclose personal data to law enforcement, regulatory bodies, courts, or government authorities when legally required by court order, subpoena, or applicable regulation, or where necessary to protect 3debit's legal rights or prevent illegal activity.

7 International Transfers

While 3debit primarily serves Indonesian residents and processes Indonesian Rupiah transactions through local banks and e-wallets, certain third-party service providers (cloud hosting, payment gateways, fraud prevention platforms, game studios) may be located outside Indonesia. When personal data is transferred internationally, we ensure adequate protection through:

• Standard contractual clauses recognized by international data protection frameworks
• Verification that the recipient jurisdiction provides adequate data protection standards
• Binding corporate rules where applicable
• Explicit consent for specific cross-border transfers where required

All international data transfers are documented and subject to ongoing compliance review. You may request details of specific transfer mechanisms by contacting our Data Protection Officer.

8 Data Retention

3debit retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:

• Active Account Data: Retained for the duration of your account's active status, plus any applicable post-closure period required for dispute resolution or regulatory compliance.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date to comply with anti-money laundering regulations and tax record-keeping requirements.
• KYC Documents: Retained for 7 years following account closure or the date of the last transaction, whichever is later, in accordance with financial crime prevention obligations.
• Marketing Communications Logs: Retained until consent is withdrawn, plus up to 2 years to honor opt-out requests and prevent re-contact.
• Support Communication Records: Retained for 3 years from the date of the last communication to facilitate follow-up and quality assurance review.
• Gameplay and Betting History: Retained for 7 years to support audit requirements, dispute resolution, responsible gaming monitoring, and pattern analysis for fraud prevention.
• Device and Access Logs: Retained for 12 months for security monitoring and technical troubleshooting purposes.

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or anonymized such that it can no longer be associated with an identifiable individual. Anonymized data may be retained indefinitely for statistical analysis and service improvement.

9 Security Measures

3debit employs robust technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction:

9.1 Encryption

All data transmissions between your device and our servers are encrypted using TLS 1.2 or higher (256-bit SSL encryption). Sensitive data at rest (passwords, payment details, KYC documents) is encrypted using AES-256 or equivalent industry-standard encryption algorithms.

9.2 Access Controls

Access to personal data is restricted to authorized personnel on a strict need-to-know basis. All employees and contractors with data access undergo background checks and sign confidentiality agreements. Multi-factor authentication (MFA) is enforced for administrative systems.

9.3 Secure Infrastructure

Data is hosted on enterprise-grade cloud infrastructure with redundant backups, firewall protection, intrusion detection systems (IDS), and 24/7 security monitoring. Regular penetration testing and vulnerability assessments are conducted by independent security auditors.

9.4 Incident Response

In the unlikely event of a data breach that poses a risk to your rights and freedoms, 3debit will notify affected individuals and relevant authorities in accordance with applicable breach notification timelines (typically within 72 hours of breach discovery). Notification will include details of the breach, potential consequences, and remedial measures taken.

10 Cookies & Tracking Technologies

3debit uses cookies, web beacons, and similar tracking technologies to enhance user experience, enable core functionality, and gather analytics data.

10.1 Types of Cookies We Use

• Essential Cookies: Required for basic Platform functionality including session management, authentication, and security. These cookies cannot be disabled without impairing core services.
• Functional Cookies: Remember your preferences (language, currency display format, game filters) to provide a personalized experience.
• Analytics Cookies: Collect aggregated data on Platform usage patterns, page views, navigation paths, and device types to help us improve service quality.
• Fraud Prevention Cookies: Generate unique device fingerprints to detect duplicate accounts, bot activity, and suspicious access patterns.

10.2 Managing Cookies

You may control cookie settings through your browser preferences. Most browsers allow you to block or delete cookies. However, disabling essential cookies will impair your ability to log in and use the Platform. Disabling analytics cookies will not affect functionality but will limit our ability to improve services based on usage data.

10.3 Third-Party Cookies

Game studio providers (Evolution Gaming, Pragmatic Play, etc.) may set their own cookies to enable live casino and slot gameplay. These cookies are governed by the respective provider's privacy policy.

11 Your Rights

As a data subject, you hold the following rights with respect to your personal data:

To exercise any of these rights, please contact our Data Protection Officer at [email protected] with "Data Subject Rights Request" in the subject line. We will respond to all valid requests within 30 calendar days. In complex cases requiring extended investigation, we may extend the response period to 60 days with prior notice. There is no charge for rights requests unless they are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or refuse the request.

12 Minors

The Platform is strictly limited to individuals who are at least 21 years of age. 3debit does not knowingly collect personal data from persons under 21. Our age verification systems (including KYC document review) are designed to detect and prevent underage registration. If we become aware that we have inadvertently collected personal data from an individual under 21, we will immediately suspend the account, cancel all pending transactions, and delete the personal data without undue delay.

Parents and guardians are encouraged to monitor their children's internet usage and implement parental control software to prevent access to gambling websites. If you believe a minor has accessed 3debit and provided personal data, please contact us immediately at [email protected].

13 Marketing Communications

3debit may send you promotional communications — including emails, SMS messages, and in-platform notifications — about bonuses, special offers, new game launches, seasonal promotions (Idul Fitri, Ramadhan, Indonesian Independence Day, Chinese New Year / Imlek, BRI Liga 1 match specials), VIP rewards, and loyalty programs. These communications are always opt-in. We will only send marketing messages to players who have explicitly consented to receive them during registration or via account preferences.

You may withdraw consent for marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any promotional email
• Adjusting your communication preferences in your account settings
• Contacting our support team at [email protected]

Withdrawal of marketing consent does not affect transactional communications (deposit confirmations, withdrawal notifications, security alerts, account verification requests, Terms & Conditions updates), which are necessary for account operation and cannot be opted out of while your account remains active.

14 Third-Party Links

The Platform may contain links to third-party websites, including payment processor login portals (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), game studio sites, and responsible gaming resources. 3debit is not responsible for the privacy practices or content of these external sites. We recommend reviewing the privacy policy of any third-party site before providing personal information. This Privacy Policy applies solely to personal data collected through the 3debit Platform.

15 Policy Amendments

3debit reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or service offerings. Material changes that significantly affect how we process personal data or expand our use of existing data will be communicated to registered players via email at least 14 days prior to the amended policy taking effect. The "Last Updated" date at the top of this document reflects the date of the most recent revision.

Your continued use of the Platform after the effective date of an amended Privacy Policy constitutes your acceptance of the amended terms. If you do not agree to a material amendment, you may close your account in accordance with the procedures set out in our Terms & Conditions.

16 Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy, our data processing practices, or the exercise of your data subject rights, please contact our Data Protection Officer (DPO):

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Privacy Inquiry / Data Subject Rights Request / DPO Contact
• Response Time: We aim to respond to all privacy inquiries within 5 business days and to complete data subject rights requests within 30 calendar days

Our DPO is responsible for overseeing data protection compliance, conducting privacy impact assessments, handling data subject rights requests, liaising with regulatory authorities, and investigating privacy complaints. All communications with the DPO are treated as confidential.

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with your local data protection authority or supervisory body.