Privacy Policy — dewa02

The following capitalized terms carry the meanings defined below wherever they appear in this Privacy Policy:

This Privacy Policy applies to all Personal Data collected, processed, or held by dewa02 in connection with the operation of the Platform. It covers all Members — whether registered or unregistered visitors — who access the Platform from any location, including Indonesia and all other jurisdictions where the Platform is accessible.

dewa02 acts as the data controller for all Personal Data processed under this Policy. As data controller, dewa02 determines the purposes and means of processing your Personal Data and bears ultimate responsibility for ensuring that processing is carried out lawfully, fairly, and transparently.

Where dewa02 engages third-party service providers to process Personal Data on its behalf (for example, payment processors, KYC verification providers, or analytics platforms), those providers act as data processors and are contractually bound to process Personal Data only on dewa02's documented instructions and in compliance with applicable data protection law.

dewa02 collects the following categories of Personal Data, depending on how you interact with the Platform:

dewa02 collects Personal Data through the following channels:

• Direct submission: When you register an Account, complete KYC verification, submit a deposit or withdrawal request, contact customer support, or respond to a promotional offer, you actively provide Personal Data to us.
• Automated technical collection: As you browse and interact with the Platform, our servers and analytics infrastructure automatically collect Technical Data (IP address, device identifiers, session logs) and Gameplay Data. This collection occurs whether or not you are logged in.
• Cookies and similar technologies: The Platform uses first-party and third-party cookies, pixel tags, and local storage objects to collect data about your browsing behavior, session state, and Platform interactions. See Clause 10 for full details on our cookie practices.
• Third-party identity verification providers: During KYC, dewa02 works with licensed identity verification services that cross-reference your submitted documents against authoritative data sources. Those providers may return enriched identity signals to dewa02 as part of the verification result.
• Payment processors: When you initiate a deposit or withdrawal via a local Indonesian bank (e.g., BCA, BRI, Mandiri) or an e-wallet (e.g., OVO, DANA, GoPay), the relevant payment provider transmits transaction confirmation data — including masked account identifiers and transaction reference numbers — to dewa02 for reconciliation.
• Fraud prevention partners: dewa02 may receive risk signals and device-fingerprint data from third-party fraud detection services to help identify and prevent unauthorized account access, bonus abuse, and financial crime.

dewa02 processes Personal Data only for specific, explicit, and legitimate purposes. The table below maps each processing purpose to the lawful basis on which it rests:

dewa02 does not sell, rent, or trade your Personal Data to any third party. We disclose Personal Data only in the following limited circumstances:

• Payment processors and banking partners: We share the minimum Financial Data necessary to execute your deposit or withdrawal with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet operator (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers operate under their own privacy policies and are bound by financial services regulations.
• KYC and identity verification providers: Your Identity Data and supporting documents are shared with licensed third-party verification services solely for the purpose of confirming your identity and age. KYC providers are contractually prohibited from using your data for any purpose beyond the verification mandate.
• Game studios and content providers: Session and Gameplay Data may be shared with licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe) to the extent required for game delivery, RNG certification audits, and responsible gaming monitoring.
• Fraud prevention and cybersecurity partners: Technical Data and risk signals may be shared with specialist fraud detection providers to protect the Platform and its Members from unauthorized access, account takeover, and financial crime.
• Legal and regulatory authorities: We will disclose Personal Data to courts, regulators, law enforcement agencies, or government bodies where we are legally required or compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of dewa02, its Members, or the public.
• Corporate transactions: In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the Company's assets, your Personal Data may be transferred to the acquiring entity, subject to that entity assuming the data protection obligations set out in this Policy.

dewa02 operates as an internationally licensed gaming platform. As a result, some Personal Data — particularly data processed by our KYC providers, game studios, and fraud detection partners — may be transferred to and stored in countries outside Indonesia. These countries may apply different data protection standards from those applicable in Indonesia.

Where such international transfers occur, dewa02 ensures that an equivalent level of protection is maintained through one or more of the following safeguards:

• Adequacy decisions recognizing the destination country's data protection framework as equivalent to international standards.
• Binding contractual clauses (Standard Contractual Clauses or equivalent mechanisms) between dewa02 and the recipient entity that impose obligations to protect Personal Data in accordance with this Policy.
• Certification schemes or codes of conduct adopted by the recipient entity, where applicable.

You may request further information about the specific safeguards in place for any particular international transfer by contacting our DPO as set out in Clause 15.

dewa02 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following indicative retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be linked to any identifiable individual. Anonymized, aggregated data may be retained indefinitely for statistical and business intelligence purposes.

dewa02 implements a comprehensive, layered security architecture to protect Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Our primary security controls include:

• Encryption in transit: All data exchanged between your device and dewa02 servers is encrypted using TLS 1.3 with forward secrecy. Connections using TLS 1.0 or 1.1 are rejected.
• Encryption at rest: Sensitive data fields — including KYC document images, financial identifiers, and personally identifiable information — are encrypted at rest using AES-256.
• Password security: Member passwords are never stored in plaintext. They are hashed using bcrypt with an adaptive cost factor, rendering brute-force attacks computationally prohibitive.
• Access controls: Access to Member Personal Data by dewa02 employees is governed by a strict least-privilege policy. Database access is role-based and audit-logged. Privileged access requires multi-factor authentication (MFA).
• Intrusion detection and prevention: dewa02 operates continuous network monitoring, web application firewall (WAF) protection, and anomaly detection systems that generate real-time alerts for suspicious activity.
• Penetration testing: Independent third-party security auditors conduct scheduled and ad hoc penetration tests against the Platform's infrastructure. Material findings are remediated within defined SLA windows.
• Incident response: In the event of a Personal Data breach that poses a risk to Members' rights, dewa02 will notify affected Members and, where required by applicable law, the relevant regulatory authority within the timeframes prescribed by law.

dewa02 uses cookies and similar technologies (pixel tags, local storage, session storage) to deliver a functional, personalized, and secure Platform experience. The types of cookies we use are categorized as follows:

You may manage your cookie preferences through your browser's privacy settings. Most modern browsers allow you to block third-party cookies, clear stored cookies, or be notified before a cookie is placed. Note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features.

As a data subject, you hold the following rights with respect to the Personal Data dewa02 holds about you. You may exercise any of these rights at any time by submitting a request to our DPO as described in Clause 15:

dewa02 will respond to all valid data subject requests within 30 calendar days of receipt. In complex or high-volume cases, this period may be extended by a further 60 days, in which case you will be notified of the extension and the reason for it. There is no charge for exercising your rights, unless a request is manifestly unfounded or excessive.

The dewa02 Platform is strictly restricted to individuals who are 21 years of age or older. dewa02 does not knowingly collect, process, or retain Personal Data from individuals under the age of 21. This policy is enforced through mandatory KYC age verification at the point of withdrawal and through automated age-plausibility checks during registration.

If dewa02 becomes aware that Personal Data has been collected from an individual under the age of 21 — whether through a fraudulent registration, an adult's failure to prevent a minor from accessing their Account, or any other means — the following actions will be taken immediately:

• The Account will be suspended and all Wallet balances frozen pending investigation.
• Any real-money deposits made from the Account will be returned to the originating payment method, less any withdrawals already processed.
• All Personal Data associated with the minor will be securely deleted from dewa02's systems as promptly as legal obligations permit.
• The matter will be reported to the relevant responsible gaming authority where legally required.

If you believe a minor has accessed or registered on the dewa02 Platform, please notify us immediately at [email protected].

The dewa02 Platform integrates with a number of third-party services to deliver its full range of gaming and payment functionality. These integrations involve some degree of data sharing, as described in Clause 6. However, once Personal Data leaves dewa02's direct control and enters a third party's systems, that third party's own privacy policy governs the subsequent processing of that data.

dewa02 takes reasonable steps to ensure that all third-party partners maintain data protection standards consistent with this Policy. However, dewa02 cannot accept responsibility for the privacy practices of third-party services that operate independently of the Platform. Members are encouraged to review the privacy policies of any third-party payment provider, game studio, or external service they interact with in connection with their use of the Platform.

The Platform does not contain links to external third-party websites for advertising or affiliate purposes. Any links present on the Platform navigate exclusively to other pages within the dewa02 domain. dewa02 is therefore not responsible for the privacy practices of any website you may navigate to independently of the Platform.

dewa02 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. The revised Policy will be published on this page with an updated "Last Updated" date at the top of the document.

Where an amendment is material — meaning it significantly affects how we process your Personal Data or substantially alters your rights — dewa02 will provide advance notice through one or more of the following channels:

• A prominent notice displayed on the Platform homepage and Account dashboard for a minimum of 14 days prior to the effective date of the change.
• An email notification to the address registered on your Account, where you have provided a valid email address and have not opted out of service communications.
• An in-Platform notification delivered upon your next login after the amendment is published.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment and acceptance of the revised Privacy Policy. If you do not agree with a material amendment, you must cease using the Platform and may request account closure and data deletion in accordance with Clause 11.

Non-material amendments — such as typographical corrections, formatting updates, or clarifications that do not change the substance of our data practices — may be made without advance notice, though the "Last Updated" date will always reflect the most recent revision.

If you have any questions, concerns, or requests relating to this Privacy Policy or to dewa02's handling of your Personal Data, you may contact our Data Protection Officer (DPO) through the following channels:

dewa02 is committed to resolving all privacy concerns in a timely, transparent, and fair manner. If you are not satisfied with our response to your privacy enquiry, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.