Privacy Policy — pw666

1.1 Data Controller. pw666 operates the Platform and acts as the data controller responsible for the personal data collected through it. As data controller, we determine the purposes and means by which your personal data is processed.

1.2 Contact Details. All privacy-related enquiries, data subject access requests, and complaints should be directed to our dedicated privacy team. You may reach us by email at [email protected] or via the Live Chat facility available in your Account dashboard. We aim to respond to all privacy enquiries within 5 business days.

1.3 Scope. This Policy applies to all current and former members of pw666, as well as visitors who access the Platform without registering an account. It covers personal data collected through the Platform, through our customer support channels, and through any marketing communications you may receive from us.

1.4 Indonesia Market. pw666 principally serves adult residents of Indonesia aged 21 and over. While we operate on an international basis, our data handling practices are designed with the needs and expectations of Indonesian members in mind, including support for local payment methods such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.

2.1 Categories of Personal Data. Depending on how you interact with the Platform, we may collect and process the following categories of personal data:

2.2 Special Category Data. We do not intentionally collect special category data (such as health data, racial or ethnic origin, religious beliefs, or political opinions). If you voluntarily disclose such information — for example, when explaining a self-exclusion request — we will treat it with the highest level of confidentiality and use it only to the extent necessary to address your request.

2.3 Data from Third Parties. We may receive data about you from third-party identity verification and fraud-detection providers, payment processors, and publicly available databases used for anti-money laundering (AML) screening. Such data supplements the information you provide directly and is used solely for the purposes described in this Policy.

3.1 Directly from You. The majority of personal data we hold is provided directly by you when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, respond to a survey, or interact with a promotional offer.

3.2 Automatically. When you visit the Platform, certain technical and usage data is collected automatically through cookies, web beacons, pixel tags, and server logs. See Section 7 for full details of our cookies and tracking practices.

3.3 From Payment Providers. When you conduct a financial transaction via a local Indonesian bank (such as BCA, BRI, or Mandiri) or an e-wallet (such as OVO or DANA), the payment provider may transmit transaction confirmation data to us, including masked account identifiers and transaction reference numbers. We do not receive your full bank account password or PIN at any point.

3.4 From Identity Verification Partners. Where we engage third-party KYC service providers to assist with identity verification, those providers may return a verification status, confidence score, and extracted document data to us. Their own privacy policies govern how they handle your data on their systems.

4.1 Account Management. We process identity and contact data to create and maintain your pw666 member account, verify your credentials at login, recover access if you are locked out, and fulfil our contractual obligations to you as a member.

4.2 Payment Processing. Financial data is processed to receive deposits, execute withdrawal requests to your nominated BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja account, detect and prevent payment fraud, and maintain accurate financial records.

4.3 Regulatory Compliance. We are required to collect and retain certain data to comply with applicable anti-money laundering (AML) regulations, Know Your Customer (KYC) obligations, and international sanctions screening requirements. This includes identity verification prior to processing withdrawals and ongoing transaction monitoring.

4.4 Responsible Gaming. Responsible Gaming data is processed to administer the tools you request (deposit limits, self-exclusion, cooling-off periods), to identify members who may be showing signs of problem gambling, and to contact those members with appropriate support information in accordance with our Responsible Gaming Policy.

4.5 Platform Improvement. Technical and usage data is analysed in aggregated and pseudonymised form to improve the performance, security, and usability of the Platform, to develop new product features, and to optimise the range and presentation of sports markets, slot titles, and live casino games offered to Indonesian members.

4.6 Marketing Communications. Where you have opted in to receive marketing communications, we may use your contact data and usage data to send you personalised promotions, bonus offers, and news about pw666 products and events — including promotions tied to BRI Liga 1 fixtures, the Piala AFF tournament, or seasonal events such as Idul Fitri and Ramadhan. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or by contacting support.

4.7 Fraud Detection and Security. Technical and transaction data is used to detect, investigate, and prevent fraudulent activity, unauthorised account access, multi-accounting, bonus abuse, and any other misuse of the Platform. This processing is necessary for the legitimate interests of both pw666 and its honest members.

4.8 Customer Support. Communications data is processed to respond to your enquiries, resolve disputes, investigate complaints, and improve the quality of our support services.

5.1 Overview. We rely on one or more of the following legal bases when processing your personal data:

• Contract Performance: Processing necessary to perform our contractual obligations to you as a registered pw666 member — including account management, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML/KYC obligations and data retention requirements imposed by our licensing authority.
• Legitimate Interests: Processing necessary for the legitimate interests of pw666 or third parties, where those interests are not overridden by your fundamental rights and freedoms. This includes fraud prevention, platform security, and aggregate analytics.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications and for the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5.2 Withdrawal of Consent. Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal, nor does it affect processing carried out on a different legal basis.

6.1 Principle of Minimum Disclosure. pw666 applies a strict minimum-disclosure principle: your personal data is shared with third parties only to the extent genuinely necessary for the purposes described in this Policy. We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.

6.2 Categories of Recipients. Your data may be shared with the following categories of recipients:

• Payment Processors and Banking Partners: Local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial information necessary to process your transactions.
• Identity Verification and AML Service Providers: Third-party KYC and AML screening providers receive identity documents and biographical data for the purpose of verifying your identity and screening against international sanctions lists.
• Game Content Providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive your account identifier and session token to deliver their game content within the Platform. These providers do not receive your full personal profile.
• Customer Support Platform Providers: We use third-party software to manage live chat and email support. Support agents and their platform provider may access your account details and communication history to resolve your queries.
• Analytics and Fraud Detection Providers: Pseudonymised technical and usage data is shared with analytics and security service providers for the purposes described in Sections 4.5 and 4.7.
• Regulatory Authorities and Law Enforcement: We may disclose personal data to governmental bodies, regulators, tax authorities, law enforcement agencies, or courts where we are required to do so by applicable law, court order, or the instructions of our licensing authority.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's business assets, member data may be transferred to the acquiring entity, subject to equivalent privacy protections.

6.3 Data Processing Agreements. All third-party service providers who process personal data on our behalf are required to enter into a data processing agreement with pw666 that mandates appropriate technical and organisational security measures and restricts the provider from using your data for any purpose other than delivering the contracted service.

7.1 What Are Cookies. Cookies are small text files placed on your device by the Platform when you visit. They allow the Platform to remember your preferences and activity across sessions and are essential for the proper functioning of many Platform features, including maintaining your login session and storing your language and display preferences.

7.2 Types of Cookies We Use.

• Strictly Necessary Cookies: Required for the Platform to function. They include session authentication tokens, load-balancing identifiers, and security tokens. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as preferred payment method, last visited game category (for example, slots or sportsbook), and display settings. Disabling these may reduce your experience on the Platform.
• Analytics Cookies: Collect pseudonymised data on how visitors interact with the Platform — which pages are visited most frequently, how long sessions last, and where users navigate from. This data is used in aggregate to improve Platform performance. We use analytics tools that process data on servers located in jurisdictions with adequate data protection standards.
• Marketing and Retargeting Cookies: Used only with your explicit consent to deliver relevant promotional content about pw666 products and offers. If you have not opted in, these cookies are not placed on your device.

7.3 Managing Cookies. You may control cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Note, however, that disabling strictly necessary cookies will prevent you from logging in and using the Platform. You may also withdraw consent for non-essential cookies at any time by adjusting your preferences in your Account settings.

7.4 Web Beacons and Pixel Tags. We may use web beacons (also known as pixel tags or tracking pixels) in emails and on certain pages of the Platform to confirm that emails have been opened and that links have been followed. This helps us measure the effectiveness of our communications and promotions.

8.1 Retention Principle. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations. Once data is no longer required, it is securely deleted or anonymised.

8.2 Retention Periods. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your membership and for a minimum of 5 years following account closure, in accordance with AML and KYC regulatory requirements.
• Financial and Transaction Data: Retained for a minimum of 5 years from the date of the transaction, in line with applicable financial record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later.
• Customer Support Communications: Retained for 3 years from the date the support interaction was closed.
• Marketing Consent Records: Retained for the duration of your membership plus 2 years to demonstrate compliance with consent requirements.
• Technical and Usage Data (Logs): Retained for 12 months from collection, after which they are deleted or anonymised.
• Self-Exclusion Records: Retained indefinitely to prevent re-registration in violation of a self-exclusion order.

8.3 Extended Retention. Where data is subject to an ongoing legal dispute, regulatory investigation, or law enforcement enquiry, we may retain it beyond the standard periods described above until the matter is fully resolved.

9.1 Our Security Measures. pw666 employs a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• 256-bit TLS encryption for all data transmitted between your device and our servers;
• AES-256 encryption at rest for all stored personal and financial data;
• Multi-factor authentication (MFA) requirements for all administrative access to member data systems;
• Regular penetration testing and vulnerability assessments conducted by independent third-party security firms;
• Strict role-based access controls ensuring that staff can access only the personal data necessary for their specific function;
• Automated real-time monitoring and alerting for suspicious access patterns or anomalous data queries;
• Segregated network architecture with firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS).

9.2 Staff Training. All pw666 employees and contractors who have access to personal data receive regular training on data protection obligations, secure data handling practices, and the recognition of social engineering and phishing attacks. Our data protection policies are reviewed and updated at least annually.

9.3 Data Breach Response. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the affected members without undue delay and, where required by applicable law, report the breach to the relevant supervisory authority. Our incident response plan is tested regularly to ensure a swift and effective response.

9.4 Your Responsibilities. The security of your account also depends on the steps you take to protect your credentials. We strongly recommend that you use a unique, strong password for your pw666 account, enable two-factor authentication (2FA) via your Account security settings, and never share your login credentials with any other person. pw666 staff will never ask for your password.

10.1 Overview of Rights. As a data subject, you have a number of rights in relation to your personal data held by pw666. These rights are set out below. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and sufficient detail to identify your account.

• Right of Access: You have the right to request a copy of the personal data we hold about you, together with information about how it is used and with whom it is shared. We will respond to access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update most account details directly in your Account profile. For KYC-verified data (such as your legal name or date of birth), updates require re-submission of supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and there are no overriding legitimate grounds. Note that this right is subject to our legal retention obligations — we cannot delete data we are legally required to retain.
• Right to Restriction of Processing: You have the right to request that we restrict processing of your data in certain circumstances — for example, while we are verifying the accuracy of data you have disputed, or while we are considering an objection you have raised.
• Right to Data Portability: Where processing is based on consent or contract performance and is carried out by automated means, you have the right to receive a copy of your data in a structured, commonly used, machine-readable format and to request that it be transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for fraud detection or Platform analytics. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests. You have an unconditional right to object to direct marketing at any time.
• Rights Related to Automated Decision-Making: Where we use automated processing to make decisions that produce significant legal or similarly significant effects on you, you have the right to request human review of that decision, to express your point of view, and to contest the outcome.

10.2 Identity Verification. To protect against unauthorised data subject requests, we will verify your identity before acting on any rights request. You will be asked to confirm your registered email address and, where necessary, to provide a copy of your government-issued ID.

10.3 Response Timeline. We will acknowledge all rights requests within 5 business days and provide a full response within 30 calendar days. Where a request is complex or involves a high volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

11.1 Age Restriction. The Platform is strictly intended for adults aged 21 years and over. pw666 does not knowingly collect personal data from any individual under the age of 21. By registering an account, you represent and warrant that you are at least 21 years old.

11.2 Underage Data Discovery. If we discover, or are notified, that we have inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data from our systems, close the associated account, and — where funds have been deposited — arrange for their return to the original payment source following identity verification of the adult account holder.

11.3 Parental Notification. If you are a parent or guardian and believe that a person under 21 has registered an account on pw666 using your details or without your knowledge, please contact us immediately at [email protected]. We will investigate and act on verified reports without delay.

12.1 No External Links. The pw666 Platform does not contain links to third-party websites or services beyond those necessary to deliver the contracted services (such as payment processor redirect pages or game content iframes). We do not embed third-party social media feeds or advertising widgets on the Platform.

12.2 Game Content Providers. Certain game content on the Platform is delivered by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you launch a game, a connection is established directly with the relevant studio's game server. Those studios may collect limited technical data (such as your session token and device type) as part of game delivery. Their collection and use of such data is governed by their own privacy policies, not by this Policy.

12.3 Payment Redirects. When making a deposit or withdrawal via a local Indonesian bank or e-wallet, you may be temporarily redirected to the payment provider's interface. Any data you enter on that provider's page is governed by their own privacy policy. pw666 does not have access to your bank PIN or full card number.

13.1 Right to Update. pw666 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. We will always post the current version of the Policy on this page with an updated "Last Updated" date at the top.

13.2 Material Changes. Where a proposed change is material — meaning it significantly affects your rights or the way we use your personal data — we will notify you by email to your registered address and by a prominent notice on the Platform at least 14 days before the change takes effect. Your continued use of the Platform after the effective date of a material change constitutes your acceptance of the updated Policy.

13.3 Prior Versions. We maintain an archive of prior versions of this Policy. If you would like to review a previous version, please contact us at [email protected] with the subject line "Prior Privacy Policy Version".

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data pw666 holds about you, please reach out to us through one of the following channels:

• Email: [email protected] — please use the subject line "Privacy Enquiry" for fastest routing
• Live Chat: Available 24/7 via your Account dashboard after login
• Response Time: Privacy enquiries are acknowledged within 5 business days; full responses are provided within 30 calendar days (WIB, UTC+7)

We are committed to resolving all privacy concerns fairly, transparently, and promptly. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.