idn99 Privacy Policy

1.1 idn99 is committed to protecting the privacy and personal data of all individuals who interact with our Platform. This Policy applies to all personal data we collect and process in the course of operating the idn99 online betting and gaming platform, including data collected during account registration, KYC verification, deposits and withdrawals, customer support interactions, and ordinary Platform use.

1.2 This Policy covers the idn99 website at https://idn99.cam and all sub-domains or mobile-optimised versions of that site. It does not apply to third-party websites, payment processors, game studios, or other external services that may be linked to or integrated with the Platform. Those parties operate under their own privacy policies, for which idn99 accepts no responsibility.

1.3 idn99 primarily serves Members based in Indonesia. We recognise the growing importance of personal data protection in Indonesia and are committed to handling all Indonesian Member data — including national identity documents (KTP), local bank account details, and e-wallet identifiers — with the highest standard of care and confidentiality.

2.1 For the purposes of this Policy, the data controller responsible for the processing of your personal data is idn99, operating the Platform at https://idn99.cam under an international gaming licence. Our designated data protection contact can be reached via the details set out in Section 16 of this Policy.

2.2 Where idn99 engages third-party service providers to process personal data on its behalf (for example, payment processors or KYC verification providers), those providers act as data processors under contract with idn99. idn99 remains responsible as the data controller for ensuring that such processing is conducted lawfully and in accordance with this Policy.

3.1 In this Policy, the following terms carry the meanings assigned below:

4.1 idn99 collects personal data across several categories depending on how you interact with the Platform:

4.2 idn99 does not intentionally collect Sensitive Data beyond what is strictly necessary for identity verification and fraud prevention. Where sensitive information such as KTP numbers or bank account details is provided, it is handled under heightened security controls and access restrictions as described in Section 9.

5.1 idn99 collects personal data through the following means:

• Direct submission: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or completing a bonus claim form.
• Automated technical collection: Technical and usage data collected automatically when you browse the Platform, including via cookies, web server logs, and analytics tools. See Section 11 for full details.
• Third-party verification providers: Where idn99 uses a third-party KYC service to verify identity documents, that provider may share verification outcomes (confirmed, unconfirmed, or flagged) and summary data with idn99 as data controller.
• Payment processors: Transaction confirmation data (amount, timestamp, payment method reference) returned by Indonesian banks and e-wallet providers upon successful deposit or withdrawal processing.
• Fraud prevention services: Risk signals and device fingerprint data from fraud-prevention tools used to detect multi-accounting, bonus abuse, and suspicious payment patterns.

6.1 idn99 processes personal data only where there is a valid legal basis for doing so. The primary legal bases and corresponding purposes are set out below:

• Contract performance: Processing your identity, contact, financial, and transaction data is necessary to provide the idn99 service — including account management, processing deposits and withdrawals in IDR (Rp), and settling bet outcomes.
• Legal obligation: Processing for KYC identity verification, age verification (21+ enforcement), anti-money laundering (AML) checks, and financial record-keeping is required by applicable regulatory and legal obligations.
• Legitimate interests: Technical and usage data is processed to maintain platform security, prevent fraud, improve platform performance, and detect Prohibited Conduct as defined in the Terms & Conditions. idn99 has assessed that these interests are not overridden by Members' privacy rights.
• Consent: Where idn99 sends direct marketing communications (promotional emails, bonus notifications), this is done only where the Member has opted in. Consent may be withdrawn at any time. See Section 14 for details.

6.2 idn99 does not use personal data for automated decision-making that produces legal or similarly significant effects on Members, except in the context of fraud-risk scoring, where a Member has the right to request human review of any decision that affects their Account.

7.1 idn99 does not sell, rent, or share personal data with third parties for advertising or commercial purposes unrelated to the idn99 service. Personal data is shared externally only in the following limited circumstances:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, GoPay, DANA, ShopeePay, LinkAja) receive the minimum data necessary to process deposit and withdrawal transactions (typically the account holder name and account number).
• KYC verification providers: Identity document images and personal details are shared with accredited third-party KYC providers for identity and age verification. These providers are bound by data processing agreements and are prohibited from using your data for any other purpose.
• Fraud prevention and security providers: Device fingerprint data, IP addresses, and risk indicators are shared with specialist fraud-detection services to protect the Platform and its Members.
• Game studios: When you play a game provided by a third-party studio (e.g., Pragmatic Play, Evolution Gaming), a session token and minimal technical identifiers are shared with the studio's servers to launch and authenticate the game session. Studios are contractually prohibited from retaining personally identifiable information beyond the session.
• Legal and regulatory authorities: idn99 may disclose personal data to law enforcement, courts, or regulatory bodies where required by a valid legal order, court order, or regulatory obligation. idn99 will, where legally permissible, notify the affected Member of such a disclosure.
• Group companies: idn99 may share data within its corporate group for internal administrative, compliance, or technical purposes, subject to the same data protection standards as those described in this Policy.

7.2 All third-party processors engaged by idn99 are selected through a due-diligence process and are contractually required to process personal data solely under idn99's documented instructions, to maintain appropriate security standards, and to notify idn99 promptly of any security incident affecting Member data.

8.1 As an internationally licensed online platform, idn99 may transfer and store personal data on servers located outside of Indonesia. This may include transfers to the jurisdiction in which idn99's operating licence is held, or to countries where our third-party service providers (KYC providers, game studios, cloud infrastructure providers) are based.

8.2 Where personal data is transferred internationally, idn99 ensures that appropriate safeguards are in place to provide a level of protection equivalent to the protections described in this Policy. These safeguards may include: contractual data protection clauses with the receiving party, transfers to jurisdictions that maintain adequate data protection frameworks, or other legally recognised mechanisms.

8.3 If you wish to obtain more information about the international transfer safeguards applicable to your data, please contact us at the details in Section 16.

9.1 idn99 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption on all data transmitted between Members' devices and idn99 servers.
• Password hashing using industry-standard one-way cryptographic algorithms — plain-text passwords are never stored.
• Two-factor authentication (2FA) available to all Members and mandatory for high-value withdrawal requests above defined thresholds.
• Role-based access controls restricting internal access to personal data on a strict need-to-know basis, with audit logging of all access events.
• Segregated storage of KYC documents and financial data in secured, access-controlled environments separate from general operational systems.
• Regular security assessments and penetration testing conducted by independent security professionals.
• Incident response procedures ensuring rapid detection of, and response to, any suspected data security breach.

9.2 While idn99 takes all reasonable steps to protect your data, no online system is entirely free from risk. Members are encouraged to use strong, unique passwords, to enable 2FA, and to contact idn99 support immediately at the details in Section 16 if they suspect unauthorised access to their Account.

10.1 idn99 retains personal data for the minimum period necessary to fulfil the purposes described in this Policy or to comply with applicable legal and regulatory requirements. The following indicative retention periods apply:

10.2 At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for analytical and reporting purposes.

11.1 idn99 uses cookies and similar tracking technologies to operate the Platform, maintain session authentication, and collect usage analytics that help us improve the user experience. The categories of cookies used are:

• Strictly necessary cookies: Required for the Platform to function — including session authentication cookies that keep you logged in during a browsing session. These cannot be disabled without disrupting Platform functionality.
• Performance and analytics cookies: Used to collect aggregated, anonymised information about how Members use the Platform — such as which pages are visited most frequently and where users encounter errors. This data helps idn99 improve Platform design and performance.
• Functional cookies: Used to remember your preferences — such as language settings or display preferences — to personalise your experience on return visits.
• Security cookies: Used as part of idn99's fraud detection and bot-prevention mechanisms to distinguish legitimate user activity from automated requests.

11.2 idn99 does not use third-party advertising or behavioural tracking cookies for the purpose of serving targeted advertisements to Members on other websites.

11.3 Most browsers allow you to manage cookie preferences. However, disabling strictly necessary cookies will prevent core Platform functionality — including the ability to log in and maintain a session — from operating correctly.

12.1 As an idn99 Member, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us at the details in Section 16. We will respond to all verified requests within 30 calendar days.

12.2 idn99 will not charge a fee for responding to data rights requests unless a request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply. We will inform you of any fee before proceeding.

12.3 If you are not satisfied with idn99's handling of a data rights request, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.

13.1 idn99 strictly prohibits access by individuals under the age of 21. The Platform is not directed at, and does not knowingly collect personal data from, individuals under 21 years of age.

13.2 If idn99 becomes aware that personal data has been collected from a person under 21 years of age, the Account will be closed immediately and all personal data associated with that Account will be deleted, with the exception of records that idn99 is legally required to retain for the purpose of demonstrating the breach and its remediation.

13.3 If a parent or guardian believes that their child (under 21) has registered on idn99, they should contact idn99 immediately using the details in Section 16 so that the Account can be reviewed and closed without delay.

14.1 idn99 may send Members promotional communications about bonuses, seasonal promotions (including those tied to Indonesian calendar events such as Idul Fitri, Independence Day, Nyepi, and Imlek), new game launches, and VIP programme updates. These communications are sent only where the Member has opted in to receive them during registration or through Account settings.

14.2 Members may withdraw consent to receive marketing communications at any time by:

• Updating communication preferences in their Account settings panel.
• Clicking the "unsubscribe" link included in any marketing email sent by idn99.
• Contacting customer support at the details in Section 16 with a request to opt out.

14.3 Opting out of marketing communications does not affect transactional communications — such as deposit confirmations, withdrawal processing updates, KYC verification notices, and security alerts — which idn99 may send regardless of marketing preferences as they are necessary for the operation of your Account.

15.1 idn99 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, idn99 will provide reasonable advance notice to Members via an in-platform notification, a notice on the Platform homepage, or an email to the Member's registered email address.

15.2 The "Last Updated" date at the top of this Policy indicates when the most recent version was published. We encourage Members to review this Policy periodically to stay informed about how idn99 handles their personal data.

15.3 Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree to the revised Policy, you should cease using the Platform and may close your Account in accordance with the Terms & Conditions.

16.1 If you have any questions about this Privacy Policy, wish to exercise a data right, or wish to raise a concern about how idn99 has handled your personal data, please contact our Data Protection team through the following channels. All contact details are provided as plain text — no clickable links or communication protocols are used below.

16.2 For formal data protection correspondence — including subject access requests, erasure requests, or complaints — please use the email address above with the subject line "Data Privacy Request — [Nature of Request]". idn99 will acknowledge receipt within three (3) business days and provide a substantive response within 30 calendar days.

16.3 If you are not satisfied with idn99's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. idn99 will cooperate fully with any such supervisory authority investigation.