Privacy Policy — uno198

1.1  uno198 ("we", "us", "our") operates the online betting and gaming platform available at uno198.club (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with our Platform.

1.2  This Privacy Policy ("Policy") describes the types of personal data we collect, the purposes for which we process it, how we protect it, the circumstances under which we may share it, and the rights you hold in relation to your personal data. It applies to all Members, prospective Members, and visitors to the Platform, including players accessing uno198 from Jakarta, Surabaya, Bandung, Medan, Bali, and all other regions across Indonesia.

1.3  This Policy should be read together with our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions on a privacy matter, this Policy prevails.

1.4  By registering an account, depositing funds, placing a bet, or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, you should not use the Platform.

2.1  In this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof.
• "Member" / "User" means any natural person who has registered an account on the uno198 Platform.
• "Controller" means uno198, the entity that determines the purposes and means of Processing your Personal Data.
• "Processor" means a third party that processes Personal Data on behalf of uno198 under a written data processing agreement (e.g., payment processors, KYC verification providers).
• "KYC" means Know Your Customer — the mandatory identity and address verification process applied to Member accounts before withdrawals are processed.
• "Cookies" means small text files placed on your device by the Platform to store preferences, session data, and analytics information.
• "IDR" means Indonesian Rupiah, the primary currency used on the Platform for Indonesian Members.
• "Sensitive Data" means a subset of Personal Data that warrants additional protection, including government-issued identity documents (e.g., Indonesian KTP), financial account credentials, and any data that could be used to commit identity fraud.

3.1  The categories of Personal Data we collect vary depending on whether you are a visitor, a registered Member, or a Member who has completed full KYC verification. The table below summarises the key data categories:

3.2  We do not collect or store full payment card numbers (PAN), CVV/CVC codes, or full bank account login credentials. Such sensitive financial authentication data is handled exclusively by our certified payment processor partners and is never transmitted to or stored on uno198 servers.

3.3  We do not collect special-category sensitive data such as racial or ethnic origin, religious beliefs, political opinions, health information, or biometric identifiers, except to the minimal extent required for age/identity verification (e.g., date of birth from a government ID) where permitted by applicable law.

4.1  uno198 collects Personal Data through the following channels:

• Direct interactions: Data you provide when creating your account, completing KYC verification, making deposits or withdrawals, placing bets, contacting customer support, or updating your account settings.
• Automated technical collection: Data collected automatically when you visit the Platform, including IP address, device identifiers, browser information, and session data via server logs, cookies, and similar technologies.
• Third-party KYC providers: Where you consent to identity verification, our KYC partner may return enriched identity data (e.g., confirmation that your KTP number and name match government records) which is then associated with your account record.
• Payment processors: Transaction confirmation data, including timestamps and reference numbers, returned by payment gateways for BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI bank transfers, OVO, DANA, GoPay, ShopeePay, LinkAja, and cryptocurrency networks.
• Responsible Gaming self-disclosures: Any limits, preferences, or exclusion elections you set voluntarily via the Responsible Gaming tools in your account dashboard.

4.2  We do not purchase Personal Data from third-party data brokers, social media platforms, or other external list providers.

5.1  uno198 processes your Personal Data for the following specific purposes:

• Account creation and management: To register your account, authenticate your identity at login, and maintain your account preferences and history.
• Transaction processing: To process deposits via Indonesian local banks and e-wallets, and to verify and execute withdrawal requests to your nominated payment method.
• KYC and AML compliance: To verify your age (21+ requirement), identity, and source of funds in accordance with internationally recognised anti-money laundering standards.
• Bet and game settlement: To record, settle, and display the results of all bets, casino rounds, togel (Indonesia's traditional numbers lottery) draws, and other gaming activity on your account statement.
• Bonus and promotion administration: To credit eligible bonuses to your account, track wagering requirement progress, and detect bonus abuse.
• Customer support: To respond to your queries, complaints, and service requests via live chat and email.
• Fraud prevention and platform security: To detect and prevent fraudulent activity, unauthorised account access, prohibited conduct, and abuse of the platform as described in the Terms & Conditions.
• Responsible Gaming: To apply and enforce the deposit limits, cooling-off periods, and self-exclusion elections you have set, and to identify patterns of play that may indicate problem gambling.
• Platform improvement: To analyse aggregate usage data and improve the functionality, performance, and user experience of the Platform.
• Legal compliance: To comply with applicable legal obligations, including responding to lawful requests from regulatory or law enforcement authorities.
• Marketing communications: To send you promotional offers, bonus alerts, and platform updates by email or in-platform notification, where you have opted in to receive such communications. You may opt out at any time.

6.1  Where data protection law requires a lawful basis for processing Personal Data, uno198 relies on the following bases:

• Contractual necessity: Processing required to perform the contract between you and uno198 — including account management, transaction processing, and bet settlement — is carried out on the basis that it is necessary for the performance of our agreement with you.
• Legal obligation: Processing required to comply with applicable law — including KYC/AML verification, regulatory reporting, and cooperation with lawful authority requests — is carried out on the basis of legal obligation.
• Legitimate interests: Processing carried out for fraud prevention, platform security, and aggregate analytics is carried out on the basis of uno198's legitimate interests in operating a secure and commercially viable platform, provided those interests are not overridden by your fundamental rights.
• Consent: Processing for optional marketing communications and non-essential cookies is carried out on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7.1  uno198 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share Personal Data only in the following circumstances and only to the extent strictly necessary:

• Payment processors: Indonesian bank transfer intermediaries and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) and cryptocurrency payment networks receive the transaction data required to execute your deposits and withdrawals. These parties process your data as independent controllers subject to their own privacy policies, or as processors under agreements with uno198.
• KYC verification partners: A certified third-party identity verification provider processes the KYC documents you submit (KTP, passport, proof of address) and returns a verification result to uno198. Your documents are handled under a data processing agreement that restricts their use to identity verification only.
• Game content suppliers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive your account identifier and session token to deliver their game content within the Platform. They do not receive your full personal profile.
• IT and hosting providers: Third-party cloud infrastructure and managed hosting providers store and process Platform data on our behalf under data processing agreements with appropriate security obligations.
• Legal and regulatory authorities: We will disclose Personal Data to law enforcement, regulatory bodies, or other governmental authorities where we are legally required to do so, or where disclosure is necessary to protect the safety of our Members or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of uno198's assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7.2  All third parties with whom uno198 shares Personal Data are required to maintain appropriate technical and organisational security measures and to use the data only for the specific purposes for which it was disclosed.

8.1  The uno198 Platform serves Members primarily in Indonesia, but our server infrastructure, game suppliers, and third-party service providers may be located in other countries. As a result, your Personal Data may be transferred to and processed in jurisdictions outside Indonesia.

8.2  Where such international transfers occur, uno198 takes steps to ensure that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses with our service providers.
• Transferring data only to countries or entities that maintain data protection standards substantially equivalent to those applied by uno198.
• Applying encryption and access controls to data in transit and at rest, regardless of the jurisdiction in which it is processed.

8.3  By using the Platform, you acknowledge that your Personal Data may be transferred and stored outside Indonesia as described in this section.

9.1  uno198 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:

9.2  After the applicable retention period expires, Personal Data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical analysis.

10.1  Subject to applicable law and certain exceptions (e.g., where processing is required for legal compliance), you hold the following rights in relation to your Personal Data:

• Right of access: You may request a copy of the Personal Data we hold about you, together with information about how and why we process it.
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data. For minor corrections (such as phone number updates), you can make changes directly in your account settings.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no other lawful basis applies. Note that we cannot erase data we are legally required to retain (e.g., transaction records for AML purposes).
• Right to restriction of processing: You may request that we restrict processing of your data in certain circumstances, such as while a dispute about its accuracy is pending.
• Right to data portability: Where processing is based on your consent or contract performance and is carried out by automated means, you may request a machine-readable copy of the Personal Data you provided to us.
• Right to object: You may object to processing carried out on the basis of legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails, non-essential cookies), you may withdraw consent at any time by contacting support or updating your account notification preferences.

10.2  To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request — [your username]". We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days. Where requests are complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension.

10.3  We may ask you to verify your identity before acting on a data rights request, to ensure that Personal Data is not disclosed to or altered by unauthorised parties.

11.1  uno198 uses cookies and similar technologies (including local storage and session storage) to operate the Platform and improve the Member experience. The categories of cookies we use are as follows:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in during your visit. These cookies cannot be disabled without breaking core platform functionality.
• Preference cookies: Store your chosen settings such as display language, odds format, and notification preferences, so they persist between sessions.
• Analytics cookies: Collect aggregate, anonymised data about how Members navigate and use the Platform (pages visited, time on page, error events). This information is used to identify usability improvements and performance issues. No individual user is identified in analytics reports.
• Security cookies: Used to detect fraudulent activity, bot traffic, and account takeover attempts. These are strictly necessary from a security perspective and cannot be disabled.

11.2  uno198 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts that track your activity across other websites.

11.3  You can manage cookie preferences through your browser settings. Disabling cookies other than strictly necessary ones may affect some Platform features (e.g., your preferences may not be saved between sessions). Disabling strictly necessary or security cookies may prevent you from logging in.

11.4  Most modern browsers allow you to view, delete, or block cookies via their privacy settings. Instructions for common browsers are available from the browser publisher's support pages.

12.1  uno198 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• TLS/SSL encryption: All data in transit between your browser and our servers is encrypted using industry-standard TLS protocols.
• Encryption at rest: Sensitive data stored on our servers, including KYC documents and financial data, is encrypted using AES-256 or equivalent standards.
• Access controls: Access to Personal Data is restricted on a strict need-to-know basis. Staff and systems are granted only the minimum permissions required for their specific function.
• Two-factor authentication (2FA): Administrative access to systems holding Personal Data requires multi-factor authentication. We encourage Members to enable 2FA on their own accounts for additional security.
• Security audits and penetration testing: The Platform undergoes regular third-party security assessments, including penetration tests and vulnerability scans, to identify and remediate potential weaknesses.
• Intrusion detection: Automated systems monitor for unusual access patterns, failed login attempts, and other indicators of a potential security incident in real time.
• Incident response: uno198 maintains a documented data breach response procedure. In the event of a confirmed breach affecting Member data, we will notify affected individuals and, where required, the relevant regulatory authority, within the timeframes mandated by applicable law.

12.2  While we take all reasonable steps to protect your Personal Data, no online platform can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately at [email protected] if you suspect any unauthorised access to your account.

13.1  uno198 is an adults-only platform. The minimum age to register and use the Platform is 21 years. We do not knowingly collect, store, or process the Personal Data of any individual under the age of 21.

13.2  Age verification is performed as part of the registration and KYC process. Where we have reason to believe that an account is operated by a person under 21 years of age, the account will be immediately suspended pending investigation. If the suspicion is confirmed, the account will be permanently closed and any deposits returned to the source payment method where possible.

13.3  If you are a parent or guardian and you believe that a minor in your care has registered an account on uno198, please contact us immediately at [email protected]. We will investigate and, if confirmed, close the account and securely delete all associated Personal Data, subject to any retention obligations under applicable law.

14.1  uno198 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The "Last updated" date at the top of this page indicates when the most recent revision was made.

14.2  Where changes are material — for example, a change to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will notify registered Members by email and/or via a prominent notice on the Platform at least 7 days before the changes take effect.

14.3  Where changes are non-material (e.g., minor corrections to wording or formatting), we may update the Policy without prior notice, although the "Last updated" date will always reflect the most recent change.

14.4  Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree with the amended Policy, you should cease using the Platform and close your account before the effective date.

15.1  If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your Personal Data, please contact us through the following channel:

15.2  For data rights requests (Section 10), please email [email protected] with the subject line "Data Rights Request — [your username]". For general privacy enquiries, subject line "Privacy Query" is sufficient.

15.3  We are committed to resolving any privacy concern you raise in good faith. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.