Privacy Policy — pej63

Data Controller: pej63 Entertainment Ltd. ("the Company", "we", "us", or "our"), the operator of the pej63 online betting platform accessible at https://pej63.cam.

The Company is an internationally incorporated entity that operates the pej63 Platform under an international gaming licence. For all inquiries relating to this Privacy Policy — including data subject access requests, correction requests, and complaints — the Company's designated point of contact is the Data Protection team, reachable via the support email address set out in Section 14 of this policy.

pej63 is built specifically for the Indonesian market, serving players across Jakarta, Surabaya, Bandung, Medan, Yogyakarta, Bali, Semarang, and beyond. All personal data processed in connection with Indonesian bank accounts and national identity documents is handled in accordance with the principles set out in this policy.

We collect only the personal data that is necessary to provide, operate, and improve the pej63 platform. The categories of data we collect are described below:

We do not intentionally collect or process sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is visible on standard KYC identity documents.

We collect personal data through the following channels:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or submit feedback, you provide data directly to us.
• Automated collection: When you browse or use the Platform, our servers and analytics systems automatically collect technical and usage data including IP addresses, device identifiers, and session behavior via cookies and similar tracking technologies. See Section 6 for details.
• Payment processors: When you deposit or withdraw funds via a bank transfer (BCA, BRI, BNI, Mandiri) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processing partners share transaction confirmation data with us to credit or debit your Wallet.
• Fraud and identity verification partners: We may receive data from third-party identity verification services and fraud detection providers to assist in confirming your identity during KYC review and to flag suspicious account activity.
• Publicly available sources: In limited circumstances (such as investigating a fraud or AML concern), we may cross-reference your information against publicly available records, sanctions lists, or adverse media databases.

We use your personal data only for lawful purposes and always in accordance with the legal bases described below. We do not use your data in ways that are incompatible with the original purpose for which it was collected.

Where we rely on legitimate interests as a legal basis, we have carried out a balancing test and are satisfied that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests — see Section 10.

pej63 does not sell, rent, or trade your personal data. We share your data only in the circumstances set out below, and only with parties who are contractually bound to protect it to an equivalent standard:

• Payment processors and banks: We share the minimum necessary financial data with payment partners (including local Indonesian bank networks and e-wallet providers such as OVO, DANA, GoPay, ShopeePay, and LinkAja) to process your deposit and withdrawal requests.
• Identity verification providers: We work with accredited KYC and AML compliance technology partners to verify the authenticity of identity documents submitted during the KYC process. These providers process your identity data strictly on our instructions and may not use it for their own purposes.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a pseudonymous player identifier and game session data in order to power game functionality and detect cheating. They do not receive your full name, banking details, or contact information.
• Fraud detection and cybersecurity services: We use third-party fraud detection tools that analyze technical data (IP address, device fingerprint, behavioral signals) to identify suspicious activity. These services operate under strict data processing agreements.
• Cloud infrastructure providers: Our platform infrastructure runs on reputable cloud hosting providers whose data centers implement enterprise-grade physical and logical security controls. These providers act as data processors under our instruction.
• Legal and regulatory authorities: We may disclose your personal data to law enforcement agencies, courts, regulators, or other governmental authorities where we are required to do so by applicable law, court order, or regulatory direction — including in connection with an AML investigation.
• Corporate transactions: If pej63 Entertainment Ltd. is involved in a merger, acquisition, asset sale, or restructuring, your personal data may be transferred to the successor entity. You will be notified of any such transfer and the privacy practices of the successor entity before the transfer takes effect.

We require all third-party data processors to implement appropriate technical and organizational security measures and to process personal data only as instructed by pej63.

pej63 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your session security, and analyze aggregate usage patterns to improve the user experience.

Strictly necessary cookies are essential for the Platform to function and cannot be disabled without breaking core functionality. All other cookie categories are activated only with your consent, which you may withdraw at any time by adjusting your browser settings to block or delete cookies. Note that disabling functional or analytics cookies may affect your experience on the Platform.

pej63 does not use third-party advertising tracking pixels or share cookie data with external advertising networks.

The security of your personal data is a core operational priority for pej63. We implement a layered security architecture that includes the following controls:

• Encryption in transit: All data exchanged between your browser or device and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). Connections using outdated protocols are rejected.
• Encryption at rest: Sensitive data stored in our databases — including financial records, KYC document files, and account credentials — is encrypted using AES-256.
• Password hashing: Account passwords are never stored in plaintext. We use a strong adaptive hashing algorithm (bcrypt with a high work factor) so that even in the event of a data breach, raw passwords cannot be recovered.
• Access controls: Access to production data systems is restricted to authorized personnel on a strict need-to-know basis. All internal access is logged and subject to regular audit review.
• Two-factor authentication: 2FA is available for all Player accounts and is mandatory for all internal administrative access to data systems.
• Penetration testing: We conduct regular third-party penetration testing of our platform infrastructure. Identified vulnerabilities are remediated on a risk-prioritized basis.
• Data breach response: We maintain a documented data breach response plan. In the event of a breach that presents a material risk to affected individuals, we will notify impacted Players promptly and take all reasonable steps to mitigate harm.

We retain your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymized so that it can no longer be associated with you as an individual. Anonymized aggregate data (such as platform-wide betting volume statistics) may be retained indefinitely for business analytics purposes.

As an internationally operated platform, pej63 may process or store your personal data in countries outside of Indonesia. This may occur when our cloud infrastructure, third-party service providers, or data processing partners operate data centers in other jurisdictions.

Whenever personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect it to a standard equivalent to the protections described in this policy. These safeguards may include:

• Standard contractual clauses (SCCs) incorporated into data processing agreements with overseas service providers.
• Transfers to countries or entities that maintain recognized adequacy standards for data protection.
• Binding corporate rules or equivalent intra-group data transfer mechanisms where applicable.

You may request further information about the specific safeguards we apply to any particular international data transfer by contacting our support team as described in Section 14.

As a user of the pej63 platform, you have the following rights in relation to your personal data. These rights apply regardless of the legal basis on which we process your data, subject to the exceptions and qualifications noted below:

• Access: You may request a copy of the personal data we hold about you. We will provide this in a structured, commonly used, machine-readable format within 30 calendar days of receiving a verified request.
• Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Minor corrections (such as fixing a typo in your registered name) can often be handled directly through your account profile settings.
• Erasure ("right to be forgotten"): You may request deletion of your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and no other legal basis applies; or (c) you object to processing and we have no overriding legitimate interest. Note that erasure requests may be declined where retention is required by our AML legal obligations (see Section 8).
• Restriction: You may request that we restrict the processing of your data while a rectification or objection request is being assessed.
• Portability: You may request a structured export of data you have provided to us directly (such as your registration information and transaction history) in a machine-readable format.
• Objection: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Automated decisions: Where we make automated decisions about you that have a significant effect (such as automated fraud detection leading to account suspension), you have the right to request human review of that decision.
• Withdraw consent: Where processing is based on your consent (such as receiving marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact the pej63 Data Protection team as described in Section 14. We may request verification of your identity before processing your request. We aim to respond to all verified requests within 30 calendar days; in complex cases we may extend this to 60 days and will notify you accordingly.

The pej63 platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Age verification is conducted at the point of registration and is reinforced through our KYC process.

If we discover that an account has been registered by a person under the age of 21, we will immediately close that account, void all associated wagers, and securely delete any personal data collected, returning deposited funds to the payment source after completing necessary identity checks.

If you believe that a minor has registered an account on pej63, please contact us immediately using the details in Section 14. We treat all such notifications as high-priority and will investigate and act within 48 hours of receiving a verified report.

With your consent, pej63 may send you promotional communications about bonuses, new game releases, seasonal promotions (such as Idul Fitri offers, Ramadhan specials, or Indonesian Independence Day campaigns), and platform updates. These communications may be delivered by email, in-platform notification, or SMS to your registered phone number.

You may withdraw your marketing consent at any time by:

• Clicking the "unsubscribe" link in any promotional email we send you.
• Updating your communication preferences in the Notifications section of your account settings.
• Contacting customer support with a request to opt out of all marketing communications.

Please allow up to 5 business days for your opt-out preference to take effect across all communication channels. Transactional notifications (such as deposit confirmations, withdrawal processing updates, and security alerts) are not subject to marketing opt-out controls and will continue to be sent while your account is active, as they are necessary for the operation of the service.

pej63 does not share your contact data with external third-party marketers. All promotional communications originate from pej63 directly.

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. The "Last updated" date at the top of this page indicates when the most recent revision was made.

Where changes are material — meaning they meaningfully affect how we process your data or alter your rights — we will notify you via a platform notification or email to your registered address at least 14 calendar days before the updated policy takes effect. Non-material changes (such as clarifications of existing practices or corrections of typographical errors) may take effect immediately upon publication.

Your continued use of the pej63 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with a material change, you may close your account before the change takes effect by contacting our support team.

For all privacy-related inquiries — including data subject access requests, rectification requests, erasure requests, objections to processing, and general questions about this policy — please contact the pej63 Data Protection team:

Complaint escalation: If you are not satisfied with our response to a privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction in which pej63 Entertainment Ltd. is incorporated, or to seek redress through applicable legal channels. We will always provide you with information about the appropriate escalation route upon request.

We take all privacy complaints seriously and are committed to resolving them promptly, fairly, and transparently. We will not penalize any user for exercising their data rights or making a good-faith complaint.