Privacy Policy — 99nobu

99nobu ("we", "us", "the Company") is the data controller responsible for personal information collected through the 99nobu Platform at 99nobu.net. As data controller, we determine the purposes and means by which your personal data is processed and we are accountable for ensuring that processing is carried out in accordance with applicable data protection principles.

This Privacy Policy applies to all Members and visitors of the 99nobu Platform, including individuals accessing the site from Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and all other parts of Indonesia. It covers all personal data collected via the website, mobile-optimised site, customer support channels, and any other touchpoint through which you interact with 99nobu.

We collect several categories of personal data, depending on the nature of your interaction with the 99nobu Platform. The table below summarises each category and the specific data points it encompasses.

We do not collect sensitive special-category data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data for identification purposes, or health data) except where strictly required by law or explicitly provided by you in a specific context.

99nobu collects your personal data through the following means:

• Direct interactions. When you register an account, complete the KYC process, make a deposit or withdrawal, contact customer support, participate in a promotion, or respond to a survey, you provide data directly to us.
• Automated technologies. As you browse and use the 99nobu Platform, we automatically collect Technical Data and Usage Data via cookies, server logs, pixel tags, and similar tracking technologies. See Section 9 for details.
• Third-party payment processors. When you transact via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, or LinkAja, our payment service providers share transaction confirmation data with us to credit your account balance.
• Identity verification providers. We work with licensed KYC and AML (anti-money-laundering) service providers who process document scans and perform watchlist screening on our behalf. These providers share the outcome of their checks (pass/fail/risk rating) with 99nobu.
• Analytics partners. Aggregated, anonymised behavioural data may be received from analytics platforms we use to understand site performance and improve the player experience. This data cannot be used to identify you individually.

We process your personal data only when we have a valid legal basis for doing so. The table below maps each processing purpose to its corresponding legal basis.

Where we rely on legitimate interests as the legal basis, we have carried out a balancing test and concluded that our interests do not override your fundamental rights and freedoms, given the nature of the data involved and the safeguards we apply.

• Payment service providers. Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum personal data required to process your transaction and confirm its completion.
• KYC and AML service providers. Licensed identity verification and watchlist-screening vendors receive document images and basic identity data to perform verification checks on 99nobu's behalf. These vendors act as data processors and are bound by strict data processing agreements.
• Game and content providers. Platform studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a pseudonymous player identifier and session token to deliver game content and calculate RTP. They do not receive your name, bank details, or contact information.
• IT infrastructure and hosting providers. Cloud hosting and CDN providers that power the 99nobu Platform process Technical Data as part of service delivery. All such providers are contractually required to implement appropriate security measures.
• Analytics providers. Aggregated and anonymised Usage Data may be shared with analytics platforms to help us understand site performance. No individually identifiable data is shared for analytics purposes.
• Legal and regulatory authorities. We may disclose personal data to government bodies, law enforcement agencies, courts, or regulators when required by law, court order, or in connection with an investigation into suspected fraud, money laundering, or other illegal activity.
• Business transfers. In the event of a merger, acquisition, or sale of all or part of 99nobu's business, Member data may be transferred to the acquiring entity. You will be notified via email and/or in-platform notification before your data becomes subject to a different privacy policy.

99nobu's primary Member base is located in Indonesia, and wherever possible we use service providers with data centre infrastructure in or near the Asia-Pacific region to minimise latency and data transfer distance. However, some of our third-party service providers — particularly game studios and KYC verification platforms — are headquartered in or operate data centres in jurisdictions outside Indonesia, including the European Union, Isle of Man, Malta, and Singapore.

When your personal data is transferred outside Indonesia, we ensure that an adequate level of protection is applied, using one or more of the following mechanisms:

• Standard contractual clauses (SCCs) approved by the relevant supervisory authority, incorporated into agreements with all data processors located outside Indonesia.
• Transfers to jurisdictions that have been formally recognised as providing an adequate level of data protection equivalent to Indonesian standards.
• Where transfers occur to our group entities, binding intragroup data transfer agreements are in place.

You may request a copy of the safeguards we have put in place for international data transfers by contacting us at the details provided in Section 13.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations. The following default retention periods apply:

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data must be retained for a longer period due to a specific legal hold (for example, ongoing litigation or a regulatory investigation), we will notify you to the extent permitted by law.

99nobu employs industry-standard and, in many areas, industry-leading technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our key security controls include:

• TLS 1.3 / 256-bit SSL encryption on all connections between your browser or device and the 99nobu Platform. Data in transit is never transmitted in plain text.
• AES-256 encryption at rest for all personally identifiable data stored in our databases, including KYC documents and financial records.
• Role-based access controls (RBAC) ensuring that only authorised 99nobu personnel whose roles require access to specific data categories can view or process that data. Access is granted on a least-privilege basis.
• Two-factor authentication (2FA) required for all administrative access to production systems, and available as an optional but strongly recommended security feature for Member accounts.
• Regular penetration testing conducted by independent third-party security firms on a scheduled basis to identify and remediate vulnerabilities before they can be exploited.
• Intrusion detection and prevention systems (IDS/IPS) monitoring the platform 24/7 for anomalous activity patterns that may indicate a breach or attack.
• Data breach response plan — in the event of a confirmed breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours and affected Members without undue delay, in accordance with applicable data breach notification obligations.

99nobu uses cookies and similar tracking technologies (pixel tags, web beacons, local storage objects) to operate the Platform efficiently and to improve your experience. By continuing to use the 99nobu Platform, you consent to the use of cookies as described in this section.

You can manage or withdraw cookie consent at any time by adjusting your browser settings to block or delete cookies. Please note that disabling strictly necessary cookies will impair the functionality of the 99nobu Platform, and you may not be able to log in or complete transactions.

Depending on your jurisdiction and the legal basis on which we process your data, you may have the following rights regarding your personal information held by 99nobu. To exercise any of these rights, please contact us using the details in Section 13.

• Right of Access. You may request a copy of all personal data we hold about you, together with information about how it is processed. We will provide this within 30 days of a verified request.
• Right to Rectification. If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. You can update most account details directly via your Account Settings page without needing to contact us.
• Right to Erasure ("Right to be Forgotten"). You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where the data has been processed unlawfully. This right is subject to legal retention obligations — for example, we are required by law to retain KYC and transaction records for a minimum of five years.
• Right to Restrict Processing. In certain circumstances, you may request that we pause processing of your data — for example, while a dispute about the accuracy of the data is being resolved.
• Right to Data Portability. Where processing is based on consent or a contract and is carried out by automated means, you may request that we provide your personal data in a structured, machine-readable format, or transmit it directly to another controller where technically feasible.
• Right to Object. Where processing is based on legitimate interests, you have the right to object. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You have an unconditional right to object to direct marketing at any time.
• Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

We will respond to all verified rights requests within 30 calendar days. In complex or high-volume cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day window.

As part of our registration and KYC process, all Members are required to confirm that they are 21 years of age or older and to provide documentary evidence of their date of birth. If we become aware that a Member account has been opened by, or on behalf of, a person under the age of 21, we will immediately suspend the account, void any associated balances or winnings, and permanently delete all personal data associated with that account.

Parents and guardians who believe that a minor in their care may have registered on the 99nobu Platform are encouraged to contact us immediately at [email protected]. We will investigate and act on verified reports without delay. We also strongly recommend using parental control software to restrict access to online gambling platforms on devices used by minors.

99nobu reserves the right to update or amend this Privacy Policy at any time. When we make material changes — for example, introducing a new category of data processing, engaging a new class of third-party recipients, or modifying how long we retain certain data — we will notify registered Members by email to the address on file and via a prominent in-platform notification at least 14 days before the changes take effect.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how 99nobu protects your information. Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any change, you should cease using the Platform and close your account in accordance with the Terms & Conditions.

Minor, non-material changes — such as correcting typographical errors, clarifying existing language without changing the substance of a clause, or updating contact details — may be made without advance notice, though the "Last Updated" date will always reflect the most recent edit.

For any questions about this Privacy Policy, to exercise your data rights, to report a potential data breach, or to request information about the safeguards we apply to international data transfers, please reach out through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line and provide your registered username and a clear description of your request. We aim to respond within 4 business hours and will resolve verified rights requests within 30 calendar days.
• Live Chat: Available 24/7 directly on the 99nobu Platform. Our Indonesian-speaking support agents can assist you in initiating a formal data request or escalating a privacy concern.
• WhatsApp: +62 811 9900 0099 — available during WIB business hours for urgent account and privacy queries.

All data rights requests will be handled by our designated Data Protection contact, who will verify your identity before actioning any access, rectification, erasure, or portability request. We will never charge a fee for handling a rights request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act, explaining our reasons in writing.