Privacy Policy

The following definitions apply throughout this Privacy Policy:

2.1 Identity. poa4d operates the Platform at https://poa4d.vip and acts as the Data Controller for all Personal Data collected from Members and visitors. poa4d's primary contact for data-related enquiries is its dedicated data protection team, reachable at the contact details set out in Section 15 of this Policy.

2.2 Indonesia Market Context. poa4d's principal user base comprises players residing in Indonesia, including cities such as Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and Makassar. Accordingly, poa4d gives particular weight to the privacy expectations and data rights of Indonesian users when designing its data processing practices, even though poa4d operates under an international gaming licence rather than an Indonesian regulatory framework.

2.3 International Licensing. poa4d holds a licence issued by a recognised international gaming authority. As a condition of that licence, poa4d is required to maintain data handling standards that meet or exceed internationally accepted privacy benchmarks, including data minimisation, purpose limitation, storage limitation, and security by design.

poa4d collects Personal Data across several categories. The scope of data collected depends on the nature of the Member's interaction with the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on a government-issued identity document.
• Date of birth (for age verification — all Members must be 21 or older).
• Indonesian National Identity Card number (NIK / KTP number) or passport number where an Indonesian KTP is not available.
• Email address and mobile phone number registered to the account.
• Residential address in Indonesia.

3.2 Financial Data

• Bank account details (account holder name, bank name — BCA, BRI, BNI, Mandiri, CIMB Niaga — and account number) used for deposit and withdrawal transactions denominated in Indonesian Rupiah (IDR).
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, or LinkAja phone number or account reference) where used as a payment method.
• Transaction history including deposit amounts, withdrawal amounts, dates, and reference numbers.
• Bonus and promotional credit history.

3.3 Account & Gaming Activity Data

• Username and encrypted password hash.
• Betting history across all product verticals: sportsbook, live casino, slot games, Mahjong, Virtual Sports, and togel (Indonesia's traditional numbers lottery).
• Session start and end times, game durations, and wager values.
• Responsible gaming tool settings (deposit limits, session time limits, self-exclusion status).
• Customer support interaction logs, including live chat transcripts and email correspondence.

3.4 Technical & Device Data

• IP address and approximate geographic location derived from IP.
• Device type, operating system, and browser type and version.
• Device fingerprint identifiers used for fraud prevention and duplicate account detection.
• Cookie identifiers and session tokens (see Section 10 for full cookie details).
• Referring URL and on-site navigation path data collected via analytics tools.

3.5 KYC Verification Documents

• Scanned or photographed copies of government-issued photo ID (KTP or passport).
• Proof-of-address documents such as utility bills or bank statements (dated within 90 days of submission).
• Payment method evidence such as screenshots of mobile banking or e-wallet interfaces showing the Member's name and account reference.
• Facial verification images or video where biometric liveness checks are required as part of enhanced KYC procedures.

4.1 Direct Collection. The majority of Personal Data held by poa4d is provided directly by Members during the registration process, the KYC verification process, the deposit and withdrawal flow, customer support interactions, and the completion of responsible gaming tools. Members are informed at each collection point of the specific data being gathered and its purpose.

4.2 Automated Collection. Technical and device data (Section 3.4) is collected automatically when a Member or visitor accesses the Platform. This includes data gathered through cookies, server logs, and analytics software. Members may manage certain automated collection mechanisms through their browser or device settings — see Section 10 for details.

4.3 Third-Party Sources. poa4d may receive or verify Personal Data from third-party sources in limited circumstances, including:

• Identity verification bureaux and KYC service providers engaged to authenticate identity documents.
• Fraud prevention networks that flag IP addresses, device identifiers, or payment method references associated with known fraudulent activity.
• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) who confirm transaction status and account ownership.
• Our international licensing authority, where regulatory data exchanges are mandated under licence conditions.

Where data is received from third-party sources, poa4d verifies that such sources have a lawful basis for sharing the data with us and that the sharing is limited to what is necessary for the stated purpose.

poa4d processes Personal Data for the following clearly defined purposes:

poa4d will not use Personal Data for any purpose that is incompatible with those listed above without first obtaining explicit consent from the affected Members.

poa4d relies on the following legal bases for the processing of Personal Data:

6.1 Contractual Necessity. The majority of Personal Data processing by poa4d is necessary for the performance of the contract between poa4d and the Member — specifically, the Terms & Conditions governing the Member's use of the Platform. Without processing identity, financial, and account data, poa4d cannot deliver the services the Member has contracted to receive.

6.2 Legal Obligation. Certain processing activities — particularly those related to KYC verification, AML monitoring, and regulatory reporting — are required by law or by the conditions of poa4d's international gaming licence. poa4d has no discretion to decline such processing.

6.3 Legitimate Interests. poa4d processes technical and device data for fraud prevention, platform security, and operational analytics on the basis of its legitimate interests as a responsible gaming operator. poa4d has assessed that these legitimate interests are not overridden by the interests or fundamental rights of Members, given the limited scope and clear security benefit of such processing.

6.4 Consent. Where poa4d processes Personal Data for marketing communications or for non-essential cookies and tracking technologies, it does so only on the basis of the Member's freely given and informed consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal, and without prejudice to the Member's ability to continue using the Platform for non-marketing purposes.

7.1 Principle of Limited Disclosure. poa4d does not sell, rent, or trade Member Personal Data to any third party for their own commercial purposes. Disclosure of Personal Data to third parties is strictly limited to the categories and circumstances described in this section.

7.2 Payment Partners

To process deposits and withdrawals in Indonesian Rupiah, poa4d shares the minimum necessary financial and identity data with its payment processing partners, including local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). Each payment partner is bound by contractual data protection obligations and processes Member data solely for the purpose of completing the requested transaction.

7.3 Game Studio Providers

Where gameplay data must be transmitted to third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) to deliver a game session, poa4d shares only the session token and anonymised player identifier required to run the game. Game studios do not receive Members' full identity or financial data.

7.4 Identity Verification Providers

poa4d engages specialist KYC and identity verification service providers to authenticate identity documents and, where applicable, to conduct biometric liveness checks. These providers process identity and document data strictly on poa4d's instructions and under data processing agreements that prohibit any independent use of the data.

7.5 Fraud Prevention Networks

poa4d participates in industry fraud prevention networks where device fingerprint data, IP addresses, and payment method references may be checked against shared databases of known fraudulent actors. Data contributed to such networks is anonymised or pseudonymised to the greatest extent practicable.

7.6 Regulatory & Legal Authorities

poa4d will disclose Personal Data to its licensing authority, law enforcement agencies, or other competent regulatory bodies where required to do so by law, court order, or as a condition of its gaming licence. poa4d will, where legally permissible, notify the affected Member of any such disclosure.

7.7 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of poa4d's business or assets, Member Personal Data may be transferred to the acquiring entity as part of that transaction. Members will be notified of any such transfer and of any material change to this Privacy Policy that results from it, with a reasonable period of notice before the change takes effect.

8.1 Active Accounts. For the duration of an active Member relationship, poa4d retains all categories of Personal Data described in Section 3. Data is reviewed periodically to ensure that information no longer necessary for the stated purposes is deleted or anonymised.

8.2 Following Account Closure. Upon voluntary account closure or account termination by poa4d, the following retention periods apply:

8.3 Self-Exclusion Records. Where a Member has activated a self-exclusion through poa4d's responsible gaming tools, the self-exclusion record is retained for the full duration of the exclusion period plus an additional 5 years. This is necessary to prevent re-registration in breach of the exclusion.

8.4 Anonymisation. Where retention of identifiable data beyond the periods above is required for statistical or research purposes, poa4d will anonymise that data such that no individual can be identified from it before continuing to retain it.

9.1 Technical Measures. poa4d employs a layered set of technical security controls to protect Member Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• Transport Layer Security (TLS 1.2 or higher) for all data transmitted between Members' devices and poa4d's servers.
• AES-256 encryption at rest for sensitive data fields including identity documents, financial records, and password hashes.
• Role-based access control (RBAC) limiting employee access to Personal Data strictly to those roles that require it for a legitimate operational purpose.
• Automated intrusion detection and real-time anomaly monitoring on all production infrastructure.
• Regular third-party penetration testing and vulnerability assessments of the Platform and supporting systems.
• Secure, geographically redundant data storage with automated backup and disaster recovery protocols.

9.2 Organisational Measures. In addition to technical controls, poa4d maintains the following organisational safeguards:

• Mandatory data protection training for all employees with access to Member Personal Data.
• A documented data breach response plan with defined escalation procedures and regulatory notification timelines.
• Data processing agreements with all third-party processors, requiring equivalent security standards.
• Periodic internal audits of data handling practices against the commitments in this Privacy Policy.

9.3 Member Responsibility. While poa4d takes all reasonable steps to secure the data it controls, Members share responsibility for maintaining the security of their own account credentials. Members should use a unique, strong password for their poa4d account, enable two-factor authentication where available, and promptly report any suspected unauthorised account access to our support team.

9.4 Data Breach Notification. In the event of a data breach that is likely to result in a high risk to the rights and freedoms of affected Members, poa4d will notify those Members without undue delay, providing a clear description of the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures poa4d has taken or proposes to take to address the breach.

10.1 What Are Cookies? Cookies are small text files placed on a Member's device by the poa4d Platform when they visit or log in. They allow the Platform to recognise the device, maintain session state, and collect technical usage data. poa4d also uses related technologies including pixel tags, local storage objects, and session fingerprinting for security purposes.

10.2 Categories of Cookies Used by poa4d

10.3 Managing Cookies. Members may manage or disable non-essential cookies through their browser settings. Please note that disabling strictly necessary or fraud prevention cookies may impair the functionality of the Platform or prevent access to certain features. Detailed instructions for managing cookies in the most widely used browsers (Chrome, Firefox, Safari, Edge) are available on the respective browser's official support pages.

10.4 Third-Party Analytics. Where poa4d uses third-party analytics tools, those tools are configured in a privacy-preserving mode — IP addresses are anonymised before any data is transmitted to the analytics provider, and no cross-site tracking of individual Members is performed.

poa4d recognises and respects the following rights of Members in relation to their Personal Data. To exercise any of these rights, please contact poa4d's data protection team using the contact details in Section 15. poa4d will respond to all verified rights requests within 30 calendar days of receipt.

11.1 Right of Access

You have the right to request a copy of the Personal Data that poa4d holds about you, together with information about the purposes for which it is processed, the categories of data held, the recipients to whom it has been disclosed, and the retention period applicable to each category.

11.2 Right to Rectification

You have the right to request that inaccurate or incomplete Personal Data held by poa4d be corrected without undue delay. Please note that certain data corrections may require re-submission of KYC documentation to verify the updated information.

11.3 Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis for processing exists, or where you object to processing and there are no overriding legitimate grounds. poa4d may decline erasure requests where retention is required by law (see Section 8) or where processing is necessary for the establishment, exercise, or defence of legal claims.

11.4 Right to Restriction of Processing

You may request that poa4d restrict the processing of your Personal Data — meaning that the data is stored but not actively used — while a dispute about its accuracy is resolved, while an objection to processing is assessed, or where processing is unlawful but you prefer restriction to erasure.

11.5 Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive a structured, commonly used, machine-readable copy of your Personal Data. Upon verified request, poa4d will provide your account and transaction data in a portable format (e.g., JSON or CSV) within 30 days.

11.6 Right to Object

You have the right to object at any time to the processing of your Personal Data for direct marketing purposes. Upon receipt of such an objection, poa4d will cease marketing-related processing immediately. You may also object to processing based on legitimate interests, in which case poa4d will assess whether its legitimate interests are overridden by your specific circumstances.

11.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal. To withdraw marketing consent, you may use the unsubscribe link in any marketing communication or contact our support team directly.

12.1 Strict 21+ Policy. The poa4d Platform is strictly intended for adults who are 21 years of age or older. poa4d does not knowingly collect Personal Data from individuals under the age of 21. If poa4d discovers that a Member has provided false age information to register an account, that account will be closed immediately, all balances will be forfeited, and any associated data will be deleted in accordance with applicable legal requirements.

12.2 Parental Controls. poa4d strongly encourages parents and guardians to make use of reputable internet filtering and parental control software to prevent minors from accessing gambling websites. If you believe that a person under 21 has registered an account on poa4d using false identity information, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.

12.3 Age Verification. poa4d applies age verification checks at registration and may require additional documentary evidence of age at any subsequent point in a Member's account lifetime. Providing false or altered identity documents to circumvent the age verification process is a breach of poa4d's Terms & Conditions and may constitute a criminal offence under applicable laws.

13.1 Cross-Border Processing. As an internationally licensed gaming operator, poa4d's data processing infrastructure and certain third-party service providers may be located in jurisdictions outside Indonesia. Where Personal Data is transferred to a country that does not provide an equivalent level of data protection as Indonesia's applicable laws, poa4d ensures that appropriate safeguards are in place before the transfer occurs.

13.2 Transfer Safeguards. Safeguards employed by poa4d for international data transfers include:

• Standard contractual clauses (SCCs) or equivalent contractual data protection terms incorporated into agreements with all international processors and sub-processors.
• Binding corporate rules where data is transferred within poa4d's corporate group.
• Transfer impact assessments to evaluate the risk profile of transfers to specific jurisdictions and to apply supplementary technical or contractual protections where necessary.

13.3 Gaming Studio Data. Game session data transmitted to third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) for the purpose of delivering game rounds may be processed in the jurisdiction where those studios' servers are located. In each case, poa4d's data processing agreement with the relevant studio requires that session data be used solely for the purpose of game delivery and is not retained by the studio beyond the minimum period necessary for game reconciliation and dispute resolution.

14.1 Right to Amend. poa4d reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the features and services available on the Platform. The revised policy will be published on this page with an updated "Effective Date" at the top.

14.2 Notification of Material Changes. Where a proposed change is material — meaning it significantly affects the way poa4d processes Personal Data or the rights available to Members — poa4d will provide advance notice of at least 14 calendar days before the revised policy takes effect. Notification will be delivered via email to the address registered to each active Member account and via a prominent notice on the Platform's homepage and login screen.

14.3 Continued Use as Acceptance. If a Member continues to use the Platform after the revised Privacy Policy takes effect, that continued use constitutes acceptance of the updated terms. If a Member does not agree with a material change, they should close their account before the revised policy's effective date. Account closure requests may be directed to our support team using the contact details in Section 15.

14.4 Version Archive. poa4d maintains an internal archive of all prior versions of this Privacy Policy. Members who wish to review a previous version may submit a request to our data protection team, and we will provide the requested historical version within 14 business days.

15.1 How to Contact Us. For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by poa4d, please contact our dedicated data protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week at WIB (Western Indonesia Time, UTC+7) via the Platform's built-in live chat interface.

15.2 Response Timeframes. poa4d aims to acknowledge all privacy-related enquiries within 2 business days of receipt. Substantive responses to rights requests (Section 11) will be provided within 30 calendar days. Where a request is particularly complex or poa4d has received a high volume of requests, we may extend this period by a further 30 days, in which case we will inform you of the extension and the reasons for it within the initial 30-day window.

15.3 Complaints. If you are not satisfied with poa4d's response to a privacy enquiry or rights request, you have the right to escalate your complaint to the relevant supervisory authority or to poa4d's international licensing body. poa4d will cooperate fully with any regulatory investigation arising from a Member complaint.