Privacy Policy koi33 — Your Data, Protected

Definitions

The following definitions apply throughout this Privacy Policy. Where terms are also defined in our Terms & Conditions, the same meanings apply here.

• "Personal Data" means any information that identifies or could reasonably identify a living individual, including but not limited to name, date of birth, email address, phone number, residential address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction — whether or not by automated means.
• "Data Controller" means koi33, the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means any third-party service provider that Processes Personal Data on behalf of koi33 under a written data processing agreement.
• "Member" or "You" means any individual who has registered an Account on the koi33 Platform.
• "Platform" means the koi33 website at koi33.bet, any associated mobile applications, and all sub-domains operated by koi33.
• "Cookies" means small text files placed on your device by the Platform when you visit, used to remember your session, preferences, and certain usage metrics.
• "KYC" (Know Your Customer) means the identity verification process conducted by koi33 to confirm a Member's identity, age, and eligibility in accordance with responsible gaming and anti-money laundering obligations.
• "Sensitive Data" means a special category of Personal Data that warrants additional protection, including (where applicable) financial data, identity document numbers, and health or self-exclusion information shared voluntarily by a Member for responsible gaming purposes.

Scope & Application

This Privacy Policy applies to all Personal Data collected and Processed by koi33 in connection with the operation of the Platform. It applies to all Members regardless of how they access the Platform — via desktop browser, mobile browser, or any application distributed by koi33.

This Policy covers data collected through the following touchpoints:

• Account registration and login processes.
• KYC identity verification submissions.
• Deposit, withdrawal, and payment transactions.
• Sports betting, live casino, slot game sessions, togel (Indonesia's traditional numbers lottery) market participation, and Sakong card game play.
• Customer support interactions via live chat, email, or WhatsApp.
• Promotional campaign participation and bonus claims.
• Automated data collected through Cookies and server logs during Platform use.

This Policy does not apply to third-party websites or services that may be referenced on the Platform. koi33 is not responsible for the privacy practices of any external entity. Members who access third-party services do so at their own risk and should review the privacy policies of those services independently.

By registering an Account on koi33, you confirm that you are at least 21 years of age, that you are based in Indonesia or accessing the Platform from a jurisdiction where your use is lawful, and that you have read and understood this Privacy Policy in full.

Data We Collect

koi33 collects Personal Data only to the extent necessary to operate the Platform, verify Member identity, process transactions, and fulfil our responsible gaming obligations. The categories of data we collect are described below.

How We Use Your Data

koi33 uses your Personal Data for the following specific purposes. We will not use your data for any purpose that is incompatible with those listed below without first notifying you and, where required, obtaining your consent.

• Account management: To create, maintain, authenticate, and, where necessary, close your Member account. This includes processing your registration details, verifying your identity, and enabling secure login.
• Transaction processing: To facilitate deposits and withdrawals via your chosen payment method — whether a local Indonesian bank transfer (BCA, BRI, BNI, Mandiri), an e-wallet (OVO, DANA, GoPay), or a cryptocurrency (USDT, BTC). This includes communicating transaction confirmations and resolving payment queries.
• KYC compliance: To verify that you are at least 21 years of age and that the identity you have provided matches your payment method, in accordance with responsible gaming and anti-money laundering best practices.
• Platform operation and improvement: To deliver, maintain, and continuously improve all Platform features, including sports betting markets (BRI Liga 1, EPL, Champions League), live casino games, slot titles from Pragmatic Play, Evolution Gaming, and other providers, togel markets, and Sakong tables.
• Customer support: To respond to your queries, investigate complaints, and resolve disputes — whether submitted via live chat, email to [email protected], or WhatsApp.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: To monitor betting patterns that may indicate problem gambling, to administer deposit limits, loss limits, cool-off periods, and self-exclusion requests, and to proactively reach out to Members who may benefit from responsible gaming support.
• Marketing communications (with consent): To send you information about promotions, seasonal bonuses (Ramadhan specials, Idul Fitri cashback offers, 17 August Independence Day tournaments), and new product launches — but only where you have provided explicit consent. You may opt out at any time.
• Legal compliance: To comply with any legal obligation to which koi33 is subject, including requests from law enforcement or regulatory bodies in the jurisdiction in which koi33 is licensed.

Legal Basis for Processing

koi33 relies on one or more of the following legal bases when Processing your Personal Data:

• Contractual necessity: Processing is necessary to perform our contract with you — specifically, to operate your Account, process your transactions, and deliver Platform services. Without this Processing, we cannot provide the services you have requested.
• Legitimate interests: Processing is necessary for koi33's legitimate business interests, where those interests are not overridden by your rights and freedoms. This includes fraud detection, platform security, service analytics, and responsible gaming monitoring.
• Legal obligation: Processing is necessary to comply with a legal obligation to which koi33 is subject, including KYC verification, anti-money laundering record-keeping, and responding to lawful requests from authorities.
• Consent: Processing is based on your freely given, specific, informed, and unambiguous consent — primarily for optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of Processing that occurred before withdrawal.

Cookies & Tracking Technologies

koi33 uses Cookies and similar tracking technologies to operate the Platform effectively, remember your preferences, and analyse how Members navigate the site. The following categories of Cookies are in use:

• Strictly necessary Cookies: Essential for the Platform to function. These include session authentication Cookies that keep you logged in during an active session and security Cookies that protect against cross-site request forgery. These Cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Used to remember your preferences — such as your preferred language, the last game category you browsed, and your notification settings. Disabling these Cookies will reduce personalisation but will not prevent Platform access.
• Analytical Cookies: Used to collect anonymised data about how Members use the Platform — which pages are visited most frequently, where Members encounter errors, and how long sessions last. This data is used solely to improve the Platform and is never sold to advertisers.
• Security and fraud-detection Cookies: Used in conjunction with our fraud prevention systems to identify anomalous behaviour patterns that may indicate automated bot activity, account takeover attempts, or multi-account abuse.

koi33 does not use third-party advertising Cookies or behavioural targeting Cookies. We do not participate in cross-site retargeting advertising networks.

Data Sharing

koi33 shares your Personal Data only in the limited circumstances described below. We do not sell your Personal Data to any third party.

• Payment processors and banking partners: We share financial data (name, account number, transaction amount) with your chosen payment provider — including local Indonesian banks such as BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, and BSI; e-wallet platforms OVO, DANA, GoPay, ShopeePay, and LinkAja; and cryptocurrency network operators — to the extent necessary to process your deposit or withdrawal. These providers operate under their own privacy policies and are independently responsible for their data practices.
• KYC verification providers: We may share identity documents and verification data with accredited third-party KYC service providers who process submissions on our behalf under strict data processing agreements. These providers are not permitted to use your data for any purpose other than KYC verification for koi33.
• Game software providers: When you play a live casino game powered by Evolution Gaming, a slot title by Pragmatic Play or Pocket Games Soft, or any other third-party studio, limited Technical Data (your session token, bet amounts, and game results) is shared with the relevant provider to run the game. These providers are contractually prohibited from using this data for purposes beyond game operation.
• Legal and regulatory disclosure: We may disclose your Personal Data to law enforcement agencies, courts, regulators, or other government authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of koi33, our Members, or the public.
• Business succession: In the event of a merger, acquisition, or sale of substantially all of koi33's assets, your Personal Data may be transferred to the acquiring entity. We will notify Members of any such transfer via a Platform notice and, where legally required, seek your consent prior to completion.

International Data Transfers

koi33 is an internationally operated Platform. Your Personal Data may be transferred to, stored on, and Processed on servers located outside of Indonesia. Where such transfers occur, koi33 takes appropriate measures to ensure that your data receives an equivalent level of protection to that afforded within Indonesia.

These measures include:

• Entering into data transfer agreements with all Data Processors who handle data outside Indonesia, incorporating standard contractual clauses or equivalent safeguards that require the recipient to protect the data to an equivalent standard.
• Selecting cloud infrastructure and data centre providers that are certified to internationally recognised security standards, including ISO/IEC 27001.
• Ensuring that all data in transit between jurisdictions is encrypted using 256-bit TLS encryption.

If you have questions about the specific countries to which your data may be transferred, please contact us at [email protected].

Data Retention

koi33 retains Personal Data for as long as is necessary to fulfil the purpose for which it was collected, and no longer. The following retention schedule applies:

After the applicable retention period expires, Personal Data is securely deleted from active systems and anonymised in any backup systems. Anonymised, aggregated data that cannot be used to identify any individual may be retained indefinitely for statistical and analytics purposes.

Your Rights

As a Member of koi33, you hold the following rights in relation to your Personal Data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [your username]". We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days.

• Right of access: You have the right to request a copy of all Personal Data that koi33 holds about you, together with information about how it is being used. We will provide this in a structured, commonly used, machine-readable format.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may correct most basic Account details (email address, contact number) directly via your Account settings page.
• Right to erasure ("right to be forgotten"): You may request that koi33 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where Processing is unlawful. Note that erasure requests may be declined where retention is required by law — for example, anti-money laundering regulations require us to retain transaction records for at least five years post-account closure.
• Right to restriction of Processing: You may request that koi33 restrict the Processing of your Personal Data in certain circumstances — for example, where you contest the accuracy of the data while we verify it, or where you have objected to Processing and verification of legitimate grounds is pending.
• Right to data portability: Where Processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another data controller.
• Right to object: You have the right to object to Processing of your Personal Data where that Processing is based on koi33's legitimate interests. koi33 will cease Processing unless we can demonstrate compelling legitimate grounds that override your interests, or where Processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where Processing is based on your consent (primarily for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of Processing that occurred before withdrawal. To opt out of marketing, use the unsubscribe link in any marketing email or contact our support team.

Children & Minors

koi33 operates a strict minimum age policy. The Platform is intended solely for adults aged 21 years and over. We do not knowingly collect, store, or Process Personal Data relating to persons under the age of 21.

All Account registrations require a declaration that the Member is at least 21 years of age. Where koi33 has reason to believe that an Account is being used by a person under 21 — whether identified through KYC documentation, a report by a third party, or our own monitoring — that Account will be immediately suspended, all balances forfeited, and the Account permanently closed in accordance with our Terms & Conditions.

If you believe that a person under 21 has registered an Account or has access to your Account, please contact our support team immediately via live chat or at [email protected] so that we can take appropriate action without delay. For additional guidance on protecting minors from gambling-related harm, please visit our Responsible Gaming page.

Security Measures

koi33 implements a comprehensive, layered security framework to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our key security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and koi33 servers is encrypted using TLS 1.3 with 256-bit AES encryption — the same standard used by major international banks.
• At-rest encryption: Personal Data stored in koi33's databases is encrypted at rest using AES-256. Encryption keys are managed through a dedicated key management system with strict access controls.
• Access control: Access to Personal Data within koi33 is restricted on a strict need-to-know basis. Employees and contractors are granted the minimum level of data access required to perform their role. Access is reviewed quarterly and revoked immediately upon termination of employment or contract.
• Two-factor authentication (2FA): All internal staff accounts with access to Member data require mandatory 2FA. Members are strongly encouraged to enable 2FA on their own Accounts — contact our support team via live chat for setup assistance.
• Regular security audits: koi33 conducts periodic internal security reviews and engages independent third-party security specialists to perform penetration testing and vulnerability assessments of the Platform.
• Incident response: In the event of a confirmed data breach that poses a risk to Member privacy, koi33 will notify affected Members via their registered email address as promptly as possible, and no later than 72 hours after koi33 becomes aware of the breach, in line with internationally recognised incident response standards.

Despite these measures, no online platform can guarantee absolute security. We encourage all Members to use a strong, unique password for their koi33 Account, to enable 2FA, and to log out after each session — particularly when using a shared or public device.

Third-Party Links

The koi33 Platform may contain references to third-party game providers, payment networks, and sporting organisations. This Privacy Policy applies solely to data Processed by koi33. It does not extend to any third-party website, service, or application — even if accessed via a link on the Platform.

koi33 is not responsible for the privacy practices or content of any third-party service. When you interact with a third-party service — such as your bank's online portal when completing a transfer, your e-wallet application (OVO, DANA, GoPay), or a game studio's proprietary interface — you do so under that third party's own privacy policy and terms of service. We recommend reviewing those policies before sharing any Personal Data with a third party.

Policy Updates

koi33 reserves the right to update or revise this Privacy Policy at any time. When we make changes, we will update the "Last Updated" date displayed at the top of this page. The most current version of this Policy will always be accessible at koi33.bet/privacy-policy.

Where changes are material — meaning they significantly affect how we collect, use, or share your Personal Data — we will provide at least 14 days' advance notice to Members via the registered email address on their Account and via a prominent notice displayed on the Platform upon login.

For minor, non-material changes (such as clarifications of existing language, corrections of typographical errors, or updates to contact details), we may update the Policy without individual advance notice. Your continued use of the Platform following any update to this Policy constitutes your acknowledgement of the revised terms. If you do not accept a revised version of this Policy, you must cease using the Platform and request Account closure by contacting our support team.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way koi33 handles your Personal Data, please contact our data privacy team through one of the following channels:

For urgent matters relating to suspected unauthorised access to your Account, contact us immediately via live chat so that our security team can act without delay. For responsible gaming assistance — including self-exclusion requests — please visit our Responsible Gaming page or contact us directly.