Privacy Policy — golwin

1 Introduction

golwin (hereinafter referred to as "we", "us", "our", or "the Platform") is committed to protecting the privacy and personal information of all users (hereinafter referred to as "you", "your", or "Members"). This Privacy Policy sets out the types of personal data we collect, how we collect it, the purposes for which we use it, the parties with whom we share it, and the measures we take to protect it. This policy should be read in conjunction with our Terms & Conditions, which govern your use of the golwin platform.

golwin operates as an online sports betting and casino gaming platform targeted at adult users aged 21 and above in Indonesia. As part of our operations, we collect and process personal data to provide account services, process payments, comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations, and deliver a secure and personalized user experience.

2 Data Controller

For the purposes of applicable data protection law, golwin is the data controller responsible for the personal information you provide and that we collect through your use of the platform. As data controller, golwin determines the purposes and means of processing your personal data. Our registered business address and contact details can be found in Section 14 of this policy.

3 Data We Collect

golwin collects personal data in the following categories:

3.1 Account Registration Data

When you register a golwin account, we collect the following information:

• Personal Identification: Full legal name (as it appears on your KTP, Passport, or other government-issued ID), date of birth, gender;
• Contact Information: Email address, mobile telephone number, residential address including city (e.g., Jakarta, Surabaya, Medan, Bandung, Bali);
• Account Credentials: Username, password (stored in encrypted hashed format), security questions and answers;
• Currency Preference: Indonesian Rupiah (IDR / Rp) as the account currency.

3.2 Know Your Customer (KYC) Verification Data

To comply with international AML and KYC regulations, we collect and verify identity documents including:

• Scanned or photographed copies of government-issued photo identification (KTP for Indonesian residents, Passport, SIM);
• Proof of address documents (utility bills, bank statements, or official correspondence showing your residential address);
• Selfie photographs holding your identification document (liveness verification);
• Source of funds declarations and income verification documents where required by our compliance procedures.

3.3 Payment and Financial Data

When you deposit or withdraw funds, we collect:

• Bank account details including bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata), account number, and account holder name;
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja;
• Transaction history including deposit amounts, withdrawal amounts, timestamps, and payment method used;
• Payment processor confirmation records and transaction reference numbers.

Note: golwin does not store full credit card numbers or CVV codes. Card transactions (if available) are processed through PCI-DSS compliant third-party payment gateways.

3.4 Behavioral and Usage Data

To improve our services, detect fraud, and personalize your experience, we automatically collect:

• Device information (device type, operating system, browser version, screen resolution);
• IP address, geographic location data (country, region, city derived from IP);
• Session data including login/logout times, pages visited, features used;
• Betting and gaming activity including wagers placed, games played, bet amounts, outcomes, bonus usage;
• Support interactions including live chat transcripts, email correspondence, and support tickets.

3.5 Marketing and Communication Data

If you opt in to receive promotional communications from golwin, we collect your communication preferences including email subscription status, SMS notification preferences, and promotional code usage history.

4 Purpose of Collection

golwin processes your personal data for the following purposes:

• Account Management: To create, maintain, and administer your golwin account, authenticate your identity, and provide customer support;
• Transaction Processing: To process deposits, withdrawals, and bet settlements; to manage your account balance and bonus funds;
• Regulatory Compliance: To comply with KYC and AML obligations, verify your age (21+ requirement), prevent fraud, and respond to legal requests from authorities;
• Platform Security: To monitor for suspicious activity, detect and prevent fraud, protect against unauthorized access, and enforce our Terms & Conditions;
• Service Improvement: To analyze usage patterns, identify technical issues, optimize platform performance, and develop new features;
• Personalization: To tailor game recommendations, bonus offers, and content to your preferences and playing history;
• Marketing Communications: With your consent, to send promotional emails, SMS notifications, and push notifications about bonuses, tournaments, and new game releases;
• Responsible Gaming: To monitor your betting patterns and intervene if we detect signs of problem gambling, to enforce deposit limits and self-exclusion requests.

5 Legal Basis for Processing

Under applicable data protection law, golwin processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to fulfill our contract with you (the Terms & Conditions) and to provide the services you requested (account operation, payment processing, customer support);
• Legal Obligation: Processing is necessary to comply with legal obligations including KYC/AML laws, age verification requirements, tax reporting, and responses to lawful requests from authorities;
• Legitimate Interests: Processing is necessary for our legitimate business interests including fraud prevention, security monitoring, platform improvement, and business analytics, provided these interests do not override your fundamental rights;
• Consent: Where required, we obtain your explicit consent before processing data for marketing communications, non-essential cookies, and certain personalization features. You may withdraw consent at any time via your account settings.

6 Data Sharing & Third-Party Disclosure

golwin shares your personal data with the following categories of third parties under strict confidentiality agreements:

6.1 Payment Processors

We share necessary financial data (account numbers, transaction amounts) with licensed payment service providers to process your deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja). These processors operate under their own privacy policies and are bound by payment industry security standards.

6.2 Game Providers and Software Suppliers

We share limited data (user ID, bet amounts, game outcomes) with licensed game providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft to deliver live casino, slots, and other gaming content. These providers use the data solely to operate games and ensure fairness; they do not have access to your identification documents or financial account details.

6.3 Identity Verification Services

We use third-party KYC verification services to authenticate your identity documents. These services receive copies of your ID documents and perform verification checks against government databases and fraud watchlists. Verification data is retained according to AML record-keeping requirements.

6.4 Customer Support Tools

Live chat and email support interactions may be processed through third-party customer service platforms. Support agents have access to your account history and transaction records solely to resolve your inquiries.

6.5 Legal and Regulatory Authorities

golwin may disclose your personal data to regulatory bodies, licensing authorities, law enforcement agencies, or courts when required by law, court order, or legal process; or when necessary to protect our rights, prevent fraud, or ensure platform security.

6.6 Business Transfers

In the event golwin undergoes a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and any changes to this Privacy Policy.

7 Data Security Measures

golwin implements comprehensive technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, alteration, or destruction:

• Encryption: All data transmissions between your device and golwin servers are protected by 256-bit SSL (Secure Socket Layer) encryption. Passwords are stored using bcrypt or similar cryptographic hashing algorithms and are never stored in plain text;
• Access Controls: Personal data is accessible only to authorized golwin personnel who require it to perform their job functions. Access is granted on a need-to-know basis and is logged for audit purposes;
• Firewall and Intrusion Detection: Our servers are protected by enterprise-grade firewalls and intrusion detection systems that monitor for suspicious access patterns;
• Regular Security Audits: golwin undergoes periodic security assessments and penetration testing by independent cybersecurity firms to identify and remediate vulnerabilities;
• Data Backup and Redundancy: Personal data is backed up regularly to secure, geographically distributed servers to ensure continuity in the event of hardware failure or disaster;
• Employee Training: All golwin staff members with access to personal data receive mandatory training on data protection principles, confidentiality obligations, and security best practices.

While we take every reasonable precaution to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorized access to your account.

8 Data Retention Period

golwin retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law:

• Active Accounts: Data associated with active accounts is retained indefinitely while the account remains open and in use;
• Closed Accounts: Upon voluntary account closure, most personal data is anonymized or deleted within 90 days. However, certain data must be retained for longer periods to comply with legal and regulatory obligations;
• KYC and Financial Records: Identity verification documents, transaction records, and financial data are retained for a minimum of 5 years following account closure or the last transaction, as required by AML and tax regulations;
• Fraud Prevention Records: Data related to suspected fraudulent activity, account violations, or security incidents may be retained indefinitely to protect golwin and other Members;
• Marketing Data: If you unsubscribe from marketing communications, your email address is retained on a suppression list to ensure you do not receive further promotional messages.

You may request early deletion of your personal data by contacting our support team; however, we may be unable to comply if retention is required by law or for legitimate business purposes such as dispute resolution or fraud prevention.

9 Cookies & Tracking Technologies

golwin uses cookies, web beacons, and similar tracking technologies to deliver essential platform functionality, enhance user experience, and analyze usage patterns. Cookies are small text files stored on your device that allow us to recognize your browser and remember certain information.

9.1 Types of Cookies We Use

• Essential Cookies: Required for core platform functionality including login authentication, session management, security features, and payment processing. These cookies cannot be disabled without impairing your ability to use golwin;
• Functional Cookies: Enable enhanced features such as language preference, currency display, and personalized game recommendations. You can disable these in your browser settings, though some features may not work correctly;
• Analytics Cookies: Collect aggregated data on how users interact with golwin, including pages visited, time spent, and navigation patterns. This data helps us optimize the platform. We may use Google Analytics or similar services for this purpose;
• Marketing Cookies: Track your visits across websites to deliver targeted advertising. These cookies are only set with your explicit consent and can be disabled via your browser or account settings.

9.2 Managing Cookie Preferences

You can control cookie settings through your browser preferences. Most browsers allow you to block or delete cookies, or to receive a warning before a cookie is stored. Please note that disabling essential cookies will prevent you from logging in and using golwin. Instructions for managing cookies in common browsers can be found at:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Privacy, search, and services → Cookies and site permissions

10 Your Data Protection Rights

Under applicable data protection law, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of all personal data golwin holds about you. We will provide this in a structured, commonly used, and machine-readable format (typically CSV or PDF) within 14 days of your request;
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request correction. You can update most account information directly via your account settings;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data, subject to legal and regulatory retention requirements. We will honor your request unless we are obligated to retain the data by law;
• Right to Restriction of Processing: You may request that we temporarily suspend processing of your personal data in certain circumstances, such as while we verify the accuracy of the data or assess your objection to processing;
• Right to Data Portability: You have the right to receive your personal data in a portable format and to transmit it to another service provider where technically feasible;
• Right to Object: You may object to processing of your personal data for direct marketing purposes at any time. You can unsubscribe from marketing emails via the link at the bottom of any promotional message;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time via your account settings. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal;
• Right to Lodge a Complaint: If you believe golwin has violated your data protection rights, you have the right to lodge a complaint with the data protection authority in your jurisdiction.

To exercise any of these rights, please contact our Data Protection Officer using the contact details provided in Section 14 of this policy.

11 Children's Privacy

golwin is strictly an adults-only platform. We do not knowingly collect, use, or store personal data from individuals under the age of 21. If you are under 21 years of age, you are prohibited from creating a golwin account or using any of our services. If we become aware that a user is under the legal age requirement, we will immediately suspend the account, forfeit all funds, and delete all associated personal data. Parents and guardians are encouraged to monitor their children's internet usage and to install parental control software to prevent access to age-restricted content.

12 International Data Transfers

golwin primarily operates within Indonesia; however, some of our service providers (payment processors, game providers, cloud hosting services) may process data in jurisdictions outside Indonesia. When we transfer personal data to third countries, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by relevant data protection authorities;
• Adequacy decisions confirming that the destination country provides an adequate level of data protection;
• Binding Corporate Rules for intra-group transfers;
• Explicit consent from you for specific transfers where required by law.

By using golwin, you acknowledge and consent to the international transfer of your personal data as described in this policy.

13 Updates to This Privacy Policy

golwin reserves the right to update, amend, or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Any material changes will be prominently displayed on this page with an updated "Last Updated" date at the top of the document. We may also notify you of significant changes via email or through an in-platform notification. Your continued use of golwin following the posting of changes constitutes your acceptance of those changes. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

14 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way golwin handles your personal data, please contact our Data Protection Officer or Customer Support team:

• Email: [email protected] (plain text only, non-clickable)
• Live Chat: Available 24/7 via your golwin account dashboard (Indonesian and English support agents available 07:00–23:00 WIB; international English agents cover overnight hours)
• Data Protection Officer: For specific data protection inquiries, privacy rights requests, or complaints, you may request to speak directly with our Data Protection Officer via the support channels above.

golwin aims to respond to all privacy-related inquiries within 14 business days. Urgent data security matters (e.g., suspected unauthorized access to your account) are prioritized and typically receive a response within 2 hours.