Privacy Policy

Definitions

The following terms have the meanings set out below throughout this Privacy Policy:

Data Controller

kw303 operates as an internationally licensed offshore gaming platform serving players in Indonesia. The kw303 operating entity acts as the data controller with respect to all personal data collected from members who access the platform at kw303.cam.

kw303 is committed to processing personal data in accordance with applicable international data protection principles, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

Data We Collect

kw303 collects personal data across the following categories. Not all categories apply to every member — the data collected depends on the services accessed and the level of account activity.

Identity and Verification Data: Full legal name, date of birth, Indonesian national identity number (NIK), passport number, KTP scan or photograph, and selfie verification images. This data is collected to verify your age and identity as required by our KYC obligations and to confirm you meet our 21+ eligibility requirement.

Contact and Location Data: Email address, mobile phone number, and residential address in Indonesia. We use this data to communicate with you about your account, process transactions, and deliver support. Your city or region of residence (e.g., Jakarta, Surabaya, Bali, Yogyakarta) may be recorded for responsible gaming analysis and fraud prevention purposes.

Financial and Payment Data: Bank account details for the payment methods you use, including account numbers associated with BCA, BRI, BNI, Mandiri, and CIMB Niaga bank transfers, and e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja. Full payment credentials are never stored on kw303 servers — they are tokenized and processed by our PCI-DSS compliant payment partners.

Gaming and Transaction Data: All bet placements, game sessions, wager amounts in IDR, win and loss records, bonus usage, and platform activity logs. This data is essential for delivering the core betting and gaming services, resolving disputes, and operating our responsible gaming monitoring systems.

Technical and Device Data: IP address, device fingerprint, browser type and version, operating system, screen resolution, and connection timestamps. This data is collected automatically and used for security purposes, fraud detection, and platform performance optimization.

How We Collect Data

kw303 collects personal data through the following channels:

• Direct provision by you: When you complete the registration form, submit KYC documentation, make a deposit or withdrawal request, contact customer support, or participate in a promotion, you provide data to us directly.
• Automated collection: Our platform automatically collects technical and usage data whenever you access kw303.cam via a browser or mobile device. This includes session logs, click-path data, and device identifiers collected through cookies and similar tracking technologies (see Section 10).
• Third-party sources: Where you use a third-party payment provider (such as an OVO or DANA e-wallet), that provider may share limited transaction confirmation data with kw303 to verify payment status. kw303 does not receive your full payment credentials from these providers — only confirmation tokens and transaction reference numbers.
• Identity verification partners: kw303 may engage third-party KYC verification vendors to cross-check identity documents. These vendors provide a verification result to kw303 but retain your document data only as permitted by their own privacy policies and our data processing agreements with them.
• AML and fraud screening: kw303 may receive risk signals or alerts from internationally recognized AML screening databases. These are used solely to assess financial crime risk and are not used for any other purpose.

How We Use Your Data

kw303 processes personal data for the following purposes, each grounded in a lawful basis:

• Account creation and management — to register your account, verify your identity, maintain your account profile, and provide access to the platform. Basis: contractual necessity.
• Transaction processing — to process deposits and withdrawals via your chosen Indonesian bank or e-wallet, and to maintain an accurate transaction record for your account. Basis: contractual necessity.
• KYC and regulatory compliance — to verify that you meet the 21+ age requirement, confirm your identity, and satisfy our AML and counter-terrorism financing (CTF) screening obligations. Basis: legal obligation.
• Fraud prevention and security — to detect and prevent unauthorized account access, multi-accounting, payment fraud, match-fixing, and other prohibited conduct described in our Terms & Conditions. Basis: legitimate interest.
• Responsible gaming monitoring — to identify behavioural patterns that may indicate problem gambling and to apply any deposit limits, cool-off periods, or self-exclusion requests you have submitted. Basis: legal obligation; legitimate interest.
• Customer support — to respond to your queries, complaints, and dispute resolution requests via our support channels. Basis: contractual necessity.
• Platform improvement — to analyze usage patterns, identify technical issues, and improve the performance and user experience of the kw303 platform. Basis: legitimate interest.
• Marketing communications — to send you promotional offers, bonus notifications, and seasonal promotions (e.g., Idul Fitri, Ramadhan, BRI Liga 1 match-day offers) where you have opted in to receive such communications. Basis: consent. You may opt out at any time.

Data Sharing

kw303 does not sell, rent, or trade personal data. We share personal data only in the following limited circumstances:

• Payment processors: Financial data is shared with our licensed payment processing partners — including banking partners supporting BCA, BRI, BNI, Mandiri, and CIMB Niaga transfers, and e-wallet partners for OVO, DANA, GoPay, ShopeePay, and LinkAja — solely to execute deposit and withdrawal transactions on your behalf.
• KYC and identity verification vendors: Identity and document data is shared with our contracted KYC verification partners to complete the age and identity verification process. These partners are bound by strict data processing agreements and may not use your data for any independent purpose.
• AML and fraud screening services: Financial transaction data and identity data may be passed to licensed AML screening databases to fulfill our legal anti-money-laundering obligations.
• IT infrastructure and cloud providers: Our hosting, database, and security infrastructure providers may technically have access to data as part of their service delivery. All such providers are contractually obligated to treat data as confidential and to process it only on kw303's instructions.
• Legal and regulatory authorities: kw303 will disclose personal data to law enforcement agencies, gaming regulators, or courts when legally compelled to do so by a valid order, warrant, or regulatory direction. Where permitted by law, we will notify affected members of such disclosures.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all assets, personal data may be transferred to a successor entity. Members will be notified of any such transfer and the successor's privacy commitments before the transfer takes effect.

International Data Transfers

kw303 operates as an internationally licensed offshore platform. Personal data collected from members in Indonesia may be transferred to and stored on servers located outside of Indonesia as part of our global infrastructure. Where such transfers occur, kw303 ensures that appropriate safeguards are in place to protect the data to a standard at least equivalent to that required under applicable data protection laws.

Safeguards employed for international transfers include contractual data protection clauses in all agreements with non-Indonesian service providers, and selection of service providers that operate under internationally recognized security certifications (ISO 27001, SOC 2 Type II, or equivalent).

Data Retention

kw303 retains personal data only for as long as it is necessary for the purpose for which it was collected, or to comply with legal obligations. The following retention periods apply:

• Identity and KYC documents: Retained for a minimum of five years from the date of account closure, in compliance with AML and CTF regulatory requirements.
• Transaction and financial records: Retained for a minimum of five years from the date of the transaction, as required by financial record-keeping obligations.
• Gaming activity logs: Retained for three years from the date of the activity, for dispute resolution, responsible gaming analysis, and fraud prevention purposes.
• Support communications: Retained for three years from the date of the last communication in a support thread, for quality assurance and complaint record purposes.
• Marketing preferences: Retained until you withdraw consent or close your account, whichever occurs earlier.
• Technical and device logs: Retained for 12 months on a rolling basis, for security and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents reconstruction of the original data. Anonymized, aggregated data may be retained indefinitely for statistical and platform analysis purposes, as it can no longer identify any individual.

Security Measures

kw303 applies a layered, defense-in-depth approach to data security. The following technical and organizational measures are in place to protect member data:

• Encryption in transit: All data transmitted between your device and kw303 servers is encrypted using TLS 1.2 or higher (256-bit SSL). The kw303 website enforces HTTPS exclusively — unencrypted HTTP connections are not accepted.
• Encryption at rest: Personal data and financial records stored on kw303 servers are encrypted using AES-256 encryption. Encryption keys are managed separately from the data they protect.
• Access controls: Access to member data is restricted to kw303 personnel who require it to perform their job functions. Role-based access control (RBAC) is applied, and all access is logged for audit purposes.
• Two-factor authentication: kw303 offers two-factor authentication (2FA) for member accounts and enforces it for all staff with access to production systems.
• Intrusion detection: kw303 operates 24/7 network monitoring and intrusion detection systems to identify and respond to unauthorized access attempts in real time.
• Penetration testing: The kw303 platform undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Data breach response: kw303 maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to member rights, affected members will be notified without undue delay.

Cookies & Tracking Technologies

kw303 uses cookies and similar technologies (local storage, session tokens, and browser fingerprinting) to operate the platform, maintain session security, and improve the member experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without preventing you from using the platform.
• Functional cookies: Remember your preferences such as language display settings, preferred payment method, and layout options. Disabling these will not prevent platform access but will reset your preferences on each visit.
• Analytical cookies: Used to collect aggregated, anonymized data about how members use the platform — pages visited, session duration, navigation paths — to improve platform design and performance. kw303 uses internal analytics tools rather than third-party tracking services for this purpose.
• Security cookies: Used to detect suspicious activity such as unusual login patterns, rapid IP changes, or device anomalies that may indicate account compromise or fraudulent access.

kw303 does not use third-party advertising cookies or behavioral targeting cookies. Your browsing data on kw303 is not shared with advertising networks.

Most browsers allow you to manage cookie preferences through the browser settings menu. Deleting or blocking strictly necessary cookies will affect your ability to log in and use the platform. Instructions for managing cookies are available in your browser's help documentation.

Minors

kw303 does not knowingly collect personal data from individuals under the age of 21. The platform is intended exclusively for adults aged 21 and over. If we become aware that personal data has been collected from a person under 21, we will delete that data immediately and close the associated account.

Parents and guardians are encouraged to monitor their children's internet usage and to use parental control software to prevent access to online gambling platforms. If you believe a minor has registered on kw303, please contact our support team immediately at [email protected] (plain text — not a clickable link) so that we can act promptly.

Exercising Your Rights

To exercise any of the data rights described in the overview section above — including access, rectification, erasure, portability, objection, restriction, or withdrawal of consent — please submit your request to our privacy team using the contact details in Section 14.

To protect your privacy and prevent unauthorized requests, kw303 will verify your identity before processing any data rights request. Verification typically requires you to confirm your registered email address, provide a matching piece of KYC identification, and answer account security questions.

kw303 will acknowledge receipt of your request within 3 business days and will respond substantively within 30 calendar days. In cases of particular complexity, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it before the initial 30-day period expires.

There is no charge for submitting a data rights request. However, kw303 reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive in scope — for example, multiple identical requests submitted within a short period.

Policy Amendments

kw303 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, we will notify active members via email at least 7 days before the updated policy takes effect, and a prominent notice will be displayed on the platform.

Non-material changes — such as clarifications of existing language, corrections of typographical errors, or updates to contact information — may be made without advance notice. The "Last updated" date at the top of this page reflects the date of the most recent revision, whether material or non-material.

Your continued use of the kw303 platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you must cease using the platform and may request account closure in accordance with the Terms & Conditions.

Contact

For all privacy-related inquiries, data rights requests, or concerns about how kw303 handles your personal data, please contact our privacy team using the details below. All communications are handled by trained staff, with native Indonesian-speaking agents available on every shift.

Email: [email protected] (plain text — not a clickable link)

Response time: Data rights requests are acknowledged within 3 business days and resolved within 30 calendar days.

Support hours: 00:00–24:00 WIB (UTC+7), every day of the year.

For formal complaints that cannot be resolved through our standard privacy support channel, please submit a written complaint addressed to the Privacy & Compliance Team at the email address above. We aim to acknowledge formal complaints within 24 hours and resolve them within 10 business days. If a complaint remains unresolved after this period, you retain the right to escalate to the applicable data protection supervisory authority in your jurisdiction.