Privacy Policy — ajo89 Data Protection

ajo89 operates as an internationally licensed online gaming platform, primarily serving English-preference players based in Indonesia. We are committed to protecting the privacy and personal data of every individual who interacts with our services — whether as a registered player, a casual visitor browsing our site, or a user engaging with our support team.

This Privacy Policy is designed to give you a clear, transparent, and plain-English account of our data practices. We believe you have a right to know precisely what information we hold about you, the reasons we hold it, and the safeguards we have in place to protect it. Where data protection law affords you rights over your personal information, we outline those rights in full and explain exactly how to exercise them.

We process personal data on the basis of the legitimate interests of operating a lawful, commercially sound, and player-safe gaming platform, as well as in fulfillment of contractual obligations when you open an account with us. In all cases, our processing is proportionate, purposeful, and limited to what is genuinely necessary.

ajo89 collects personal data across several categories depending on the nature of your interaction with the platform. The following table outlines the categories of data we collect and specific examples within each category:

2.1 Sensitive Data

ajo89 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data (beyond facial photograph for KYC), or health data. If you voluntarily disclose such information through a support interaction, we will handle it with heightened care and will not use it for any purpose other than the specific support context in which it was shared.

ajo89 collects personal data through the following channels and mechanisms:

3.1 Direct Collection

You provide data directly to us when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account preferences. The accuracy of directly provided data is your responsibility, and providing false or misleading information constitutes a breach of our Terms & Conditions.

3.2 Automated Collection

When you visit ajo89.one or use any part of the platform, our servers automatically log technical data including your IP address, browser fingerprint, device identifiers, and interaction patterns. This data is collected using server logs, session tracking, and first-party analytics tools. We do not use third-party behavioral advertising trackers. See Section 7 for details on our cookie practices.

3.3 Third-Party Sources

In limited circumstances, ajo89 may receive data about you from trusted third-party sources, including:

• KYC Verification Providers: Identity document validation and liveness check results from licensed verification service providers.
• Payment Processors: Transaction status, settlement confirmations, and fraud flag indicators from BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja integrations.
• Fraud Prevention Services: Device reputation scores, IP risk signals, and account fraud indicators from specialized third-party risk engines.

Data received from third-party sources is used only for the specific purpose for which it was obtained and is never combined with your personal data to build marketing profiles.

ajo89 processes your personal data for the following clearly defined purposes. Each purpose is tied to a specific legal basis described in Section 5:

• Account Management: Creating, maintaining, verifying, and closing your registered account, and authenticating your identity on each login.
• Service Delivery: Processing deposits and withdrawals in IDR through local Indonesian payment channels, enabling gameplay across sportsbook, casino, slots, and togel (Indonesia's traditional numbers lottery) verticals, and providing customer support.
• Identity Verification (KYC): Confirming that account holders meet the 21+ age requirement and that all financial transactions originate from legitimate, self-owned payment accounts.
• Fraud Prevention and Security: Detecting and preventing unauthorized account access, duplicate account creation, money laundering activity, and exploitation of bonuses or platform features.
• Responsible Gaming: Monitoring play patterns to identify at-risk behavior, enforcing deposit limits and self-exclusion requests, and surfacing responsible gaming tools at appropriate touchpoints.
• Legal and Regulatory Compliance: Meeting record-keeping, reporting, and investigation obligations under applicable international gaming regulations and anti-money laundering standards.
• Platform Improvement: Analyzing aggregated, de-identified usage data to improve site performance, game offering, payment reliability, and customer support quality.
• Communications: Sending transactional notifications (deposit confirmations, withdrawal updates, security alerts) and, where you have opted in, promotional communications about relevant offers and bonuses.

ajo89 processes personal data on one or more of the following legal bases:

ajo89 does not sell your personal data. We share personal data with third parties only where strictly necessary for service delivery, legal compliance, or platform security. All third-party recipients are bound by contractual data protection obligations. The following categories of recipients may receive your personal data:

6.1 Payment Processors

Your financial transaction data is shared with the relevant Indonesian bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit or withdrawal instruction. Each provider operates under its own regulated data protection framework and is independently responsible for compliance with applicable Indonesian financial data protection standards.

6.2 KYC and Identity Verification Providers

To fulfill our identity verification obligations, your identity document images and facial photograph may be shared with a licensed KYC verification service provider. This provider processes your data solely for the purpose of document authenticity checking and liveness detection, and is prohibited by contract from using your data for any other purpose.

6.3 Game Content Providers

Third-party game studios — including Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Spribe, and Pocket Games Soft — may receive limited technical session data (such as a pseudonymous player token and session currency) in order to initialize and manage your game session. These studios do not receive your identity data, financial account data, or contact details.

6.4 Fraud Prevention and Security Services

Technical data including device fingerprints, IP addresses, and behavioral signals may be shared with specialized fraud prevention and cybersecurity service providers for the purpose of protecting the platform and its users from unauthorized access, account takeover, and financial crime.

6.5 Legal and Regulatory Authorities

ajo89 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or a binding order issued by a competent authority. We will notify you of such disclosures where legally permitted to do so.

ajo89 uses cookies and similar technologies to ensure the platform functions correctly, to maintain your session across page visits, and to collect anonymized analytics data that helps us improve the user experience.

7.1 Types of Cookies We Use

7.2 Third-Party Cookies

ajo89 does not embed third-party advertising cookies, social media tracking pixels, or behavioral profiling scripts on its platform. Game content iframes served by third-party studios may set their own strictly necessary session cookies within their sandboxed environment; these cookies are subject to the respective studio's own privacy policy.

7.3 Managing Cookies

You can manage or delete cookies at any time through your browser settings. Disabling strictly necessary cookies will impair or prevent your ability to log in and use the platform. Disabling functional cookies will result in the loss of saved preferences. Disabling analytics cookies has no impact on your ability to use the platform.

ajo89 retains personal data only for as long as it is necessary to fulfill the purpose for which it was collected, to comply with legal retention obligations, or to resolve any disputes that may arise. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active account and for a minimum of 5 years following account closure, in accordance with international AML record-keeping standards.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, regardless of account status.
• KYC Verification Documents: Retained for the duration of the account relationship and for a minimum of 5 years post-closure, subject to any extended retention required by applicable regulations.
• Customer Support Communications: Retained for 2 years from the date of the interaction, after which they are securely deleted unless associated with an open dispute or regulatory inquiry.
• Technical and Usage Data: Retained in identifiable form for a maximum of 12 months, after which data is either deleted or anonymized for aggregate analytics purposes.
• Marketing Consent Records: Retained for the duration of your opted-in status plus 2 years following opt-out, as evidence of consent history.

When personal data is no longer required, it is securely deleted from our systems using industry-standard data destruction methods. Backup copies are purged in accordance with our scheduled backup rotation policy.

ajo89 implements a comprehensive suite of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Transport Layer Security: All data exchanged between your browser and our servers is encrypted using TLS 1.2 or higher, with a valid 256-bit SSL certificate enforced across the entire ajo89.one domain.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All employees and contractors with data access are subject to background checks, confidentiality agreements, and mandatory data protection training.
• Two-Factor Authentication (2FA): ajo89 offers optional 2FA for all player accounts. Internal administrative systems operate with mandatory 2FA for all personnel.
• Intrusion Detection and Monitoring: Our infrastructure is monitored continuously for anomalous activity, unauthorized access attempts, and indicators of compromise. Automated alerts trigger immediate incident response protocols.
• Data Pseudonymization: Where technically feasible, personal identifiers are separated from behavioral and financial data within our internal analytics systems, reducing the risk of data exposure in the event of a breach.
• Regular Security Assessments: ajo89 conducts periodic vulnerability assessments and penetration testing exercises on its production infrastructure. Critical findings are remediated on a priority basis.

9.1 Data Breach Response

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, ajo89 will notify affected players promptly — and in any case no later than 72 hours after becoming aware of the breach — via the email address registered to your account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps ajo89 has taken or proposes to take to address it. If you suspect that your account has been compromised, please contact us immediately at [email protected].

As a user of the ajo89 platform, you have meaningful rights over your personal data. These rights are detailed below. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days.

The ajo89 platform is strictly intended for adults aged 21 years or older. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in our account registration and KYC process, and we use document-based verification to confirm that all registered players meet this minimum age requirement.

If ajo89 becomes aware that personal data has been collected from a person under the age of 21 — whether through a misrepresentation at registration or any other means — the following steps will be taken immediately:

• The account will be suspended and permanently closed.
• Any balance associated with the account, including deposits and winnings, will be held pending investigation and may be forfeited or returned to the depositing payment method, at ajo89's discretion.
• All personal data associated with the underage account will be securely deleted as promptly as legally permitted, consistent with our retention obligations.

If you are a parent or guardian and believe that a person under 21 has accessed or registered on the ajo89 platform, please contact us immediately at [email protected]. We take these reports extremely seriously and will act on them without delay.

ajo89 operates as an internationally licensed platform. As a result, your personal data may be transferred to and processed in countries outside Indonesia where our licensed infrastructure, KYC providers, payment processors, and game content partners are located. Such countries may have data protection frameworks that differ from those applicable in your home jurisdiction.

Where personal data is transferred internationally, ajo89 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual Safeguards: All third-party service providers who receive personal data outside Indonesia are bound by contractual data protection clauses that require them to maintain standards equivalent to those applied by ajo89 itself.
• Adequacy Assessments: Before engaging a new international data processor, ajo89 conducts a data transfer impact assessment to evaluate the legal environment in the recipient country and the adequacy of protections available.
• Encryption in Transit: All data transferred internationally is encrypted using TLS 1.2 or higher, ensuring that it cannot be intercepted or read during transmission.
• Minimal Data Transfers: Only the minimum data required for the specific processing purpose is shared with international recipients. We do not transmit full account profiles or unnecessary personal details to overseas processors.

By registering an account with ajo89 and accepting these policies, you acknowledge that your personal data may be processed internationally in accordance with the safeguards described above.

ajo89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. All amendments are effective upon publication on this page.

When material changes are made to this Privacy Policy — that is, changes that meaningfully affect how we collect, use, or share your personal data — ajo89 will notify registered players by email at least 14 days before the changes take effect. The notification will summarize the nature of the changes and direct you to the updated policy. Your continued use of the platform after the effective date of any amendment constitutes your acknowledgment of the revised policy.

Minor, non-material amendments (such as corrections of typographical errors, clarifications that do not change the substantive meaning of a clause, or updates to contact details) may be made without advance notice, though the "Last updated" date at the top of this page will always reflect the most recent revision date.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ajo89 processes your personal data, please contact our dedicated data protection team through the following channels:

• Email: [email protected] — use the subject line "Privacy Inquiry" for fastest routing to our data protection team.
• Live Chat: Available 24/7 within the platform after logging in via the ajo89 Login page. Indonesian-speaking agents are available at all times.
• Response Commitment: We aim to acknowledge all privacy-related inquiries within 24 hours (WIB business hours) and to provide a full substantive response within 14 calendar days. For complex data subject access requests, we may require up to 30 calendar days, in which case we will notify you of the extended timeline.

14.1 Complaints

If you are not satisfied with ajo89's response to a privacy inquiry or believe that we have processed your personal data unlawfully, you have the right to raise a complaint. ajo89 takes all privacy complaints seriously and will investigate them thoroughly and impartially. To submit a formal privacy complaint, please email [email protected] with the subject line "Privacy Complaint", providing a clear description of your concern and any relevant details. We commit to acknowledging all complaints within 24 hours and delivering a substantive response within 10 business days.