Privacy Policy

1 Introduction

pati29 ("we", "us", "our") is an online gaming and sports betting platform serving Indonesian players. We are committed to handling your personal data with the utmost care, transparency, and respect. This Privacy Policy ("Policy") sets out a clear and comprehensive account of our data practices, drafted in plain professional English so that every player can understand exactly how their information is treated.

This Policy should be read alongside our Terms & Conditions, which govern your use of the pati29 Platform. Where this Policy and the Terms & Conditions overlap on data-related provisions, this Policy takes precedence.

If you have any questions about how we handle your personal data, or if you wish to exercise any of your rights as described in Section 11, please contact our Data Protection team using the details provided in Section 15.

2 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifier, or factors specific to the physical, economic, cultural, or social identity of that person.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means pati29, which determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means any third party that Processes Personal Data on behalf of pati29, such as payment processors, KYC verification providers, and hosting infrastructure providers.
• "Player" / "You" means any individual who has registered an Account on the pati29 Platform or otherwise interacts with our services.
• "Platform" means the pati29 website accessible at https://pati29.cam and all associated services and features.
• "KYC" means Know Your Customer — the identity and age verification process required for all registered Players prior to their first withdrawal.
• "Cookies" means small text files placed on your device by the Platform to support functionality, analytics, and personalisation, as described in Section 8.

3 Data We Collect

pati29 collects Personal Data across three broad categories: information you provide directly, information collected automatically through your use of the Platform, and information obtained from verified third-party sources.

3.1 Data You Provide Directly

3.2 Data Collected Automatically

• Device Information: Device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Network Information: IP address, approximate geographic location (city/province level), internet service provider, and connection type.
• Usage Data: Pages visited, features used, games played, betting history, session duration, click-stream data, and search queries within the Platform.
• Transaction Logs: Deposit and withdrawal timestamps, amounts, payment method used, and transaction reference numbers.
• Cookie and Tracking Data: As described in detail in Section 8 of this Policy.

3.3 Data from Third Parties

• KYC Verification Providers: Results of identity verification checks, fraud-risk scores, and watchlist screening results from certified third-party KYC services.
• Payment Processors: Transaction confirmation data, payment status, and chargeback notifications from banking partners.
• Fraud Prevention Services: Device fingerprinting results and behavioural risk scores from anti-fraud technology providers.

4 How We Collect Your Data

pati29 collects Personal Data through the following channels:

• Account Registration Form: When you create a new Account on the Platform, you voluntarily provide your registration data as described in Section 3.1.
• KYC Submission Portal: When you submit your identity documents through the in-platform verification portal prior to your first withdrawal.
• Deposit and Withdrawal Flows: When you initiate financial transactions, your payment method details are collected and processed by our payment gateway partners.
• Platform Interaction: Automatically, as you browse and use the Platform, through cookies, server logs, and analytics tools.
• Customer Support Channels: When you contact our support team via live chat or email, the contents of those communications are recorded and stored.
• Responsible Gaming Tool Configuration: When you set deposit limits, self-exclusion periods, or other player-protection preferences, those settings and their timestamps are recorded.
• Third-Party Verification: When our KYC and fraud-prevention partners conduct background checks in connection with your Account, the results of those checks are shared with us.

5 How We Use Your Data

pati29 uses your Personal Data for the following purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was collected:

• Account Management: Creating, maintaining, and securing your Account; processing login authentication; and managing account preferences and settings.
• KYC & Compliance: Verifying your identity and age in accordance with our responsible gaming commitments and international anti-money-laundering obligations.
• Payment Processing: Executing deposit and withdrawal transactions via your nominated bank account or e-wallet, and maintaining accurate financial records.
• Service Delivery: Providing access to sports betting markets, casino games, togel (Indonesia's traditional numbers lottery) draws, and all other features available on the Platform.
• Customer Support: Responding to your inquiries, resolving disputes, and improving the quality of our support services based on interaction history.
• Responsible Gaming: Monitoring gameplay patterns to identify early indicators of problem gambling, enforcing self-exclusion and deposit limit requests, and providing timely interventions where appropriate.
• Fraud Prevention & Security: Detecting and investigating fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Platform Improvement: Analysing aggregated and anonymised usage data to understand player behaviour, improve Platform features, and optimise user experience.
• Marketing Communications: Sending you promotional offers, bonus notifications, and Platform updates where you have provided explicit consent to receive such communications. You may withdraw this consent at any time.
• Legal Obligations: Complying with applicable laws, regulatory requirements, court orders, and responding to lawful requests from competent authorities.

6 Legal Basis for Processing

pati29 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform our contract with you — specifically, the Terms & Conditions you agreed to upon registration. This includes account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC/AML obligations and responsible gaming mandates.
• Legitimate Interests: Processing carried out in pursuit of pati29's legitimate business interests — such as fraud detection, platform security, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily in the context of direct marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing

pati29 does not sell your Personal Data. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

7.1 Service Providers (Data Processors)

We engage carefully selected third-party Data Processors to support the delivery of our services. These include:

• KYC & Identity Verification Partners: Certified providers that perform document authentication and biometric verification on our behalf.
• Payment Gateway Providers: Intermediaries that facilitate secure transactions between your bank account or e-wallet (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) and the Platform.
• Fraud Prevention & Cybersecurity Providers: Technology vendors that supply device fingerprinting, behavioural analytics, and threat-detection capabilities.
• Cloud Infrastructure & Hosting Providers: Companies that provide the server infrastructure on which Platform data is stored and processed.
• Customer Support Technology: Live chat and ticketing platform providers that power our 24/7 Indonesian-speaking support operations.

All Data Processors are bound by contractual data processing agreements that require them to handle your Personal Data only on pati29's documented instructions, maintain appropriate security standards, and not use your data for their own purposes.

7.2 Legal and Regulatory Disclosures

pati29 may disclose your Personal Data to law enforcement agencies, regulatory authorities, courts, or other government bodies where required to do so by applicable law, court order, or legal process — including in response to lawful requests from Indonesian authorities or international financial intelligence units investigating money laundering or related offences.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of pati29's business, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and any resulting change to this Privacy Policy via email and a prominent Platform notice, with a minimum of 30 days' advance notice before the transfer takes effect.

8 Cookies & Tracking Technologies

pati29 uses cookies and similar tracking technologies to ensure Platform functionality, improve your experience, and gather analytical insights. The following categories of cookies are used:

You can manage your cookie preferences through your browser settings at any time. Please note that disabling essential cookies will affect Platform functionality. Disabling analytics or marketing cookies will not prevent you from using the Platform but may result in a less personalised experience.

9 Data Retention

pati29 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention schedules apply:

• Account Data: Retained for the duration of your active Account and for a period of 5 years following Account closure, to comply with AML record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years from the date of verification, as required by international AML standards. Physical copies are destroyed securely; digital copies are encrypted and access-controlled.
• Transaction Records: All deposit, withdrawal, and wagering records are retained for 7 years to support financial auditing, dispute resolution, and regulatory compliance.
• Support Communications: Live chat transcripts and email correspondence are retained for 2 years from the date of the interaction, after which they are securely deleted.
• Marketing Consent Records: Retained indefinitely as evidence of your consent history, but the associated marketing activity ceases immediately upon opt-out.
• Analytics Data: Aggregated, anonymised analytics data that cannot be linked back to an individual Player may be retained indefinitely for Platform improvement purposes.
• Self-Exclusion Records: Retained permanently to prevent re-registration by a self-excluded Player, even if the Platform is rebranded or transferred to a successor entity.

10 Data Security

pati29 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in Transit: All data transmitted between your device and pati29 servers is encrypted using TLS 1.3 / 256-bit SSL protocols.
• Encryption at Rest: Sensitive Personal Data, including KYC documents and financial records, is encrypted at rest using AES-256 encryption.
• Password Security: Passwords are never stored in plain text. We use industry-standard cryptographic hashing algorithms with salting to protect stored credentials.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their Accounts for an additional layer of login security.
• Access Controls: Access to Personal Data within pati29 is strictly limited on a need-to-know basis. Staff access is role-based and logged, with privileged access subject to enhanced monitoring.
• Regular Security Audits: We commission independent penetration tests and security audits on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: pati29 maintains a documented data breach response plan. In the event of a breach affecting your Personal Data, we will notify affected players within 72 hours of becoming aware of the incident.

11 Your Rights

As a Player on the pati29 Platform, you have the following rights over your Personal Data. To exercise any of these rights, contact our support team using the details in Section 15. We will respond to all valid requests within 30 days:

• Right of Access: You may request a copy of all Personal Data that pati29 holds about you, along with information about how and why it is being processed.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated promptly.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where processing is unlawful — subject to our legal retention obligations described in Section 9.
• Right to Restriction of Processing: You may request that we temporarily restrict processing of your Personal Data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another service provider where technically feasible.
• Right to Object: You may object to processing based on our legitimate interests, including profiling for fraud-prevention purposes, where you believe your individual rights and freedoms override our interests.
• Right to Withdraw Consent: Where processing is based on your consent (primarily marketing communications and non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Please note that certain rights may be limited where pati29 is required by law to retain or process your data — for example, KYC and transaction records subject to AML retention mandates. In such cases, we will explain the applicable limitation clearly when responding to your request.

12 Minors

The pati29 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that a registered Account belongs to a person under 21 years of age, the Account will be immediately suspended, all related Personal Data will be deleted in accordance with our data minimisation principles, and any deposits will be returned where lawfully permissible.

If you are a parent or guardian and believe that your child has registered an Account on pati29, please contact our support team immediately using the details in Section 15. We will investigate and take prompt remedial action.

13 International Data Transfers

As an internationally operated platform serving Indonesian players, some of your Personal Data may be transferred to, stored, and processed in countries outside of Indonesia — specifically in the jurisdictions where our infrastructure providers, KYC partners, and payment processors operate.

Wherever such transfers occur, pati29 ensures that adequate safeguards are in place to protect your Personal Data to a standard equivalent to, or higher than, that required under applicable Indonesian data protection principles. These safeguards include:

• Contractual data processing agreements incorporating internationally recognised standard data protection clauses.
• Transfer only to jurisdictions that maintain adequate data protection frameworks as assessed by recognised international standards.
• Technical security measures — including end-to-end encryption — applied to all cross-border data transmissions.

You may request further information about the specific safeguards applied to international transfers of your Personal Data by contacting our support team.

14 Policy Amendments

pati29 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. Where changes are material — for example, a new category of data being collected, a new purpose for which existing data is used, or a change to our data-sharing arrangements — we will provide at least 14 days' advance notice via email to your registered address and a prominent notice on the Platform homepage.

The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the amended terms, you must cease using the Platform and request Account closure before the effective date.

We encourage you to review this Policy periodically to stay informed about how pati29 is protecting your personal information.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or pati29's data protection practices, please reach out to our team through the following channels:

• Data Protection Inquiries Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via your Account dashboard — select "Privacy & Data" as your inquiry category for priority routing to our Data Protection team
• Response Time: We aim to acknowledge all data-related requests within 48 hours and to resolve them fully within 30 calendar days
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays (WIB, UTC+7)

For concerns specifically related to responsible gaming, self-exclusion, or deposit limits, please visit our dedicated Responsible Gaming page.