kyu4d Privacy Policy

kyu4d ("we", "us", "our") operates the online gaming and sports betting platform accessible at https://kyu4d.cam (the "Platform"). We are committed to safeguarding the privacy and personal data of every individual who accesses, registers on, or interacts with our Platform.

This Privacy Policy sets out, in clear and transparent terms, what personal data we collect about you, the lawful basis on which we process it, how long we retain it, with whom we share it, and the rights available to you in relation to that data. It also explains our use of cookies and similar tracking technologies.

This policy applies to all Users of the Platform, including registered account holders, visitors who browse without registering, and individuals who contact our customer support team. It should be read alongside our Terms & Conditions, which govern your use of the Platform as a whole.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — i.e., any data that can be used directly or indirectly to identify you as an individual.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means kyu4d, which determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of kyu4d under a formal data processing agreement.
• "User" means any individual who accesses or uses the Platform, whether or not they hold a registered Account.
• "KYC Data" means identity verification documents and related personal information collected as part of the Know Your Customer compliance process.
• "Cookie" means a small text file placed on your device by the Platform for the purposes of session management, analytics, or preference storage.
• "Sensitive Data" means a category of Personal Data that warrants heightened protection, including financial account details, identity document numbers, and any data relating to health or well-being (such as responsible gaming self-exclusion records).

kyu4d collects Personal Data across several categories depending on how you interact with the Platform. The table below summarizes what we collect and why:

kyu4d collects your Personal Data through the following channels:

• Direct Interactions: When you register an Account, complete your player profile, submit KYC documents, request a deposit or withdrawal, contact customer support via live chat, email, or WhatsApp, or respond to any survey or promotional communication from us.
• Automated Technical Collection: When you visit the Platform, our servers automatically record Technical Data including your IP address, device fingerprint, browser configuration, and session metadata. This occurs regardless of whether you are logged in to an Account.
• Cookies and Tracking Technologies: Through cookies, web beacons, pixel tags, and similar technologies placed on your device as described in Clause 8 of this policy.
• Third-Party Sources: From identity verification and fraud-prevention service providers as part of the KYC process; from payment processors and Indonesian banking partners when processing transactions; and from responsible gaming registries where you have previously registered a self-exclusion.
• Publicly Available Sources: In limited circumstances, from publicly available directories or social media profiles where this is necessary to verify your identity or investigate a fraud or security concern.

We do not collect Personal Data from third-party data brokers for marketing profiling purposes, and we do not purchase marketing lists containing Personal Data about Indonesian consumers.

kyu4d processes your Personal Data only where a valid lawful basis exists. The primary purposes for which we process your data, and the corresponding lawful basis, are set out below:

• Account Creation and Management: Processing your Identity Data and Contact Data to open, maintain, and administer your Account is necessary for the performance of our contract with you.
• Identity Verification (KYC): Processing KYC Data is necessary for compliance with our legal obligations under applicable anti-money laundering and counter-terrorism financing regulations, as well as our responsible gaming obligations with respect to the 21+ age restriction.
• Payment Processing: Processing your Financial Data and Transaction Data to execute deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and other supported channels is necessary for the performance of our contract with you.
• Fraud Prevention and Security: Processing Technical Data and Behavioral Data to detect and prevent fraudulent activity, unauthorized Account access, money laundering, and Platform abuse is in our legitimate interests and is necessary for legal compliance.
• Responsible Gaming: Processing Responsible Gaming Data — including self-exclusion records, deposit limit settings, and behavioral pattern monitoring — is necessary to fulfill our legal and ethical obligations and is in the vital interests of the User.
• Customer Support: Processing Communications Data to respond to your queries, complaints, and support requests is necessary for the performance of our contract and is in our legitimate interests to maintain a high standard of service.
• Platform Improvement and Analytics: Processing Behavioral Data and Technical Data in aggregated or pseudonymized form to understand how Users interact with the Platform and to improve its features and performance is in our legitimate interests, provided these interests are not overridden by your privacy rights.
• Marketing Communications: Sending promotional emails, bonus notifications, and personalized offers where you have given specific consent to receive such communications, or where we rely on a soft-opt-in basis for existing Account holders. You may withdraw consent at any time as described in Clause 12.
• Legal Claims and Regulatory Compliance: Retaining and disclosing data as required to establish, exercise, or defend legal claims, or to comply with applicable regulatory requirements.

kyu4d does not sell your Personal Data. We share your data only in the following limited and controlled circumstances:

• Payment Processors and Banking Partners: We share Financial Data with our Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals. These entities act as independent data controllers for the payment leg of the transaction and are governed by their own privacy policies.
• Identity Verification Providers: We share KYC Data with specialized identity verification and document authentication service providers who act as our Data Processors under formal data processing agreements. They may not use your data for any purpose other than providing their verification services to us.
• Game Content Providers: Game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive limited Transaction Data such as your session token and wager amounts to deliver game functionality. These studios do not receive your full identity or financial data.
• Fraud and AML Compliance Services: We may share Technical Data and Transaction Data with fraud detection and anti-money laundering compliance technology providers who assist us in identifying suspicious activity.
• Responsible Gaming Registries: Where you register a self-exclusion, your name and contact details may be shared with relevant inter-operator self-exclusion schemes to prevent you from opening accounts with our affiliated platforms during your exclusion period.
• Legal and Regulatory Authorities: We may disclose Personal Data to law enforcement agencies, tax authorities, or financial regulators where required by law, court order, or binding regulatory direction. We will, where legally permitted, notify you of such disclosure.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of kyu4d or its assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer.

All third-party Data Processors are contractually required to process your data only on our documented instructions, to maintain appropriate security measures, and to delete or return your data upon termination of the processing relationship.

kyu4d operates on a global platform infrastructure. This means that your Personal Data may be transferred to, stored in, and processed in countries outside Indonesia where our servers, technology partners, or service providers are located. Some of these countries may have data protection laws that differ from those in your home jurisdiction.

Where we transfer your Personal Data internationally, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that provided under this Privacy Policy. Such safeguards include:

• Contractual data transfer agreements incorporating internationally recognized standard contractual clauses.
• Transfers to recipients in jurisdictions recognized as providing an adequate level of data protection by relevant international standards.
• Binding corporate rules where transfers occur within our corporate group.

kyu4d uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain your session, and gather aggregate usage analytics. The types of cookies we use are as follows:

kyu4d does not use third-party advertising or retargeting cookies. We do not permit external ad networks to place tracking cookies on the Platform. You may adjust your browser settings to refuse or delete cookies at any time; however, disabling Strictly Necessary cookies will prevent you from logging in to your Account.

Web beacons and pixel tags may be used in our marketing emails to confirm whether an email was opened and whether links within the email were clicked. This helps us assess the effectiveness of our communications. You may opt out of marketing emails entirely as described in Clause 12, which also removes any associated tracking.

kyu4d retains your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Our standard retention schedule is as follows:

• Account and Identity Data: Retained for the duration of your Account's active status plus a minimum of five (5) years following permanent Account closure, to comply with anti-money laundering record-keeping requirements.
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of each transaction, in line with financial record-keeping regulations.
• KYC Documents: Retained for a minimum of five (5) years following Account closure or the date the document was submitted, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the most recent interaction, unless a longer period is required for pending dispute resolution.
• Responsible Gaming Data: Self-exclusion records are retained for the full duration of the exclusion period plus two (2) years thereafter, to prevent circumvention through re-registration.
• Technical and Behavioral Data (Logs): Retained for twelve (12) months for security and fraud analysis purposes, after which they are deleted or irreversibly anonymized.
• Marketing Consent Records: Retained for three (3) years from the date consent was last confirmed or withdrawn, to demonstrate compliance with our marketing obligations.

Following the expiry of the applicable retention period, Personal Data is securely deleted using industry-standard data erasure methods, or irreversibly anonymized so that it can no longer be associated with you as an identifiable individual.

kyu4d implements a layered security architecture to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our technical and organizational security measures include:

• Transport Encryption: All data in transit between your browser or app and our servers is protected by TLS 1.2 or higher encryption. Our SSL certificate is maintained with HSTS (HTTP Strict Transport Security) headers enforced.
• Data-at-Rest Encryption: Sensitive data fields — including KYC document files, bank account numbers, and e-wallet identifiers — are encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Control: Internal access to Personal Data is granted on a strict need-to-know basis using role-based access control (RBAC). All employee access to production data is logged and audited quarterly.
• Multi-Factor Authentication: Administrative access to our internal systems requires multi-factor authentication. We also offer two-factor authentication (2FA) to Users for their Accounts.
• Vulnerability Management: We conduct regular automated vulnerability scans and periodic penetration tests conducted by independent security professionals. Critical vulnerabilities are patched within 48 hours of discovery.
• Incident Response: We maintain a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay and in accordance with applicable breach notification obligations.

As a User of the kyu4d Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact us using the details in Clause 15. We will respond within 30 days of receiving a verified request:

Where your Personal Data is processed on the basis of consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent does not entitle you to a refund or any other remedy beyond the cessation of the relevant processing activity.

We will not charge a fee for handling a data rights request unless the request is manifestly unfounded or excessive — in which case we may charge a reasonable administrative fee or decline to respond, with written reasons provided.

kyu4d may send you promotional communications — including bonus offers, seasonal promotions tied to events such as Idul Fitri, Ramadhan, or BRI Liga 1 fixtures, and personalized wagering recommendations — via email, SMS, or WhatsApp. We do so only where:

• You have given explicit consent during or after account registration, or
• You are an existing Account holder and we are marketing our own similar products and services to you (soft opt-in), and you have not previously opted out.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email.
• Updating your communication preferences in your Account settings.
• Contacting our support team via live chat or email with a request to be removed from all marketing lists.

Opting out of marketing communications does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal status updates, Account security alerts, KYC request notifications, and responsible gaming checks — which are necessary to administer your Account and cannot be unsubscribed from while your Account remains active.

The kyu4d Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect, process, or retain Personal Data from any individual under the age of 21. This restriction applies universally across all Indonesian regions and time zones (WIB, WITA, and WIT).

As part of our KYC verification process, all Users are required to submit valid government-issued identity documents confirming that they meet the 21+ age requirement before any real-money activity is permitted on the Platform. Accounts where the age verification process cannot be completed successfully will be suspended pending resolution.

Parents and guardians are encouraged to make use of parental control software and device-level restrictions to prevent minors from accessing gambling platforms. kyu4d cooperates fully with any reasonable request from a parent or guardian relating to the removal of a minor's data.

kyu4d reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or the features and services available on the Platform. All updates are effective from the date the revised policy is published at https://kyu4d.cam/privacy-policy.

Where a change is material — meaning it significantly affects how we process your Personal Data or materially reduces your privacy rights — we will provide advance notice through one or more of the following channels:

• A prominent notice displayed on the Platform's homepage for at least 14 days prior to the change taking effect.
• An email notification sent to the address registered on your Account.
• A notification within your Account dashboard upon your next login.

Non-material changes — such as corrections of typographical errors, clarifications of existing language, or updates to contact details — may be made without advance notice, though the "Last Updated" date at the top of this policy will always reflect the date of the most recent revision.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should cease using the Platform and contact us to close your Account before the revised policy takes effect.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how kyu4d handles your Personal Data, please contact our support team through any of the following channels:

• Email: [email protected] — please use the subject line "Privacy Request – [Your Account Username]" to ensure prompt routing to our data protection team.
• Live Chat: Available 24/7 directly within the Platform interface. Our Indonesian-speaking agents are on hand across all time zones (WIB, WITA, WIT).
• WhatsApp Support: Available during extended hours via the contact details displayed in your Account dashboard.

We aim to acknowledge all privacy-related requests within 5 business days and to resolve them fully within 30 calendar days. For complex requests that require additional time, we will notify you of the extended timeline and the reasons for the delay.

kyu4d is committed to handling all privacy matters with the seriousness and urgency they deserve. We view data protection not as a compliance checkbox but as a core element of the trust relationship between kyu4d and every Indonesian player on our Platform.