bd303 Privacy Policy

1 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, including name, date of birth, email address, mobile number, payment account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, and deletion.
• "Data Controller" means bd303, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third-party service provider that processes Personal Data on behalf of bd303 under a written data-processing agreement.
• "KYC Data" means identity and address verification documents submitted by the Player during the Know Your Customer verification process, including government-issued photo identification such as the Indonesian National Identity Card (KTP) or Passport.
• "Transaction Data" means records of deposits, withdrawals, bonuses, wagers, and winnings associated with a Player's account, including payment method details, amounts in Indonesian Rupiah (IDR), timestamps, and reference numbers.
• "Cookies" means small text files placed on a Player's device by the Platform for purposes of session management, security, preference storage, and aggregated analytics.

2 Data We Collect

2.1 Registration Data

When you create a bd303 account, we collect the information you provide directly, including your full legal name, date of birth, Indonesian mobile number, email address, and a username of your choosing. This information is required to create and manage your account.

2.2 Identity Verification (KYC) Data

To comply with our platform's anti-money-laundering obligations and to protect players from identity fraud, bd303 may request documentary evidence of identity and residency. Acceptable documents include a valid Indonesian National Identity Card (KTP), Passport, or other government-issued photographic identification. KYC documents are processed securely and are not retained beyond the period required under applicable regulations.

2.3 Transaction Data

We record all financial activity on your account, including deposits made via BCA, BRI, BNI, Mandiri, CIMB Niaga, or OCBC NISP bank transfer, and e-wallet transactions through OVO, DANA, GoPay, ShopeePay, or LinkAja. Transaction records include the payment method used, amounts in IDR, timestamps (referenced to Western Indonesia Time, WIB, UTC+7), and internal reference numbers.

2.4 Technical & Device Data

When you access the Platform, our servers automatically log certain technical information, including your IP address, browser type and version, operating system, screen resolution, device type (desktop, mobile, or tablet), referring URL, and session duration. This data is used for security monitoring, fraud detection, and platform performance optimisation.

2.5 Behavioural & Usage Data

bd303 collects aggregated and, where necessary, individual-level data on how Players interact with the Platform — including pages visited, games played, bet types, wager amounts, session frequency, and feature engagement. This data helps us improve the user experience, personalise game recommendations, and identify unusual account behaviour indicative of fraud or problem gambling.

2.6 Communications Data

When you contact our support team via live chat, email, or WhatsApp, we retain a record of the conversation, including the content of your messages and any attachments you provide. These records are used to resolve disputes, train support staff, and maintain an audit trail of customer interactions.

3 How We Use Your Data

bd303 uses the personal data collected from Players for the following purposes:

• Account Management: To create, maintain, and close Player accounts, and to authenticate your identity each time you log in.
• Transaction Processing: To process deposits and withdrawals via your chosen Indonesian bank or e-wallet, and to maintain accurate financial records in IDR.
• Identity Verification: To comply with our Know Your Customer obligations and verify that Players are genuine individuals who meet the 21+ age requirement.
• Customer Support: To respond to enquiries, resolve disputes, and maintain a record of support interactions for quality and training purposes.
• Security & Fraud Prevention: To detect and prevent unauthorised account access, multi-accounting, bonus abuse, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: To monitor account behaviour for indicators of problem gambling and, where necessary, to apply protective measures including cooling-off periods and self-exclusion.
• Platform Improvement: To analyse aggregated usage patterns, improve game navigation, optimise loading performance, and test new platform features.
• Promotions & Communications: To notify you of bonuses, promotions, and platform updates relevant to your account, where you have not opted out of such communications.
• Legal Compliance: To fulfil any obligation imposed by applicable law, regulation, or a lawful order from a competent authority.

4 Legal Basis for Processing

bd303 processes personal data on the following legal bases:

• Contractual Necessity: Processing that is required to fulfil our contractual obligations to you under the bd303 Terms & Conditions — including account creation, payment processing, and customer support.
• Legitimate Interests: Processing carried out for purposes that are in the legitimate operational interests of bd303 and are proportionate to those interests — including fraud detection, security monitoring, platform analytics, and responsible gaming oversight.
• Legal Obligation: Processing that is required to comply with a legal or regulatory requirement applicable to bd303 as a licensed online gaming platform, including identity verification and the retention of financial transaction records.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for optional marketing communications. You may withdraw consent for marketing communications at any time by contacting our support team.

5 Data Sharing & Disclosure

5.1 Third-Party Service Providers

bd303 engages a limited number of third-party Data Processors to support the operation of the Platform. These include payment gateway operators facilitating transactions via Indonesian banks and e-wallets, identity verification service providers supporting our KYC process, cloud hosting and infrastructure providers, and analytics tools used for aggregated platform performance monitoring. All Data Processors are bound by written data-processing agreements that restrict their use of your data to the specific service they provide to bd303.

5.2 Game Providers

Games on the bd303 Platform are powered by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you play a game powered by one of these providers, certain technical and gameplay data (such as your Player ID, bet amounts, and game round outcomes) may be processed by the relevant provider's systems. These providers operate under their own privacy frameworks and are contractually prohibited from using your data for any purpose other than delivering the game service.

5.3 Legal Disclosure

bd303 may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by a valid legal process, court order, or applicable regulation. In such cases, bd303 will disclose only the minimum data required to satisfy the legal obligation and, where permitted by law, will notify the affected Player.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of bd303's business assets, personal data held by bd303 may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer via the Platform or by email to their registered address, and will be given the option to request deletion of their data if they do not wish to continue using the successor platform.

5.5 No Sale of Data

bd303 does not sell, rent, lease, or otherwise transfer personal data to third parties for commercial or marketing purposes. Your data is not an asset that bd303 monetises independently of the services you use.

6 Cookies & Tracking Technologies

6.1 What We Use

bd303 uses the following categories of cookies and similar technologies on the Platform:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication tokens that keep you logged in during your visit, and CSRF protection tokens that defend your account against cross-site request forgery attacks. These cookies cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how Players navigate the Platform — including pages visited, time on page, and error events. This data helps bd303 identify and fix performance issues. No individually identifiable data is retained via these cookies.
• Functional Cookies: Used to remember your preferences, such as display language and interface settings, so that you do not need to reconfigure them on each visit.

6.2 What We Do Not Use

bd303 does not deploy third-party advertising cookies, retargeting pixels, social-media tracking scripts, or cross-site tracking technologies. The Platform does not include Facebook Pixel, Google Ads remarketing tags, or equivalent third-party advertising SDKs.

6.3 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Note that disabling strictly necessary cookies will prevent you from logging in to your bd303 account.

7 Data Security

bd303 applies a layered security architecture to protect personal data from unauthorised access, alteration, disclosure, and destruction. Key measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and the bd303 Platform is encrypted using industry-standard Transport Layer Security protocols.
• Encryption at Rest: Sensitive personal data fields — including identity document images, payment account details, and passwords — are encrypted in our database using AES-256 encryption.
• Access Controls: Access to personal data within bd303's infrastructure is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, and all access events are logged for audit purposes.
• Intrusion Detection: The Platform is monitored 24/7 by automated intrusion detection systems that flag and alert on anomalous access patterns, brute-force login attempts, and unusual data-export activity.
• Penetration Testing: bd303 conducts periodic third-party security assessments of its Platform infrastructure and application code to identify and remediate vulnerabilities before they can be exploited.

No data security system is impenetrable. In the unlikely event of a data breach that poses a material risk to Players, bd303 will notify affected individuals and the relevant authorities as required by applicable law, and will take immediate remedial action.

8 Data Retention

bd303 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised so that it can no longer be attributed to an identifiable individual.

9 Your Rights

As a Player on the bd303 Platform, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of the personal data that bd303 holds about you. We will provide this within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (such as updating your email address or phone number), you may do so directly through your account settings.
• Right to Erasure: You may request that bd303 delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal obligation to retain it.
• Right to Restriction: You may request that bd303 temporarily restrict the processing of your personal data while a correction or objection request is being assessed.
• Right to Object: You may object to the processing of your personal data where bd303 is relying on legitimate interests as the legal basis, including profiling for responsible gaming purposes. bd303 will assess your objection and cease processing unless there are compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (primarily marketing communications), you may withdraw that consent at any time by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Data Portability: You may request that bd303 provide your personal data in a structured, commonly used, machine-readable format, where technically feasible.

To exercise any of the above rights, contact bd303 support via live chat or by email at [email protected]. We may need to verify your identity before processing a data rights request. All requests will be acknowledged within 5 business days and resolved within 30 calendar days.

10 Children & Minors

bd303 is strictly an adults-only platform. You must be at least 21 years of age to register an account or use any service on the Platform. bd303 does not knowingly collect personal data from individuals under the age of 21.

If bd303 becomes aware that personal data has been collected from a person under 21 years of age, the relevant account will be suspended immediately, all personal data associated with that account will be deleted, and any balance will be forfeited in accordance with our Terms & Conditions.

If you believe that a person under 21 has created an account on bd303, please contact our support team immediately at [email protected] so that we can take prompt action.

11 Third-Party Links

The bd303 Platform does not include links to external third-party websites. All navigation within the Platform remains within the bd303 domain at https://bd303.one. Accordingly, this Privacy Policy applies exclusively to data processed by bd303 on its own Platform and does not extend to any third-party site or service.

If a Game Provider's software interface presents any external link as part of a game experience, bd303 is not responsible for the privacy practices of that external destination. Players should review the privacy policies of any third-party destination they visit independently of the bd303 Platform.

12 Updates to This Policy

bd303 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. Where an update is material — such as a change to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will notify registered Players via the Platform or by email to their registered address at least 14 days before the change takes effect.

The "Last Updated" date at the top of this Policy and in the sidebar will be revised with each update. We encourage you to review this Policy periodically. Continued use of the bd303 Platform following the effective date of any update constitutes acceptance of the revised Privacy Policy.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bd303 handles your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 on the bd303 Platform. Our support team includes native Indonesian-speaking agents serving players across Jakarta, Surabaya, Medan, Bandung, Bali, and all Indonesian time zones (WIB, WITA, WIT).
• Email: [email protected] — displayed as plain text; not a clickable link.
• WhatsApp: +62 811 9303 303 — displayed for reference; not a clickable link.

Data rights requests submitted by email will receive an acknowledgement within 5 business days and a full response within 30 calendar days. For urgent security concerns — such as suspected unauthorised access to your account — please use the live chat function for the fastest response.