Privacy Policy — wa365

Introduction

wa365 ("we", "us", "our") is committed to protecting and respecting the privacy of every person who interacts with our platform. This Privacy Policy sets out the basis on which we collect , use, store, and disclose personal information we receive from players and visitors. It also describes the rights you hold in respect of that data and how you can exercise them.

wa365 primarily serves Indonesian players who use local bank transfer services (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and domestic e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja) to fund their accounts. The data practices described in this policy reflect the requirements of our international offshore gaming licence and applicable data protection principles recognized globally.

By registering an account with wa365 or continuing to use our services after the effective date of this policy, you acknowledge that you have read and understood how we process your personal data as described herein. If you do not agree with any part of this policy, you should discontinue use of the wa365 platform and may request account closure by contacting our support team.

Definitions

The following terms have specific meanings throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, email address, date of birth, payment details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means wa365, the entity that determines the purposes and means by which your personal data is processed.
• "Data Processor" means any third-party service provider that processes personal data on behalf of wa365 under a written data processing agreement.
• "Player" means any registered account holder on the wa365 platform.
• "Visitor" means any individual who accesses the wa365 website without creating a registered account.
• "KYC Data" means identity verification documents and associated data collected during the Know Your Customer process, including national identity cards (KTP), proof of address, and selfie verifications.
• "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, financial status beyond standard transaction records, or biometric identification data.

Data We Collect

wa365 collects the following categories of personal data depending on how you interact with our platform:

wa365 does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, or political opinions. If any such data is inadvertently submitted — for example, via an identity document that reveals religious affiliation — it is not used for any processing purpose and is subject to enhanced deletion procedures.

How We Collect Data

wa365 collects personal data through the following channels:

4.1 Direct Submission

Data you provide directly when registering an account, completing KYC verification, making deposits or withdrawals, contacting our support team, or participating in promotions. This is the primary source of identity and financial data.

4.2 Automated Technologies

Technical and behavioural data is collected automatically when you access the wa365 platform. This includes cookies, web beacons, server logs, and session tracking technologies. See Section 8 (Cookies & Tracking) for full details.

4.3 Third-Party Sources

wa365 may receive data about you from third parties in limited circumstances, including:

• Identity verification service providers who validate KYC documents.
• Payment processors who confirm the status of deposit and withdrawal transactions via BCA, BRI, BNI, or e-wallet providers.
• Fraud detection and anti-money-laundering screening services.
• Analytics providers who supply aggregated, anonymized data about platform traffic (this does not include individual player identification).

How We Use Your Data

wa365 uses your personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your wa365 account, including password resets and two-factor authentication.
• Transaction Processing: Executing IDR deposits and withdrawals via local Indonesian bank transfers and e-wallets, and maintaining accurate financial records.
• KYC Compliance: Verifying your identity and age (21+) as required by our licensing obligations and to prevent underage gambling and financial crime.
• Customer Support: Responding to queries, complaints, and technical issues submitted through live chat or email at [email protected].
• Responsible Gaming: Monitoring account activity to identify potential problem gambling indicators and to administer self-exclusion, deposit limits, and other player protection tools.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Service Improvement: Analysing platform usage patterns — in aggregated, anonymized form where possible — to improve the wa365 product, fix technical issues, and optimize the player experience.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in. You may opt out at any time.
• Legal Compliance: Meeting obligations under our international offshore gaming licence, responding to lawful requests from regulatory authorities, and maintaining records as required by applicable law.

Legal Basis for Processing

wa365 processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform our obligations under the account agreement with you — including account setup, transaction processing, and customer support.
• Legal Obligation: Processing required to comply with our licensing conditions, anti-money-laundering obligations, and any lawful regulatory request.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where our interests do not override your privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, freely given, and revocable consent.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent for marketing does not affect your ability to use the wa365 platform.

Data Sharing & Disclosure

wa365 does not sell your personal data. We share personal data only in the following limited circumstances and always under appropriate contractual safeguards:

7.1 Service Providers

We engage carefully vetted third-party vendors who process data on our behalf to deliver core platform functions. These include payment processors facilitating IDR transactions via BCA, BRI, BNI, Mandiri, and e-wallet networks; KYC and identity verification providers; game content providers such as Evolution Gaming, Pragmatic Play, and Pocket Games Soft; and cloud hosting infrastructure providers. All service providers are bound by data processing agreements that restrict how they may use your data.

7.2 Regulatory & Legal Disclosure

wa365 may disclose personal data to our licensing regulator, law enforcement agencies, or other competent authorities when legally required to do so — for example, in connection with a criminal investigation, court order, or regulatory audit. We will notify you of any such disclosure where legally permitted.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or other corporate restructuring involving wa365, player data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change in privacy practices that may result.

7.4 Aggregated & Anonymized Data

wa365 may share aggregated, anonymized statistical data — which cannot identify any individual player — with industry partners, analytics providers, or for publication in research. This type of sharing does not constitute disclosure of personal data.

Cookies & Tracking Technologies

wa365 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and improve your experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for platform operation — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your preferences such as language settings, currency display (IDR), and responsible gaming tool configurations so you do not need to re-enter them each session.
• Analytics Cookies: Collect anonymized data about how players use the wa365 platform — page visits, session duration, and navigation paths — to help us improve the service. These are only set with your consent.
• Marketing Cookies: Used to deliver relevant promotional content and to measure the effectiveness of our marketing campaigns. These are only set with your explicit consent and can be withdrawn at any time via your account settings.

You can manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies will impair or prevent platform access. wa365 does not use third-party advertising networks that track your browsing activity across external websites.

International Data Transfers

wa365 operates as an internationally licensed platform, and your personal data may be stored and processed in data centers located outside Indonesia. When transferring personal data internationally, wa365 ensures appropriate safeguards are in place, including:

• Data processing agreements incorporating internationally recognized data protection clauses with all recipients.
• Use of cloud infrastructure providers that maintain ISO 27001 certification and region-specific data residency options where available.
• Encryption in transit and at rest for all cross-border data flows.

KYC documents — including copies of your KTP and proof of address — are stored in encrypted form on servers in jurisdictions that maintain data protection standards consistent with international best practices. These documents are accessible only to authorized compliance personnel.

Data Retention

wa365 retains personal data for as long as necessary to fulfil the purposes described in this policy or as required by our licensing and legal obligations. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of your account and for five (5) years following verified account closure, to meet regulatory record-keeping requirements under our gaming licence.
• KYC Documents: Retained for five (5) years from the date of submission or from the date of account closure, whichever is later, in accordance with anti-money-laundering obligations.
• Financial Transaction Records: Retained for seven (7) years from the date of each transaction, consistent with standard financial record-keeping practices.
• Communication Records: Live chat logs and email correspondence are retained for two (2) years unless they relate to an ongoing dispute or investigation, in which case they are retained until the matter is fully resolved.
• Marketing Data: Retained until you withdraw consent for marketing communications. Following opt-out, your marketing preference record (opt-out status) is retained indefinitely to prevent inadvertent re-contact.
• Anonymized Data: Behavioural and analytics data that has been fully anonymized is not subject to a deletion timeline, as it can no longer be attributed to an identifiable individual.

When the applicable retention period expires, personal data is securely deleted or anonymized. Players may request early deletion subject to the limitations described in Section 11.

Your Privacy Rights

Subject to applicable law and certain conditions, you hold the following rights in respect of the personal data wa365 holds about you:

To exercise any of the above rights, please contact our data protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within three (3) business days and respond in full within thirty (30) calendar days. There is no fee for submitting a data rights request unless the request is manifestly unfounded or repetitive, in which case a reasonable administrative fee may apply.

Minors & Age Verification

wa365 does not knowingly collect personal data from individuals under the age of 21. Our platform is strictly for adults aged 21 and over. As part of the KYC process, all players are required to submit valid government-issued identity documentation confirming they meet the minimum age requirement before full account access and withdrawals are enabled.

If wa365 becomes aware that personal data has been collected from an individual under 21 — whether through a false registration, use of another person's identity, or any other means — we will immediately suspend the relevant account, delete all associated personal data to the extent permitted by law, and report the incident to our compliance team. Any balances associated with such an account will be managed in accordance with our Terms & Conditions and applicable licensing rules.

Data Security

wa365 implements a layered information security framework designed to protect personal data against unauthorized access, accidental loss, destruction, and disclosure. Key security measures include:

• Encryption: AES-256 encryption for data at rest and TLS 1.3 for all data in transit between your device and our servers.
• Access Controls: Role-based access controls limiting personal data access to authorized personnel with a documented need. All internal data access is logged and audited.
• Two-Factor Authentication (2FA): Available and strongly recommended for all player accounts to prevent unauthorized access resulting from compromised credentials.
• Penetration Testing: wa365 commissions regular independent penetration tests and vulnerability assessments of its platform infrastructure.
• Incident Response: A documented data breach response procedure is in place. In the event of a breach affecting your personal data, wa365 will notify affected players without undue delay and take immediate remediation steps.
• Secure Data Destruction: Expired personal data is deleted using secure erasure methods that prevent recovery.

While wa365 applies robust technical and organizational security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us promptly if you suspect unauthorized access to your account.

Third-Party Services

The wa365 platform integrates with third-party service providers to deliver specific platform features. These providers operate as data processors under written agreements that restrict data use to the specific services they provide to wa365. Current categories of third-party processors include:

• Game Content Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft — these providers may receive anonymized session identifiers for game integrity and RNG certification purposes.
• Payment Infrastructure: Third-party payment gateways facilitating IDR transfers through BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja. These providers receive only the financial data necessary to process your specific transaction.
• KYC & Identity Verification: Specialist providers who validate identity documents and perform automated liveness checks. Document images are processed under strict data handling agreements.
• Cloud Hosting & Infrastructure: wa365 uses enterprise-grade cloud infrastructure providers subject to ISO 27001 certification.

wa365 does not permit its service providers to use player data for their own independent purposes, to share player data with further third parties, or to use player data for advertising or profiling beyond the scope of the service they provide to wa365.

Changes to This Policy

wa365 may update this Privacy Policy periodically to reflect changes in our data practices, platform features, or applicable legal requirements. When we make material changes — meaning changes that meaningfully affect how we collect, use, or share your personal data — we will notify all registered players via email at least seven (7) days before the changes take effect, and will post a prominent notice on the wa365 platform.

Minor or clarificatory updates that do not change the substance of our data practices may be made without prior notification, though the "Last Updated" date at the top of this policy will always reflect the most recent revision. We recommend reviewing this policy periodically. Your continued use of the wa365 platform following any update constitutes acceptance of the revised policy. If you do not agree with the updated terms, you may request account closure as described in our Terms & Conditions.

Contact & Data Requests

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy concern, please contact our data protection team through the following channels:

• Email: [email protected] — include "Privacy" or "Data Rights Request" in the subject line for prompt routing. Responses are provided within 30 calendar days.
• Live Chat: Available 24/7 on the wa365 platform. For urgent data security concerns, live chat is the fastest way to reach our team.

All data rights requests are handled by trained compliance personnel. We will verify your identity before acting on any request to ensure your data is not disclosed to an unauthorized party. Verification typically requires confirming account details consistent with our KYC records.