Privacy Policy

1. Introduction

payaja operates as a premium online gaming platform serving players primarily based in Indonesia. In the course of providing our Services — which include sports betting, live casino games, slot machines, lottery-style products such as togel (Indonesia's traditional numbers lottery), and other gaming categories — we necessarily collect and process personal information about the individuals who use our Platform.

We take data protection seriously. This Policy is designed to give you full transparency over our data practices so that you can make informed decisions about your engagement with payaja. If at any point you have questions that this Policy does not answer, you are encouraged to contact our Data Protection team using the details provided in Section 13.

payaja processes personal data in accordance with internationally recognized data protection principles, including purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. We do not sell your personal data to third parties under any circumstances.

2. Data We Collect

2.1 Data You Provide Directly

When you register an account, complete KYC verification, make a deposit, contact our support team, or participate in promotions, you provide us with personal data including:

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued identification number (KTP number for Indonesian residents, or passport number).
• Contact Data: Email address, Indonesian mobile phone number, and residential address (including city — e.g., Jakarta, Surabaya, Bandung, Bali, Medan).
• Financial Data: Bank account details for withdrawal purposes (e.g., BCA, BRI, BNI, Bank Mandiri, CIMB Niaga, Bank Permata account numbers), and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja). We do not store full card numbers or CVV codes.
• Verification Documents: Copies of government-issued ID, proof of address, and selfie photographs submitted during the KYC process.
• Support Communications: Records of chat transcripts, emails, and call logs when you contact our support team.

2.2 Data Collected Automatically

When you access and use the Platform, we automatically collect certain technical and behavioral data:

• Device & Technical Data: IP address, device type and model, operating system, browser type and version, screen resolution, and time zone (typically WIB — Western Indonesia Time, UTC+7).
• Usage Data: Pages visited, games played, bet amounts, session durations, login timestamps, click patterns, and navigation paths through the Platform.
• Transaction Data: Records of all deposits, withdrawals, bets placed, bonuses claimed, and gaming activity history.
• Location Data: Approximate geographic location derived from your IP address, used for fraud prevention and regional compliance.

2.3 Data From Third Parties

We may receive supplementary personal data from the following third-party sources:

• Identity verification service providers used in the KYC process.
• Payment processing partners (e.g., bank confirmation of account ownership).
• Fraud detection and anti-money laundering screening services.
• Publicly available sources such as government registries, where permitted by applicable law.

Data Category	Examples	Source
Identity	Name, DOB, KTP number	You / KYC provider
Contact	Email, phone, address	You
Financial	Bank account, e-wallet ID	You / payment processor
Technical	IP address, device ID, browser	Automatic collection
Behavioral	Games played, session time, bet history	Automatic collection
Communications	Chat logs, email threads	You / support system

3. How We Use Your Data

payaja uses the personal data we collect for the following purposes:

3.1 Account Management & Service Delivery

We use your Identity and Contact Data to create and manage your account, verify your identity, process deposits and withdrawals to your nominated Indonesian bank accounts or e-wallets, and deliver the gaming services you have requested. Without this data, we cannot operate your account.

3.2 Regulatory Compliance & Fraud Prevention

We are required to process identity and financial data to comply with anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and responsible gaming regulations. We use automated systems and human review to detect suspicious account activity, multi-accounting, bonus abuse, and potential fraud patterns.

3.3 Responsible Gaming Monitoring

We analyze behavioral and transaction data to identify patterns consistent with problem gambling — such as rapidly escalating deposit amounts, unusual playing hours, or repeated failed self-exclusion attempts. Where such patterns are detected, our responsible gaming team may proactively reach out. You can learn more about our player protection approach on the Responsible Gaming page.

3.4 Communications & Customer Support

We use your Contact Data to send transactional communications (deposit confirmations, withdrawal notifications, security alerts), respond to support requests, and — where you have opted in — send promotional communications about bonuses, events such as Idul Fitri reload promotions or Ramadhan cashback campaigns, and platform updates.

3.5 Platform Improvement & Analytics

Aggregated and anonymized usage data helps us understand how players navigate the Platform, which game categories are most popular, and where technical improvements are needed. This analysis does not involve profiling individual players for commercial targeting.

3.6 Personalization

With your consent, we may use your gaming preferences and behavioral data to surface relevant game recommendations, applicable bonus offers, and content tailored to your demonstrated interests on the Platform.

4. Legal Basis for Processing

payaja processes your personal data under the following legal bases:

• Contractual Necessity: Processing required to deliver the Services you have registered for and to manage your account under our Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable AML, KYC, and regulatory obligations.
• Legitimate Interests: Processing for fraud prevention, p latform security, responsible gaming monitoring, and service improvement — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional personalization, marketing communications, and non-essential cookies — where you have given explicit, freely withdrawable consent.

5. Data Sharing & Disclosure

5.1 Service Providers

We share personal data with carefully selected third-party service providers who assist us in operating the Platform. These providers are bound by strict data processing agreements and are permitted to use your data only for the specific purposes for which they were engaged. Categories of service providers include:

• KYC and identity verification partners.
• Payment processing partners facilitating transactions via BCA, BRI, BNI, Bank Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Cloud hosting and infrastructure providers.
• Fraud detection and AML screening services.
• Customer support platform providers.
• Game content suppliers (e.g., Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe).

5.2 Legal & Regulatory Disclosures

We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so, where we believe disclosure is necessary to prevent serious harm or criminal activity, or where disclosure is required to protect the rights, property, or safety of payaja, its players, or third parties.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of payaja's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected players via email before any such transfer takes effect and will ensure the receiving entity is bound by privacy obligations no less protective than those in this Policy.

5.4 No Sale of Personal Data

payaja does not sell, rent, or trade your personal data to third-party advertisers, data brokers, or marketing agencies. Your data is used solely to operate and improve the payaja Platform and to fulfill our legal obligations.

6. Cookies & Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. payaja uses cookies and similar tracking technologies (such as pixel tags and local storage objects) to enable core Platform functionality, remember your preferences, analyze usage patterns, and — with your consent — deliver relevant content.

6.2 Types of Cookies We Use

Cookie Type	Purpose	Consent Required?
Strictly Necessary	Session management, login authentication, security tokens, load balancing	No — essential for operation
Functional	Language preference, game settings, last-visited lobby, currency display (IDR)	No — enhances experience
Analytics	Page views, session duration, navigation paths, error tracking	Yes — opt-in
Personalization	Game recommendations, bonus offer targeting based on play history	Yes — opt-in

6.3 Managing Cookies

You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions. Instructions for managing cookies are available in the help documentation of your specific browser (Chrome, Firefox, Safari, Samsung Internet, etc.).

7. Data Retention

payaja retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Our standard retention periods are as follows:

• Active Account Data: Retained for the full duration of your account's active status plus five (5) years following account closure, to meet AML and audit trail requirements.
• Transaction Records: Retained for seven (7) years from the date of each transaction, in accordance with financial record-keeping obligations.
• KYC Documents: Retained for five (5) years following the last KYC verification event or account closure, whichever is later.
• Support Communications: Retained for three (3) years from the date of each interaction.
• Marketing Preferences: Retained until you withdraw consent or close your account, whichever occurs first.
• Technical Logs: Retained for a rolling period of twelve (12) months from the date of generation.

When data reaches the end of its applicable retention period, it is securely deleted or irreversibly anonymized so that it can no longer be associated with any individual player.

8. Security Measures

payaja implements a layered security architecture to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted in transit using industry-standard TLS 1.2 or higher protocols.
• Encryption at Rest: Sensitive data stored in our databases — including financial details and identity documents — is encrypted at rest using AES-256 encryption.
• Two-Factor Authentication (2FA): Available to all account holders as an additional layer of login security, strongly recommended for all players.
• Access Controls: Strict role-based access controls ensure that only authorized payaja staff can access personal data, and only to the extent required for their specific job function.
• Penetration Testing: Our Platform undergoes regular third-party security penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach response plan. In the event of a confirmed personal data breach affecting your rights and freedoms, we will notify affected players within 72 hours of becoming aware of the incident.

9. Your Privacy Rights

As a player on payaja, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our Data Protection team at the email address in Section 13. We will respond to all verified requests within 30 calendar days.

Please note that certain rights are subject to legal limitations — for example, we cannot erase transaction records that we are legally required to retain for AML compliance purposes. Where a limitation applies, we will explain it clearly in our response to your request.

10. Children's Privacy

payaja's Services are strictly for adults aged 21 and over. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes an age declaration step, and our KYC verification process independently confirms date of birth via government-issued identification.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will immediately close the associated account, delete all collected data, and — where applicable — void any funds in the account in accordance with our Terms & Conditions. If you believe a minor has registered on our Platform, please notify us immediately at the contact address in Section 13.

11. International Data Transfers

payaja operates infrastructure that may involve the transfer of personal data to servers or service providers located outside Indonesia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. These safeguards may include:

• Standard contractual clauses that obligate the receiving party to apply equivalent data protection standards.
• Transfers only to jurisdictions that maintain recognized adequacy frameworks for personal data protection.
• Binding corporate rules for transfers within the payaja group of entities.

You may request further information about the specific safeguards applied to any international transfer of your personal data by contacting our Data Protection team.

12. Policy Amendments

payaja reserves the right to revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform operations. When we make material changes, we will notify registered players via email at least 7 calendar days before the changes take effect. The revised Policy will also be published on this page with an updated "Last Updated" date at the top.

Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy. If you do not agree with the changes, you must cease using the Platform and may close your account by contacting our support team.

13. Contact & Data Protection Inquiries

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection team. We are committed to resolving all privacy-related inquiries promptly and transparently.