idcwin Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, including name, email address, phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" means idcwin, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third-party service provider that processes personal data on behalf of idcwin under a written data processing agreement.
• "User" or "you" means any individual who registers for, accesses, or uses the idcwin platform.
• "KYC Documents" means identity verification documents, including Indonesian KTP (national identity card), passport, driver's license, and proof of residential address.
• "Cookies" means small text files stored on your device by your web browser at the request of a website.

2. Data Controller

idcwin operates as the Data Controller for all personal data collected through the idcwin platform. As Data Controller, idcwin is responsible for ensuring that your personal data is processed lawfully, fairly, and transparently in accordance with applicable data protection legislation, including Indonesia's Personal Data Protection Law (UU PDP).

For all data protection inquiries, privacy rights requests, and data breach notifications, idcwin maintains a dedicated privacy team reachable via the contact details provided in Section 14 of this policy.

3. Data We Collect

3.1 Data You Provide Directly

When you register for an idcwin account and use our services, you voluntarily provide the following categories of personal data:

• Account Registration Data: Full legal name, date of birth, email address, mobile phone number (Indonesian numbers preferred), and residential address.
• Identity Verification (KYC) Data: Copies of government-issued identification documents (Indonesian KTP, passport, or driver's license), proof of residential address, and, where required, biometric verification data (selfie photographs for identity matching).
• Financial Data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, and others), e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history, deposit records, and withdrawal records. idcwin does not store full credit or debit card numbers.
• Communications Data: Messages, emails, chat transcripts, and other communications you send to idcwin's customer support team.
• Responsible Gaming Data: Self-imposed limits, self-exclusion requests, and any problem gambling disclosures you share with idcwin.

3.2 Data Collected Automatically

When you access the idcwin platform, certain data is collected automatically through technical means:

• Usage Data: Pages visited, games played, bets placed, session duration, click patterns, and navigation flow within the platform.
• Device & Technical Data: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and language settings.
• Location Data: General geographic location derived from IP address (city/country level). idcwin does not collect precise GPS location data.
• Cookie & Tracking Data: See Section 7 for full details of our cookie practices.

3.3 Data Received from Third Parties

In certain circumstances, idcwin may receive personal data about you from the following third-party sources:

• Identity Verification Providers: Third-party KYC service providers may return identity match scores and document authentication results to idcwin as part of the account verification process.
• Payment Processors: Local Indonesian banks and e-wallet providers share transaction confirmation data (transaction ID, amount, timestamp, sender account reference) to facilitate deposit and withdrawal processing.
• Fraud Detection Services: Risk and fraud management partners may share risk scores or flagging alerts related to your account activity.

4. Legal Basis for Processing

idcwin processes your personal data on the following legal grounds:

Processing Purpose	Legal Basis
Account registration and identity verification	Performance of contract; Legal obligation (KYC/AML)
Processing deposits and withdrawals	Performance of contract
Fraud prevention and security monitoring	Legitimate interests; Legal obligation
Responsible gaming monitoring	Legitimate interests; Legal obligation
Customer support communications	Performance of contract; Legitimate interests
Platform analytics and improvement	Legitimate interests
Marketing communications (where opted in)	Consent
Regulatory reporting and record-keeping	Legal obligation

5. How We Use Your Data

idcwin uses the personal data it collects for the following specific purposes:

5.1 Service Delivery

Your personal data is primarily used to create and manage your account, verify your identity, process financial transactions (deposits and withdrawals to and from Indonesian bank accounts and e-wallets), and deliver the full range of idcwin betting and gaming services.

5.2 Security and Fraud Prevention

idcwin processes personal data — including usage patterns, IP addresses, and device fingerprints — to detect, investigate, and prevent fraudulent activity, unauthorized account access, multi-accounting, and other security threats. This processing is in the legitimate interests of idcwin and its user community.

5.3 Regulatory and Legal Compliance

As an internationally licensed platform, idcwin is subject to anti-money laundering (AML), counter-terrorist financing (CTF), and Know Your Customer (KYC) obligations. Processing of identity and financial data for these purposes is a legal requirement and cannot be refused.

5.4 Responsible Gaming

idcwin uses behavioral and account data to identify indicators of potential problem gambling. Where such indicators are identified, our responsible gaming team may proactively contact you — in Indonesian where requested — to offer support tools including deposit limits, session time restrictions, reality-check reminders, and self-exclusion. This processing reflects idcwin's genuine commitment to player welfare.

5.5 Customer Support

Communications data (chat transcripts, emails, support tickets) is used to resolve your queries, improve support quality, and maintain accurate account records.

5.6 Platform Improvement

Aggregated and anonymized usage data is used to analyze platform performance, identify areas for improvement, test new features, and optimize the user experience for Indonesian players.

5.7 Marketing Communications

With your explicit consent at registration (or subsequently via your account settings), idcwin may send you promotional emails, SMS messages, or in-platform notifications about new games, promotions, and special offers. You may withdraw your consent and unsubscribe from marketing communications at any time by updating your account notification preferences or contacting our support team. Withdrawal of marketing consent does not affect the legality of processing that occurred before withdrawal.

6. Data Retention

idcwin retains personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention obligations:

Data Category	Retention Period	Basis
Account registration data	Duration of account + 5 years after closure	AML/KYC legal obligation
KYC identity documents	Duration of account + 5 years after closure	AML legal obligation
Financial transaction records	Duration of account + 7 years after closure	Financial record-keeping obligation
Customer support communications	3 years from the date of the communication	Legitimate interests (dispute resolution)
Usage and analytics data	24 months (rolling)	Legitimate interests (platform improvement)
Marketing consent records	Until withdrawal of consent + 3 years	Legal obligation (consent records)

Upon expiration of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with idcwin's internal data deletion procedures.

7. Cookies & Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They allow the website to remember information about your visit, such as your login session and display preferences, to improve your next visit and make the site more useful to you.

7.2 Cookies idcwin Uses

idcwin uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the functioning of the idcwin platform and cannot be disabled without affecting core functionality. They include authentication cookies (to keep you logged in), session cookies (to maintain your session state), and security cookies (to protect against CSRF attacks).
• Functional Cookies: These cookies remember your preferences, such as language settings (English/Indonesian), display preferences, and odds formatting (decimal, fractional, or American).
• Analytical Cookies: These cookies collect anonymous usage statistics that help idcwin understand how users interact with the platform — which pages are visited, which games are most popular, and where users encounter friction. This data is aggregated and does not directly identify you.

idcwin does not use cross-site advertising trackers, social media tracking pixels, or third-party marketing cookies.

7.3 Managing Cookies

You can control and delete cookies through your browser settings. Most web browsers allow you to:

• View and delete individual cookies
• Block all cookies or cookies from specific websites
• Set preferences for accepting cookies (e.g., the "Do Not Track" or privacy settings in your browser)

Please note that if you block strictly necessary cookies, certain idcwin features may not function correctly, and you may be unable to log in or place bets. The idcwin platform does not display a cookie consent banner; instead, cookie usage is disclosed here in full, in accordance with our transparency commitment.

8. Data Sharing & Disclosure

idcwin does not sell, rent, or trade your personal data to third parties for marketing purposes. However, we do share personal data with carefully selected categories of recipients, as described below:

8.1 Categories of Recipients

Recipient Category	Purpose of Sharing	Data Disclosed
Game and software providers	Delivering casino, slot, and live dealer games	Account ID, game session data
Payment processors / banks	Processing deposits and withdrawals (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja)	Name, account number, transaction amount
KYC / identity verification providers	Document authentication and identity matching	Identification documents, biometric match data
Fraud and risk management partners	Fraud detection and prevention screening	Device fingerprint, IP address, account activity
Hosting and infrastructure providers	Secure cloud hosting, data storage, content delivery	Server logs, hosted account data
Regulatory authorities	Reporting obligations under applicable licensing law	As required by law (transaction records, KYC data)
Legal advisors and auditors	Compliance review, dispute resolution, financial audit	Relevant account and transaction records

All third-party processors with access to personal data are bound by written data processing agreements that require them to implement appropriate technical and organizational security measures, to process data only on idcwin's documented instructions, and to comply with applicable data protection law.

8.2 Legal Disclosures

idcwin may disclose personal data where required to do so by law, regulation, judicial order, or subpoena, or where such disclosure is reasonably necessary to:

• Comply with a legal obligation
• Protect the rights, property, or safety of idcwin, our users, or the public
• Prevent or investigate wrongdoing in connection with the platform
• Enforce our Terms & Conditions

8.3 Corporate Transactions

In the event of a merger, acquisition, reorganization, or sale of idcwin's assets, your personal data may be transferred as part of the business transaction. In such circumstances, the receiving entity will be bound by a confidentiality agreement and may not use your personal data in a manner materially different from that described in this Privacy Policy.

9. International Data Transfers

idcwin operates as an internationally licensed platform and its servers are located in jurisdictions outside Indonesia. Consequently, your personal data will be transferred to, and processed in, jurisdictions other than Indonesia. These jurisdictions may have data protection laws that differ from Indonesia's Personal Data Protection Law (UU PDP).

Where personal data is transferred internationally, idcwin ensures that appropriate safeguards are in place, including:

• Standard contractual clauses / contractual safeguards governing the transfer
• Verification that the receiving jurisdiction maintains an adequate level of data protection
• Encryption of data in transit (TLS/SSL) and at rest (AES-256)

By using the idcwin platform, you consent to the international transfer of your personal data as described in this section.

10. Data Security

idcwin takes the security of your personal data seriously and implements a comprehensive suite of technical and organizational safeguards designed to protect against unauthorized access, alteration, disclosure, or destruction:

10.1 Technical Measures

• Encryption in Transit: All data transmitted between your browser and idcwin servers is protected using TLS 1.3 encryption (HTTPS).
• Encryption at Rest: Personal data stored on idcwin servers is encrypted using AES-256, a bank-grade encryption standard.
• Network Security: Multi-layered firewall protection, intrusion detection and prevention systems (IDPS), and Distributed Denial of Service (DDoS) mitigation are deployed at the network perimeter.
• Access Control: Sensitive personal data is accessible only to authorized idcwin personnel through a role-based access control (RBAC) system requiring multi-factor authentication.
• Monitoring: Continuous security monitoring, automated anomaly detection, and regular penetration testing are performed to identify and remediate vulnerabilities.

10.2 Organizational Measures

• Data protection training for all idcwin employees handling personal data
• Written internal data protection policies and procedures
• Binding confidentiality obligations imposed on all staff and contractors
• Incident response and data breach notification procedures

10.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, idcwin will notify the relevant supervisory authority and, where the breach is likely to result in a high risk to you, will notify you directly without undue delay. You will be informed of the nature of the breach, the data affected, and the remedial actions taken.

11. Your Privacy Rights

Subject to applicable law — including Indonesia's Personal Data Protection Law (UU PDP) — you have the following rights with respect to your personal data:

Right	Description
Right of Access	You may request a copy of all personal data we hold about you, together with information on how it is processed.
Right to Rectification	You may request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure	You may request deletion of your personal data where it is no longer needed for its original purpose, subject to legal retention obligations.
Right to Restriction	You may request that we restrict processing of your personal data in certain circumstances, such as while a dispute is being resolved.
Right to Data Portability	You may request that we provide your personal data in a structured, machine-readable format.
Right to Object	You may object to processing based on legitimate interests, including profiling for marketing or fraud detection.
Right to Withdraw Consent	Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time.
Right to Complain	You may lodge a complaint with the relevant supervisory authority in Indonesia (the Ministry of Communication and Digital Affairs) or with idcwin's data protection officer.

To exercise any of these rights, please submit a written request to idcwin's privacy team via the contact details in Section 14. We will respond within 30 days of receiving a verified request. Where a request cannot be fulfilled (for example, because fulfilling it would conflict with our legal retention obligations under AML law), we will explain the reasons for the refusal in writing.

12. Protection of Minors

idcwin is a service strictly restricted to individuals aged 21 years and above. We do not knowingly process personal data from individuals under the age of 21. Our Responsible Gaming policy includes stringent age verification measures at registration.

If you believe that a minor has registered for an idcwin account or provided personal data to us, please contact our privacy team immediately and we will take appropriate steps to delete the account and associated personal data. Parents and guardians are encouraged to use parental control tools and to discuss age restrictions with their children.

13. Changes to This Policy

idcwin may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or technological developments. When we make material changes, we will:

• Notify all registered users via email and on-platform notification at least 7 days before the changes take effect
• Update the "Last Updated" date at the top of this page
• Provide a summary of the material changes

Your continued use of the idcwin platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised policy, you may close your account and request deletion of your personal data.

14. Contact & Data Requests

For all privacy-related inquiries, data subject access requests, data breach reports, or complaints, please contact idcwin's dedicated privacy team:

• Email: [email protected] (displayed as plain text — not clickable)
• Live Chat: Available 24/7 within the idcwin platform
• Postal Address: Available on request via customer support

Our privacy team operates in English and Indonesian. When making a data subject request, please clearly state:

1. The specific right you wish to exercise
2. The personal data concerned (where relevant)
3. Your registered email address to facilitate identity verification

For your protection, idcwin may require you to verify your identity before responding to a data subject request. This is to ensure that personal data is not disclosed to unauthorized parties.