Privacy Policy

1 Definitions

The following terms carry specific meanings throughout this Privacy Policy:

2 Scope & Applicability

This Privacy Policy applies to:

• All individuals who visit https://rislot.cam, whether or not they are registered Members.
• All registered Members regardless of their country of residence, with specific provisions relevant to individuals in Indonesia.
• All Personal Data collected through the Platform, including data submitted during registration, KYC verification, deposits, withdrawals, customer support interactions, and general browsing activity.

This Policy does not apply to third-party websites, applications, or services that may be linked to or from the Platform. rislot is not responsible for the privacy practices of those external parties, and we encourage you to review their policies independently.

Where Indonesian data protection law (including Law No. 27 of 2022 on Personal Data Protection, "PDP Law") imposes requirements that are stricter than those set out in this Policy, those stricter requirements shall prevail for Indonesian residents.

3 Data We Collect

3.1 Registration & Account Data

When you open an Account with rislot, we collect the following information:

• Full legal name as it appears on your government-issued identity document
• Date of birth (to confirm you meet the minimum age requirement of 21 years)
• Email address and mobile phone number (Indonesian format accepted)
• Residential address (including city — such as Jakarta, Surabaya, Bandung, or Medan — and province)
• Chosen username and encrypted password
• Preferred language and currency (Indonesian Rupiah, IDR)

3.2 KYC & Verification Data

Prior to first withdrawal, you are required to submit identity documents for KYC verification. This includes:

• Government-issued photo ID (e.g., Indonesian National Identity Card / KTP, or passport)
• Proof of residential address (utility bill, bank statement, or official correspondence dated within three months)
• Selfie photograph holding your identity document
• Bank account details or e-wallet credentials to confirm payment-method ownership (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja)

3.3 Financial Transaction Data

We record all deposit and withdrawal transactions, including the amount in IDR, the payment method used, the transaction timestamp, and any bank reference numbers. We do not store raw bank account passwords or full card numbers on our servers.

3.4 Gameplay & Behavioral Data

To maintain platform integrity and improve our services, rislot collects gameplay records including bet amounts, game titles accessed, session durations, and win/loss outcomes. This data is used for fraud detection, responsible gaming monitoring, and product improvement. It is never shared with third-party advertisers.

3.5 Technical & Device Data

When you access the Platform, our servers automatically log certain technical information, including:

• IP address and approximate geographic location (city-level)
• Browser type and version
• Operating system and device type
• Referring URL and pages visited within the Platform
• Session timestamps and duration

3.6 Customer Support Data

When you contact our support team — whether via live chat, email, or WhatsApp — we record the content of the communication, together with your Account identifier and the date and time of the interaction. These records are retained to ensure continuity of service and for quality assurance purposes.

4 How We Collect Data

rislot collects Personal Data through the following channels:

5 Purposes of Processing

rislot processes your Personal Data for the following specific purposes:

1. Account Management: Creating, maintaining, and securing your Member Account, including authentication and password recovery.
2. Transaction Processing: Executing IDR deposits and withdrawals via local bank transfers and e-wallets, and maintaining accurate financial records.
3. Identity Verification (KYC): Verifying your identity and age (minimum 21 years) as required by our licensing obligations and anti-money-laundering regulations.
4. Customer Support: Responding to your queries, resolving disputes, and maintaining records of support interactions for quality purposes.
5. Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, account takeover attempts, money laundering, and other security threats.
6. Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling behavior and applying protective measures where appropriate.
7. Legal Compliance: Meeting obligations under applicable laws, including responding to lawful requests from regulatory or law enforcement authorities.
8. Platform Improvement: Analyzing aggregate usage data to enhance game selection, user interface, and overall service quality.
9. Promotional Communications: Sending you relevant bonus offers and promotional updates by email or in-platform notification, subject to your communication preferences and the ability to opt out at any time.

6 Legal Basis for Processing

For each category of data processing, rislot relies on one or more of the following legal bases:

7 Data Sharing

rislot does not sell your Personal Data. We share data only in the following defined circumstances and strictly on a need-to-know basis:

7.1 Service Providers (Data Processors)

We engage carefully vetted third-party service providers who process data on our behalf under written data-processing agreements. These include:

• Payment processors: To facilitate IDR transactions via bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• KYC verification providers: To carry out automated and manual identity document checks.
• Cloud infrastructure providers: To host Platform data on secure, encrypted servers.
• Customer support software providers: To manage live chat and ticketing systems.
• Game studios: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, and Microgaming receive the minimum data required (e.g., a pseudonymized player ID and session token) to operate their games within the Platform environment.

7.2 Legal & Regulatory Authorities

rislot may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where disclosure is required by law, by a valid legal order, or where we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of rislot, our Members, or the public.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of rislot's business, Personal Data held about Members may be transferred to the acquiring entity as part of that transaction. You will be notified by email prior to any such transfer, and the acquiring entity will be bound by terms no less protective than those in this Policy.

7.4 With Your Explicit Consent

rislot may share your data with additional parties in circumstances not covered above if you have provided your clear, informed, and freely given consent at the time of sharing.

8 International Data Transfers

As an internationally operating platform, rislot may transfer your Personal Data to servers and service providers located outside Indonesia. Whenever such transfers occur, we ensure that appropriate safeguards are in place to protect your data at a standard no less rigorous than that provided by Indonesian data protection law. Applicable safeguards include:

• Adequacy decisions recognizing the recipient country's data protection framework as equivalent.
• Standard contractual clauses incorporated into our agreements with overseas processors.
• Binding corporate rules where data is transferred within a corporate group.
• Your explicit consent in circumstances where no other safeguard is available.

You may request details of the specific safeguards applicable to any international transfer of your data by contacting our DPO at the address provided in Section 16.

9 Retention Periods

rislot retains Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by law. The following indicative retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with an identifiable individual.

10 Security Measures

rislot implements a layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Our principal security measures include:

• Transport Security: All data transmitted between your browser or device and our servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Data at Rest Encryption: Sensitive fields within our databases — including identity document images and financial records — are encrypted at rest using AES-256.
• Access Controls: Access to Personal Data by rislot staff is strictly role-based. Employees are granted access only to the data necessary to perform their specific job functions, and all access events are logged and periodically audited.
• PCI DSS Compliance: Payment processing pipelines conform to Payment Card Industry Data Security Standard (PCI DSS) requirements. Raw card or bank account numbers are never stored on rislot's servers.
• Two-Factor Authentication: Administrative and technical access to systems holding Personal Data requires two-factor authentication.
• Vulnerability Management: Regular penetration testing and security audits are conducted by qualified third-party security firms. Critical vulnerabilities are remediated within 48 hours of identification.
• Incident Response: rislot maintains a documented data breach response plan. In the event of a breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

11 Cookies & Tracking Technologies

rislot uses cookies and similar tracking technologies on the Platform for the following purposes:

rislot does not deploy advertising cookies, retargeting pixels, or social media tracking scripts. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform.

12 Your Rights

As a Member — and particularly as an individual protected under Indonesian data protection law — you hold the following rights with respect to your Personal Data held by rislot. To exercise any of these rights, contact our DPO at [email protected]. We will respond within 30 calendar days of receiving a valid request.

13 Minors

The Platform is strictly intended for adults aged 21 years and above. rislot does not knowingly collect Personal Data from individuals under 21. Age is verified at registration through date-of-birth submission and confirmed via KYC documentation prior to first withdrawal.

If rislot discovers that Personal Data has been collected from an individual under the age of 21, that Account will be immediately closed, all deposited funds will be returned to the originating payment method (subject to verification), and all Personal Data associated with that Account will be deleted from our systems as promptly as technically feasible.

If you are a parent or guardian and believe that your child under 21 has registered an Account on the Platform, please contact us immediately at [email protected] so that we can take appropriate action without delay.

14 Third-Party Links

The Platform may occasionally reference or display content that originates from third-party sources such as game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) or sports data providers. While rislot takes care to partner with reputable providers, we have no control over the privacy practices of these external entities.

Any link or embedded content from a third party that directs you away from https://rislot.cam is subject to that third party's own privacy policy. rislot accepts no liability for data handling by third-party services accessed through or referenced by the Platform. We strongly recommend reviewing the privacy policies of any external service before providing your personal information to them.

15 Policy Changes

rislot reviews this Privacy Policy at least annually and whenever significant changes to our data practices, legal obligations, or Platform features make an update necessary. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page.
• Notify registered Members by email to the address registered to their Account at least 14 calendar days before the revised Policy takes effect — or immediately if a change is required urgently by law.
• Display a prominent notice on the Platform homepage for a period of at least 30 days following the effective date of any material revision.

Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must cease using the Platform and request Account closure before the effective date. Your deposit balance, net of any pending conditions, will be returned upon closure.

Previous versions of this Privacy Policy are available on request from our DPO.

16 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way rislot handles your Personal Data, please contact us through any of the following channels. Please include your registered Account username and a clear description of your request or concern to help us respond efficiently.

If you are not satisfied with our response to a data rights request or believe we are processing your data unlawfully, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For Indonesian residents, this is the Ministry of Communication and Information Technology (Kementerian Komunikasi dan Informatika, Kominfo) or the designated supervisory authority established under the PDP Law.