Privacy Policy

gaya11 is committed to protecting the privacy and security of our members' personal information. We operate in accordance with internationally recognized data protection principles, including purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.

This commitment extends to all personal data we process in connection with our services — including account management, payment processing, identity verification (KYC), responsible gaming monitoring, customer support, marketing communications (where consent has been given), and fraud prevention.

Our platform serves players primarily based in Indonesia, and we take particular care to ensure that the handling of personal data belonging to Indonesian residents is conducted responsibly, transparently, and in keeping with internationally accepted best practice in data protection.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, online identifiers, or factors specific to that person's physical, economic, or social identity.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, transmission, or deletion.
• "Data Controller" means gaya11, the entity that determines the purpos es and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of gaya11 under a written data processing agreement (for example, payment gateway providers, KYC verification services, or cloud hosting providers).
• "Cookies" means small text files placed on your device by the Platform to store session information, preferences, and analytical data.
• "KYC" means Know Your Customer — the identity and document verification process required before withdrawals may be processed or upon request by gaya11.
• "Services" means all features, products, and functionalities available on the gaya11 Platform, including live casino games, sports betting, slot gaming, togel (Indonesia's traditional numbers lottery) participation, customer support, and promotional activities.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including government-issued identification numbers, financial account details, and biometric data where collected for verification purposes.

The categories of personal data we collect about you vary depending on how you interact with the Platform. The following table summarizes the main data categories and the context in which they arise:

We do not intentionally collect Sensitive Data beyond what is strictly required for identity verification and payment processing. We do not collect health data, racial or ethnic origin data, religious or political belief data, or biometric data unless a specific verification process expressly requires it and you have provided your explicit consent.

gaya11 collects personal data through the following primary channels:

• Direct interactions: Information you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or submit any form on the Platform.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including through cookies, server logs, session tracking tools, and device fingerprinting technologies. See Section 11 for more detail on our Cookie Policy.
• Payment providers: Confirmation and reference data received from Indonesian payment processors (such as bank transfer gateways and e-wallet APIs for OVO, DANA, GoPay, ShopeePay, and LinkAja) when you initiate or complete a financial transaction.
• Identity verification partners: Where we engage third-party KYC services to assist with document authentication, those partners may share verification results and risk scores with us under strict data processing agreements.
• Fraud prevention and security tools: Data from anti-fraud systems, device reputation databases, and IP geolocation services that help us identify and mitigate suspicious activity on the Platform.
• Third-party game providers: Aggregated gameplay and wagering data received from certified game studios including Pragmatic Play, Evolution Gaming, PG Soft, Spribe, NetEnt, and Microgaming, to the extent necessary for game dispute resolution and responsible gaming monitoring.

gaya11 processes your personal data on the following legal bases, depending on the specific purpose of processing:

• Contractual necessity: Processing required to perform the contract between you and gaya11, including operating your account, processing deposits and withdrawals, delivering gaming services, and handling customer support queries.
• Legal obligation: Processing necessary to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations, KYC verification requirements, fraud prevention duties, and financial record-keeping obligations.
• Legitimate interests: Processing carried out for gaya11's legitimate business interests where those interests are not overridden by your fundamental rights and freedoms. This includes platform security, fraud detection, responsible gaming monitoring, internal analytics, and service improvement.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications (promotional emails, SMS, and WhatsApp messages about bonuses and offers). You may withdraw your consent at any time by contacting our support team or updating your account preferences.

gaya11 uses the personal data we collect for the following purposes:

• Account management: Creating and maintaining your player account, authenticating your identity at login, and enabling account-level features such as deposit limits, self-exclusion, and session history.
• Payment processing: Facilitating deposits and withdrawals via your chosen Indonesian payment method, reconciling transactions, and investigating payment disputes.
• Identity verification (KYC): Verifying your identity, age (21+ requirement), and eligibility to use the Platform in accordance with our Terms & Conditions.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, account takeover attempts, money laundering, bonus abuse, multi-accounting, and other prohibited conduct.
• Responsible gaming: Monitoring gameplay patterns to identify potential signs of problem gambling, enforcing deposit limits and self-exclusion instructions, and providing appropriate support resources.
• Customer support: Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of our communications with you.
• Platform improvement: Analyzing aggregated usage data to understand how members interact with the Platform, identify technical issues, and improve the overall user experience.
• Marketing communications: Sending you information about relevant promotions, bonuses, and offers where you have consented to receive such communications. This may include notifications related to Indonesian cultural events and seasonal promotions.
• Legal compliance: Meeting our obligations under applicable laws, responding to lawful requests from regulatory or law enforcement authorities, and maintaining required financial records.

We will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your consent.

gaya11 does not sell, rent, or otherwise commercially transfer your personal data to third parties. We share your personal data only in the following limited and controlled circumstances:

• Service providers and Data Processors: We engage carefully selected third-party service providers who process data on our behalf, including payment gateway operators, KYC and identity verification platforms, cloud infrastructure providers, live chat and customer support software providers, and anti-fraud technology vendors. All such providers are bound by data processing agreements that restrict them from using your data for any purpose other than delivering services to gaya11.
• Game studios: Certified gaming providers (including Pragmatic Play, Evolution Gaming, PG Soft, and others) receive the minimum data necessary to operate game sessions, settle wagers, and resolve game disputes. These providers operate under their own data protection policies and are independently regulated.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulators, courts, or government bodies where required to do so by applicable law, a valid court order, or in connection with any legal proceedings. We will notify you of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of gaya11's business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you prior to any such transfer and ensure that adequate data protection standards continue to apply.
• With your explicit consent: In any other circumstance where you have provided your clear and specific consent to a particular sharing arrangement.

As an international online gaming platform serving Indonesian players, gaya11 may transfer your personal data to servers or service providers located outside of Indonesia. Such transfers may be necessary, for example, to utilize cloud hosting infrastructure, KYC verification services, or game studio platforms that operate internationally.

Where personal data is transferred internationally, gaya11 takes appropriate safeguards to ensure that your data receives a standard of protection consistent with the principles set out in this Policy. These safeguards may include:

• Entering into data processing agreements with recipient organizations that incorporate internationally recognized data protection clauses.
• Transferring data only to jurisdictions or service providers that maintain data protection standards comparable to those applied by gaya11.
• Applying additional technical and organizational security measures where data is transferred to regions with less developed data protection frameworks.

By using the gaya11 Platform and providing your personal data, you acknowledge and consent to the transfer of your data outside of Indonesia in the circumstances described above.

gaya11 retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active account data: Personal data associated with an active gaya11 account is retained for the duration of your account relationship with us.
• Closed account data: Following account closure, we typically retain personal data for a period of five (5) years to comply with financial record-keeping requirements, anti-money laundering obligations, and to resolve any post-closure disputes or chargebacks.
• KYC documentation: Identity and verification documents are retained for the period required by applicable anti-money laundering regulations, generally five (5) years from the date of verification or from the date of account closure, whichever is later.
• Transaction records: Financial transaction records, including deposit and withdrawal histories, are retained for a minimum of five (5) years for accounting, auditing, and regulatory compliance purposes.
• Marketing data: Data held solely on the basis of your marketing consent is deleted or anonymized promptly following the withdrawal of that consent, subject to any overriding legal retention obligation.
• Support communications: Customer support records are typically retained for three (3) years from the date of the last interaction, to facilitate dispute resolution and service quality review.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized so that it can no longer be associated with you as an individual.

gaya11 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Encryption in transit: All data exchanged between your browser or app and our servers is encrypted using 256-bit TLS/SSL protocols. Sensitive data — including passwords and payment details — is never transmitted in plain text.
• Encryption at rest: Sensitive personal data stored on our servers, including financial data and identity documents, is encrypted at rest using industry-standard algorithms.
• Access controls: Access to personal data within gaya11 is restricted on a strict need-to-know basis. Staff who require access to personal data as part of their role are subject to confidentiality obligations and receive regular data protection training.
• Multi-factor authentication: Administrative access to systems containing personal data requires multi-factor authentication as a mandatory security control.
• Penetration testing and vulnerability assessments: Our platform undergoes regular independent security assessments to identify and remediate potential vulnerabilities before they can be exploited.
• Incident response: gaya11 maintains a documented data breach response plan. In the event of a security incident that poses a risk to your personal data, we will notify affected users without undue delay and take all necessary remedial action.

gaya11 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, remember your preferences, and analyze how the Platform is used. The following cookie categories are in use:

• Essential cookies: Strictly necessary for the Platform to function. These include session authentication tokens, load balancing cookies, and security cookies. These cannot be disabled without significantly impairing your ability to use the Platform.
• Functional cookies: Used to remember your preferences and personalize your experience — for example, your preferred language setting or whether you have acknowledged the age restriction notice. These improve convenience but are not strictly essential.
• Analytics cookies: Used to collect aggregated, anonymized data about how users interact with the Platform, including pages visited, session duration, and error occurrences. This data helps us identify performance issues and improve the user experience. We use privacy-respecting analytics tools that do not share data with third-party advertisers.

gaya11 does not use third-party behavioral advertising cookies that track your activity across other websites for the purpose of serving targeted advertisements on external platforms.

Most web browsers allow you to control cookie settings through the browser's preferences or settings menu. You may choose to block or delete cookies; however, please be aware that disabling essential cookies will impair the functionality of the Platform, including your ability to log in and maintain a game session.

gaya11 respects your rights in relation to your personal data. You may exercise any of the following rights by contacting our support team at [email protected]:

• Right of access: You have the right to request a copy of the personal data we hold about you and to receive information about how that data is processed.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent on which processing was based, or where processing has been unlawful. This right is subject to any overriding legal retention obligations.
• Right to restriction of processing: In certain circumstances, you may request that we restrict the processing of your personal data — for example, while the accuracy of data is being verified following a rectification request.
• Right to data portability: Where processing is based on your consent or on contract performance, and is carried out by automated means, you may request that we provide your personal data to you in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to processing of your personal data carried out on the basis of our legitimate interests. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

We will respond to all data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it.

The gaya11 Platform is strictly intended for adults. You must be at least 21 years of age to register an account or participate in any gaming or betting activity on the Platform. We do not knowingly collect or process personal data from individuals under the age of 21.

During registration, all users are required to confirm that they are 21 years of age or older. We enforce mandatory KYC age verification and will immediately suspend any account where there is reasonable suspicion that the account holder does not meet the minimum age requirement. Any personal data inadvertently collected from an underage individual will be deleted promptly upon discovery.

If you believe that a minor has registered an account on gaya11 or that we have inadvertently collected personal data from a minor, please notify us immediately at [email protected] and we will take swift action to investigate and, if confirmed, delete the relevant data and close the account.

gaya11 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, regulatory requirements, or platform features. When material changes are made to this Policy, we will notify registered members via the email address associated with their account and/or by displaying a prominent notice on the Platform.

The date displayed in the "Last Updated" notice at the top of this page reflects the date on which the most recent version of this Policy was published. We encourage you to review this Policy periodically. Your continued use of the Platform following the publication of any revised Policy constitutes your acknowledgment of and agreement to the updated terms.

If you disagree with any changes to this P olicy, you should discontinue use of the Platform and may request account closure by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which gaya11 processes your personal data, please contact our dedicated privacy support team through any of the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available directly on the Platform, 24 hours a day, 7 days a week
• WhatsApp: Available 24/7 — contact details provided within your Account dashboard

Our support team includes native Indonesian-speaking agents who are available around the clock to assist with any privacy-related queries. We are committed to handling all data subject requests and privacy enquiries with the highest level of care and within the response timeframes described in Section 12 of this Policy.