Privacy Policy

This Privacy Policy ("Policy") is published by erek39 ("we", "us", "our", or "the Company"), the operator of the online betting and live casino platform accessible at https://erek39.cam ("the Platform"). This Policy applies to all individuals who visit, register on, or otherwise interact with the Platform, including prospective members, active members, and former members ("you" or "Member").

erek39 is designed and marketed for adults aged 21 and over residing primarily in Indonesia. When you create an Account or use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read alongside our Terms & Conditions, which govern the overall contractual relationship between you and erek39. In the event of any conflict between this Policy and the Terms & Conditions on a matter of data privacy, this Policy shall prevail.

erek39 collects the following categories of Personal Data from Members and prospective Members:

erek39 collects Personal Data through the following channels and mechanisms:

1. Direct Submission: Data you provide when completing the registration form, submitting KYC documents, filling out payment details, or communicating with our support team via live chat or email.
2. Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser fingerprint, and session activity logs. This data is captured through server-side logging and first-party cookies.
3. Payment Processors: When you initiate a deposit or withdrawal, your designated payment provider (e.g., BCA, BRI, OVO, DANA, GoPay) transmits transaction confirmation data to erek39 to facilitate account crediting and reconciliation. erek39 does not receive or store full bank account passwords or full card numbers.
4. KYC Verification Partners: erek39 works with accredited identity verification service providers to cross-reference the documents you submit during KYC. These partners return a verification status and confidence score to erek39; raw document images are handled in accordance with their own privacy policies.
5. Analytics Tools: erek39 uses first-party analytics tools to understand aggregate platform usage patterns. These tools collect anonymized or pseudonymized behavioral data and do not identify individual Members by name.

erek39 processes your Personal Data for the following specific, legitimate purposes:

• Account Management: Creating, maintaining, and administering your Member Account, including processing login requests, managing preferences, and enabling account recovery.
• Transaction Processing: Facilitating deposits and withdrawals in IDR through your selected Indonesian bank or e-wallet, verifying payment confirmations, and maintaining accurate financial records.
• Identity Verification (KYC): Verifying your age (21+ requirement), identity, and residence as required by our responsible gaming obligations and anti-money laundering (AML) compliance procedures.
• Fraud Prevention & Security: Detecting and preventing unauthorized account access, fraudulent transactions, bot activity, collusion, and other forms of platform abuse.
• Legal & Regulatory Compliance: Fulfilling obligations under applicable international gaming regulations, AML legislation, and data protection frameworks. This may include disclosing data to authorities where legally required.
• Customer Support: Responding to inquiries, resolving disputes, processing responsible gaming requests (deposit limits, self-exclusion), and maintaining support records.
• Platform Improvement: Analyzing aggregate usage data to improve game offerings, optimize platform performance, and tailor the user experience for our Indonesian membership base.
• Promotional Communications: Sending you information about bonuses, promotions, and platform updates, subject to your communication preferences. You may opt out at any time by contacting support.

erek39 will not process your Personal Data for any purpose that is incompatible with those listed above without first obtaining your explicit consent.

Each category of processing activity carried out by erek39 rests on one or more of the following legal bases:

erek39 does not sell your Personal Data. We share data with third parties only in the following limited circumstances:

1. Payment Service Providers: We share the minimum necessary transaction and identity data with Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process deposits and withdrawals on your behalf.
2. KYC and AML Partners: Accredited identity verification and anti-money laundering screening providers receive copies of KYC documents and identity data to perform verification checks. These partners are contractually bound to process data solely for the stated verification purpose and to maintain equivalent data security standards.
3. Cloud Infrastructure Providers: erek39 uses reputable cloud hosting and database providers to store and process platform data. These providers act as Data Processors under binding data processing agreements and have no independent right to use Member data.
4. Game Technology Partners: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive a pseudonymized player identifier to facilitate game session management and RTP auditing. These partners do not receive your full name, national ID, or financial details.
5. Legal and Regulatory Authorities: erek39 will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or urgent safety consideration. We will notify affected Members of such disclosures wherever legally permitted.
6. Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your Personal Data may be transferred to the successor entity. You will be notified of any such transfer and its privacy implications prior to completion.

erek39 retains Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is either securely and irreversibly deleted or rendered permanently anonymous so that it can no longer be associated with any individual.

erek39 implements a multi-layered data security framework designed to protect Personal Data against unauthorized access, accidental loss, disclosure, or destruction. Our key security measures include:

• Encryption in Transit: All data exchanged between your browser or device and the Platform is encrypted using 256-bit SSL/TLS protocols. HTTPS is enforced across the entire Platform without exception.
• Encryption at Rest: Sensitive data fields — including KYC document images, bank account identifiers, and authentication credentials — are encrypted at rest using AES-256 or equivalent industry-standard algorithms.
• Access Controls: Access to Member Personal Data within erek39's internal systems is governed by strict role-based access controls. Staff members access only the data necessary to perform their assigned function, and all access events are logged and audited.
• Two-Factor Authentication: erek39 supports and encourages two-factor authentication (2FA) for all Member accounts. Internal administrative systems require 2FA for all staff as a mandatory control.
• Penetration Testing: The Platform undergoes regular third-party penetration tests and security audits. Identified vulnerabilities are remediated in accordance with a risk-based prioritization framework.
• Incident Response: In the event of a confirmed data breach that is likely to result in a risk to the rights and freedoms of Members, erek39 will notify affected Members within 72 hours of becoming aware of the breach, to the extent that contact information is available and legally required.

erek39 uses cookies and similar tracking technologies to provide core Platform functionality and to understand how Members interact with the Platform. We use the following categories of cookies:

erek39 does not use third-party advertising cookies or cross-site tracking technologies. You may manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies will prevent you from accessing authenticated areas of the Platform.

As a Member of erek39, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team using the details provided in Section 14. erek39 will respond to all verified requests within 30 calendar days.

erek39 will not charge a fee for standard data rights requests. We reserve the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive in volume. Where we are unable to fulfill a request due to legal obligations, we will explain the applicable restriction clearly and in writing.

erek39 operates a strict minimum age policy of 21 years. The Platform is not directed at, and does not knowingly collect Personal Data from, individuals under the age of 21. Registration by minors is expressly prohibited under our Terms & Conditions.

During the registration and KYC verification process, erek39 verifies the age of all prospective Members through documentary identity checks. Any account found to have been created by a person under 21 will be immediately suspended, all associated funds will be returned to the depositing payment method (net of any processing costs), and all Personal Data associated with the underage account will be securely deleted in accordance with our data lifecycle policy.

If you have reason to believe that a minor has registered or is actively using an erek39 Account, please contact our support team immediately. We treat all reports of underage access as a high-priority compliance matter and will investigate and act within 4 hours during WIB business hours.

erek39 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform functionality. When material changes are made — meaning changes that affect how we use your data or the rights available to you — we will notify registered Members by email at least 7 days before the revised Policy takes effect.

Minor amendments, such as typographical corrections or clarifications that do not alter the substance of how data is processed, may be published without advance notice. The "Last Updated" date at the top of this page reflects the effective date of the current version.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the changes, you have the right to close your Account and request deletion of your Personal Data in accordance with Section 11.

We encourage all Members to review this Policy periodically to stay informed of how erek39 protects and manages your personal information. The current version of this Policy is always available at https://erek39.cam/privacy-policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the erek39 Privacy Team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line for prompt routing to our data protection team.
• Live Chat: Available 24/7 through the Platform interface. For data rights requests, our team will escalate your query to the Privacy Team within 2 hours.
• Response Time: All written privacy requests are acknowledged within 48 hours and fully responded to within 30 calendar days. Complex or high-volume requests may take up to 60 days, in which case we will notify you of the extension within the initial 30-day period.

If you are dissatisfied with erek39's response to a privacy complaint, you have the right to escalate your complaint to a relevant data protection supervisory authority or seek resolution through applicable legal channels in your jurisdiction.