Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below unless the context indicates otherwise:

• "idx66", "we", "us", "our" — the idx66 platform accessible at https://idx66.bio and its operating entity responsible for processing your personal data.
• "Member", "you", "your" — any individual who has registered an account on the idx66 platform or who browses the platform without registering.
• "Personal Data" — any information that identifies or can be used to identify a natural person, directly or indirectly, including name, date of birth, address, phone number, email address, payment details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "KYC" — Know Your Customer identity verification, comprising the submission and approval of government-issued identification and proof of payment method documents.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data; for the purposes of this Policy, idx66 acts as Data Controller in respect of all Member data.
• "Third-Party Processor" — any external service provider engaged by idx66 to process Personal Data on its behalf, including payment processors, KYC verification vendors, fraud detection providers, and cloud hosting services.
• "WIB" — Western Indonesia Time (UTC+7), the default time zone for all operational references in this Policy.

idx66 collects the following categories of Personal Data, depending on how you interact with the platform:

2.1 Registration Data

When you open an idx66 account, we collect your full legal name, date of birth, residential address in Indonesia, mobile telephone number, and the username and password you choose. This information is mandatory — the account cannot be created without it.

2.2 Identity Verification (KYC) Data

To comply with our anti-money-laundering (AML) obligations and to protect the integrity of the platform, we may collect copies of your government-issued national identity card (KTP), passport or driver's licence, a photograph of you holding the identity document, and documentary evidence of your payment method (for example, a screenshot of your OVO, DANA, or mobile banking application showing your registered name and account number).

2.3 Financial Data

When you make a deposit or request a withdrawal, we record the payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, GoPay, ShopeePay, LinkAja), transaction amounts in Indonesian Rupiah (IDR), transaction timestamps (WIB), and transaction reference numbers. Full bank account numbers and card numbers are not stored by idx66; they are handled exclusively by our PCI-DSS-compliant payment processor partners.

2.4 Technical & Usage Data

When you access the idx66 platform, our servers automatically record your IP address, browser type and version, operating system, device type, referring URL, pages visited, session duration, and in-game activity logs. This data is used for fraud detection, platform security, and service improvement.

2.5 Communications Data

If you contact our support team via live chat or email, we retain transcripts and correspondence for quality assurance, dispute resolution, and regulatory compliance purposes.

idx66 collects Personal Data through the following channels:

• Directly from you — during account registration, KYC submission, deposit and withdrawal requests, support interactions, and participation in promotional campaigns.
• Automatically — through server logs, session cookies, and browser fingerprinting technology as you navigate the platform.
• From Third-Party Processors — identity verification vendors and payment processors may return verified data attributes (such as a confirmed name match or a payment method ownership flag) to idx66 as part of KYC and fraud-prevention workflows.
• From publicly available sources — in limited circumstances relating to fraud investigation, idx66 may cross-reference information against publicly accessible databases, sanction lists, or politically exposed persons (PEP) registries.

idx66 processes your Personal Data for the following purposes. The table below maps each purpose to the category of data involved and the corresponding legal basis described in Clause 5.

idx66 does not use automated decision-making or profiling that produces legal effects or similarly significant consequences for Members without human oversight and the opportunity to contest the outcome.

idx66 relies on the following legal bases for processing your Personal Data:

• Contract Performance: Processing is necessary to open your account, execute transactions, and deliver the gaming and sportsbook services you have requested. Without this processing, idx66 cannot provide its services to you.
• Legal Obligation: idx66 is subject to AML, counter-terrorism financing (CTF), and responsible gaming regulations that require it to collect, verify, and retain certain categories of Personal Data regardless of your preferences.
• Legitimate Interest: idx66 has a legitimate interest in securing the platform, preventing fraud, analysing aggregated usage patterns to improve services, and enforcing its Terms & Conditions. These interests are balanced against and do not override your fundamental privacy rights.
• Consent: Where processing is not required for contract performance or legal compliance — specifically, for optional promotional marketing communications — idx66 will ask for your explicit consent at the time of registration or at the point the communication preference is set. You may withdraw consent at any time by contacting support or updating your account preferences.

6.1 Categories of Recipients

idx66 shares Personal Data only with the following categories of third parties, and only to the extent necessary for the stated purpose:

• Payment Processors: Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction data necessary to execute deposits and withdrawals.
• KYC and Identity Verification Vendors: Specialist third-party providers process submitted identity documents to confirm authenticity and perform sanctions and PEP screening.
• Game Studios and Software Providers: Live casino and slot providers — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, and Spribe — receive a pseudonymous Member identifier necessary to operate the game session. These providers do not receive your full name, address, or financial details.
• Fraud Detection and Cybersecurity Providers: Technical usage data (IP addresses, device fingerprints, behavioural patterns) may be shared with specialist fraud prevention platforms to identify and block suspicious activity.
• Cloud Infrastructure Providers: idx66's platform infrastructure is hosted on enterprise-grade cloud servers. The hosting provider processes data in the capacity of a data processor acting on idx66's documented instructions.
• Regulatory Authorities: Where required by applicable law, idx66 will disclose Personal Data to financial intelligence units, law enforcement bodies, or licensing authorities without prior notice to the Member.

6.2 No Sale of Data

idx66 does not sell, rent, or exchange your Personal Data with third-party marketing organisations, data brokers, or advertisers. All Third-Party Processors engaged by idx66 are bound by contractual data protection obligations that are no less restrictive than those set out in this Privacy Policy.

7.1 Types of Cookies Used

idx66 uses the following categories of cookies and similar tracking technologies when you access the platform:

7.2 No Third-Party Advertising Cookies

idx66 does not deploy third-party advertising networks, social media tracking pixels, or cross-site behavioural targeting cookies. No data about your idx66 platform activity is shared with advertising platforms such as Google Ads, Meta, or TikTok Ads.

7.3 Managing Cookies

You may configure your browser to block or delete cookies. Please note that disabling strictly necessary cookies will prevent you from logging in to your idx66 account. Instructions for managing cookies in the most common browsers are available through each browser's official documentation. Disabling performance or preference cookies will not affect your ability to use the core platform.

idx66 implements a layered security architecture designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our technical and organisational security measures include:

• TLS 1.3 encryption for all data in transit between your device and idx66 servers.
• AES-256 encryption for Personal Data and KYC documents stored at rest.
• Multi-factor authentication (MFA) for all internal administrative access to Member data systems.
• Role-based access controls ensuring that only authorised personnel with a documented operational need can access specific categories of Member data.
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• Intrusion detection systems monitoring network traffic in real time for anomalous patterns.
• Incident response procedures with documented escalation paths to notify affected Members and relevant authorities in the event of a confirmed data breach, within the timeframes required by applicable law.

As a Member of the idx66 platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact our support team using the details in Clause 14. idx66 will respond to verified rights requests within 30 calendar days of receipt.

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is being processed.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you may request that it be corrected. Account name corrections require re-submission of KYC documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data. This right is subject to our legal obligation to retain certain records (see Clause 10). Where a legal retention obligation applies, we will suppress your data from active processing while retaining it only for mandatory compliance purposes.
• Right to Restrict Processing: In certain circumstances — for example, while a rectification request is under review — you may request that we limit processing of your data to storage only.
• Right to Data Portability: You may request a machine-readable export of the Personal Data you provided to us directly (registration data and preference settings), in a structured, commonly used format.
• Right to Object: You may object to processing based on legitimate interest, including profiling for responsible gaming purposes. We will assess your objection and cease or restrict processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., promotional communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

idx66 retains Personal Data for no longer than is necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods imposed by applicable law and regulatory guidance:

At the end of each applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

The idx66 platform is intended exclusively for adults who are 21 years of age or older. idx66 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that Personal Data has been submitted by a person under 21, we will immediately close the associated account, void any transactions, and securely delete all data collected from that individual without delay.

If you are a parent or guardian and you believe that your child under the age of 21 has created an idx66 account or submitted Personal Data to us, please contact our support team immediately using the contact details in Clause 14. We will treat such reports as highest priority and act within 24 hours of receiving sufficient information to identify the account.

As an internationally operated platform, idx66 may transfer your Personal Data to servers or Third-Party Processors located outside of Indonesia. Where such transfers occur, idx66 ensures that appropriate safeguards are in place to protect your Personal Data to a standard equivalent to that required under applicable Indonesian data protection law, including:

• Contractual clauses (data processing agreements) with all Third-Party Processors that impose binding obligations equivalent to those set out in this Policy.
• Transfer to processors located in jurisdictions recognised as providing an adequate level of data protection by relevant regulatory bodies.
• Additional technical controls, such as encryption and pseudonymisation, applied to data prior to any international transfer where the destination jurisdiction provides a lower baseline level of protection.

You may request information about the specific safeguards applied to any international transfer of your Personal Data by contacting our Data Protection Officer at the details provided in Clause 14.

idx66 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. When material changes are made, we will notify active Members via a prominent notice on the platform and, where practicable, by email to the address on file at least 14 days before the revised Policy takes effect.

The effective date displayed at the top of this page will be updated with each revision. We recommend reviewing this Policy periodically. Your continued use of the idx66 platform following the effective date of any revised Policy constitutes your acknowledgement of the updated terms. If you do not accept the revised Policy, you must cease using the platform and contact us to close your account in accordance with the account closure procedure described in our Terms & Conditions.

Previous versions of this Privacy Policy are available upon request by contacting our support team.

If you have any questions, concerns, or complaints about this Privacy Policy or about how idx66 handles your Personal Data, or if you wish to exercise any of the rights described in Clause 9, please contact us through the following channels:

• Email: [email protected] — plain text address, not a clickable link; responses within 2 hours during business hours WIB, within 24 hours at all other times.
• Data Rights Requests: Address your request clearly as "Data Rights Request — [your username]" in your email subject line to ensure prompt routing to our Data Protection Officer.
• Live Chat: Available 24/7 through the chat widget on the idx66 platform; average response time under 60 seconds.

We aim to resolve all privacy-related enquiries and data rights requests promptly and fairly. If you are not satisfied with our response, you retain the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.