Privacy Policy

1 Introduction

twdown operates as a trusted online betting platform primarily serving players based in Indonesia, including major cities such as Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and Makassar. The protection of your personal data is a fundamental priority for us. We process personal information solely for defined, legitimate purposes and apply internationally recognized data protection principles at every stage of our operations.

This Policy applies to all personal data collected through the twdown website, mobile interfaces, customer support channels, payment processing systems, and any other service touchpoints operated by or on behalf of twdown. It does not apply to the practices of third-party companies or services that may be referenced on or linked from our Platform — each of those third parties operates under its own privacy framework.

We are committed to the following core privacy principles: lawfulness, fairness, and transparency in data processing; purpose limitation (data collected only for specified, explicit purposes); data minimization (we collect only what is necessary); accuracy (keeping records up to date); storage limitation (data retained only as long as required); integrity and confidentiality (protecting data against unauthorized access); and accountability (demonstrating compliance with these principles at all times).

2 Definitions

For the purposes of this Policy, the following terms carry the meanings defined below:

• "Personal Data" — any information relating to an identified or identifiable natural person, directly or indirectly, including name, identification number, location data, online identifier, or factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Controller" — twdown, as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Processor" — a third party that processes personal data on behalf of twdown under a binding contractual agreement (e.g., payment processors, KYC verification providers, cloud hosting providers).
• "Consent" — a freely given, specific, informed, and unambiguous indication of a Player's agreement to the processing of their personal data for one or more specified purposes.
• "KYC" — Know Your Customer — identity and address verification procedures used to confirm Player eligibility and comply with anti-money-laundering obligations.
• "Cookie" — a small text file placed on your device by the Platform to enable functionality, remember preferences, and analyze usage patterns.

3 Data We Collect

twdown collects personal data in several distinct categories depending on how you interact with our Platform. The table below sets out what we collect and why:

Category	Specific Data Points	Primary Purpose
Identity Data	Full legal name, date of birth, KTP (National ID) number, selfie photograph, KTP image scan	Account registration, KYC verification, age verification (21+)
Contact Data	Email address, Indonesian mobile phone number, residential address	Account communication, customer support, withdrawal confirmation
Financial Data	Bank account number and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, etc.), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history in IDR	Deposit processing, withdrawal disbursement, fraud prevention, AML compliance
Technical Data	IP address, device type and operating system, browser type and version, session timestamps, login history, geolocation (city-level)	Security monitoring, fraud detection, platform optimization
Usage Data	Pages visited, games played, bets placed (sport, amount, odds, outcome), session duration, click patterns, search queries within Platform	Product improvement, personalization, responsible gaming monitoring
Communications Data	Live chat transcripts, email correspondence, support ticket content, call recordings (if applicable)	Dispute resolution, quality assurance, compliance auditing
Marketing Preferences	Promotional opt-in/opt-out status, preferred communication channel, bonus history	Targeted promotions, VIP program management (only where consent is given)

4 How We Collect Data

4.1 Directly From You

The majority of personal data we hold is provided directly by you during the following interactions:

• Completing the account registration form on the twdown Platform;
• Submitting KYC verification documents (KTP scan, proof of address, selfie photograph);
• Making a deposit or requesting a withdrawal, including providing bank account or e-wallet details;
• Contacting our customer support team via live chat, email, or any other support channel;
• Opting into or out of marketing communications;
• Participating in promotions, surveys, or VIP loyalty programs.

4.2 Automatically From Your Device

When you access the twdown Platform, our systems automatically collect certain technical data from your device and browser. This includes your IP address, device identifiers, operating system version, browser type, referring URL, session start and end times, and pages or game interfaces visited. This automatic collection enables us to maintain platform security, detect suspicious login activity, and continuously improve the user experience.

4.3 From Third-Party Service Providers

twdown may receive supplementary personal data from trusted third-party partners in the following circumstances:

• KYC verification providers — identity matching and document authentication results;
• Payment processors — transaction status confirmations from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay);
• Fraud prevention services — device fingerprinting and risk-scoring signals;
• Analytics platforms — aggregated, anonymized behavioral data to help us understand Platform usage patterns.

5 Purpose of Processing

twdown processes your personal data exclusively for the following defined purposes. We do not process personal data for any purpose incompatible with those listed below without first obtaining your explicit consent:

1. Account Management — creating, maintaining, and securing your Player Account, including authentication and password recovery;
2. Age and Identity Verification — confirming that you are at least 21 years of age and that the identity you have provided is authentic, in accordance with our KYC obligations;
3. Transaction Processing — facilitating deposits and withdrawals in Indonesian Rupiah (IDR) via your nominated bank account or e-wallet, and maintaining accurate financial records;
4. Regulatory Compliance — meeting our anti-money-laundering (AML), counter-terrorism financing (CTF), and responsible gaming obligations under applicable international standards;
5. Fraud Prevention and Security — detecting, investigating, and preventing unauthorized account access, multi-accounting, bonus abuse, and other fraudulent or prohibited activities;
6. Customer Support — responding to your inquiries, resolving disputes, and documenting support interactions for quality assurance and compliance purposes;
7. Platform Improvement — analyzing aggregated usage data to enhance the performance, reliability, and feature set of the twdown Platform;
8. Responsible Gaming — monitoring gameplay patterns for indicators of problematic behavior and taking proactive steps — including account restrictions — where necessary to protect Player welfare;
9. Marketing Communications — sending promotional offers, bonus notifications, and VIP program updates to Players who have given explicit opt-in consent, with an easy mechanism to withdraw consent at any time.

6 Legal Basis for Processing

twdown processes your personal data on one or more of the following lawful bases, depending on the specific processing activity:

• Contractual Necessity — processing required to perform our obligations under the Terms & Conditions you accepted upon account registration, including account management, bet settlement, and financial transactions;
• Legal Obligation — processing required to comply with KYC, AML, CTF, and responsible gaming regulations applicable to international online gaming operators;
• Legitimate Interests — processing carried out in pursuit of twdown's legitimate business interests, including fraud prevention, platform security, and service improvement, provided those interests are not overridden by your fundamental rights;
• Consent — processing for marketing communications and certain non-essential analytics, where your freely given, specific, and informed consent has been obtained. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing

twdown does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary:

7.1 Service Providers (Processors)

We engage carefully vetted third-party processors to support our operations. These include KYC and identity verification providers, cloud infrastructure and hosting services, payment gateway operators (including interfaces with BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay), fraud detection platforms, and customer support software providers. All processors are bound by contractual data processing agreements that prohibit them from using your data for any purpose other than delivering the contracted service to twdown.

7.2 Regulatory and Law Enforcement Authorities

twdown may disclose personal data to governmental, regulatory, or law enforcement bodies — including Indonesia's financial intelligence unit (PPATK) — where we are legally required to do so, or where such disclosure is necessary to investigate suspected criminal activity, enforce our Terms & Conditions, or protect the rights, property, or safety of twdown, our Players, or the public.

7.3 Business Transfers

In the event that twdown undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the successor entity as part of that transaction. In such circumstances, we will notify affected Players via the email address on file and ensure the receiving entity is bound by privacy obligations no less protective than those described in this Policy.

7.4 Aggregated and Anonymized Data

twdown may share aggregated, anonymized statistical data — from which no individual Player can be identified — with analytics partners, game studios, or industry bodies for the purposes of research, product development, and market analysis. This sharing does not constitute disclosure of personal data and carries no privacy risk to individual Players.

8 International Data Transfers

As an internationally operated platform serving Indonesian Players, twdown may process or store personal data on servers located outside Indonesia. Where such international transfers occur, we ensure that appropriate safeguards are in place to protect your data at a standard equivalent to that applied within the Platform's primary operating jurisdiction.

Safeguards used for international transfers include contractual clauses that obligate the receiving party to protect data to the same standard as twdown; data processing agreements with processors that comply with internationally recognized privacy frameworks; and technical measures including encryption at rest and in transit, access controls, and audit logging.

Regardless of where your data is stored or processed, twdown retains full responsibility for ensuring it is handled in accordance with this Privacy Policy.

9 Data Retention

twdown retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. Our standard retention periods are as follows:

• Account and identity data — retained for the duration of your active Account plus a minimum of 5 years following account closure, to comply with AML record-keeping requirements;
• Financial transaction records — retained for a minimum of 5 years from the date of each transaction, in accordance with financial reporting obligations;
• KYC documents — retained for 5 years from the date of verification or from account closure, whichever is later;
• Customer support communications — retained for 2 years from the date of the interaction, unless the communication relates to an ongoing dispute or investigation;
• Marketing preferences and consent records — retained for 3 years from the date consent was given or last renewed;
• Technical and usage logs — retained for 12 months on a rolling basis, after which they are anonymized or deleted.

When personal data is no longer required for its original purpose and no legal obligation compels continued retention, twdown securely deletes or irreversibly anonymizes it using industry-standard data destruction methods.

10 Security Measures

twdown implements a comprehensive, layered security architecture to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our technical and organizational security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or app and our servers;
• Encryption at rest for all databases containing personal and financial data, using AES-256 encryption standards;
• Role-based access controls (RBAC) — internal access to personal data is strictly limited to staff with a documented need-to-know, and all access is logged and audited;
• Multi-factor authentication (MFA) required for all internal administrative access to systems holding Player data;
• Regular penetration testing conducted by independent third-party security firms to identify and remediate vulnerabilities;
• 24/7 intrusion detection and monitoring systems that flag and respond to anomalous access patterns in real time;
• Data breach response procedures — in the unlikely event of a confirmed data breach affecting your personal data, twdown will notify affected Players without undue delay and take all reasonable steps to contain and remediate the incident.

11 Cookies & Tracking Technologies

11.1 What Are Cookies?

Cookies are small text files stored on your device when you visit the twdown Platform. They allow us to recognize your browser, remember your preferences, maintain your login session, and analyze how you interact with our services. We also use related technologies such as web beacons, pixel tags, and local storage objects for similar purposes.

11.2 Categories of Cookies We Use

• Strictly Necessary Cookies — essential for core Platform functionality including login session management, bet slip persistence, and security token validation. These cannot be disabled without breaking core features.
• Performance and Analytics Cookies — collect anonymized data about how Players navigate the Platform, which pages are most visited, and where errors occur, helping us improve reliability and speed.
• Functionality Cookies — remember your preferences such as language selection (English / Bahasa Indonesia), preferred odds format, and notification settings.
• Marketing Cookies — used only where you have provided explicit consent, to track the effectiveness of promotional campaigns and deliver relevant offers. You may opt out of marketing cookies at any time via your Account settings.

11.3 Managing Cookies

You may manage cookie preferences through your browser settings, which allow you to block, delete, or receive alerts about cookies. Please be aware that disabling strictly necessary cookies will impair your ability to use core twdown features. For detailed guidance on managing cookies in your specific browser, consult your browser's help documentation.

12 Your Privacy Rights

As a Player on the twdown Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our Data Privacy team at [email protected] (plain text — not a clickable link). We will respond to all valid requests within 30 days.

• Right of Access — you may request a copy of the personal data we hold about you, including information on how it is processed, where it came from, and with whom it has been shared;
• Right to Rectification — if any personal data we hold is inaccurate or incomplete, you have the right to request that we correct or update it promptly;
• Right to Erasure ("Right to be Forgotten") — you may request deletion of your personal data where it is no longer necessary for its original purpose, subject to overriding legal retention obligations (e.g., AML record-keeping requirements);
• Right to Restriction of Processing — you may ask us to suspend certain processing activities while a dispute or correction request is being resolved;
• Right to Data Portability — you may request a structured, machine-readable copy of personal data you have provided to us, for transfer to another service provider;
• Right to Object — you may object at any time to processing of your data for direct marketing purposes. We will honor such objections immediately and without question;
• Right to Withdraw Consent — where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

13 Protection of Minors

The twdown Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, store, or process the personal data of any person under the age of 21. Our registration process incorporates age verification checks, and all Players are required to complete KYC identity verification before withdrawing funds.

If twdown discovers that it has inadvertently collected personal data from a person under 21 years of age, we will immediately suspend the associated Account, delete or anonymize all personal data collected, forfeit any associated balance, and — where appropriate — report the incident to relevant authorities. If you believe a minor has registered on our Platform, please contact us immediately at [email protected] so that we may take prompt corrective action.

We encourage parents and guardians to make use of parental control software to prevent minors from accessing online gambling sites. Our Responsible Gaming page provides further resources and guidance on this topic.

14 Policy Amendments

twdown reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or regulatory requirements. When material changes are made, we will notify registered Players via email to the address on file at least 7 calendar days before the updated Policy takes effect. The revised Policy will also be published on this page with an updated "Last Updated" date.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Continued use of the twdown Platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree with material changes, you are entitled to close your Account before the changes take effect by contacting our support team.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data twdown holds about you, please reach out to our Data Privacy team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform
• Response Time: Privacy-related requests are acknowledged within 24 hours and fully resolved within 30 calendar days
• Language: Privacy inquiries are handled in both English and Bahasa Indonesia by our dedicated support agents

For concerns specifically related to responsible gaming, self-exclusion, or deposit limit requests, please visit our dedicated Responsible Gaming page or raise the matter directly with our 24/7 support team. We treat all such requests as high priority and act on them immediately.