Privacy Policy

1. Definitions and Scope

This Privacy Policy ("Policy") describes how valbet ("we," "us," or "our") collects, uses, discloses, and safeguards the personal information of individuals who visit, register with, or otherwise interact with the valbet website and associated services (collectively, the "Platform"). This Policy applies to all users regardless of the device or location from which they access the Platform, with particular relevance for users located in the Republic of Indonesia.

For the purposes of this Policy:

• "Personal Data" means any information that identifies, or could reasonably be used to identify, a specific individual, including but not limited to names, identification numbers, contact details, financial data, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, and deletion.
• "User" or "You" refers to any registered account holder or visitor to the valbet Platform.
• "KYC" stands for Know Your Customer — the identity and age-verification procedures required before full account functionality is activated.
• "Sensitive Data" refers to Personal Data that warrants enhanced protection, such as government-issued identification numbers (e.g., Indonesian KTP number), payment card details, and biometric data.

By accessing or using the valbet Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your information as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.

2. Data Controller Information

valbet operates as the data controller responsible for the Personal Data collected through the Platform. We are responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently in accordance with applicable international data protection standards.

For Indonesian residents, valbet acknowledges the principles set out in Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions (GR 71/2019) and relevant provisions of Indonesia's developing personal data protection framework. We are committed to upholding the privacy rights of all Indonesian users to the fullest extent practicable.

3. Personal Data We Collect

3.1 Registration and Identity Data

When you create an account with valbet, we collect the following identity and contact information:

• Full legal name (as it appears on government-issued identification)
• Date of birth (to verify you are 21 years of age or older)
• Gender
• Residential address, including city, province, and postal code within Indonesia
• Email address
• Mobile telephone number
• Preferred language
• Username and encrypted password

3.2 Identity Verification (KYC) Data

To comply with our anti-money laundering obligations and to enforce our 21+ age policy, we collect the following verification documents:

• Indonesian National Identity Card (KTP — Kartu Tanda Penduduk), including the 16-digit NIK number
• Passport or driver's license (SIM) where KTP is not available
• Proof of address documents (utility bills, bank statements) dated within three months
• Selfie photograph taken while holding the identity document
• In certain high-value cases: source-of-funds declaration

3.3 Financial and Transaction Data

We collect financial data necessary to process deposits, withdrawals, and to comply with anti-money laundering laws:

• Bank account details (bank name — e.g., BCA, BRI, BNI, Mandiri — account number, account holder name)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja phone numbers or account IDs)
• Deposit and withdrawal transaction histories, amounts, and timestamps
• Betting history, game activity, and wagering records
• Bonus redemption and promotion usage history

We do not store full credit or debit card numbers. All card-based payment processing is handled by PCI-DSS-compliant third-party payment processors, and we receive only tokenized references to card transactions.

3.4 Technical and Usage Data

When you access the Platform, we automatically collect certain technical information:

• IP address and approximate geographic location (city/region level)
• Device type, operating system, and browser version
• Pages visited, features used, and time spent on the Platform
• Referral source (how you arrived at valbet)
• Session timestamps and login/logout records
• Error logs and crash reports

3.5 Communications Data

We retain records of communications between you and valbet, including:

• Live chat transcripts
• Email correspondence
• WhatsApp messages (where consent is given)
• In-app messages and notifications
• Support ticket records and resolution notes

4. How We Collect Your Data

valbet collects Personal Data through the following channels:

• Direct submission: Information you provide during registration, KYC verification, deposit/withdrawal requests, or when contacting customer support.
• Automated collection: Technical data collected automatically as you navigate the Platform through cookies, web beacons, and server logs.
• Third-party sources: Identity verification agencies, fraud prevention databases, and payment processors who may share data with us as part of our compliance obligations.
• KYC service providers: Automated document verification platforms that process identity document images and return verification results to valbet.

5. Purposes and Legal Basis for Processing

We process your Personal Data for the following purposes, each with a corresponding legal basis:

6. Sharing and Disclosure of Personal Data

valbet does not sell, rent, or trade your Personal Data to third parties. We share your information only in the following limited circumstances, and only to the extent strictly necessary:

• Payment processors and banking partners: We share transaction data with BCA, BRI, BNI, Mandiri, CIMB Niaga, and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposits and withdrawals.
• KYC and identity verification providers: Document images and personal details are shared with accredited third-party verification agencies to complete the KYC process.
• Fraud prevention and AML screening services: We may share data with international fraud detection databases to identify and prevent fraudulent activity.
• Game providers: Providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft may receive your user ID and session token to deliver their games. They do not receive your full name, banking details, or KYC documents.
• IT and infrastructure providers: Cloud hosting, content delivery, and security service providers who process data on our behalf under strict data processing agreements.
• Legal authorities: We may disclose your data to law enforcement, regulatory bodies, or courts where required to do so by applicable law, court order, or to protect the rights and safety of valbet, its users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of valbet's business, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom we share Personal Data are contractually required to implement appropriate technical and organizational security measures and to use your data only for the purposes specified by valbet.

7. International Data Transfers

valbet operates internationally, and your Personal Data may be transferred to and processed in countries outside Indonesia. Some of these countries may not have data protection laws equivalent to those in Indonesia. Where such transfers occur, we implement appropriate safeguards, including:

• Contractual clauses that require recipients to protect your data to standards equivalent to those described in this Policy
• Ensuring that third-party processors are bound by data processing agreements incorporating internationally recognized data protection principles
• Conducting due diligence on the data protection practices of all international service providers before engagement

By using the valbet Platform, you acknowledge and consent to the transfer of your Personal Data to servers and processors located outside Indonesia where necessary to provide our services.

8. Data Retention Periods

We retain your Personal Data for as long as necessary to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of submission or account closure, whichever is later.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Betting and gaming history: Retained for a minimum of three (3) years to facilitate dispute resolution and responsible gaming analysis.
• Customer support communications: Retained for two (2) years from the date of resolution.
• Technical and usage logs: Retained for twelve (12) months, then deleted or fully anonymized.
• Marketing consent records: Retained for the duration of the consent period plus three (3) years to demonstrate compliance.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with you.

9. Cookies and Tracking Technologies

9.1 What Cookies We Use

valbet uses cookies and similar tracking technologies (such as web beacons and local storage) to operate and improve the Platform. We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function correctly — enabling login sessions, security tokens, and core navigation. These cannot be disabled without affecting Platform functionality.
• Performance and analytics cookies: Help us understand how users interact with the Platform, which pages are visited most frequently, and where errors occur. Data collected is aggregated and anonymized.
• Functionality cookies: Remember your preferences such as language selection, currency display, and odds format to personalize your experience.
• Security cookies: Used to detect and prevent fraudulent activity, bot traffic, and multiple-account abuse.

We do not use third-party advertising or retargeting cookies. We do not participate in cross-site behavioral advertising networks.

9.2 Managing Cookie Preferences

You can control cookie settings through your browser. Most modern browsers allow you to block or delete cookies via their settings menus. Please note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.

10. Security Measures

valbet takes the security of your Personal Data seriously and maintains a comprehensive suite of technical and organizational security controls, including:

• TLS/SSL encryption: All data in transit between your device and our servers is encrypted using current TLS standards.
• Encryption at rest: Sensitive data stored on our servers is encrypted using AES-256 or equivalent standards.
• Access controls: Personal Data is accessible only to authorized valbet staff who require it to perform their job functions, governed by role-based access control (RBAC) policies.
• Multi-factor authentication (MFA): Available to all users and mandatory for administrative access to valbet systems.
• Regular security audits: We engage independent cybersecurity specialists to conduct penetration testing and vulnerability assessments at least annually.
• Incident response plan: We maintain a documented data breach response procedure and will notify affected users and relevant authorities within required timeframes in the event of a material breach.
• Staff training: All valbet staff handling Personal Data receive regular data protection and security awareness training.

11. Your Rights

Subject to applicable law, you have the following rights with respect to your Personal Data held by valbet:

• Right of access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to rectification: If any of your Personal Data is inaccurate or incomplete, you have the right to request correction. You can update most information directly through your Account settings.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we are required to retain certain data (e.g., KYC records, transaction history) for a minimum of five years even after account closure.
• Right to restriction of processing: In certain circumstances you may request that we restrict the processing of your data while a dispute or verification request is pending.
• Right to data portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format (such as CSV or JSON) where technically feasible.
• Right to object: You have the right to object to processing based on our legitimate interests, or to opt out of direct marketing communications at any time.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our support team at [email protected]. We will respond within 30 calendar days. We may need to verify your identity before processing certain requests to protect against unauthorized access to your data.

12. Children's Privacy

The valbet Platform is strictly for adults aged 21 years or older. We do not knowingly collect Personal Data from any individual under the age of 21. If you are a parent or guardian and believe that your child has provided Personal Data to valbet without your consent, please contact us immediately at [email protected]. Upon verification, we will delete such data from our systems as promptly as practicable.

We use age-verification checks during the registration process and require submission of government-issued identification as part of our KYC process to enforce this requirement. Any account found to belong to an individual under 21 will be immediately suspended, all funds returned (net of any losses), and the account permanently closed.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, new services, or evolving legal requirements. When we make material changes, we will notify you by posting a prominent notice on the Platform, sending an email to your registered address, or displaying an in-app notification at least 14 days before the updated Policy takes effect.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. Your continued use of valbet after the effective date of any changes constitutes your acceptance of the revised Policy. We encourage you to review this page periodically to stay informed of how we protect your information.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way valbet handles your Personal Data, please reach out through any of the following channels: