396win Privacy Policy

1. Definitions and Scope

This Privacy Policy (hereinafter "Policy") applies to all users of the 396win platform, accessible at https://396win.cam, and any associated mobile applications or services (collectively, the "Platform"). It governs the collection, processing, storage, and transfer of personal data submitted to or collected by 396win in the course of providing its online betting and gaming services.

For the purposes of this Policy, the following definitions apply:

• "396win", "we", "us", or "our" refers to the operators of the 396win Platform and all affiliated entities acting as joint data controllers.
• "User", "you", or "your" refers to any individual who accesses, registers for, or uses the Platform.
• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, location data, or online identifiers — as defined by applicable international data protection standards.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means 396win, which determines the purposes and means of processing your Personal Data.
• "Third Party" means any person or organization other than you, 396win, or 396win's authorized processors acting on our behalf.

This Policy applies to all Personal Data collected from users located in Indonesia and other jurisdictions where 396win operates. Where Indonesian data protection laws impose additional requirements beyond those described herein, we comply with those requirements to the fullest extent practicable.

2. Information We Collect

2.1 Information You Provide Directly

When you register an Account on 396win or interact with our Services, we collect information that you provide to us voluntarily. This includes:

• Identity Information: Full legal name, date of birth, gender, nationality, and government-issued identification number (e.g., Indonesian KTP number or passport number).
• Contact Information: Email address, mobile phone number, and residential address (including city, province, and postal code in Indonesia or your country of residence).
• Financial Information: Bank account details (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga account numbers), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction history on the Platform.
• Identity Verification Documents: Copies or images of government-issued photo identification, proof of address documents, and payment method ownership evidence submitted during KYC (Know Your Customer) verification.
• Account Credentials: Username and encrypted password used to access your Account. We never store passwords in plain text.
• Communication Records: Content of messages, emails, live chat transcripts, or other communications you send to our customer support team.
• Preference and Marketing Information: Choices you make regarding marketing communications, game preferences, and notification settings.

2.2 Information We Collect Automatically

When you access and use the Platform, we automatically collect certain technical and behavioral data, including:

• Device and Technical Information: IP address, browser type and version, operating system, device type (mobile, desktop, tablet), screen resolution, and hardware identifiers.
• Usage and Behavioral Data: Pages viewed, links clicked, games played, bets placed, time spent on each page or game, and navigation patterns within the Platform.
• Session Data: Login timestamps, session duration, logout events, and geographic location at the time of access (derived from IP address).
• Transaction and Betting History: All deposits, withdrawals, wagers, bonus claims, and win/loss records associated with your Account.
• Cookies and Tracking Data: Data collected through cookies, pixel tags, web beacons, and similar technologies as described in Section 6 of this Policy.

2.3 Information from Third Parties

In certain circumstances, we may receive Personal Data about you from third-party sources, including:

• Identity verification service providers used for KYC compliance;
• Fraud detection and anti-money laundering screening services;
• Payment processors and financial institutions processing your deposits and withdrawals;
• Advertising partners and affiliates who referred you to the Platform;
• Publicly available sources such as government sanctions lists, adverse media databases, and politically exposed persons (PEP) registries.

3. How We Use Your Information

396win processes your Personal Data for specific, legitimate purposes. The table below summarizes our primary uses:

4. Legal Basis for Processing

396win processes your Personal Data only where a valid legal basis exists. Depending on the specific processing activity, we rely on one or more of the following legal grounds:

• Performance of Contract: Processing necessary to fulfill our contractual obligations to you under our Terms and Conditions, including managing your Account, processing transactions, and delivering our Services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) laws, age verification requirements, and regulatory reporting obligations.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit, freely given, and informed consent — primarily for marketing communications and the use of non-essential cookies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

We share Personal Data with carefully vetted third-party service providers who assist us in operating the Platform and delivering our Services. All such providers are contractually bound to process data only on our behalf, in accordance with our instructions, and subject to appropriate confidentiality and security obligations. Categories of authorized processors include:

• Payment processing partners and financial institutions (including Indonesian banks and e-wallet providers);
• Identity verification and KYC service providers;
• Fraud detection and cybersecurity firms;
• Game content providers and platform software suppliers (including Pragmatic Play, Evolution Gaming, Microgaming, and similar studios — who may receive anonymized session data but not identifiable personal information);
• Customer support technology providers (live chat platforms, ticketing systems);
• Cloud hosting and data storage providers;
• Analytics and performance monitoring services.

5.2 Regulatory and Legal Disclosure

396win may disclose your Personal Data to competent authorities, law enforcement agencies, or judicial bodies where required by law or where such disclosure is necessary to protect the rights, property, or safety of 396win, its users, or the public. We will endeavor to provide you with prior notice of such disclosure where legally permitted to do so.

5.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of 396win's business, your Personal Data may be transferred to the successor entity as part of the transaction. We will notify you of any such change and of your options with respect to your Personal Data.

5.4 No Sale of Personal Data

396win does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We may share anonymized, aggregated, and non-personally identifiable data with analytics partners or in published industry reports, but such data cannot be used to identify you as an individual.

6. Cookies and Tracking Technologies

6.1 Types of Cookies Used

396win uses cookies and similar tracking technologies (pixel tags, web beacons, local storage objects) to enhance your experience on the Platform, ensure Platform functionality, and support our analytics and marketing activities. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These cookies enable core features such as session management, login authentication, and security measures. They cannot be disabled.
• Performance and Analytics Cookies: Collect anonymized information about how users interact with the Platform — which pages are visited most, where errors occur, and how users navigate. This data is used solely to improve Platform performance.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and game layout choices to provide a more personalized experience.
• Marketing and Targeting Cookies: Used to deliver relevant promotions and advertising based on your interests and Platform activity. These cookies require your consent and can be disabled at any time.

6.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings or the cookie preference center within the Platform. Please note that disabling certain cookies may affect the functionality and performance of the Platform. Instructions for managing cookies in major browsers (Chrome, Firefox, Safari, Edge) are available on those browsers' official support pages.

7. Data Security Measures

396win takes the security of your Personal Data seriously and employs industry-leading technical and organizational safeguards to protect it against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 396win Platform is encrypted using industry-standard 256-bit SSL/TLS technology, ensuring that your information cannot be intercepted in transit.
• Encrypted Data Storage: Sensitive personal data (including passwords, payment details, and identity documents) is stored in encrypted format in secure databases. Passwords are hashed using modern one-way hashing algorithms and are never stored in recoverable plain text.
• Multi-Factor Authentication (MFA): Account access is protected by multi-factor authentication options to prevent unauthorized login attempts.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. 396win employees and contractors are granted only the minimum level of data access required to perform their specific duties.
• Regular Security Audits: Our platform infrastructure undergoes regular penetration testing, vulnerability assessments, and third-party security audits to identify and address potential weaknesses before they can be exploited.
• Fraud Detection Systems: Automated fraud detection systems monitor Account activity in real time, flagging and investigating suspicious transactions, login attempts from unrecognized devices, and other anomalous behavior patterns.
• Incident Response Plan: In the event of a data security incident, 396win maintains a documented incident response plan to contain the breach, assess its scope, notify affected users and relevant authorities as required by law, and implement corrective measures.

While we implement robust security measures, no system can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for immediately notifying us at support@396win.cam if you suspect any unauthorized access to your Account.

8. Data Retention

396win retains Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your Account and for a minimum of five (5) years following Account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction and Financial Records: Retained for a minimum of seven (7) years following each transaction, in compliance with financial reporting and audit obligations.
• KYC Verification Documents: Retained for a minimum of five (5) years following the completion of verification or Account closure, whichever is later.
• Customer Support Communications: Retained for up to three (3) years from the date of the most recent interaction, to support dispute resolution and quality assurance.
• Marketing and Preference Data: Retained until you withdraw your consent for marketing communications or request erasure, subject to applicable legal retention requirements.
• Technical and Usage Logs: Retained for up to twelve (12) months, after which they are anonymized or deleted.

At the end of each applicable retention period, Personal Data is securely deleted or anonymized in a manner that makes individual identification impossible. Anonymized data may be retained indefinitely for statistical and analytical purposes.

9. Your Rights as a Data Subject

As a user of the 396win Platform, you are entitled to exercise the following rights with respect to your Personal Data. To submit a request, contact our Data Protection team at support@396win.cam with the subject line "Data Rights Request." We will respond within thirty (30) days of receiving a verifiable request.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you and information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. You may also update most Account information directly through your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to overriding legal retention obligations.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: Where processing is based on contract or consent and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to the processing of your Personal Data where we rely on legitimate interests as the legal basis, or where data is used for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

10. International Data Transfers

396win operates globally and may transfer your Personal Data to countries outside Indonesia, including to our hosting providers, payment processors, and other service partners located in various jurisdictions. When we transfer data internationally, we ensure that appropriate safeguards are in place to maintain the level of protection described in this Policy, including:

• Standard contractual clauses approved by recognized data protection authorities;
• Transfers to countries deemed to provide an adequate level of data protection by relevant regulatory bodies;
• Binding corporate rules or other legally recognized transfer mechanisms where applicable.

By using the 396win Platform, you acknowledge and consent to the international transfer of your Personal Data as described in this section, subject to the safeguards outlined above.

11. Children's Privacy

The 396win Platform and Services are strictly intended for adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. If you are under 21, you must not register an Account or use the Platform.

If we become aware that we have inadvertently collected Personal Data from a user under the age of 21, we will take immediate steps to delete that data and close the associated Account. If you are a parent or guardian and believe that your child may have registered on the Platform, please contact us immediately at support@396win.cam so that we can investigate and take appropriate action.

12. Changes to This Policy

396win reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or operational requirements. The "Last Updated" date at the top of this document will reflect the date of the most recent revision.

Where changes are material — meaning they significantly affect your rights or how we process your Personal Data — we will provide you with prominent notice via email to your registered address or through a notification on the Platform prior to the change taking effect. For non-material updates, your continued use of the Platform following the revised Policy's effective date constitutes acceptance of the changes.

We encourage you to review this Policy periodically to stay informed of how 396win protects your information. Archived versions of previous policies are available upon request.

13. Contact and Data Controller

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 396win handles your Personal Data, please contact our dedicated Data Protection team through the following channels:

• Email: support@396win.cam (subject line: "Privacy Inquiry" or "Data Rights Request")
• Live Chat: Available 24/7 through the Platform dashboard — ask to be connected to the Data Protection team
• Response Time: We aim to acknowledge all privacy-related inquiries within 48 hours and to provide a substantive response within 30 calendar days

We are committed to resolving all privacy concerns promptly and transparently. If you feel that your concerns have not been addressed to your satisfaction, you retain the right to escalate the matter to the competent data protection authority in your jurisdiction.