puna33 Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings set out below. These definitions are consistent with those used in the puna33 Terms & Conditions.

• "puna33" / "we" / "us" / "our" — the online gaming platform operated at https://puna33.org and all associated digital properties and services.
• "Member" / "User" / "You" — any natural person who has registered a puna33 account or who browses the puna33 website without an account.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including name, date of birth, email address, phone number, device identifiers, and financial account details.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — puna33, which determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" — any third party that processes personal data on behalf of puna33 under a contractual data-processing agreement (e.g., payment gateway providers, KYC verification services).
• "KYC" — Know Your Customer; the identity and document verification process used to confirm a member's age, identity, and payment method ownership.
• "Cookies" — small text files stored on a member's device by the puna33 website, used to maintain session state, remember preferences, and collect anonymised analytics data.
• "Sensitive Data" — a subset of personal data warranting heightened protection, including government-issued ID numbers (e.g., Indonesian KTP number), financial account details, and any data relating to health or wellbeing submitted through responsible gaming tools.

puna33 collects personal data through several channels: account registration, ongoing platform usage, payment processing, customer support interactions, and automated technical means. The categories of data collected are described below.

puna33 uses personal data only for the specific purposes described in this policy. We do not repurpose data for unrelated activities without first notifying you and, where legally required, obtaining your renewed consent. The primary purposes for which we process your data are:

• Account management: Creating and administering your puna33 account, verifying your identity, maintaining your account history and preference settings, and communicating account-related notices.
• Payment processing: Facilitating Rupiah deposits and withdrawals via local Indonesian bank transfer and e-wallet channels; reconciling transaction records; detecting and preventing fraudulent payment activity.
• KYC and AML compliance: Verifying that you meet the minimum eligibility requirements (21 years of age, Indonesian residency context), screening transactions against anti-money laundering thresholds, and reporting where legally obligated.
• Platform delivery and improvement: Operating the sportsbook, live casino, slots, Domino QQ, and Blackjack verticals; diagnosing technical faults; analysing aggregate usage patterns to improve product features; personalising game recommendations.
• Responsible gaming: Monitoring gameplay patterns for indicators of problem gambling; enforcing self-imposed deposit limits, session time limits, and self-exclusion periods; contacting members who have activated responsible gaming tools.
• Customer support: Responding to enquiries, resolving disputes, processing formal complaints in accordance with the procedure set out in the Terms & Conditions.
• Marketing communications: Sending promotional emails, SMS notifications, and in-platform messages about bonuses, new game releases, and seasonal promotions (Idul Fitri, Imlek, Indonesian Independence Day, etc.) — subject to your communication preferences.
• Legal and regulatory obligations: Retaining records as required by applicable financial crime and gaming regulations; responding to lawful requests from competent authorities.

Every processing activity carried out by puna33 rests on at least one of the following lawful bases:

• Contractual necessity: Processing required to perform the contract between puna33 and you as a registered member — including account creation, payment processing, game delivery, and dispute resolution.
• Legal obligation: Processing required to comply with applicable anti-money laundering regulations, identity verification mandates, financial record-keeping requirements, and any lawful order from a competent regulatory or law enforcement authority.
• Legitimate interests: Processing carried out in pursuit of puna33's legitimate business interests where those interests are not overridden by your fundamental rights — including fraud prevention, platform security, IT infrastructure maintenance, and aggregate analytics for product improvement.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications and the use of non-essential analytics cookies. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

puna33 does not sell your personal data. We share personal data with third parties only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial account details necessary to execute deposit and withdrawal instructions. These providers operate under their own privacy policies and applicable banking regulations.
• KYC / identity verification providers: puna33 engages accredited third-party identity verification services to process government-issued ID documents and conduct liveness checks. These processors are bound by strict contractual data-processing agreements that prohibit secondary use of your data.
• Game technology providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive anonymised session tokens necessary to deliver games within the puna33 environment. They do not receive your name, bank details, or contact information.
• Cloud infrastructure and hosting providers: puna33's platform is hosted on secure cloud infrastructure. Hosting providers access server data solely for the purpose of providing infrastructure services and are contractually prohibited from accessing or using member data for any other purpose.
• Legal and regulatory authorities: puna33 will disclose personal data to competent governmental, regulatory, or law enforcement authorities where required to do so by law, court order, or in connection with a bona fide investigation into financial crime or fraud.
• Business restructuring: In the event of a merger, acquisition, or sale of all or part of puna33's assets, member data may be transferred to the acquiring entity, provided that the acquiring entity agrees to honour this Privacy Policy or provides equivalent protections. Members will be notified of any such transfer in advance.

puna33 uses cookies and similar technologies to operate core platform features, maintain login sessions, and understand how members interact with our website. The cookies we use fall into three categories:

puna33 does not use third-party advertising cookies or cross-site tracking pixels. Analytics data is aggregated and anonymised before review by puna33's product team; no individual member is profiled for advertising purposes.

Most web browsers accept cookies by default. You can configure your browser to refuse all cookies or to alert you when cookies are being set. Note that disabling strictly necessary cookies will impair your ability to log in and use core platform features. Browser-based opt-out instructions are available in the help documentation for Chrome, Firefox, Safari, and Edge.

puna33 employs a layered security architecture designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• Transport security: All communications between your browser and puna33's servers are encrypted using TLS 1.2 or higher with 256-bit symmetric encryption. The puna33 domain enforces HTTPS via HTTP Strict Transport Security (HSTS).
• Data at rest: Stored personal data — including KYC documents, bank account details, and gameplay records — is encrypted at rest using AES-256.
• Access controls: Access to personal data is restricted to puna33 employees and contractors on a strict need-to-know basis, enforced through role-based access controls, multi-factor authentication, and comprehensive access logging.
• Vulnerability management: puna33's platform undergoes regular penetration testing and security audits by independent third-party specialists. Critical vulnerabilities are patched on an emergency basis; non-critical findings are addressed within a defined remediation window.
• Incident response: puna33 maintains a documented data breach response plan. In the event of a security incident involving personal data, affected members will be notified within the timeframe required by applicable law, along with guidance on protective steps to take.
• Staff training: All puna33 employees with access to personal data receive mandatory data protection training at onboarding and annually thereafter.

puna33 retains personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. The following retention periods apply:

• Active account data: Retained for the full duration of your puna33 membership and for a minimum of five years following account closure, in accordance with anti-money laundering record-keeping obligations.
• KYC documents: Retained for a minimum of five years after the conclusion of the business relationship, as mandated by applicable financial crime regulations. Original document images are stored in encrypted, access-controlled storage.
• Transaction records: All deposit, withdrawal, and wagering records are retained for a minimum of five years following the transaction date.
• Customer support records: Live chat transcripts and email correspondence are retained for a period of three years from the date of the interaction, or for the duration required by any related ongoing dispute or investigation.
• Marketing consent records: Records of consent given or withdrawn for marketing communications are retained indefinitely for compliance audit purposes.
• Technical and analytical data: Anonymised server logs and aggregated analytics data are retained for up to two years. IP address logs associated with security events are retained for up to 12 months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Anonymised, aggregated data may be retained indefinitely for statistical and product improvement purposes.

As a puna33 member, you hold the following rights in respect of your personal data. puna33 will respond to all valid rights requests within 30 days of receipt. There is no charge for exercising any of these rights.

To exercise any of these rights, send a written request to [email protected] with the subject line "Data Rights Request" and include your registered username and the specific right(s) you wish to exercise. puna33 may ask you to verify your identity before processing the request to prevent unauthorised access to another member's data.

Where puna33 is unable to fulfil a request — for example, because complying would conflict with a legal obligation to retain the data — we will explain the reason in our response and advise you of any available escalation options.

puna33 strictly enforces a 21+ age policy across all services on the platform. We do not knowingly collect, store, or process personal data belonging to any individual under the age of 21 years.

At the point of account registration, all members self-declare that they are at least 21 years of age. puna33 further validates age through the KYC document verification process, which requires submission of a valid government-issued photo ID (such as an Indonesian KTP) confirming date of birth.

If you are a parent or guardian and have reason to believe that a minor has registered a puna33 account using false information, please contact puna33 immediately at [email protected] with the subject line "Underage Account Report". We take these reports seriously and will investigate and act on every report received.

puna33 is an internationally operated gaming platform serving players primarily in Indonesia. In order to deliver our services, certain personal data may be transferred to, stored in, or processed in countries outside of Indonesia. These transfers may occur in the following contexts:

• Cloud infrastructure servers operated in jurisdictions where puna33's hosting providers maintain data centres.
• KYC and identity verification partners whose processing systems are located outside Indonesia.
• Game technology providers (Pragmatic Play, Evolution Gaming, etc.) whose live studio and game server infrastructure operates internationally.

Wherever personal data is transferred internationally, puna33 takes appropriate steps to ensure that the receiving party provides an adequate level of data protection. These steps may include executing standard contractual clauses, conducting data transfer impact assessments, and ensuring the receiving jurisdiction has an adequacy determination recognised by applicable data protection frameworks.

If you have questions about the specific safeguards applied to any particular international data transfer, please contact [email protected] and we will provide the relevant information within a reasonable timeframe.

puna33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, platform features, applicable law, or regulatory requirements. The following process governs policy updates:

• Material changes — those that affect the types of data we collect, the purposes for which data is used, the third parties with whom data is shared, or member rights — will be communicated to all active members via their registered email address at least 14 days before the changes take effect.
• Minor changes — including typographical corrections, clarifications that do not alter the substantive meaning of any provision, or the addition of new data processor relationships of a routine nature — may be published without advance individual notice and will take effect upon publication.
• The "Effective Date" shown at the top of this document will be updated each time a revision is published. The version number will also be incremented accordingly.
• Your continued use of the puna33 platform after any updated Privacy Policy takes effect constitutes your acceptance of the revised terms. If you do not agree with the changes, you should stop using puna33 and may request account closure by contacting support.
• It is your responsibility to review this Privacy Policy periodically. puna33 recommends bookmarking this page and checking the effective date whenever you visit.

If you have any questions, concerns, or formal requests relating to this Privacy Policy or the way puna33 handles your personal data, please contact us through the following channels:

• Email: [email protected] — use the subject line "Privacy Enquiry" for data-related matters; responses to formal requests are issued within 30 days
• Live Chat: Available 24 hours a day, 7 days a week via the puna33 platform — Indonesian-speaking agents are on hand at all times across WIB, WITA, and WIT time zones
• Postal / Formal Complaints: For formal written complaints, include your registered username, a clear description of your concern, relevant dates and any supporting documentation, and send to the puna33 compliance team at the address on file with our licensing authority

puna33 is committed to resolving all privacy-related concerns promptly, fairly, and transparently. We take our obligations as a data controller seriously and welcome any feedback that helps us improve our data practices for the benefit of all members across Indonesia.

If you are not satisfied with our response to a privacy complaint, you may have the right to escalate the matter to a relevant data protection supervisory authority in the jurisdiction under whose laws your complaint falls.