Privacy Policy

The following terms carry the meanings set out below throughout this Privacy Policy:

2.1 Identity. The Data Controller responsible for the Personal Data collected via https://33kz.cam is 33kz, an internationally licensed online gaming operator. 33kz operates under an international gaming license on an offshore basis, primarily serving English-preference players across Indonesia.

2.2 Contact Point. For all data-protection enquiries, including the exercise of your data rights under clause 11 of this Policy, please contact the 33kz Data Protection team at: [email protected] (subject line: "Data Protection Enquiry"). All requests will be acknowledged within 5 business days.

3.1 Registration Data. When you open a 33kz account, we collect the following mandatory information: full legal name; date of birth; email address; mobile phone number; and chosen username. This data is required to create and maintain your account.

3.2 KYC Verification Data. Prior to processing any withdrawal, 33kz collects KYC Data comprising: a government-issued photo identification document (Indonesian KTP, SIM, or passport); proof of residential address (e.g., utility bill, bank statement dated within three months); and, where applicable, proof of ownership of the payment method used for deposit.

3.3 Financial Transaction Data. We record all deposit and withdrawal transactions, including the amount in Indonesian Rupiah (IDR / Rp), the payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, Mastercard), timestamps, and transaction reference numbers.

3.4 Gaming Activity Data. We collect a complete record of your betting and gaming activity on 33kz, including the games played, wager amounts, outcomes, and session durations. This data is used for account management, dispute resolution, responsible-gaming monitoring, and regulatory compliance.

3.5 Technical and Device Data. When you access the 33kz platform, we automatically collect: IP address; browser type and version; operating system; device type and model; time zone setting; and referring URL. This data is collected via cookies and server logs.

3.6 Communications Data. We retain records of all communications between you and the 33kz support team — including live chat transcripts, email correspondence, and support ticket history — for a period of five years from the date of each communication.

3.7 Voluntary Data. You may choose to provide additional information (such as city of residence or preferred language) when completing your profile. Provision of this data is optional and does not affect your ability to use the platform.

33kz processes Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between 33kz and the Player — for example, creating and managing accounts, processing deposits and withdrawals, and settling bets.
• Legal Obligation: Processing required to comply with applicable laws and the conditions of 33kz's international gaming license — for example, KYC verification, anti-money-laundering (AML) checks, and record-keeping obligations.
• Legitimate Interests: Processing carried out in the legitimate interests of 33kz or third parties, provided those interests are not overridden by the Player's rights — for example, fraud detection, platform security, and service improvement analytics.
• Consent: Processing based on the Player's freely given, specific, informed, and unambiguous consent — for example, sending marketing communications where the Player has opted in. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

33kz uses collected Personal Data for the following purposes:

• Account Management: Creating, maintaining, and administering your 33kz player account, including authentication, password resets, and account-security notifications.
• Transaction Processing: Processing deposits via BCA, BRI, BNI, Mandiri, DANA, OVO, GoPay, ShopeePay, and other accepted methods; processing withdrawals to the same instruments; and maintaining accurate transaction records in IDR.
• Identity Verification: Conducting KYC checks to confirm that you meet the 21+ age requirement and that the identity you have provided is accurate and consistent across all interactions.
• Regulatory Compliance: Fulfilling obligations under 33kz's international gaming license, including AML screening, transaction monitoring, suspicious-activity reporting, and record retention.
• Responsible Gaming: Monitoring gaming patterns for indicators of problem gambling; actioning deposit limits, session reminders, and self-exclusion requests; and contacting Players where responsible-gaming concerns arise.
• Customer Support: Responding to queries, resolving disputes, and maintaining support-interaction histories to ensure consistency and quality of service.
• Marketing Communications: Sending promotional emails, bonus notifications, and event-related messages to Players who have opted in — including seasonal promotions aligned with Idul Fitri, Ramadhan, Imlek, and major sporting events such as BRI Liga 1 and the FIFA World Cup.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, payment-method coverage, and the overall player experience.
• Fraud & Security: Detecting and investigating suspicious login attempts, payment fraud, bonus abuse, multi-accounting, and other integrity violations.

6.1 General Principle. 33kz does not sell, rent, or trade Personal Data to third parties for their own marketing purposes. We share Personal Data only with the categories of recipient described in this clause, and only to the extent necessary for the purpose specified.

6.2 Payment Service Providers. To process deposits and withdrawals, 33kz necessarily shares transaction-relevant data with our payment partners. These include Indonesian local banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja), and international card networks (Visa, Mastercard). Each of these providers operates under its own privacy and data-security framework.

6.3 Identity Verification Services. KYC Data is shared with third-party identity-verification and age-verification service providers under strict Data Processing Agreements. These providers process KYC Data solely to perform identity checks on behalf of 33kz and are contractually prohibited from using the data for any other purpose.

6.4 Game Technology Providers. Game studios (including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) may receive session-level gaming data (e.g., Player ID, bet amounts, game outcomes) to facilitate game delivery, calculate RTP, and resolve game-level disputes. No name, address, or payment data is shared with game studios.

6.5 Analytics Providers. Aggregated and pseudonymised technical and device data may be shared with platform analytics providers to support performance monitoring and user-experience improvements. Analytics providers are not permitted to correlate pseudonymised 33kz data with other datasets to re-identify individual Players.

6.6 Regulatory and Law Enforcement Authorities. 33kz may disclose Personal Data to governmental, regulatory, or law enforcement bodies where required to do so by applicable law, court order, or by the conditions of its international gaming license. In all such cases, 33kz will disclose only the minimum data necessary to satisfy the lawful request.

7.1 Cross-Border Processing. As an internationally licensed operator, 33kz may transfer and store Personal Data on servers located outside Indonesia. Some of our Data Processors — including game studios, KYC providers, and analytics partners — are headquartered in jurisdictions that may have different data-protection standards from those applicable in Indonesia.

7.2 Transfer Safeguards. Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection, 33kz implements appropriate safeguards including: standard contractual clauses binding the recipient to data-protection obligations consistent with this Privacy Policy; vendor security assessments prior to onboarding; and periodic compliance reviews of all Data Processor relationships.

7.3 Data Residency. Primary player account data and transaction records are stored on servers in the Asia-Pacific region, minimising latency for players based in Jakarta, Surabaya, Medan, Bandung, Bali, and other major Indonesian cities, while maintaining compliance with applicable international data-protection standards.

8.1 Retention Periods. 33kz retains Personal Data for no longer than is necessary for the purpose for which it was collected, subject to any longer retention periods required by applicable law or regulatory obligation. The following standard retention periods apply:

8.2 Post-Retention Disposal. Upon expiry of the applicable retention period, Personal Data is either securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and platform-improvement purposes.

9.1 Technical Safeguards. 33kz implements a multi-layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. Key technical measures include:

• 256-bit TLS/SSL encryption on all data transmitted between the Player's device and the 33kz platform.
• AES-256 encryption at rest for all sensitive Personal Data and financial records stored on 33kz servers.
• Two-factor authentication (2FA) available to all Players and mandatory for all 33kz staff accounts with access to Personal Data.
• Web Application Firewall (WAF) and Distributed Denial of Service (DDoS) mitigation to protect platform availability and integrity.
• Intrusion detection and prevention systems with 24/7 security operations monitoring.

9.2 Organisational Safeguards. Access to Personal Data within 33kz is granted on a strict need-to-know basis. All staff with access to Personal Data undergo mandatory data-protection training and are bound by confidentiality obligations. Third-party Data Processors are subject to formal vendor assessments before onboarding and periodic security reviews thereafter.

9.3 Breach Response. In the event of a Personal Data breach that poses a risk to Players, 33kz will notify affected individuals promptly and without undue delay, providing a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.

10.1 What Are Cookies. Cookies are small text files placed on your device when you visit the 33kz platform. They enable the platform to recognise your device across sessions, remember your preferences, maintain your login state, and collect anonymous analytics data.

10.2 Types of Cookies Used. 33kz uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session cookies that keep you logged in and security cookies that support fraud detection. These cookies cannot be disabled without impairing core platform functionality.
• Functional Cookies: Remember your preferences such as language, time zone (WIB by default), and display settings to personalise your experience on return visits.
• Analytics Cookies: Collect pseudonymised data about how Players use the platform — pages visited, session duration, click paths — to help 33kz improve the platform. Analytics cookies do not identify you personally.
• Marketing Cookies: Used where you have consented to receive personalised promotional communications. These cookies help 33kz understand which offers resonate with different player segments and avoid showing you promotions you have already seen or declined.

10.3 Managing Cookies. You may configure your browser to block or delete cookies at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use core platform features. You may withdraw consent for analytics and marketing cookies at any time by adjusting your browser settings or by contacting 33kz support.

Subject to applicable law and the conditions of 33kz's international gaming license, you hold the following rights in respect of your Personal Data:

• Right of Access: You may request a copy of all Personal Data held about you by 33kz, together with information about how it is processed. 33kz will respond to access requests within 30 calendar days.
• Right to Rectification: If any Personal Data held by 33kz is inaccurate or incomplete, you have the right to request its correction. Requests to amend KYC Data may require submission of updated documentation.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and no other legal basis applies. Note that regulatory retention obligations (see clause 8) may prevent immediate full erasure.
• Right to Restrict Processing: You may request that 33kz suspends the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your Personal Data where 33kz relies on legitimate interests as its legal basis, or where your data is used for direct marketing. Upon receipt of a valid objection to marketing, 33kz will cease all marketing communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.

To exercise any of the rights described above, please contact 33kz at [email protected] with the subject line "Data Rights Request". We will acknowledge all requests within 5 business days and action them within the timeframes specified above.

12.1 Age Restriction. The 33kz platform is strictly intended for adults aged 21 and over. 33kz does not knowingly collect Personal Data from individuals under 21 years of age. If you are under 21, you must not register an account or provide any Personal Data to 33kz.

12.2 Discovery of Underage Data. If 33kz becomes aware that Personal Data has been collected from a person under the age of 21 — whether through a false declaration at registration or otherwise — the relevant account will be immediately suspended, all associated balances voided, and the underage Player's Personal Data deleted as soon as the applicable regulatory retention obligations permit.

12.3 Parental Notification. If you believe that a minor in your household has registered a 33kz account without your knowledge, please contact 33kz support immediately at [email protected]. 33kz will investigate and take appropriate action promptly.

13.1 Right to Amend. 33kz reserves the right to update this Privacy Policy at any time to reflect changes in data-processing practices, applicable law, or platform functionality. Material changes will be communicated to registered Players via the email address on file at least 7 calendar days before the amendment takes effect.

13.2 Continued Use. Your continued use of the 33kz platform following the effective date of any revised Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree with the revised policy, you must cease using the platform and contact support to request account closure.

13.3 Version History. The "Last Updated" date at the top of this page identifies the current version of the Privacy Policy. Previous versions are available on request from the 33kz Data Protection team.

14.1 Data Protection Enquiries. For all questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by 33kz, please contact us using the details below:

Email: [email protected] (subject line: "Privacy Policy Enquiry" or "Data Rights Request")

Response Time: All data-protection enquiries are acknowledged within 5 business days. Complex requests (such as full data access exports or erasure requests requiring regulatory review) are resolved within 30 calendar days, measured in WIB (UTC+7).

14.2 Language. You may contact the 33kz data team in English or Bahasa Indonesia. Responses will be issued in the language of your enquiry.