bsk21 Privacy Policy

1 Introduction

bsk21 ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who interacts with our Platform. This Privacy Policy sets out, in plain and transparent terms, the categories of personal data we collect, the lawful grounds on which we process that data, the purposes for which it is used, and the rights available to you as a data subject.

By registering an account on bsk21 or by continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood these provisions. If you do not agree with any part of this Policy, you must discontinue use of the Platform and may request closure of your account by contacting our support team.

This Policy is to be read alongside bsk21's Terms & Conditions, which govern the contractual relationship between bsk21 and its Members. In the event of any conflict between the two documents on matters relating to data privacy, this Privacy Policy takes precedence.

2 Data Controller

For the purposes of applicable data protection legislation, bsk21 is the data controller in respect of the personal data collected from Members and prospective Members located in Indonesia. As data controller, bsk21 determines the purposes for which, and the means by which, personal data is processed.

bsk21 operates under an international gaming licence and maintains its data infrastructure in accordance with internationally recognised data protection standards. Where bsk21 engages third-party processors to handle personal data on its behalf, it does so pursuant to written data processing agreements that impose equivalent data protection obligations on those processors.

3 Personal Data We Collect

bsk21 collects personal data across several categories. The table below sets out each category, specific data types within it, and the primary purpose for collection.

bsk21 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data (beyond responsible gaming self-assessments), or biometric data except where a Member voluntarily provides a document containing such information as part of KYC (e.g., a KTP that indicates religion). In such cases the sensitive data is noted only to the extent required for identity verification and is not processed for any other purpose.

4 How We Collect Personal Data

4.1 Directly from You

The majority of personal data bsk21 holds is provided directly by you during:

• Account registration (name, date of birth, contact details);
• KYC document submission (identity card, proof of address, payment method confirmation);
• Deposit and withdrawal transactions (bank account or e-wallet details);
• Support interactions via live chat, email, or WhatsApp;
• Completion of responsible gaming questionnaires or self-assessment tools;
• Participation in surveys or promotional competitions.

4.2 Automatically from Your Device

When you access the bsk21 Platform, our servers and analytics systems automatically collect certain Technical Data and Usage Data as described in Clause 3. This collection is necessary for platform security, fraud prevention, and ensuring a stable, personalised user experience.

4.3 From Third Parties

In limited circumstances, bsk21 may receive personal data about you from third-party sources, including:

• Identity verification providers: Third-party KYC services may cross-reference your submitted documents against public or licensed databases to confirm authenticity.
• Payment processors: Our payment gateway partners may share transaction status information, including confirmation or failure codes, to support deposit and withdrawal processing.
• Fraud prevention networks: bsk21 participates in industry-level fraud prevention schemes that may flag device fingerprints or email addresses associated with known fraudulent activity.

5 Purposes & Legal Basis for Processing

bsk21 processes your personal data only where a lawful basis exists. The table below maps our processing activities to their corresponding legal grounds:

Where bsk21 relies on consent as the legal basis for processing (primarily for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To opt out of marketing communications, contact support or update your preferences within your account settings.

6 Data Sharing & Disclosure

6.1 Service Providers and Data Processors

bsk21 shares personal data with a limited number of carefully selected third-party service providers who process data on our behalf and under our documented instruction. These include:

• Payment processors: Partners facilitating bank transfers via BCA, BRI, BNI, Mandiri, and e-wallet transactions via OVO, DANA, GoPay, ShopeePay, and LinkAja, as well as USDT blockchain transaction routing;
• KYC and identity verification platforms: Services that validate government-issued ID documents and cross-reference identity data;
• Cloud infrastructure providers: Server hosting and database management platforms that store encrypted Member data;
• Customer support platforms: Live chat and CRM software that processes communications data to enable our support team to assist you;
• Fraud detection services: Tools that analyse device and behavioural signals to identify potentially fraudulent account activity.

All third-party processors are bound by data processing agreements that prohibit them from using your data for any purpose beyond the specific service they provide to bsk21.

6.2 Legal Disclosures

bsk21 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of bsk21, its Members, or the public. We will notify affected Members of such disclosures where we are legally permitted to do so.

6.3 No Sale of Data

bsk21 does not, under any circumstances, sell, rent, lease, or otherwise trade your personal data to third-party advertisers, data brokers, or marketing companies. This prohibition applies regardless of the commercial value of such data and is a foundational commitment of bsk21's privacy practice.

7 International Data Transfers

bsk21's primary data infrastructure is hosted on servers located outside of Indonesia. As a result, your personal data may be transferred to, stored in, and processed in countries other than Indonesia. These countries may have data protection laws that differ from those applicable in Indonesia.

Where such transfers occur, bsk21 ensures that appropriate safeguards are in place to protect your personal data to a standard at least equivalent to the protections afforded under this Policy. These safeguards include contractual clauses with data processors and hosting providers that impose obligations consistent with internationally recognised data protection standards.

By using the bsk21 Platform, you acknowledge and accept that your personal data may be transferred internationally in accordance with the safeguards described in this Clause.

8 Data Retention

bsk21 retains personal data only for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

• Active account data: Retained for the duration of the Member relationship and for a minimum of five (5) years following account closure, in order to meet AML and regulatory record-keeping obligations.
• KYC documents: Retained for a minimum of five (5) years post-account closure as required by applicable anti-money laundering legislation.
• Financial transaction records: Retained for a minimum of five (5) years to support audit, compliance, and dispute resolution requirements.
• Support communications: Retained for three (3) years from the date of the final communication in a given ticket or thread.
• Marketing preference records: Retained for the duration of your active account plus two (2) years to evidence consent status.
• Technical and usage logs: Retained for twelve (12) months for security monitoring purposes, then anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be attributed to an identifiable individual.

9 Security Measures

bsk21 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS/SSL encryption for all data in transit between Member devices and bsk21's servers;
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records;
• Role-based access controls (RBAC) ensuring that bsk21 staff can only access Member data to the extent required for their specific job function;
• Multi-factor authentication (MFA) for all bsk21 administrative system access;
• Regular penetration testing and vulnerability assessments conducted by independent security firms;
• Intrusion detection systems (IDS) and real-time anomaly monitoring across all production infrastructure;
• Staff training on data handling, phishing awareness, and incident response, conducted at least annually.

While bsk21 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security against all threats. Members are strongly encouraged to use strong, unique passwords and to enable two-factor authentication on their accounts.

10 Cookies & Tracking Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device by a website you visit. bsk21 uses cookies and similar tracking technologies (including local storage tokens and session identifiers) to operate core platform functionality, maintain your logged-in session, detect fraud, and understand aggregate usage patterns.

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function. These include session management cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery (CSRF). These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language display, preferred payment method, and last-accessed game category. Disabling these cookies will not prevent access to the Platform but may result in a less personalised experience.
• Analytics Cookies: Collect anonymised or aggregated data about how Members navigate the Platform — pages visited, time spent, click paths — to help bsk21 identify usability improvements. No individual Member is identified through analytics cookies.
• Security & Fraud Detection Cookies: Used to detect automated bots, identify unusual access patterns, and flag potential account takeover attempts.

10.3 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies; however, blocking strictly necessary cookies will prevent you from accessing your bsk21 account. Refer to your browser's help documentation for instructions on managing cookies.

11 Your Data Rights

As a Member of bsk21 and a data subject under applicable data protection principles, you hold the following rights in relation to your personal data. To exercise any of these rights, contact us using the details in Clause 14.

bsk21 will respond to all data rights requests within 30 calendar days. We reserve the right to extend this period by a further 60 days for complex or numerous requests, in which case we will notify you of the extension within the initial 30-day period.

12 Minors

The bsk21 Platform is strictly restricted to individuals who are at least 21 years of age. bsk21 does not knowingly collect or process personal data from any person under the age of 21.

If bsk21 discovers or reasonably suspects that personal data has been submitted by or on behalf of an individual under 21, we will immediately suspend the associated account, delete the personal data to the extent permitted by law, and notify the individual accordingly. Any winnings accrued on such an account will be forfeited.

If you believe that a minor has submitted personal data to bsk21, please contact our Data Protection team immediately using the details in Clause 14.

13 Amendments to This Policy

bsk21 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Material changes — those that meaningfully affect your rights or how your data is used — will be communicated to Members via account notification and/or email at least 14 days before the amended Policy takes effect.

The effective date displayed at the top of this document will be updated with each revision. We encourage you to review this Policy periodically. Continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy.

14 Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the personal data bsk21 holds about you, please contact our Data Protection team through the following channels:

• Email (plain text — not a clickable link): [email protected]
• Subject line for data requests: "Data Privacy Request — [Your Registered Email]"
• Live Chat: Available 24 hours a day, 7 days a week via the bsk21 Platform. Identify yourself as submitting a data privacy request at the start of the conversation.
• WhatsApp (display only — not a clickable link): +62 811 000 0000 · Available 07:00–24:00 WIB.

To protect the integrity of your data, all access, rectification, and erasure requests will require identity verification before processing commences. We will request that you confirm your registered email address and, where necessary, submit a copy of your government-issued ID.

bsk21 aims to acknowledge all privacy-related inquiries within 24 hours and to provide a substantive response within 30 calendar days of receiving a complete and verified request.