Privacy Policy — bpowin

The following terms carry the meanings assigned to them throughout this Policy:

• "Personal Data" — Any information that, alone or in combination with other data, identifies or could reasonably identify a living individual, including but not limited to names, identification numbers, location data, email addresses, IP addresses, and financial account details.
• "Processing" — Any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Subject" — The identified or identifiable natural person to whom Personal Data relates; in this context, a registered User or visitor of the Platform.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. bpowin is the Data Controller for all Personal Data processed through the Platform.
• "Data Processor" — A third party that processes Personal Data on behalf of bpowin under a data processing agreement, such as a KYC verification provider or cloud infrastructure vendor.
• "Cookies" — Small text files placed on a User's device by the Platform to enable functionality, remember preferences, and support analytics and security operations.

bpowin acts as the Data Controller for all Personal Data collected through the bpowin.cam Platform. As Data Controller, bpowin determines the purposes for which your Personal Data is processed and the means by which that processing occurs. bpowin operates internationally and serves players primarily based in Indonesia, including users in Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Makassar, and Palembang.

For all data protection inquiries, requests to exercise your rights, or formal complaints, please contact our Data Protection point of contact at [email protected] (plain text — not a clickable link). We aim to respond to all data-related requests within 14 calendar days of receipt.

bpowin collects Personal Data across several categories, depending on the nature of your interaction with the Platform. The table below provides a structured overview:

bpowin collects Personal Data through the following channels:

• Direct Submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or completing a survey or feedback form.
• Automated Technical Collection: Data collected passively when you access the Platform, including IP addresses, device fingerprints, cookie data, and session logs generated by our web servers and analytics infrastructure.
• Third-Party KYC Providers: Where bpowin uses a third-party identity verification service to authenticate your documents, that provider may supply us with a verification outcome and associated data flags in accordance with their own privacy practices and our data processing agreement with them.
• Payment Processors: When you initiate a bank transfer or e-wallet transaction, our payment processing partners may share transaction metadata (reference numbers, account name, partial account identifiers) with bpowin solely for the purpose of matching and crediting your deposit or processing your withdrawal.
• Fraud Prevention & Risk Monitoring Tools: bpowin employs automated risk-scoring and fraud detection systems that may aggregate Technical Data and Behavioural Data to identify patterns consistent with account compromise, bonus abuse, or money laundering activity.

bpowin processes your Personal Data only where a valid lawful basis exists. The following table maps each processing purpose to its corresponding lawful basis:

bpowin does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We may share your Personal Data with third parties only in the following circumstances and solely to the extent necessary:

• KYC & Identity Verification Providers: Third-party verification services engaged to authenticate your identity documents, assess age compliance (21+), and check your details against sanctions and politically exposed persons (PEP) watchlists. These providers act as Data Processors under binding agreements with bpowin.
• Payment Partners: Local bank networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transactional data necessary to process your deposits and withdrawals — typically your registered account name and transaction reference.
• Cloud Infrastructure & Hosting Providers: bpowin's Platform data is hosted on enterprise-grade cloud infrastructure. Our hosting providers process data as Data Processors and are contractually prohibited from accessing or using your data for their own purposes.
• Game Content Providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive a pseudonymous player identifier and session token to enable game delivery and results recording. They do not receive your full identity or financial data.
• Fraud Prevention & Security Services: Specialist anti-fraud and cybersecurity service providers may receive Technical Data and aggregated Behavioural Data to identify and block fraudulent activity targeting the Platform or your account.
• Legal & Regulatory Authorities: bpowin will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid court order, or where disclosure is necessary to protect the rights, safety, or property of bpowin or third parties.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of bpowin's business, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections and prior notification to affected Users where practicable.

As an internationally operated platform, bpowin may transfer your Personal Data to countries outside of Indonesia in the course of providing its services — for example, to cloud hosting infrastructure or KYC verification partners located in other jurisdictions. Such transfers are made only to countries or recipients where adequate safeguards are in place to protect your Personal Data at a standard equivalent to that applied by bpowin.

Safeguards used for international data transfers include, but are not limited to:

• Standard contractual clauses or equivalent contractual protections incorporated into data processing agreements;
• Transfers to recipients in jurisdictions recognized as providing an adequate level of data protection by international standards;
• Binding corporate rules where transfers occur within a corporate group subject to unified data governance standards.

If you have questions about the safeguards applicable to a specific international transfer, please contact us at [email protected].

bpowin retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with any identifiable individual. Where data is retained beyond the primary retention period solely for legal or regulatory compliance, access to that data is strictly limited to authorized compliance personnel.

bpowin uses cookies and similar tracking technologies to operate essential platform functionality, remember your preferences, analyze site performance, and support security operations. The following cookie categories are used on the Platform:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without impairing your ability to use core Platform features.
• Functional Cookies: Enable the Platform to remember your preferences — such as your preferred language, interface settings, and last-visited game category. These enhance your user experience but are not essential to core functionality.
• Analytics Cookies: Collect aggregated, anonymized data about how Users interact with the Platform, including page views, session durations, and navigation paths. This data helps us identify usability issues and prioritize Platform improvements.
• Security Cookies: Support fraud detection and account security operations by assigning a device fingerprint and tracking login patterns to identify potentially unauthorized access attempts.

bpowin does not use third-party advertising cookies or cross-site behavioural tracking technologies that profile your activity outside of the bpowin.cam Platform domain.

bpowin applies a layered set of technical and organizational security measures designed to protect your Personal Data against unauthorized access, disclosure, alteration, destruction, or accidental loss. Key measures include:

• Encryption in Transit: All data transmitted between your device and the bpowin Platform is encrypted using TLS 1.2 or higher (256-bit SSL). This protects your login credentials, financial information, and personal data from interception during transmission.
• Encryption at Rest: Sensitive data stored in bpowin's databases — including KYC document data, financial account details, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to systems containing Personal Data is governed by role-based access control (RBAC). Staff members can only access data strictly necessary for their job function. All privileged access is logged and subject to regular audit review.
• Two-Factor Authentication (2FA): Users are strongly encouraged to enable 2FA on their bpowin accounts. Internal administrative access to production systems requires mandatory multi-factor authentication for all personnel.
• Penetration Testing & Vulnerability Management: bpowin's Platform undergoes regular third-party penetration testing and continuous automated vulnerability scanning. Identified vulnerabilities are prioritized and remediated according to a defined severity-based patching schedule.
• Incident Response: In the event of a confirmed data breach affecting your Personal Data, bpowin will notify affected Users promptly and take immediate containment steps in accordance with our incident response plan.

As a Data Subject, you hold a set of rights with respect to your Personal Data held by bpowin. These rights are summarized below. To exercise any of these rights, please submit a written request to [email protected]. We will acknowledge your request within five business days and aim to fulfill it within 14 calendar days, subject to identity verification.

The bpowin Platform is strictly intended for adults aged 21 years and above. bpowin does not knowingly collect Personal Data from any individual under the age of 21. Age verification is a mandatory component of the KYC process, and bpowin applies automated and manual controls to identify and prevent account registration by underage individuals.

If bpowin becomes aware — through KYC review, user report, or any other means — that an account has been registered by or on behalf of a person under 21 years of age, the following actions will be taken immediately:

• The account will be suspended and all active sessions terminated;
• Any balance in the account — whether deposited funds, winnings, or bonus funds — will be handled in accordance with bpowin's responsible gaming obligations, which may include return of deposited funds to the original payment source;
• All Personal Data associated with the account will be flagged for expedited deletion, subject to any minimum legal retention requirements;
• The matter will be escalated to bpowin's compliance team and, where required by law, reported to relevant authorities.

If you believe that a minor may have accessed the Platform or registered an account, please contact us immediately at [email protected]. For guidance on how to restrict access to gambling websites on shared or family devices, please visit our Responsible Gaming page.

The bpowin Platform may contain references to third-party services — for example, game studio names such as Pragmatic Play, Evolution Gaming, or Spribe — but does not include outbound hyperlinks to external websites. In the event that any third-party links are present in informational content on the Platform, bpowin is not responsible for the privacy practices or content of those external sites. This Policy applies solely to Personal Data collected and processed through the bpowin.cam domain. We encourage you to review the privacy policies of any third-party services you use in connection with your gaming activity.

bpowin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or Platform functionality. Where changes are material — meaning they significantly affect how your Personal Data is used or your rights as a Data Subject — we will notify registered Users by email prior to the changes taking effect, where it is reasonably practicable to do so.

The "Last Updated" date displayed at the top of this Policy reflects the date of the most recent revision. The version of the Policy in effect at the time your Personal Data is collected governs how that data is processed, unless a subsequent version must apply to comply with applicable law. We recommend reviewing this Policy periodically.

For all privacy-related inquiries, requests to exercise your data subject rights, or concerns about how bpowin handles your Personal Data, please reach out to our support team using the details below. Our Indonesian-speaking agents are available around the clock to assist users across all Indonesian time zones — WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9).