Privacy Policy

1.1 coi99 operates the online betting and gaming platform accessible at https://coi99.cam (the "Platform"). coi99 acts as the data controller in respect of the personal data of Platform members and visitors, meaning we determine the purposes and means by which personal data is processed.

1.2 This Privacy Policy applies to all personal data collected through: the Platform and any associated mobile-optimised interfaces; customer support and live chat interactions; email correspondence with our team; and any other touchpoint through which you interact with coi99.

1.3 This policy does not cover third-party websites that may be linked from the Platform, nor the privacy practices of payment processors or identity verification providers, each of which operates under its own privacy framework. Where we share data with such providers, we do so under contractual safeguards as described in Clause 6.

1.4 coi99's primary user base consists of adults aged 21 and above located in Indonesia. In implementing this policy, coi99 applies data protection standards consistent with internationally recognised best practices, including principles equivalent to those set out in the European Union General Data Protection Regulation (GDPR), to the extent they represent a meaningful standard for the protection of individual privacy rights.

In this Privacy Policy, the following terms have the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, national identity number, payment account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" means the identified or identifiable natural person whose Personal Data is processed — in the context of this policy, a Platform member or visitor.
• "Data Controller" means coi99, which determines the purposes and means of processing Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of coi99 under a written data processing agreement.
• "Sensitive Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data used for identification purposes, or financial data of a particularly sensitive nature.
• "Consent" means a freely given, specific, informed, and unambiguous indication by the Data Subject that they agree to the processing of their Personal Data for a stated purpose.

3.1 coi99 collects the following categories of Personal Data:

3.2 coi99 does not intentionally collect Sensitive Personal Data beyond what is necessary for identity verification (KYC) purposes. Where identity documents contain sensitive data fields (such as religion or blood type, which appear on Indonesian KTP cards), that information is not extracted, stored separately, or used for any processing purpose beyond confirming document authenticity and matching the document to the account holder.

3.3 You are not required to provide all categories of data listed above to access the Platform at a basic level. However, certain features — including withdrawal processing above minimum thresholds and access to higher-tier VIP benefits — require KYC completion. Where data provision is mandatory for a specific feature, this will be communicated clearly at the point of collection.

4.1 coi99 uses your Personal Data for the following purposes:

• Account management: creating and maintaining your account, authenticating your identity at login, and administering your account settings and preferences.
• Service delivery: processing deposits and withdrawals via your chosen payment channels (including BCA, BRI, BNI, Mandiri, GoPay, OVO, DANA, ShopeePay, and LinkAja), settling bets and game outcomes, and crediting winnings to your Wallet.
• Identity verification and fraud prevention: conducting KYC checks to verify your age, identity, and payment account ownership; detecting and investigating suspected fraudulent activity, money laundering, or breach of our Terms and Conditions.
• Regulatory and legal compliance: meeting obligations under applicable anti-money laundering (AML) frameworks, responding to lawful requests from competent authorities, and maintaining records required by law.
• Customer support: responding to your enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance and training purposes.
• Platform improvement: analysing aggregated and anonymised usage data to identify technical issues, optimise page performance, improve mobile experience, and develop new features.
• Marketing communications: sending you promotional offers, bonus notifications, and platform updates by email, SMS, or push notification — but only where you have opted in to receive such communications, or where we have a legitimate interest in notifying you of service-related updates directly relevant to your account.
• Responsible gaming: monitoring betting patterns to identify behaviour that may indicate problem gambling and, where appropriate, reaching out proactively or applying account-level protections in line with our Responsible Gaming commitment.

4.2 coi99 does not use Personal Data to make fully automated decisions that produce significant legal effects on Data Subjects without human review. Where automated monitoring flags an account for review (for example, for suspected bonus abuse or irregular betting patterns), a member of our compliance team reviews the flag before any account action is taken.

5.1 coi99 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: processing required to perform the contract between you and coi99 (i.e., the Terms and Conditions you agreed to upon registration), including account creation, payment processing, and bet settlement.
• Legal obligation: processing required to comply with applicable laws and regulations, including AML obligations, age verification requirements, and responses to lawful authority requests.
• Legitimate interests: processing where coi99 has a legitimate interest that is not overridden by your privacy rights, including fraud prevention, platform security, improving platform performance, and communicating service-critical updates to existing members.
• Consent: processing based on your explicit opt-in, including marketing communications by email, SMS, or push notification. You may withdraw consent at any time by updating your communication preferences in your account settings or by contacting our support team.

5.2 Where processing is based on legitimate interests, coi99 has assessed that such interests are not overridden by the fundamental rights and freedoms of Data Subjects. A summary of these assessments is available upon written request to our privacy team.

6.1 coi99 does not sell, rent, or trade your Personal Data. We share your data only in the following circumstances and only to the minimum extent necessary:

• Payment processors: your bank account details or e-wallet identifiers are shared with the relevant Indonesian payment network (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, GoPay, OVO, DANA, ShopeePay, or LinkAja) solely to execute the transaction you have initiated.
• Identity verification providers: KYC document data is transmitted to our contracted identity verification service provider for authenticity and biometric matching checks. This provider acts as a Data Processor under a written agreement that prohibits secondary use of your data.
• Game content providers: studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, and Spribe receive a pseudonymous session token to deliver game content. They do not receive your full name, payment data, or identity documents.
• Fraud prevention and AML partners: anonymised or pseudonymised transaction signals may be shared with fraud detection service providers under confidentiality agreements, strictly for the purpose of protecting the integrity of the Platform.
• Legal and regulatory authorities: coi99 will disclose Personal Data to competent authorities when required to do so by law, court order, or enforceable governmental request. Where legally permitted, we will notify affected members of such disclosures.
• Corporate transactions: in the event of a merger, acquisition, or sale of substantially all assets of coi99, Personal Data may be transferred to the acquiring entity, subject to continuity of data protection obligations at least equivalent to those in this policy. Members will be notified of any such transfer.

6.2 All third-party Data Processors engaged by coi99 are contractually required to: process Personal Data only on documented instructions from coi99; implement appropriate technical and organisational security measures; not engage sub-processors without coi99's prior written consent; and delete or return all Personal Data upon termination of the service agreement.

7.1 coi99 uses cookies, local storage, and similar client-side technologies to support Platform functionality, analyse usage patterns, and deliver a consistent experience across sessions. The categories of cookies we deploy are set out below:

7.2 coi99 does not deploy cross-site tracking cookies that follow members to third-party websites. Marketing cookies are only activated for members who have explicitly opted in to promotional communications.

7.3 Most web browsers allow you to control cookies through browser settings. Disabling strictly necessary cookies will impair or prevent access to the Platform. Instructions for managing cookies in major browsers are available in each browser's help documentation.

8.1 coi99 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:

• Account and registration data: retained for the duration of the account relationship and for five (5) years following permanent account closure, to meet AML record-keeping requirements.
• KYC and identity documents: retained for five (5) years from the date of submission or from the date of account closure, whichever is later, in line with standard AML compliance practice.
• Transaction and bet records: retained for five (5) years from the date of each transaction, consistent with applicable financial record-keeping obligations.
• Customer support records: retained for three (3) years from the date of each interaction, for quality assurance and dispute resolution purposes.
• Marketing preference records: retained for the duration of the account relationship; opt-out records are retained for five (5) years to demonstrate compliance with consent withdrawal.
• Technical and usage logs: retained for twelve (12) months in identifiable form, after which logs are anonymised for aggregated analytics purposes with no retention limit.

8.2 Where retention is required solely to comply with a legal obligation, the data is stored in a restricted-access archive and is not used for any operational purpose during the retention period. Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised.

9.1 As a Data Subject, you have the following rights in respect of your Personal Data held by coi99. To exercise any of these rights, submit a written request to [email protected] with the subject line "Privacy Rights Request" and a description of your request. coi99 will acknowledge your request within 24 hours and respond substantively within 30 calendar days.

• Right of access: you may request a copy of the Personal Data coi99 holds about you, along with information about the purposes of processing, the categories of data involved, and any third parties to whom the data has been disclosed.
• Right to rectification: if any Personal Data we hold about you is inaccurate or incomplete, you may request that we correct or complete it. Simple corrections (such as updating your email address or phone number) can also be made directly through your account settings.
• Right to erasure: you may request that we delete your Personal Data where: it is no longer necessary for the purposes for which it was collected; you have withdrawn consent and no other legal basis applies; or the data has been unlawfully processed. This right is subject to overriding legal retention obligations as described in Clause 8.
• Right to restriction: in certain circumstances — for example, while a dispute about accuracy is pending — you may request that we restrict processing of your Personal Data to storage only.
• Right to object: you may object to processing based on legitimate interests, including profiling for responsible gaming monitoring. coi99 will honour such objections unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to data portability: where processing is based on consent or contractual necessity and is carried out by automated means, you may request a structured, machine-readable copy of your Personal Data for transfer to another service provider.
• Right to withdraw consent: where processing is based on consent (including marketing communications), you may withdraw that consent at any time with no adverse consequences to your account status. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9.2 coi99 will not charge a fee for processing privacy rights requests submitted in good faith. Where requests are manifestly unfounded or excessive — in particular, where they are repetitive in nature — coi99 reserves the right to charge a reasonable administrative fee or to decline to act on the request, with written reasons provided.

10.1 coi99 implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. Key measures include:

• TLS 1.3 encryption for all data in transit between user devices and coi99 platform servers;
• AES-256 encryption for Personal Data stored at rest, including identity documents and payment records;
• Role-based access controls ensuring that employees can only access Personal Data relevant to their specific job function;
• Multi-factor authentication required for all internal staff systems that handle Personal Data;
• Regular penetration testing and vulnerability assessments conducted by independent third-party security firms;
• Intrusion detection systems and real-time anomaly monitoring on all production infrastructure;
• Formal data breach response procedures with defined escalation paths and notification timelines.

10.2 In the event of a personal data breach that poses a risk to the rights and freedoms of affected members, coi99 will notify affected individuals without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address the breach.

10.3 While coi99 takes all reasonable and commercially practicable steps to protect your Personal Data, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for using strong, unique passwords. If you suspect that your account has been compromised, please contact our support team immediately at [email protected].

11.1 coi99's primary platform infrastructure is hosted in data centres located within or in proximity to the Asia-Pacific region. Certain service providers engaged by coi99 — including game content studios, fraud prevention systems, and cloud infrastructure providers — may process Personal Data in jurisdictions outside Indonesia.

11.2 Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that described in this policy, coi99 ensures that appropriate safeguards are in place before the transfer occurs. These safeguards include contractual data protection clauses that impose obligations on the receiving party equivalent to those under this policy, and technical measures such as encryption that limit exposure in the event of a security incident at the receiving end.

11.3 Members who wish to obtain further information about the specific safeguards in place for cross-border data transfers may submit a written request to our privacy team at [email protected].

12.1 The coi99 platform is strictly intended for adults aged 21 and above. coi99 does not knowingly collect or process the Personal Data of any individual under the age of 21. Registration by persons under 21 is a breach of the Terms and Conditions and grounds for immediate account closure.

12.2 If coi99 becomes aware that it has inadvertently collected Personal Data from an individual who was under 21 at the time of collection, we will delete all associated data promptly, close the account, void all bets placed during the period of underage access, and — where applicable — return deposited funds net of any withdrawals already processed.

12.3 Parents or guardians who believe that a minor may have created an account on the coi99 platform are strongly encouraged to contact our support team immediately at [email protected]. We will investigate and act without delay.

13.1 coi99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable legal obligations. The "Last Updated" date at the top of this page will be revised whenever material changes are made.

13.2 Where changes are material — meaning they affect the way we collect, use, or share your Personal Data in a manner that may significantly impact your privacy — coi99 will notify active members by email to the address registered to their account at least 14 calendar days before the changes take effect. Continued use of the Platform after the effective date of any revised policy constitutes acceptance of the revised terms.

13.3 We encourage you to review this Privacy Policy periodically. Archived versions of previous policies are available upon written request to our privacy team.

14.1 For all privacy-related enquiries, data subject requests, or concerns about how your Personal Data is handled on the coi99 platform, please contact our privacy team using the details below. We ask that you include your registered email address and a clear description of your request or concern so we can respond efficiently.

Privacy Team — coi99
Email: [email protected]
Subject line: "Privacy Enquiry" or "Data Subject Request"
Response commitment: acknowledgement within 24 hours; substantive response within 30 calendar days.

14.2 If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority or regulatory body in your jurisdiction. coi99 will cooperate fully with any such authority in the investigation of a privacy complaint.

14.3 For general support enquiries unrelated to privacy, you may also use the live chat feature available on the coi99 homepage, where our Indonesian-speaking support team is available 24 hours a day, 7 days a week. Live chat response times during WIB peak hours (08:00–24:00, UTC+7) average under two minutes.