Privacy Policy — cuka22

01 Introduction

cuka22 ("we", "us", "our") is committed to protecting and respecting the privacy of everyone who uses our platform. We operate an international online betting and casino service specifically designed to serve English-preference players across Indonesia, and we understand that the trust our players place in us extends to how we handle their personal information.

This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed. Please read this Policy carefully. By accessing or using the cuka22 platform, you acknowledge that you have read and understood this Policy. If you have any questions or concerns, please contact us using the details in Section 14 before continuing to use our services.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, which together govern your use of the cuka22 platform.

02 Data Controller

For the purposes of applicable data protection legislation, cuka22 is the data controller in respect of personal data collected through the Platform. This means cuka22 determines the purposes for which, and the manner in which, your personal data is processed.

Our designated data protection contact can be reached at [email protected]. Please include "Privacy — Data Controller Query" in the subject line of any correspondence relating to data protection matters.

03 Data We Collect

We collect the following categories of personal data about you, depending on how you interact with the Platform:

We do not intentionally collect any special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless this is incidentally contained within a KYC document you submit. Where such data is present, it is not used for any purpose beyond identity verification and is subject to enhanced access controls.

04 How We Collect Your Data

cuka22 collects personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated technologies: When you visit the Platform, we automatically collect Technical Data and Usage Data via cookies, web server logs, and similar tracking technologies. See Section 10 for full details of our cookie practices.
• Third-party payment providers: When you transact via a local Indonesian bank (such as BCA, BRI, BNI, or Mandiri) or an e-wallet provider (such as OVO or DANA), we may receive confirmation data from those providers to reconcile your transaction. We do not receive your full payment credentials from these providers.
• Identity verification partners: Where we use a third-party KYC service provider to assist with document verification, that provider may supply us with a verification outcome and a risk score alongside the data you submitted.
• Fraud prevention and analytics services: We may receive aggregated or pseudonymized data from third-party fraud detection and analytics partners to help us identify unusual account activity or improve platform performance.

05 Purpose & Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. The table below sets out the primary purposes for which we process your data and the corresponding legal basis in each case:

06 Sharing Your Data

cuka22 does not sell or rent your personal data to any third party. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Payment processors and financial institutions: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) require transaction data to facilitate deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged to verify the authenticity of identity documents and assess fraud risk. These providers act as data processors under written agreements with cuka22.
• IT infrastructure and hosting providers: Cloud hosting, database management, and content delivery network (CDN) providers that support the technical operation of the Platform.
• Fraud detection and cybersecurity partners: Specialist providers that help us identify and respond to account compromise, collusion, or fraudulent transaction patterns.
• Customer support platform providers: Third-party helpdesk and live chat software providers used to manage support ticket workflows. These providers process communication data on our behalf.
• Regulators and law enforcement: We may disclose personal data to our licensing authority, financial intelligence units, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to prevent or detect crime.
• Professional advisors: Lawyers, accountants, and auditors engaged to provide professional services to cuka22, bound by confidentiality obligations.

All third parties with whom we share personal data are required to process it lawfully, in accordance with applicable data protection legislation, and solely for the purposes specified in our agreements with them. We do not permit third-party data processors to use your personal data for their own unrelated purposes.

07 International Data Transfers

As an internationally operated platform, cuka22 may transfer your personal data to servers or service providers located outside Indonesia. Where such transfers occur, we take the following steps to ensure your data remains adequately protected:

• We transfer data only to countries or recipients that offer an adequate level of data protection, as assessed by reference to internationally recognized standards.
• Where an adequacy determination is not available, we implement appropriate safeguards — such as standard contractual clauses or binding corporate rules — prior to any transfer.
• We conduct periodic reviews of our international data transfer arrangements to ensure they remain compliant with evolving regulatory requirements.

By registering an account with cuka22, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions other than Indonesia. We will always take reasonable steps to ensure that any such transfer is handled securely and in accordance with this Policy.

08 Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. Our general retention principles are as follows:

• Active account data: Retained for the full duration of your account's active status plus a minimum period following account closure, as required by our licensing and financial record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission, in line with standard anti-money-laundering record-keeping requirements.
• Transaction records: Financial transaction records, including deposit and withdrawal history in IDR (Rp), are retained for a minimum of five (5) years following the transaction date.
• Support communications: Customer support tickets and correspondence are retained for three (3) years from the date of resolution, or longer if the communication relates to an open dispute or regulatory inquiry.
• Technical and usage data: Log data is typically retained for up to twelve (12) months, after which it is aggregated or deleted.
• Marketing preference data: Retained until you withdraw consent, plus a short additional period to process the opt-out and suppress further communications.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be attributed to you as an individual. Where anonymization rather than deletion is applied, the resulting data may be retained and used for statistical or analytical purposes without restriction.

09 Security Measures

cuka22 implements a layered security architecture designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our key technical and organizational measures include:

• Encryption in transit: All communications between your browser or device and the cuka22 Platform are encrypted using 256-bit SSL/TLS protocols. Our site enforces HTTPS at all times; unencrypted HTTP connections are automatically redirected.
• Encryption at rest: Sensitive data fields — including payment account identifiers, KYC document files, and authentication credentials — are encrypted at the database level using AES-256 or equivalent industry-standard algorithms.
• Access controls: Access to systems containing personal data is restricted on a role-based, least-privilege basis. Staff may only access personal data that is directly relevant to their job function. All access is logged and subject to periodic audit.
• Two-factor authentication (2FA): Administrative access to back-end systems requires multi-factor authentication. We encourage Players to enable 2FA on their own accounts for an additional layer of protection.
• Regular security assessments: We conduct periodic vulnerability assessments and penetration testing of our infrastructure. Critical vulnerabilities are remediated within defined SLA windows.
• Incident response: cuka22 maintains a documented data breach response plan. In the event of a security incident that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and take all reasonable steps to contain and remediate the incident.

10 Cookies & Tracking Technologies

cuka22 uses cookies and similar tracking technologies to operate the Platform, enhance your experience, and gather usage analytics. A cookie is a small text file placed on your device by our web server when you visit the Platform. Cookies do not contain executable code and cannot access other files on your device.

We use the following categories of cookies:

• Strictly necessary cookies: These are essential for the Platform to function. They enable core features such as session authentication, account security, fraud prevention, and load balancing. These cookies cannot be disabled without significantly impairing your ability to use the Platform.
• Functional cookies: These remember your preferences — such as language settings, display options, and previously used deposit methods — to provide a more personalized experience on your return visits.
• Analytics cookies: These help us understand how Players navigate the Platform, which pages are most visited, and where technical errors occur. The data collected is aggregated and pseudonymized wherever possible. We use this information solely to improve Platform performance.
• Marketing cookies: Where you have opted in to receive promotional communications, these cookies may be used to measure the effectiveness of our campaigns and to ensure that any promotional content you see is relevant to your interests. They are only placed with your prior consent.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent parts of the Platform from functioning correctly. For detailed instructions on managing cookies in popular browsers, refer to the help documentation of your specific browser.

11 Your Data Rights

Subject to applicable law, you hold the following rights in respect of your personal data held by cuka22. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy — Data Rights Request". We will respond within 30 calendar days of receiving a verifiable request.

We will not charge a fee for handling data rights requests unless the request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or decline to act on the request, with written reasons provided.

12 Minors

The cuka22 Platform is strictly intended for use by adults aged 21 years and older. We do not knowingly collect, process, or retain personal data belonging to individuals under the age of 21. Our registration process requires users to declare their date of birth, and we enforce KYC age verification for all accounts prior to the processing of withdrawal requests.

If we become aware that personal data has been collected from an individual under the age of 21 without verifiable parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has registered on our Platform, please contact us immediately at [email protected].

13 Changes to This Policy

cuka22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The "Last Updated" date at the top of this page indicates when the current version took effect.

Where changes are material — meaning they significantly affect the way we process your personal data or materially alter your rights — we will notify you by email to the address registered on your account at least seven (7) days before the changes come into force. For non-material updates (such as typographical corrections or minor clarifications), we may update the Policy without prior notice.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you must stop using the Platform and may request account closure by contacting our support team.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way cuka22 processes your personal data, please reach out to us using the contact details below. We take all privacy inquiries seriously and will endeavor to respond promptly and thoroughly.