Privacy Policy

This Privacy Policy applies to all services operated by gwin4 and accessible via the domain gwin4.app, including the sportsbook, live casino, togel (Indonesia's traditional numbers lottery) draw markets, slot library, and all associated account management, payment, and customer support functions.

gwin4 is committed to protecting the personal data of every Member and visitor. We process personal information only to the extent necessary to deliver a secure, fair, and responsive gaming experience. We do not sell personal data to advertisers or data brokers, and we do not share it with third parties beyond the limited categories described in Section 6 of this Policy.

By registering an Account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not use the Platform.

For the purposes of applicable data protection legislation, gwin4 acts as the data controller in respect of all personal data collected through the Platform. The data controller is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is carried out lawfully, fairly, and transparently.

gwin4 is an internationally incorporated entity operating under an international gaming license. All data protection inquiries, subject access requests, and complaints should be directed to our dedicated privacy contact channel at [email protected] with the subject line "Privacy — [Your Account Username]".

gwin4 collects personal data across several categories depending on how you interact with the Platform. The table below provides a comprehensive overview of the personal data categories we process:

We do not collect sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (beyond document photographs required for KYC), or health data, except where you voluntarily disclose health-related information in the context of a responsible gaming request.

gwin4 collects personal data through the following channels:

• Directly from you: When you complete the Account registration form, submit KYC documents, make a deposit or withdrawal request, contact our support team, or respond to a survey or promotion.
• Automatically during Platform use: Through server logs, session tracking, and first-party cookies that record your IP address, device identifiers, browsing behavior on gwin4.app, and in-game activity. See Section 10 for full cookie details.
• From payment processors: When you initiate a deposit via a local Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) or an e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the payment processor confirms transaction status and payment method identifiers to our system.
• From identity verification partners: Our KYC providers may return a verification score, flag potential document anomalies, or confirm the validity of an Indonesian national identity document against public registry data.
• From fraud prevention services: Third-party fraud detection tools may supply risk scores, device fingerprints, or known-fraud indicators associated with your IP address or device.

gwin4 processes personal data only where a lawful basis exists. The following table maps each processing purpose to its corresponding legal basis:

Where we rely on legitimate interest as a legal basis, we have conducted a balancing test to confirm that our interests do not override your fundamental rights and freedoms. You may request a copy of any legitimate interest assessment by contacting [email protected].

gwin4 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: We share transaction data with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) strictly to the extent necessary to execute your deposit and withdrawal requests. These partners process your data under their own privacy policies and are subject to Bank Indonesia regulatory oversight.
• Identity Verification Partners: KYC document submissions are shared with certified identity verification service providers for the sole purpose of confirming your identity and age. These providers are contractually bound to process your data only for this purpose and to maintain data security standards equivalent to our own.
• Game Content Providers: When you play a game from a third-party studio (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), your session data and game history are processed by that studio's remote game server. Game providers are contractually prohibited from using this data for any purpose other than game operation and auditing.
• Fraud Prevention Services: Technical identifiers (IP address, device fingerprint) are shared with fraud detection providers to assess transaction and account risk. No directly identifiable personal data such as your full name or passport number is shared for this purpose.
• Legal and Regulatory Authorities: We will disclose personal data to law enforcement agencies, licensing regulators, or courts where required to do so by applicable law, a valid legal order, or where disclosure is necessary to prevent imminent harm or financial crime.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of gwin4's assets, your personal data may be transferred to the acquiring entity. You will be notified in advance of any such transfer, and your rights under this Policy will be preserved.

All third-party processors engaged by gwin4 are bound by data processing agreements that require them to implement appropriate technical and organizational security measures, process data only on gwin4's documented instructions, and assist gwin4 in fulfilling its obligations under applicable data protection law.

gwin4 is an internationally operated platform. Your personal data may be transferred to and processed in countries outside Indonesia, including countries where gwin4's servers, cloud infrastructure, or third-party processors are located. These countries may not have data protection laws equivalent to those applicable in your jurisdiction.

Where personal data is transferred internationally, gwin4 implements appropriate safeguards to ensure an equivalent level of protection, including:

• Standard contractual clauses approved by recognized data protection authorities, incorporated into agreements with all international processors.
• Data transfer impact assessments conducted prior to transferring data to jurisdictions assessed as presenting elevated privacy risks.
• Encryption of all personal data in transit using TLS 1.3 and at rest using AES-256, regardless of the jurisdiction in which it is stored.

gwin4 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, or to resolve disputes and enforce our agreements. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where anonymization is applied, the resulting data set (which can no longer be linked to any individual) may be retained indefinitely for statistical analysis and platform improvement purposes.

gwin4 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our technical and organizational security measures include:

• Transport Encryption: All data transmitted between your browser or application and gwin4's servers is encrypted using TLS 1.3 with HSTS (HTTP Strict Transport Security) enforced. Older TLS versions (1.0, 1.1) are disabled.
• Data-at-Rest Encryption: Personal data stored in our databases — including KYC documents, transaction records, and account credentials — is encrypted using AES-256.
• Password Security: User passwords are never stored in plain text. We apply bcrypt hashing with an adaptive cost factor, ensuring that even in the unlikely event of a database breach, passwords remain computationally infeasible to crack.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA via SMS or authenticator app. gwin4 staff accounts are required to use 2FA without exception.
• Access Controls: Access to Member personal data by gwin4 staff is governed by role-based access controls (RBAC) on a strict need-to-know basis. All staff access to production systems is logged and audited.
• Penetration Testing: gwin4's platform undergoes regular third-party penetration testing and vulnerability assessments. Critical vulnerabilities are remediated within 72 hours of identification.
• Incident Response: In the event of a personal data breach, gwin4 will notify affected Members and relevant authorities within 72 hours of becoming aware of the breach, in accordance with applicable data protection law, and will take immediate steps to contain and remediate the incident.

gwin4 uses first-party cookies and similar tracking technologies to operate the Platform, maintain your login session, remember your preferences, and analyze aggregate usage patterns. We do not use third-party advertising cookies or behavioral tracking cookies that track you across external websites.

You can control functional and analytics cookies through your browser settings. However, disabling strictly necessary cookies will prevent the Platform from functioning correctly, and you will not be able to log in to your Account. Instructions for managing cookies are available in your browser's help documentation.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to your personal data held by gwin4. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request — [Your Account Username]":

gwin4 will respond to all verified data rights requests within thirty (30) calendar days of receipt. We may ask you to verify your identity before processing the request to prevent unauthorized access to another person's data. In complex cases, the response period may be extended by up to an additional sixty (60) days, with notice provided to you.

Please note that certain rights are subject to exceptions. For example, we cannot erase transaction records that we are legally required to retain for AML compliance purposes, nor can we delete KYC records during an active Account. These limitations will be clearly explained to you if applicable to your specific request.

gwin4 enforces a strict minimum age requirement of 21 years. The Platform is not directed at, designed for, or intended to be used by any person under the age of 21. We do not knowingly collect personal data from individuals under 21.

If you believe that a person under the age of 21 has registered an Account or submitted personal data to gwin4, please contact us immediately at [email protected]. Upon confirmation, we will immediately close the Account, void any associated bets, return the net deposit amount to the funding source, and securely delete all personal data associated with the underage individual.

The gwin4 Platform does not include links to external third-party websites for the purpose of advertising, affiliation, or outbound referral. All navigation links on gwin4.app lead to pages within this domain. However, game content delivered via embedded third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) is served from those studios' remote game servers and is subject to those studios' own privacy and data processing terms.

When you launch a third-party game, your session identifiers and in-game activity are processed by the respective studio's server infrastructure. gwin4 has entered into data processing agreements with all game studio partners to ensure that your data is used only for game delivery and auditing purposes and is not shared further or used for independent marketing by the studio.

gwin4 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify you by email to your registered address and display a prominent notice on the Platform for a period of not less than fourteen (14) days prior to the changes taking effect.

The date at the top of this Policy indicates when it was last revised. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree to the revised terms, you should close your Account before the effective date by contacting [email protected].

We maintain an archive of previous versions of this Privacy Policy. If you require a copy of a prior version for reference or dispute purposes, please contact our Privacy Officer at [email protected].

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how gwin4 handles your personal data, please contact us through the following channels:

• Privacy & Data Inquiries: [email protected] — subject line "Privacy — [Your Account Username]". Response within 5 business days.
• Responsible Gaming & Self-Exclusion: [email protected] — for privacy matters connected to responsible gaming tools and self-exclusion records.
• Live Chat: Available 24/7 via the Platform. Indonesian-speaking agents are on duty daily from 08:00 to 24:00 WIB for immediate assistance.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the data protection authority or relevant regulatory body in the jurisdiction in which gwin4 is licensed. Details of the applicable supervisory authority are available on request.