Privacy Policy — How dewi17 Protects Your Data

The following defined terms are used throughout this Privacy Policy. Where a term is not defined here, its meaning shall be consistent with the definition given in the dewi17 Terms & Conditions.

• "dewi17" / "the Platform" / "we" / "us" / "our" refers to dewi17, the online betting and casino platform accessible at https://dewi17.pro, operated by its licensed and regulated international entity.
• "Member" / "you" / "your" refers to any individual who has registered an account on dewi17, or who browses the platform without a registered account.
• "Personal Data" means any information that directly or indirectly identifies a natural person, including but not limited to name, date of birth, residential address, email address, phone number, payment account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "KYC" means Know Your Customer — the identity and document verification process required to comply with anti-money-laundering (AML) standards and to enable withdrawal processing.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including government-issued identity document numbers (e.g., Indonesian KTP number), bank account details, and any data relating to responsible gaming self-assessments.
• "Third-Party Processor" means any external service provider engaged by dewi17 to process Personal Data on dewi17's behalf, including payment processors, identity verification providers, and fraud prevention services.
• "Cookie" means a small text file placed on your device by the dewi17 platform to enable session management, analytics, and security functions as further described in Section 8.

This Privacy Policy applies to all Personal Data collected through the dewi17 website at https://dewi17.pro, any mobile-optimised version of the platform, and all communications between dewi17 and its Members via email, WhatsApp, or live chat.

dewi17 acts as the Data Controller for the Personal Data described in this policy — meaning dewi17 determines the purposes for which your data is collected and the manner in which it is processed. Where dewi17 engages Third-Party Processors, those processors act solely on dewi17's instructions and are bound by data processing agreements that impose equivalent data protection obligations.

This policy is directed at individuals accessing dewi17 from Indonesia. By registering an account or continuing to use the platform, you acknowledge that your Personal Data will be processed in accordance with this Privacy Policy. If you do not agree with any provision of this policy, you must discontinue use of the platform immediately.

dewi17 collects Personal Data across the following categories. The table below summarises each category, the specific data points within it, and the primary purpose for collection.

dewi17 collects Personal Data through the following channels and mechanisms:

• Registration form: When you create a dewi17 account, you directly provide Registration Data including your name, date of birth, Indonesian address, email address, and phone number.
• KYC submission portal: When you upload identity documents to complete the KYC process prior to your first withdrawal, you provide KYC Documents directly to dewi17's secure verification system.
• Deposit and withdrawal flows: When you submit a deposit or withdrawal request, you provide the bank account or e-wallet details required to process the transaction.
• Platform activity: Activity Data — including bets, game sessions, and togel (Indonesia's traditional numbers lottery) entries — is automatically recorded in dewi17's systems as a record of your account activity.
• Cookies and device signals: Technical Data is collected automatically via cookies and server logs each time you access the platform. See Section 8 for full details on cookie use.
• Customer support interactions: When you contact dewi17 via email at [email protected], via live chat on the platform dashboard, or via WhatsApp at +62 811 0000 1717, your communications and any personal data you share within those communications are recorded.
• Third-party verification services: Where dewi17 uses a third-party identity verification provider as part of the KYC process, that provider may return a verification result and risk score to dewi17 based on your submitted documents. dewi17 does not receive raw data from external sources without your knowledge.

dewi17 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contract performance: Processing is necessary to provide the dewi17 services you have signed up for — including account management, payment processing, and game access. Without this processing, dewi17 cannot deliver the services described in the Terms & Conditions.
• Legal obligation: Processing is necessary to comply with AML (anti-money laundering) obligations, age verification requirements (21+ policy), and the reporting obligations of dewi17's international licence. KYC document processing falls primarily under this basis.
• Legitimate interests: Processing is necessary for purposes of fraud prevention, platform security, responsible gaming monitoring, and improving the quality of dewi17's services — provided such interests are not overridden by your rights and freedoms.
• Consent: Where dewi17 sends you optional promotional communications (such as bonus offers and tournament alerts), it does so on the basis of your consent given at registration or subsequently via account settings. You may withdraw this consent at any time by contacting [email protected].

dewi17 uses the Personal Data it collects for the following purposes only:

• Account management: Creating, maintaining, and securing your dewi17 account, including password reset and session management.
• Identity and age verification: Confirming that you are at least 21 years of age and a resident of Indonesia as required by dewi17's 21+ policy and KYC obligations.
• Payment processing: Executing deposits from and withdrawals to your registered Indonesian bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, or Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, or LinkAja) in Indonesian Rupiah (IDR).
• Fraud and AML monitoring: Detecting and preventing fraudulent activity, money laundering, multi-accounting, and bonus abuse through automated systems and manual review where appropriate.
• Responsible gaming: Monitoring your Activity Data to identify patterns that may indicate problem gambling behaviour, and to apply any deposit limits, loss limits, cool-off periods, or self-exclusion instructions you have set via your account settings.
• Customer support: Responding to your queries, complaints, and formal disputes in a timely and accurate manner. Communications Data is retained to maintain a complete record of all support interactions.
• Platform improvement: Analysing aggregated, anonymised Technical Data and Activity Data to understand user behaviour, fix bugs, and improve the quality of dewi17's games and betting products.
• Promotional communications (consent-based): Sending you information about bonuses, tournaments, seasonal promotions (e.g., Idul Fitri reload offers, Ramadhan cashback campaigns), and new game releases — strictly where you have given consent to receive such communications.
• Legal and regulatory compliance: Fulfilling reporting obligations to dewi17's licensing authority and complying with any lawful request from a competent authority.

dewi17 does not sell, rent, or trade your Personal Data. Data is shared with third parties only in the following limited circumstances:

• Payment processors: Your bank account or e-wallet details are shared with the relevant Indonesian payment infrastructure (e.g., BCA transfer network, OVO API gateway) solely to process your deposit or withdrawal transaction. These processors receive only the data required to execute the specific transaction.
• KYC and identity verification providers: Your identity documents and selfie photograph may be transmitted to a third-party identity verification service to assist with automated KYC processing. This provider is contractually bound to use your data only for the purposes of verification on dewi17's behalf.
• Fraud prevention and AML screening services: Technical Data and transaction patterns may be shared with specialist fraud screening services to detect and prevent suspicious activity. These services do not receive more data than is necessary for the specific screening purpose.
• Legal authorities: dewi17 may be required by law, court order, or the instruction of a competent regulatory authority to disclose Personal Data. In such cases, dewi17 will disclose only the minimum data required and, where legally permissible, will notify the affected Member.
• Business successors: In the event of a merger, acquisition, or transfer of dewi17's business operations, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material changes to data processing practices that result from it.

dewi17 uses cookies and similar client-side storage technologies on the platform. The table below details the categories of cookies we use, their purpose, and their typical retention duration.

dewi17 does not use advertising cookies, cross-site tracking pixels, or any cookie that reports your browsing behaviour on external websites to third parties.

Most web browsers allow you to manage cookie preferences via browser settings. Disabling strictly necessary or security cookies will impair platform functionality and may prevent you from logging in or completing transactions. dewi17 is not liable for reduced functionality resulting from cookie restrictions applied by the Member.

dewi17 applies a layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Transport encryption: All data in transit between your device and dewi17 servers is encrypted using 256-bit SSL/TLS. The platform enforces HTTPS on every page and rejects unencrypted HTTP connections.
• Data at rest encryption: Sensitive Data, including KYC document files and financial account details, is encrypted at rest using AES-256 encryption in dewi17's data storage systems.
• Access controls: Internal access to Personal Data is restricted on a need-to-know basis. dewi17 employees and contractors are granted the minimum data access necessary for their specific role. Access logs are maintained and reviewed regularly.
• Password security: Member passwords are stored exclusively as salted cryptographic hashes. dewi17 support staff cannot view your password in plain text and will never ask you for it.
• Intrusion detection: dewi17 employs automated intrusion detection systems that alert the security team to anomalous access patterns in real time, including failed login attempts, unusual IP behaviour, and bulk data access events.
• Penetration testing: dewi17 engages independent third-party security professionals to conduct periodic penetration testing of the platform infrastructure. Critical findings are remediated within 72 hours of identification.

In the event of a data breach that poses a material risk to affected Members, dewi17 will notify affected Members via their registered email address within 72 hours of confirming the breach, and will take all reasonable steps to contain and remediate the incident.

dewi17 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and dewi17's AML compliance obligations. The following retention periods apply:

Upon expiry of the applicable retention period, Personal Data is either securely deleted from dewi17's systems or rendered permanently anonymous such that it can no longer be associated with any identifiable individual. Backups are purged on the same schedule within a maximum of 90 days following the primary deletion.

As a dewi17 member, you hold the following rights with respect to the Personal Data we process about you. To exercise any of these rights, contact dewi17 at [email protected] with the subject line "Privacy Rights Request" and include your registered username and a clear description of the right you wish to exercise.

• Right of Access: You may request a copy of all Personal Data dewi17 holds about you. dewi17 will respond within 30 days of receiving a verified request.
• Right to Rectification: If any Personal Data dewi17 holds about you is inaccurate or incomplete, you may request that it be corrected. Account profile details may also be updated directly via your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations. dewi17 may not be able to delete data that must be retained for AML or regulatory compliance purposes.
• Right to Restrict Processing: You may request that dewi17 restrict certain processing activities (for example, during a period in which you have contested the accuracy of your data) while the matter is being resolved.
• Right to Data Portability: You may request a structured, machine-readable export of the Personal Data you have provided to dewi17 (Registration Data and Activity Data), in a format such as JSON or CSV.
• Right to Object: You may object at any time to processing carried out on the basis of legitimate interests. dewi17 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., promotional emails), you may withdraw that consent at any time by emailing [email protected] or updating your communication preferences in account settings.

dewi17 operates a strict minimum age policy of 21 years. The platform is not directed at, and does not knowingly collect Personal Data from, any individual under the age of 21. All registration flows include an age declaration, and the KYC process verifies date of birth via government-issued identity documents.

If dewi17 becomes aware — through the KYC process, a third-party report, or any other means — that a Member is under 21 years of age, the following steps will be taken immediately:

• The Member's account will be suspended with immediate effect.
• All Personal Data collected from the underage individual will be securely deleted, except where retention is required for AML or fraud investigation purposes.
• Any real-money deposit funds will be returned to the source payment method where technically feasible; all winnings will be forfeited.

Parents and guardians who believe a minor may have registered a dewi17 account are urged to contact dewi17 immediately at [email protected] with the subject line "Minor Account Report". dewi17 will treat all such reports with the highest urgency.

The dewi17 platform may reference or link to third-party services, including game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe), sports data providers (providing live scores for BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, Champions League, and other leagues), and payment infrastructure providers.

When you interact with game interfaces powered by third-party studios, those studios may collect certain game-play event data directly in their capacity as independent data controllers. dewi17 is not responsible for the privacy practices of third-party data controllers. You are encouraged to review the privacy policies of any third-party service you interact with through or alongside the dewi17 platform.

dewi17 does not embed third-party social media widgets, advertising scripts, or cross-site analytics tags on the platform. All analytics capabilities are operated by dewi17 directly or through processors bound by dewi17's data processing instructions.

dewi17 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services we offer. When material changes are made, dewi17 will notify active Members via their registered email address at least 14 days before the updated policy takes effect.

The effective date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how dewi17 protects your data. Your continued use of the platform after the effective date of any update constitutes your acknowledgement of the revised policy.

Where a change to this Privacy Policy requires your fresh consent under applicable law — for example, where we introduce a materially new purpose for processing your data — dewi17 will obtain that consent separately and will not rely on deemed acceptance through continued use.

For any questions, concerns, or requests relating to this Privacy Policy or dewi17's data processing practices, please contact our Data Privacy team using the details below. All communications must be in English. Please do not send sensitive documents (such as copies of your KTP or passport) via email unless specifically requested by dewi17's support team as part of a verified KYC or account recovery process.

dewi17 is committed to resolving all privacy-related complaints promptly and fairly. If you submit a complaint, dewi17 will:

• Acknowledge receipt of your complaint within 5 business days (WIB).
• Conduct a thorough internal investigation of the matter.
• Provide a substantive written response within 30 calendar days, or notify you of an extension if the matter requires additional time.
• Where a complaint is upheld, take immediate remedial action and inform you of the specific steps taken.

If you are not satisfied with dewi17's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection or regulatory authority in the jurisdiction where dewi17 holds its operating licence. Details of the applicable supervisory authority are available upon request from [email protected].