gol33 Privacy Policy

gol33 operates an online gaming platform available at gol33.ws, offering sports betting — including coverage of BRI Liga 1, EPL, Champions League, and the AFF Cup (Piala AFF) — live casino games, slot titles from studios such as Pragmatic Play, PGSoft, and NetEnt, daily togel (Indonesia's traditional numbers lottery) draws, and Esports betting markets across Mobile Legends MPL, PUBG Mobile, and Free Fire. Our primary audience is adults aged 21 and above located across Indonesia, including major cities such as Jakarta, Surabaya, Medan, Bandung, Yogyakarta, and Bali.

As part of delivering these services, gol33 collects and processes certain personal data about our Members and website visitors. We act as the data controller for all personal data processed in connection with the gol33 platform. This Privacy Policy is our formal statement of how we discharge our obligations as a responsible data controller.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference into this document where relevant.

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data. Examples include name, date of birth, email address, mobile number, IP address, and national identity card number.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Member" refers to any individual who has registered an Account on the gol33 platform and whose Personal Data gol33 processes in connection with that Account.
• "Visitor" refers to any individual who browses the gol33 website without registering an Account.
• "KYC" means Know Your Customer — the identity and age verification process gol33 conducts before processing a Member's first withdrawal.
• "Platform" refers to the gol33 website, mobile-optimized interface, and any associated applications or APIs operated under the gol33.ws domain.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, gol33.
• "Data Processor" means any third party that processes Personal Data on behalf of gol33 under a written data processing agreement.
• "Sensitive Data" refers to Personal Data that warrants heightened protection — specifically KYC identity documents (KTP scans, selfie photographs), financial account details, and any data that reveals a person's health condition or financial vulnerability in the context of responsible gaming.

gol33 collects the following categories of Personal Data, depending on how you interact with the Platform:

3.1 Registration & Account Data

• Full legal name (as it appears on your Indonesian National Identity Card — KTP)
• Date of birth (used to verify the 21+ age requirement)
• Gender
• Registered mobile number
• Email address
• Username and encrypted password
• Preferred language and currency (IDR)

3.2 KYC & Verification Data

• Scan or photograph of Indonesian KTP
• Selfie photograph, where requested for liveness verification
• Bank account details (account holder name, account number, bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OCBC NISP, BSI, Bank Danamon) used to process withdrawals
• E-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja, where used for deposits or withdrawals

3.3 Transaction & Gaming Data

• Deposit amounts, timestamps, and payment method references
• Withdrawal requests, amounts, and processing status
• Betting history across all product verticals (sportsbook, live casino, slots, togel, Esports)
• Bonus claims, wagering progress, and promotional participation records
• Account balance and transaction ledger

3.4 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Session start and end times, session duration
• Pages visited, links clicked, and features used within the Platform
• Cookie identifiers and similar tracking technologies (see Clause 10)

3.5 Communications Data

• Live chat transcripts with gol33 support agents
• WhatsApp message records related to account or support queries
• Emails sent to or received from gol33's support address
• Records of any responsible gaming requests (deposit limit settings, self-exclusion requests, cooling-off periods)

gol33 collects Personal Data through the following means:

• Directly from you: When you register an Account, complete KYC verification, make a deposit or withdrawal, place a bet, contact support, or participate in a promotion, you provide data to us directly.
• Automatically: When you visit or use the Platform, our servers and analytics systems automatically collect technical and device data, including IP address, session identifiers, and clickstream data, via server logs, cookies, and similar technologies.
• From payment processors: When you make a deposit or withdrawal via a local bank (BCA, BRI, BNI, Mandiri, and others) or an e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processor partners share transaction confirmation data with gol33 to reconcile your account balance.
• From identity verification services: Where gol33 engages a third-party KYC verification service to authenticate identity documents, that service returns a verification result and document data to gol33.
• From fraud detection services: Our risk management systems may cross-reference account and transaction data against third-party fraud signals to detect suspicious activity, duplicate accounts, or bonus abuse.

gol33 processes your Personal Data for the following purposes:

gol33 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contract performance: The majority of our processing — including Account management, payment processing, bet settlement, and customer support — is necessary to perform the contract between you and gol33 (as set out in our Terms & Conditions) or to take steps at your request prior to entering into that contract.
• Legal obligation: Certain processing activities are required for gol33 to comply with applicable legal obligations, including KYC verification, anti-money laundering record-keeping, and responding to lawful requests from competent authorities.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics is conducted on the basis of gol33's legitimate interests in operating a secure and sustainable platform, provided those interests are not overridden by your rights and interests.
• Consent: Where gol33 sends you direct marketing communications or uses non-essential cookies, we rely on your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

gol33 does not sell, rent, or trade your Personal Data to third parties for commercial marketing purposes. We share Personal Data only in the circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors and banking partners: We share transaction data with local bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals. These parties act as independent data controllers for their own payment infrastructure.
• KYC and identity verification providers: We engage specialist third-party services to assist with document verification and liveness checks. These providers process your KYC documents as Data Processors under a written agreement that restricts their use of your data to verification purposes only.
• Game software providers: When you play a game hosted by a third-party studio (such as Pragmatic Play, Evolution Gaming, PGSoft, or Spribe), your game session data is processed by the relevant studio's platform. Game studios operate under their own privacy frameworks and receive only the session data necessary to deliver the game.
• Fraud detection and risk management services: We share relevant technical and transaction data with third-party risk systems to detect fraud, money laundering, and multi-accounting. These providers are bound by Data Processing Agreements.
• Customer support infrastructure: Our live chat and support ticketing tools are operated by third-party service providers. Communications you send via these channels are stored on the provider's platform under a Data Processing Agreement.
• Legal and regulatory authorities: We may disclose Personal Data to law enforcement, regulatory bodies, or courts when required by a lawful order or applicable legal obligation. We will notify you of any such disclosure where we are legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all assets of gol33, Member data may be transferred to the acquiring entity. Affected Members will be notified in advance where practicable.

gol33 operates a platform that primarily serves Members based in Indonesia (WIB, UTC+7), and our core infrastructure is designed with that audience in mind. However, some of the third-party Data Processors we engage — particularly in the areas of game delivery, fraud detection, and cloud hosting — may store or process data on servers located outside Indonesia.

Where such international transfers occur, gol33 takes the following steps to ensure that your Personal Data remains adequately protected:

• We enter into Data Processing Agreements with all third-party processors that include data transfer safeguards equivalent to internationally recognised standards.
• We select processors that maintain recognised security certifications (such as ISO/IEC 27001) and operate under privacy frameworks consistent with the standards applicable to gol33's international licensing jurisdiction.
• We conduct periodic due-diligence reviews of our processor relationships to verify ongoing compliance with these standards.

gol33 retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, and in any event for the minimum periods required by applicable legal and regulatory obligations. The table below sets out our standard retention periods by data category:

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Anonymised, aggregated data may be retained indefinitely for statistical and platform-improvement purposes, as it can no longer be used to identify any individual.

gol33 uses cookies and similar tracking technologies on the Platform to deliver essential functionality, improve performance, and — where you have given consent — to personalise your experience. The categories of cookies we use are as follows:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They maintain your login session, store your language preference, and enable core security features such as CSRF protection. These cookies cannot be disabled without breaking core Platform functionality.
• Performance and analytics cookies: These cookies collect aggregated, anonymised data about how Members navigate the Platform — which pages are visited most frequently, where users encounter errors, and how long sessions last. This data helps us improve the Platform. These cookies are enabled by default but may be disabled in your browser settings.
• Functional cookies: These cookies remember preferences you have set — such as your last-used deposit method or your preferred sports league view — to personalise your experience on return visits.
• Marketing cookies (consent-based): Where you have consented, we may use cookies that track your interaction with promotional content on the Platform. We do not use third-party advertising network cookies that track you across other websites.

You can manage cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will impair your ability to use the Platform. For all other cookie categories, disabling them will not prevent you from accessing games or account features.

As a Member or Visitor whose Personal Data gol33 processes, you hold the following rights. To exercise any of these rights, please contact our Data Protection contact as described in Clause 16.

• Right of access: You may request a copy of the Personal Data gol33 holds about you, along with information about how it is processed. gol33 will respond to access requests within 30 days.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. You may also update basic account information (email address, mobile number) directly within your Account settings.
• Right to erasure ("right to be forgotten"): You may request that gol33 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (if consent was the basis for processing), or where you object to processing and there is no overriding legitimate interest. Note that this right does not apply where gol33 is required to retain data to comply with a legal obligation — for example, KYC and transaction records that must be retained for five years under anti-money-laundering rules.
• Right to restriction: You may request that gol33 restrict processing of your Personal Data in certain circumstances — for example, while a rectification request is under review, or where you have contested the legal basis for processing.
• Right to data portability: Where processing is based on contract or consent and carried out by automated means, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object: You may object at any time to processing carried out on the basis of gol33's legitimate interests. You also have an absolute right to object to your data being processed for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

gol33 implements a layered approach to information security designed to protect Member Personal Data against unauthorized access, disclosure, alteration, and destruction. Our current security framework includes:

• TLS/SSL encryption in transit: All data transmitted between your browser or device and the gol33 Platform is encrypted using TLS 1.2 or higher. The Platform operates exclusively over HTTPS.
• Encryption at rest: Sensitive data stored in gol33's databases — including passwords (stored as salted hashes), KYC documents, and payment account details — is encrypted using AES-256 or an equivalent standard.
• Access controls: Access to systems and databases that contain Member Personal Data is restricted to authorised personnel on a need-to-know basis. All staff with access to sensitive data undergo background screening and data protection training.
• Multi-factor authentication (MFA): Administrative access to gol33's backend systems requires multi-factor authentication. Members are also encouraged to enable MFA on their own accounts.
• Intrusion detection and monitoring: gol33's infrastructure is monitored around the clock for anomalous access patterns, potential intrusion attempts, and distributed denial-of-service (DDoS) threats.
• Penetration testing: gol33 conducts periodic third-party security assessments and penetration tests of the Platform to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed data breach that is likely to result in risk to Members, gol33 will notify affected Members within 72 hours of becoming aware of the breach, detailing the nature of the incident, the data affected, and the steps taken to contain it.

The gol33 Platform is strictly for adults aged 21 and above. gol33 does not knowingly collect or process Personal Data from any individual under the age of 21. As part of the registration and KYC process, gol33 verifies each Member's date of birth against their Indonesian KTP to enforce this age restriction.

If gol33 becomes aware that it has inadvertently collected Personal Data from a person under the age of 21, we will:

• Immediately suspend the Account associated with that individual.
• Return any deposited funds to the original payment source after deducting reasonable administrative costs.
• Permanently delete the Personal Data collected from the minor as soon as reasonably practicable, retaining only the minimum records required to document the closure for compliance purposes.

If you are a parent or guardian and believe that a minor in your care has registered an Account on the gol33 Platform, please contact gol33 support immediately via live chat or WhatsApp at +62 811 0033 3300.

The gol33 Platform may contain references to or integrations with third-party game studios, payment networks, and service providers. When you interact with an embedded third-party game interface or a payment gateway operated by a partner (such as a BCA or OVO payment window), you are subject to that third party's own privacy policy in addition to this Privacy Policy.

gol33 is not responsible for the data practices of third-party services that operate their own separate platforms or data environments. We recommend that you review the privacy policies of any third-party service you interact with in the course of using the gol33 Platform.

gol33 reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, new services we introduce, legal developments in Indonesia or in our licensing jurisdiction, or guidance from data protection authorities.

When we make material changes to this Privacy Policy — changes that substantively affect your rights or how your data is used — we will notify active Members via the email address or mobile number registered to their Account no fewer than 7 days before the changes take effect. The updated Privacy Policy will also be published on this page with a revised effective date at the top of the document.

For non-material changes (such as corrections to typographical errors, clarifications that do not alter your substantive rights, or updates to contact information), the revised policy takes effect immediately upon publication. Your continued use of the Platform after the effective date of any update constitutes your acknowledgement of the revised Privacy Policy.

If you have any questions about this Privacy Policy, wish to exercise a data right described in Clause 11, or want to raise a concern about how gol33 handles your Personal Data, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the gol33 Platform. Our support agents include Indonesian-speaking staff who can assist in understanding your data rights.
• WhatsApp: +62 811 0033 3300 (available 08:00–24:00 WIB).
• Email: [email protected] (plain text — not a clickable link; type this address into your email client directly). Data rights requests sent by email will be acknowledged within 2 business days and resolved within 30 days.

When submitting a data rights request, please include your registered full name, your gol33 username, and a clear description of your request. gol33 will ask you to complete a brief identity verification step before actioning any request that involves accessing, amending, or deleting your account data, in order to protect you against fraudulent requests made by third parties.