Privacy Policy — How ubo365 Handles Your Personal Data

This Privacy Policy applies to all personal data collected, processed, and stored by ubo365 in connection with the operation of the ubo365 online gaming platform, accessible at ubo365.app and all associated subdomains and mobile-optimised interfaces (collectively, the "Platform").

ubo365 acts as the data controller with respect to the personal data of Members and visitors who access the Platform. As data controller, ubo365 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, transparently, and in accordance with this Policy.

This Policy governs the personal data of:

• Registered Members of ubo365 — individuals who have completed account registration on the Platform.
• Prospective Members — individuals who visit the Platform, browse its content, or begin but do not complete the registration process.
• Former Members — individuals whose accounts have been closed or terminated, to the extent that their data is retained for legal or regulatory compliance purposes.

This Policy is incorporated by reference into the ubo365 Terms & Conditions. By registering an account or otherwise using the Platform, you confirm that you have read and understood this Privacy Policy and consent to the data practices described herein.

ubo365 collects the following categories of personal data from Members and Platform visitors. The specific data collected in each category depends on your level of engagement with the Platform.

ubo365 collects personal data through the following channels and mechanisms:

• Direct collection: Data you provide voluntarily when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or updating your account profile.
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device information, and session behaviour, collected via server logs, cookies, and similar tracking technologies. See Section 7 (Cookies & Tracking) for full details.
• Payment processor data: When you make a deposit or withdrawal via a supported payment method — including bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja) — our payment processing partners may provide ubo365 with transaction confirmation data, including the originating account name and reference number, to enable reconciliation.
• Third-party identity verification: During the KYC process, ubo365 may use third-party identity verification providers who cross-reference the documents you submit against authoritative data sources. These providers return a verification result to ubo365; we do not permanently store raw identity data from third-party databases.
• Game providers: Third-party game software providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Spribe) may share session and results data with ubo365 to enable account crediting, bet settlement, and fraud monitoring.

ubo365 processes your personal data only where a valid legal basis exists. The table below sets out the primary processing purposes and the corresponding legal basis for each:

ubo365 does not sell your personal data. We share your data with third parties only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment processors and banking partners: We share transaction data (including your account name and payment reference) with our Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process deposit and withdrawal requests you have initiated.
• Identity verification providers: During the KYC process, we share identity document data with certified third-party identity verification service providers. These providers are contractually prohibited from using your data for any purpose other than identity verification on behalf of ubo365.
• Game software providers: We share session identifiers and, where necessary, account identifiers with licensed third-party game providers (such as Evolution Gaming, Pragmatic Play, NetEnt, and Spribe) to facilitate game play, bet settlement, and jackpot processing. These providers receive only the minimum data necessary for these functions.
• Cloud and infrastructure providers: ubo365 uses reputable cloud hosting and infrastructure providers to operate the Platform. These providers process data on our behalf as data processors and are bound by strict data processing agreements that prohibit them from accessing or using your data for their own purposes.
• Legal and regulatory authorities: ubo365 may disclose personal data to law enforcement agencies, financial intelligence units, courts, or regulatory authorities where required to do so by applicable law, a valid court order, or a binding regulatory direction. We will notify you of any such disclosure to the extent permitted by law.
• Anti-fraud and AML compliance networks: We may share data with industry anti-fraud and AML compliance platforms to identify and prevent money laundering, bonus abuse, and other forms of financial crime. Such sharing is limited to the minimum data necessary and is subject to appropriate confidentiality agreements.
• Business transfers: In the event that ubo365 undergoes a merger, acquisition, or sale of substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and the applicable privacy protections before the transfer takes effect.

ubo365 operates as an internationally licensed gaming platform. As a result, your personal data may be transferred to, stored in, or processed in countries outside of Indonesia, including countries where ubo365's hosting infrastructure, game providers, or identity verification providers are located.

Whenever we transfer personal data outside Indonesia, we ensure that appropriate safeguards are in place to protect your data, including:

• Contractual data processing agreements with all recipient third parties that impose data protection standards equivalent to those applied by ubo365.
• Transfer only to countries or organisations that provide an adequate level of data protection, as determined by internationally recognised privacy frameworks.
• Where required, your explicit consent to the specific international transfer.

If you have questions about the international transfer mechanisms applicable to your data, please contact us at [email protected] with the subject line "Data Transfer Inquiry".

ubo365 uses cookies and similar tracking technologies to operate the Platform, personalise your experience, detect fraud, and analyse Platform performance. The following categories of cookies are used:

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform. Instructions for managing cookies in major browsers are available at the browser provider's support pages.

ubo365 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable laws and regulations. The following retention schedule applies:

• Active account data (identity, contact, account settings): Retained for the duration of your active membership and for 5 years following account closure, in accordance with AML/KYC record-keeping obligations.
• Financial transaction records (deposits, withdrawals, bet history): Retained for a minimum of 5 years following the date of each transaction, as required by financial compliance obligations.
• KYC verification documents (ID copies, selfies, proof of address): Retained for 5 years following account closure or the most recent KYC verification update, whichever is later.
• Customer support communications (chat logs, email correspondence): Retained for 2 years from the date of the interaction, unless the communication relates to an ongoing legal matter.
• Technical/log data (IP addresses, session logs, device fingerprints): Retained for 12 months from collection date for security and fraud monitoring purposes.
• Marketing preference data: Retained until you withdraw consent or until your account is closed, at which point it is deleted within 30 days.

At the end of the applicable retention period, personal data is securely and irreversibly deleted or anonymised so that it can no longer be linked back to you. Anonymised and aggregated data (for example, aggregate betting statistics with no individual identifiers) may be retained indefinitely for platform analytics and improvement purposes.

As a ubo365 member, you hold the following rights with respect to your personal data. These rights can be exercised by contacting us at [email protected] with the subject line "Data Rights Request — [Your Username]":

• Right of Access: You may request a copy of all personal data that ubo365 holds about you. We will provide this in a structured, machine-readable format within 30 days of your verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. For account-level data (name, email, phone), you can update most fields directly in your account settings without contacting support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Please note that this right is subject to limitations: ubo365 may be required to retain certain data to comply with AML/KYC legal obligations (as described in Section 8) even after your account is closed.
• Right to Restriction of Processing: In certain circumstances — for example, where you contest the accuracy of your data or have objected to processing — you may request that ubo365 restrict further processing of your data pending resolution of the contested matter.
• Right to Data Portability: You may request that ubo365 provide your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) so that you can transfer it to another service provider.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interest, including profiling for direct marketing purposes. Upon receipt of a valid objection, ubo365 will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.

ubo365 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption at rest for all stored personal data and financial records.
• Two-factor authentication (2FA) available to all Members as an optional but strongly recommended account security feature.
• Web Application Firewall (WAF) and DDoS mitigation systems protecting the Platform from external attacks.
• Real-time fraud monitoring using automated systems that flag suspicious login patterns, unusual transaction behaviour, and multi-account indicators.
• Segregated database architecture — financial data, identity data, and gaming activity data are stored in logically separated environments with strict access controls.
• Role-based access controls (RBAC) for all ubo365 staff — employees can only access personal data that is necessary for their specific role.
• Regular security audits and penetration testing conducted by independent third-party security firms on a scheduled basis to identify and remediate vulnerabilities before they can be exploited.
• Staff security training — all ubo365 personnel with access to personal data receive mandatory data protection and security awareness training upon onboarding and annually thereafter.
• Incident response plan — ubo365 maintains a documented data breach response procedure that is tested regularly and activates automatically upon detection of a potential security incident.

ubo365 is strictly an adults-only platform. You must be 21 years of age or older to register an account or use any part of the ubo365 Platform. This age restriction reflects both our licensing obligations and our commitment to responsible gaming.

ubo365 does not knowingly collect personal data from individuals under the age of 21. During the registration process, all applicants are required to confirm that they meet the minimum age requirement. All registered Members are subject to identity verification (KYC), which includes confirmation of date of birth against a government-issued identity document such as a KTP (Indonesian National Identity Card) or passport.

If ubo365 becomes aware that personal data of an individual under the age of 21 has been collected — whether through a KYC review, a report from a third party, or any other means — we will take the following steps immediately:

• Suspend the relevant account pending investigation.
• Conduct a thorough review of the account's registration and verification records.
• If the account holder is confirmed to be under 21, permanently close the account.
• Return any deposits minus any applicable bonuses claimed in accordance with our Terms & Conditions.
• Securely delete all personal data associated with the underage account, except to the extent that retention is required by law.

If you are a parent or guardian and believe that a minor under your care has created a ubo365 account, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and respond within 48 hours.

The ubo365 Platform integrates third-party game software from providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft, among others. When you play a game powered by one of these providers, your session data may be processed by that provider's systems in accordance with their own data processing arrangements with ubo365.

All third-party game providers integrated into the ubo365 Platform are contractually required to:

• Process Member data only for the specific purpose of delivering the game session and returning results to ubo365 for account settlement.
• Maintain appropriate security standards for any Member data they process.
• Not use Member data for their own independent marketing, profiling, or commercial purposes.
• Delete session data in accordance with agreed retention periods.

ubo365's Platform does not contain links to external third-party websites. All navigation within the Platform remains within the ubo365 domain. If you independently navigate to any external website, please be aware that ubo365 has no control over and accepts no responsibility for the privacy practices or content of those external sites.

ubo365 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When we make material changes to this Policy, we will notify you by:

• Displaying a prominent notice on the Platform for a minimum of 14 days following the update.
• Sending an email notification to your registered email address summarising the key changes.
• Updating the "Last Updated" date at the top of this document.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should cease using the Platform and may request account closure in accordance with the ubo365 Terms & Conditions.

The current version of this Privacy Policy is always accessible at ubo365.app/privacy-policy. We encourage you to review this page periodically to stay informed about how ubo365 protects your data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ubo365 handles your personal data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — please include the subject line "Privacy Inquiry — [Your Username]" so your query is routed directly to our data protection team. We aim to respond within 24 hours during standard operating hours (08:00–24:00 WIB).
• Live Chat: Available 24/7 via the chat widget on the Platform. For data rights requests, live chat agents can initiate the formal request process on your behalf and provide you with a reference number.
• Indonesian-speaking support: Native Indonesian-speaking agents are available via live chat and email from 08:00 to 24:00 WIB daily, for Members who prefer to communicate in Bahasa Indonesia regarding their data rights or privacy concerns.
• WhatsApp: Available after login via the contact option in your account dashboard. Please note that WhatsApp should not be used to transmit sensitive personal data such as identity document copies.

For formal data rights requests (access, erasure, portability, rectification, or objection), please submit your request in writing to [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 5 business days and complete it within the timeframes set out in Section 9.