Privacy Policy

udinjp ("we", "us", "our", "the Platform") takes the privacy and security of your personal data seriously. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed and used by udinjp. It applies to all users of the Platform, including registered Members, visitors browsing without an account, and individuals who contact us through any available support channel.

We are committed to maintaining the trust of every person who interacts with udinjp. Our data practices are designed to be proportionate, transparent, and aligned with internationally recognized privacy standards, including principles consistent with the General Data Protection Regulation (GDPR) and applicable data protection frameworks in the Asia-Pacific region, which we apply as a matter of best practice.

Please read this policy carefully alongside our Terms & Conditions, which govern your use of the Platform. Capitalized terms used but not defined here carry the meanings given in the Terms & Conditions.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, IP address, financial data, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, transmission, alteration, or deletion.
• "Data Controller" — udinjp, being the entity that determines the purposes and means of processing your Personal Data.
• "Data Subject" — you, the individual whose Personal Data is being processed.
• "Third Party" — any entity other than the Data Subject and udinjp that may receive or have access to Personal Data in accordance with this Policy.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" — Know Your Customer verification process, including identity and address verification steps required of all Members prior to withdrawal processing.

udinjp collects only the data that is necessary for the specific purposes described in this Policy. The categories of Personal Data we process are as follows:

udinjp collects Personal Data through the following channels:

• Direct Interactions: Data you actively provide when completing the registration form, submitting KYC documents, making deposits or withdrawal requests, contacting our support team, or responding to surveys and promotional communications.
• Automated Technologies: Technical and Usage Data collected automatically when you visit or interact with the Platform, including through cookies, web beacons, server logs, and similar tracking technologies as described in Section 8.
• Third-Party Sources: In limited circumstances, we may receive Personal Data from third parties such as identity verification providers, payment processors (including local Indonesian bank gateways and e-wallet providers), fraud prevention services, and analytics partners — always subject to appropriate data sharing agreements.
• Publicly Available Sources: We may supplement your profile with data from publicly accessible sources where this is permitted under applicable law and is necessary for compliance or fraud prevention purposes.

We process your Personal Data only where we have a lawful basis for doing so. The table below sets out the primary purposes for which we process your data and the corresponding legal basis in each case:

udinjp does not sell your Personal Data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and always subject to binding confidentiality and data protection obligations:

• Payment Processors: Indonesian bank gateway providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) require transaction data to process your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and AML compliance services that assist us in verifying your identity and screening against sanctions lists, to meet our legal obligations.
• Game Software Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized session data necessary to deliver their games through the Platform.
• IT and Infrastructure Service Providers: Cloud hosting, cybersecurity, and server management providers who process data solely on our instructions and are contractually bound to maintain equivalent levels of data protection.
• Analytics Providers: Platform performance and usage analytics services that receive aggregated or pseudonymized data to help us understand user behavior and improve the Platform.
• Legal and Regulatory Authorities: Where required by applicable law, court order, or at the request of a competent regulatory or law enforcement authority, we may disclose your Personal Data without prior notice.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this Policy.

udinjp retains your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, including compliance with applicable legal, regulatory, accounting, and reporting obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping standards applicable in the region.
• KYC Documents: Retained for a minimum of five (5) years following the end of the business relationship, unless a longer period is required by applicable law.
• Support and Communications Data: Retained for three (3) years from the date of the last interaction, to allow for dispute resolution and quality assurance.
• Technical and Usage Data: Retained for up to twenty-four (24) months, after which it is aggregated or anonymized for analytical purposes.
• Marketing Preferences: Retained until you withdraw your consent or unsubscribe, at which point it is updated immediately and no further marketing communications are sent.

At the end of the applicable retention period, your Personal Data is securely deleted or irreversibly anonymized so that it can no longer be linked to you as an individual.

udinjp uses cookies and similar tracking technologies to ensure the Platform functions correctly, to protect the security of your session, and to understand how Members interact with our services. The cookies we deploy fall into the following categories:

• Strictly Necessary Cookies: Essential for core Platform functionality, including maintaining your logged-in session, remembering your language and currency preferences, and enabling secure transactions. These cookies cannot be disabled without affecting Platform usability.
• Performance & Analytics Cookies: Used to collect aggregated, anonymized data about how visitors use the Platform — pages visited, time spent, error messages encountered — to help us improve the user experience. No personally identifying information is transmitted through these cookies.
• Functional Cookies: Allow the Platform to remember choices you have made (such as your preferred game category or responsible gaming settings) to provide a more personalized experience during your session.
• Security Cookies: Used for fraud detection, bot prevention, and rate-limiting to protect the integrity of the Platform and the security of Member accounts.

udinjp does not use third-party advertising cookies or cross-site tracking cookies that build profiles for targeted advertising on external networks. Most web browsers allow you to control cookies through their settings preferences. Please note that disabling strictly necessary cookies may impair your ability to use the Platform.

udinjp implements a comprehensive set of technical and organizational security measures designed to protect your Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Security: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS encryption, ensuring that your credentials, financial data, and session information cannot be intercepted in transit.
• Data Encryption at Rest: Sensitive data stored in our databases — including identity documents, financial records, and KYC data — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Strict role-based access controls are enforced across all internal systems. Only personnel with a documented, legitimate operational need may access Personal Data, and all access events are logged and audited.
• Regular Security Audits: Our infrastructure undergoes regular penetration testing and security vulnerability assessments conducted by independent third-party security specialists.
• Incident Response: udinjp maintains a formal data breach incident response plan. In the event of a breach that poses a risk to your rights, we will notify affected Members and relevant authorities within seventy-two (72) hours of becoming aware of the incident, where required by applicable standards.
• Staff Training: All udinjp personnel who handle Personal Data undergo mandatory data protection and security awareness training as part of their onboarding and on an annual basis thereafter.

As a Data Subject, you hold the following rights with respect to your Personal Data processed by udinjp. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) days of receiving a verified request.

Please note that certain rights are subject to limitations. For example, we may be unable to delete data that we are legally required to retain, or restrict processing that is necessary for the performance of our contract with you. Where we are unable to fulfill a request in full, we will explain the reason clearly in our response.

udinjp operates a strict Adults Only (21+) policy. The Platform is not intended for, and does not knowingly collect Personal Data from, individuals under the age of 21. All prospective Members are required to confirm their age at registration, and age verification is conducted as part of the KYC process.

If udinjp becomes aware that Personal Data has been collected from an individual under the age of 21, that Account will be immediately closed, all associated data will be deleted (subject to any overriding legal retention obligations), and any deposits will be returned after deduction of applicable processing costs at our discretion.

If you are a parent or guardian and believe that your child under the age of 21 has registered on udinjp without your knowledge, please contact us immediately at [email protected] so that we can take appropriate action without delay.

For guidance on parental control tools and resources available to help prevent underage access to online gaming, please visit our Responsible Gaming page.

The udinjp Platform integrates with a number of third-party service providers to deliver core functionality, including game content, payment processing, and identity verification. While we take care to partner only with reputable providers, udinjp is not responsible for the privacy practices of third-party entities whose services are accessed through the Platform.

Specifically, please be aware of the following:

• Game Providers: Software studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft operate their own game servers and may collect technical data necessary to deliver their games. Each provider operates under its own privacy policy and licensing framework.
• Payment Networks: When you transact via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja, your financial data passes through those providers' own systems, which are governed by their respective privacy policies. udinjp does not store full bank account credentials on its servers.
• No Endorsement: The inclusion of any third-party service within the Platform does not constitute an endorsement of that provider's privacy practices by udinjp. We encourage you to review the privacy policies of all third-party services you use in connection with the Platform.

udinjp reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will notify registered Members by email to the address on file, and the updated Policy will be published on this page with a revised "Last Updated" date.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the Platform following the posting of changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you should discontinue use of the Platform and may request account closure by contacting [email protected].

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which udinjp handles your Personal Data, please contact our privacy team using the details below. All privacy inquiries are treated with strict confidentiality and are responded to within twenty-four (24) hours for general inquiries and within thirty (30) days for formal data rights requests.

• Privacy Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Rights Request" for faster routing.
• Live Chat: Available 24/7 on the Platform homepage. Our Indonesian-speaking support agents handle all privacy queries with the same level of confidentiality as email communications.
• Response Commitment: We acknowledge all privacy-related communications within twenty-four (24) hours (WIB, UTC+7) and resolve formal data rights requests within thirty (30) calendar days.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data protection authority or seek independent legal advice. udinjp will cooperate fully with any such inquiry.