Privacy Policy — t0303 Data Commitment

The data controller responsible for the personal data collected through the t0303 platform (accessible at https://t0303.org) is the operator of t0303 and its authorised representatives. When this Privacy Policy refers to "t0303", "we", "us", or "our", it refers to that entity in its capacity as data controller for all personal information processed in connection with your use of the platform.

As data controller, t0303 determines the purposes for which and the means by which your personal data is processed. We are committed to processing your personal data responsibly, transparently, and in accordance with internationally recognised data protection principles — including the principles of data minimisation, purpose limitation, storage limitation, accuracy, and integrity and confidentiality.

t0303 collects personal data across several categories, depending on how you interact with the platform. The table below summarises the categories of personal data we collect, along with illustrative examples of the specific data points within each category.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is strictly necessary for age and identity verification as part of our KYC process.

t0303 collects personal data through the following channels and mechanisms:

• Direct Registration: When you create an account on t0303, you voluntarily provide Identity Data, Contact Data, and Account Data through the registration form.
• KYC Verification: When you submit identity verification documents (KTP, SIM, Passport, proof of address) as part of the KYC process, we collect the Identity Data contained in those documents.
• Financial Transactions: When you make a deposit or request a withdrawal via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, or other accepted Indonesian payment channels, Financial Data is collected and recorded.
• Platform Usage: As you use the t0303 platform, we automatically collect Gaming Activity Data and Technical Data through server logs, session tracking, and game provider API integrations.
• Cookies & Tracking Technologies: Our platform uses cookies and similar technologies to collect Technical Data and to maintain your session state. See Section 9 for full details.
• Support Communications: When you contact our support team via email ([email protected]) or WhatsApp, we collect and retain the content of those communications as part of our support records.
• Third-Party Sources: In limited circumstances, we may receive data from third-party identity verification services used to assist with KYC compliance, or from payment processors confirming transaction status.

t0303 processes your personal data only for specific, defined purposes. We do not process your data in a manner incompatible with the purpose for which it was collected. The table below sets out the primary processing purposes and the categories of data involved in each.

t0303 processes personal data on the following legal bases, each of which applies to one or more of the processing purposes described in Section 4:

• Performance of a Contract: The majority of our processing is necessary to perform the contract between you and t0303 — i.e., to provide you with access to the gaming platform, process your deposits and withdrawals, and manage your account. Without this processing, we cannot deliver our services.
• Legal Obligation: Certain processing activities — particularly KYC verification, anti-money-laundering record-keeping, and age verification — are carried out to comply with applicable legal and regulatory obligations.
• Legitimate Interests: We process Technical Data and Gaming Activity Data for fraud prevention, platform security, responsible gaming monitoring, and platform improvement, where these interests are not overridden by your rights and interests. We always conduct a balancing assessment before relying on this basis.
• Consent: Where we send you promotional communications or use non-essential cookies, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal, and without affecting your ability to use the platform.

t0303 does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for each specific purpose:

• Game Providers: To deliver gaming services, certain Account Data and session identifiers are shared with our licensed Game Providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft). These providers process data solely to deliver the game experience and are contractually bound to data protection standards equivalent to those described in this policy.
• Payment Processors & Banks: Financial Data is shared with the relevant Indonesian payment channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) strictly to process your deposits and withdrawals. These are regulated financial institutions subject to their own data protection obligations.
• KYC Verification Services: Where third-party identity verification tools are used to assist with KYC compliance, the minimum necessary Identity Data is shared with those services under strict data processing agreements.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulators, or other governmental authorities where required by applicable law, court order, or where we reasonably believe disclosure is necessary to prevent fraud or serious harm.
• Professional Advisors: In limited circumstances, we may share data with legal, financial, or security advisors acting under professional confidentiality obligations, strictly for the purpose of obtaining professional advice.
• Business Transfers: In the event of a merger, acquisition, or sale of assets involving t0303, your personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

t0303 retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. Our standard retention periods are as follows:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Anonymised data may be retained indefinitely for statistical and analytical purposes.

t0303 employs a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS 1.3): All data in transit between your device and t0303 servers is encrypted using TLS 1.3, ensuring that data cannot be intercepted or read by unauthorised parties during transmission.
• Password Hashing: Account passwords are never stored in plaintext. They are processed using industry-standard one-way cryptographic hashing algorithms before storage, meaning that even t0303 staff cannot read your password.
• Access Controls: Personal data is accessible only to t0303 staff and authorised systems with a documented business need. Role-based access controls ensure that staff see only the minimum data necessary for their function.
• Fraud Detection Systems: Automated and manual fraud detection systems monitor account activity in real time to identify and respond to suspicious patterns, including unauthorised login attempts and unusual transaction behaviour.
• Penetration Testing: Our platform undergoes regular security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: t0303 maintains an incident response plan for data security events. In the event of a breach that is likely to result in a high risk to your rights, we will notify affected players promptly and take all reasonable steps to contain and remediate the incident.

t0303 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. The table below explains the categories of cookies we use and their purposes.

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair the functionality of the t0303 platform. Most modern browsers allow you to block or delete cookies; consult your browser's help documentation for instructions.

As a t0303 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our Privacy team at [email protected] with the subject line "Data Rights Request" and your registered username. We will respond within 30 days of receiving a valid request.

The t0303 platform is strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in our KYC process, and accounts suspected of being registered by or on behalf of a minor will be suspended immediately pending investigation.

If you are a parent or guardian and believe that your child has provided personal data to t0303 without your consent, please contact us immediately at [email protected]. Upon verification, we will promptly delete the relevant data and close the associated account.

As an international online gaming platform serving players across Indonesia, t0303 may transfer certain personal data to servers or service providers located outside of Indonesia. This may include transfers to jurisdictions where data protection laws differ from those in your home country.

Where such transfers occur, t0303 takes all reasonable steps to ensure that your personal data receives an equivalent level of protection to that described in this Privacy Policy. Safeguards we employ for international transfers include:

• Contractual Safeguards: We enter into data processing agreements with all third-party recipients of personal data, incorporating standard contractual clauses that impose data protection obligations equivalent to those applicable under this policy.
• Adequacy Assessments: Where data is transferred to a jurisdiction recognised as providing adequate data protection, we rely on that adequacy determination as the transfer mechanism.
• Technical Protections: Regardless of where data is processed, all transmissions are encrypted using TLS 1.3, and access controls are applied consistently across all processing locations.

If you would like further information about the specific safeguards applied to any given international transfer of your personal data, please contact us at [email protected].

t0303 may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law, new platform features, or feedback from players. When we make changes, we will update the "Last Reviewed" date at the top of this page.

For material changes — those that substantively affect how we collect, use, or share your personal data — we will provide advance notice via a prominent on-platform notification and, where we hold your email address, by direct email to your registered address. We will give you at least 14 days' notice before a material change takes effect.

For minor, non-material changes (such as typographical corrections or clarifications that do not alter the substance of any provision), the updated policy will take effect upon publication without advance individual notice. We encourage you to review this Privacy Policy periodically to stay informed about how t0303 protects your data. Continued use of the platform following the effective date of any update constitutes your acknowledgement of the revised policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way t0303 handles your personal data, our Privacy team is available 24 hours a day, 7 days a week. Please use the contact details below and include your registered username and a clear description of your enquiry to help us respond as efficiently as possible.

For data rights requests (access, rectification, erasure, portability, objection), please allow up to 30 calendar days for a full response. In complex cases we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason before the initial 30-day period expires.