Privacy Policy

Introduction

api67 is committed to protecting the privacy and personal data of every individual who interacts with our platform. We operate a trusted online sportsbook and live casino service for players in Indonesia and take our data protection responsibilities seriously — not merely as a compliance exercise, but as a reflection of the trust our Members place in us.

This Policy sets out, in plain and professional English, the categories of personal data we process, the purposes and legal bases for that processing, the parties with whom we may share data, and the rights available to you under applicable data protection principles. Where Indonesian regulatory guidance intersects with our processing activities, we observe those standards in addition to internationally recognised privacy frameworks.

If you have any questions about this Policy or the way api67 handles your data, please contact us at [email protected] before or at any point during your use of the platform.

Data We Collect

api67 collects personal data in the following categories:

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric identifiers beyond what is strictly required for age and identity verification under our KYC process.

How We Collect Data

api67 collects personal data through the following channels:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or opt in to promotional communications, you provide data to us directly.
• Automated collection: When you visit or interact with the api67 platform, our servers and analytics tools automatically record Technical Data and Usage Data as described in Clause 2. This includes data collected via cookies and similar technologies (see Clause 9).
• Third-party sources: Where permitted by law, we may receive identity verification data from KYC service providers, fraud-prevention databases, and payment processors such as local Indonesian bank networks and e-wallet operators (OVO, DANA, GoPay, ShopeePay). We use this data solely to verify your identity and protect the integrity of financial transactions.
• Game studios: Licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, and Microgaming may provide aggregate session data to api67 for responsible gaming monitoring purposes. This data does not include additional personal identifiers beyond those api67 already holds.

Purpose & Use of Your Data

api67 processes your personal data for the following specific purposes. We will not use your data for any purpose that is incompatible with those listed below without first obtaining your consent or establishing a new lawful basis for processing.

Legal Basis for Processing

api67 processes your personal data on the following legal bases, consistent with internationally recognised data protection principles:

• Performance of a contract: Processing your Identity Data, Contact Data, and Financial Data is necessary to fulfil our obligations under the Terms & Conditions you accept when registering — including operating your account, processing transactions, and awarding bonuses.
• Legal obligation: Processing for KYC verification, AML screening, and record-keeping is required to comply with applicable anti-money-laundering and financial crime prevention obligations.
• Legitimate interests: Processing Technical Data and Usage Data for fraud prevention, platform security, and responsible gaming monitoring is based on api67's legitimate interest in maintaining a safe, fair, and sustainable platform for all Members.
• Consent: Where you have opted in to receive promotional emails, SMS notifications, or push notifications about api67 offers and seasonal promotions (e.g., Idul Fitri campaigns, Ramadhan deposit bonuses), we process your Contact Data on the basis of your consent. You may withdraw consent at any time by contacting [email protected] or using the unsubscribe option in any promotional communication.

Sharing & Disclosure

api67 does not sell, rent, or otherwise commercialise your personal data. We may share your data with the following categories of recipient only to the extent necessary for the stated purpose:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, and e-wallet providers (OVO, DANA, GoPay, ShopeePay) receive only the transaction data required to execute your deposit or withdrawal. These partners operate under their own privacy policies and applicable Indonesian financial regulations.
• KYC and identity verification providers: Specialist third-party services that assist api67 in verifying your identity, age, and document authenticity. These providers are contractually bound to process your data solely for verification purposes and to maintain equivalent security standards.
• Game studios and platform providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive session data sufficient to operate their games within the api67 environment. They do not receive your full personal profile.
• Fraud and AML screening databases: Industry-shared fraud-prevention and sanctions-screening services may receive limited identity data where api67 has a legitimate interest or legal obligation to perform a check.
• Professional advisers: Legal counsel, auditors, and compliance consultants who are subject to professional confidentiality obligations.
• Law enforcement and regulatory authorities: api67 will disclose personal data to Indonesian law enforcement agencies, financial intelligence units, or other competent authorities where required by a valid legal order, court order, or applicable regulation. We will notify affected Members of such disclosures where we are legally permitted to do so.

Data Retention

api67 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention schedules are as follows:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to any identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and platform-improvement purposes.

Security Measures

api67 employs a layered, defence-in-depth security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational measures include:

• Encryption in transit: All data exchanged between your browser or app and the api67 platform is encrypted using TLS 1.3 (Transport Layer Security). The platform operates exclusively over HTTPS; unencrypted HTTP connections are automatically redirected.
• Encryption at rest: Personal data stored in api67's databases is encrypted using AES-256, the same standard used by major global financial institutions.
• Access controls: Access to personal data is restricted to api67 personnel who require it to perform their job functions, enforced through role-based access control (RBAC) and multi-factor authentication (MFA) for all administrative accounts.
• Regular security audits: api67 conducts periodic penetration tests and vulnerability assessments carried out by independent security specialists. Critical vulnerabilities are remediated on a priority basis within defined SLA timeframes.
• Incident response: api67 maintains a documented data breach incident response plan. In the event of a confirmed breach affecting your personal data, we will notify affected Members within the timeframe required by applicable law and take immediate steps to contain the incident.
• Staff training: All api67 personnel who handle personal data receive mandatory data protection and security awareness training on joining and annually thereafter.

Cookies & Tracking Technologies

api67 uses cookies and similar technologies (local storage, session storage, pixel tags) to enable essential platform functionality, improve your experience, and gather anonymised analytics data. The categories of cookies we use are:

api67 does not use third-party advertising or retargeting cookies that track your browsing behaviour across external websites. You may control cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair the functionality of the api67 platform.

Your Rights

As a Member of api67, you have the following rights with respect to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 WIB business days and provide a substantive response within 30 calendar days.

• Right of access: You may request a copy of all personal data api67 holds about you, together with information about how it is processed.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected or updated.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations outlined in Clause 7.
• Right to restrict processing: You may request that api67 limit the processing of your data in certain circumstances — for example, while a dispute regarding its accuracy is being resolved.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, you may request that we provide your personal data in a structured, machine-readable format.
• Right to object: You may object to processing carried out on the basis of api67's legitimate interests — including processing for direct marketing purposes — at any time. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Minors & Age Verification

api67 is strictly an adults-only platform. You must be at least 21 years of age to register an account or use any api67 service. We do not knowingly collect personal data from individuals under the age of 21.

As part of our KYC process, we verify the age of every Member using government-issued identity documents. Where api67 discovers — at any point — that a Member is under 21 years of age, we will:

• Immediately suspend and permanently close the account.
• Void all bets placed and reverse all bonus credits.
• Return deposited funds (net of any withdrawals already made) to the original payment method where possible.
• Delete or anonymise the personal data of the underage individual, retaining only the records required by our legal obligations.

If you are a parent or guardian and believe that a minor may have accessed or registered on api67, please contact us immediately at [email protected] so that we can take prompt action.

Cross-Border Data Transfers

api67's primary data infrastructure is hosted in data centres that maintain high availability and security standards. In operating the platform, certain personal data may be processed by service providers located outside Indonesia — for example, KYC verification partners or game studio technical infrastructure providers.

Where personal data is transferred outside Indonesia, api67 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to that described in this Policy. These safeguards may include:

• Contractual data processing agreements that impose obligations on the recipient equivalent to those api67 is subject to.
• Transfer to recipients located in jurisdictions recognised as providing an adequate level of data protection under applicable standards.
• Technical controls (encryption, pseudonymisation) that mitigate the risk of unauthorised access during transfer.

You may request further information about the specific safeguards applied to any particular cross-border transfer by contacting [email protected].

Changes to This Policy

api67 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. Where changes are material — for example, where we introduce a new category of data processing or a new type of third-party sharing — we will notify registered Members by email and display a prominent notice on the platform at least 7 days before the updated Policy takes effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of api67 following the effective date of any amendment constitutes your acknowledgment of the updated Policy. If you do not agree with a material change, you may close your account and request deletion of your data in accordance with Clause 10.

Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the way api67 handles your personal data, please contact our Data Protection team using the details below. We take all privacy concerns seriously and will respond promptly and professionally.

To submit a formal data rights request or privacy complaint, email us at [email protected] with the subject line "Data Rights Request" or "Privacy Complaint" as appropriate. Please include your registered username and a clear description of your request or concern. api67 will acknowledge receipt within 5 WIB business days and provide a full response within 30 calendar days.