Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, including but not limited to name, date of birth, identity card number, email address, mobile phone number, residential address, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, alex17.
• "Processor" means a third party that processes Personal Data on behalf of the Controller, such as payment processors, KYC verification providers, or cloud infrastructure providers.
• "Consent" means freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data by a clear affirmative action — such as registering an account on alex17.
• "KTP" (Kartu Tanda Penduduk) means the official Indonesian National Identity Card issued by the Government of Indonesia.

2. Personal Data We Collect

alex17 collects personal data that you provide directly, data generated automatically through your use of the platform, and data received from third-party service providers where necessary to operate our services. The categories of personal data we collect are detailed below.

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile phone number, and preferred username and password at the time of account creation.
• Profile data: Residential address, city (e.g., Jakarta, Surabaya, Bandung, Medan, Bali), province, and postal code.
• Identity verification (KYC) data: Scanned or photographed copies of your KTP (Indonesian National Identity Card) or valid passport, proof-of-address documents (utility bills, bank statements from BCA, BRI, BNI, Mandiri, etc.), and selfie photographs taken for verification purposes.
• Financial data: Bank account numbers, account holder names, e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction history including deposit and withdrawal amounts and timestamps.
• Communications data: Messages sent to our customer support team via live chat or email, including support tickets, complaints, feedback, and any attachments you provide.

2.2 Data Collected Automatically

• Usage data: Pages visited, game sessions played (including game titles, session durations, bet sizes, and outcomes), features used, and navigation paths within the platform.
• Device and technical data: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, time zone (WIB/WITA/WIT), and language settings.
• Cookies and tracking technologies: Session cookies (required for login and security), preference cookies (to remember your settings), and analytical cookies (to measure platform performance). See Section 8 for full cookie details.
• Transaction metadata: Timestamps, payment method identifiers, transaction reference numbers, and processing outcomes for all deposit and withdrawal activity.

2.3 Data from Third Parties

• Payment processors: Transaction confirmation data, fraud-risk scores, and identity-match results from payment gateways processing transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC verification providers: Identity verification results, document authenticity scores, facial recognition match results, and watchlist screening outcomes from independent KYC service providers.
• Fraud and AML screening: Risk-assessment scores and adverse media screening results from third-party compliance service providers used for anti-money-laundering (AML) and counter-terrorism-financing (CTF) due diligence.

3. How We Use Your Personal Data

alex17 processes your personal data for the following purposes, each of which is supported by an appropriate legal basis:

4. Disclosure of Your Personal Data

alex17 does not sell your personal data to any third party. We disclose personal data only in the limited circumstances described below, and only to the extent necessary for the specific purpose:

4.1 Service Providers and Processors

We engage carefully vetted third-party processors to assist in delivering our services. These include payment gateway operators (local Indonesian banks and e-wallet providers), KYC and identity verification vendors, cloud infrastructure providers hosting our platform, cybersecurity firms conducting penetration testing and threat monitoring, and customer support tooling providers. All processors operate under written data processing agreements that strictly limit their use of your data to the specific s ervice they provide and prohibit any independent use or onward disclosure.

4.2 Regulatory and Law Enforcement Disclosure

alex17 may disclose personal data to government authorities, regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or lawful request. We will notify you of any such disclosure where we are legally permitted to do so. Where possible, we will seek to limit the scope of data disclosed to the minimum required to satisfy the legal obligation.

4.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or part of alex17's assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you via email and a prominent notice on the platform prior to any such transfer and inform you of any changes to this Privacy Policy that may result.

4.4 Fraud Prevention and Safety

Where we have a good-faith belief that disclosure is necessary to prevent fraud, financial crime, imminent physical harm, or to protect the rights, property, or safety of alex17, our members, or the public, we may disclose relevant personal data to appropriate parties including other licensed gaming operators (for shared blacklist/self-exclusion databases), fraud prevention agencies, or law enforcement.

5. International Data Transfers

alex17 is an internationally operated platform. Some of the third-party service providers we engage — including cloud hosting infrastructure, KYC verification vendors, and game content providers such as Pragmatic Play, Evolution Gaming, and Microgaming — may process your personal data in jurisdictions outside Indonesia. Where data is transferred internationally, alex17 ensures appropriate safeguards are in place, including:

• Standard contractual clauses requiring the receiving entity to protect data to standards equivalent to those applied by alex17.
• Transfers only to jurisdictions or entities with adequately recognized data protection frameworks.
• Written data processing agreements limiting the scope and purpose of any international processing.

By using alex17 and consenting to this Privacy Policy, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia, subject to the safeguards described above.

6. Data Retention

alex17 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the following specific retention schedules:

• Account and identity data (KYC documents): Retained for the duration of your account plus a minimum of five (5) years following account closure, as required by international AML and KYC regulatory standards.
• Transaction records (deposits, withdrawals, bets): Retained for a minimum of five (5) years from the date of each transaction, in line with standard financial record-keeping obligations.
• Communications data (support tickets, chat logs): Retained for two (2) years from the date of the interaction, or longer where the communication relates to an unresolved dispute or ongoing investigation.
• Usage and analytics data: Retained in anonymised, aggregated form indefinitely for platform improvement purposes. Non-anonymised usage logs are retained for up to twelve (12) months.
• Cookie and device data: Session cookies expire when you close your browser. Preference and analytics cookies have maximum lifespans of twelve (12) months, after which they are automatically purged.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. You may request earlier deletion of your data (subject to regulatory retention obligations) as described in Section 7 below.

7. Your Data Protection Rights

As a user of alex17, you have the following rights with respect to your personal data. To exercise any of these rights, contact our Data Protection team at the email address listed in Section 11.

7.1 Right of Access

You have the right to request a copy of all personal data that alex17 holds about you, free of charge, within thirty (30) days of your request. We will provide this in a structured, machine-readable format (JSON or CSV) where technically feasible.

7.2 Right to Rectification

If any personal data we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct it. Some corrections (e.g., legal name or date of birth) may require re-submission of supporting identity documents.

7.3 Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where we have no legitimate reason to continue processing it. This right is subject to override where we are required by law to retain specific records — for example, transaction histories mandated by AML regulations.

7.4 Right to Restriction of Processing

In certain circumstances — such as while the accuracy of data is being contested, or while an objection to processing is assessed — you may request that we temporarily suspend active processing of your personal data. We will store it securely but refrain from using it until the matter is resolved.

7.5 Right to Data Portability

Where processing is based on your consent or a contractual relationship, and where technically feasible, you may request that we transmit your personal data directly to another service provider in a structured, commonly used, machine-readable format.

7.6 Right to Object

You have the right to object at any time to the processing of your personal data where that processing is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is required for the establishment, exercise, or defence of legal claims.

7.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Note that withdrawal of consent for processing that is essential to the operation of your account (such as identity verification) may result in the suspension or closure of your account.

8. Cookies and Tracking Technologies

alex17 uses cookies — small text files stored on your device — and similar technologies to ensure the platform functions securely, remembers your preferences, and allows us to understand how the platform is used. The categories of cookies we deploy are as follows:

alex17 does not use advertising cookies, retargeting pixels, or any tracking technology that monitors your behaviour on third-party websites or applications. You can manage or delete cookies through your browser's settings at any time. Removing strictly necessary cookies may affect the security and functionality of your session.

9. Protection of Minors

alex17 is strictly an adults-only platform. Our services are not directed at, and we do not knowingly collect personal data from, individuals under the age of twenty-one (21). Our registration process includes a date-of-birth field and mandatory KYC verification, both of which are designed to detect and prevent underage account creation.

If we become aware that personal data has been collected from an individual under 21 years of age, we will take immediate steps to delete that data, close the associated account, and return any deposited funds to the originating payment method. We strongly encourage parents and guardians to use internet parental-control software to prevent minors from accessing online gambling platforms.

10. Data Security Measures

alex17 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure:

• Encryption in transit: All data exchanged between your browser and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). We enforce HTTPS-only access and use HTTP Strict Transport Security (HSTS) headers.
• Encryption at rest: Sensitive personal data fields — including KYC documents, bank account numbers, and e-wallet identifiers — are encrypted at the database layer using AES-256 encryption.
• Access controls: Internal access to personal data is restricted to personnel who genuinely require it for their role, governed by a strict least-privilege access model. All internal access is logged and audited.
• Infrastructure security: Our platform infrastructure is hosted in ISO 27001-certified data centres with physical access controls, redundant power systems, and 24/7 security monitoring.
• Penetration testing: We commission independent cybersecurity firms to conduct penetration tests and vulnerability assessments on our platform on a regular basis, with critical findings remediated within defined SLA windows.
• Incident response: We maintain a formal data-breach incident response plan. In the event of a breach affecting your personal data, we will notify you within seventy-two (72) hours of becoming aware of the incident, consistent with international notification standards.

While we implement robust security measures, no platform can guarantee absolute security. You also play a role in protecting your data — choose a strong, unique password for your alex17 account, do not share your login credentials with anyone, and contact us immediately if you suspect unauthorized access to your account.

11. Contact and Data Protection Inquiries

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our Data Protection team using the details below. We are committed to responding to all privacy inquiries within forty-eight (48) hours and resolving data rights requests within thirty (30) days.

• Email: [email protected]
• Subject line for data rights requests: "Data Rights Request – [Your Account Username]"
• Support availability: 24 hours a day, 7 days a week (Western Indonesia Time / WIB, UTC+7)
• Response languages: English and Indonesian

12. Changes to This Privacy Policy

alex17 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, we will notify you by email and display a prominent notice on the platform at least fourteen (14) days before the changes take effect. Your continued use of the platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically. The "Last Updated" date at the top of this Policy indicates when it was most recently revised.