Privacy Policy

The following terms carry the meanings defined below throughout this Privacy Policy:

2.1 Registration Data. When you create a wind4 account, we collect your full legal name, date of birth, gender (optional), email address, phone number, and residential address — including city (e.g., Jakarta, Surabaya, Bandung, Bali, Medan) and postal code.

2.2 Identity Verification (KYC) Data. To comply with our licensing obligations and prevent fraud, we collect copies of your government-issued National Identity Card (KTP or passport), proof of residential address (utility bill or bank statement dated within 90 days), and a selfie image for liveness verification. This data is processed only for identity and age verification purposes.

2.3 Financial Data. We collect information relating to your deposit and withdrawal transactions, including payment method type (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, USDT), transaction amounts in IDR or cryptocurrency, transaction timestamps, and reference numbers. We do not store full bank account numbers or card numbers; these are handled directly by our payment processor partners under PCI-DSS-compliant systems.

2.4 Gameplay Data. We record your betting history, game sessions, wager amounts, wins, losses, and product usage patterns across all Platform products including sports betting (BRI Liga 1, EPL, Champions League, esports), live casino, slots, and togel (Indonesia's traditional numbers lottery) draws. This data is used for account management, responsible gaming monitoring, and product improvement.

2.5 Technical and Device Data. When you visit the Platform, we automatically collect your IP address, browser type and version, operating system, device identifiers, screen resolution, referring URL, and pages visited. This information is used for security monitoring, fraud prevention, and platform analytics.

2.6 Communications Data. If you contact our support team via live chat or email, we retain a record of that communication, including the content of messages and any attachments, for service quality and dispute resolution purposes.

2.7 Responsible Gaming Data. If you set deposit limits, session time limits, loss limits, or request a self-exclusion, we record those preferences and any associated support interactions. This data is processed for your protection and is never used for marketing purposes.

wind4 uses the Personal Data we collect for the following purposes:

wind4 processes your Personal Data on the following legal grounds:

• Contractual necessity: Processing your registration data, KYC data, and financial data is necessary to create and maintain your account and to fulfil the services described in our Terms & Conditions.
• Legal obligation: We are required to collect and retain KYC data, transaction records, and communications in order to comply with our international gaming licence conditions and applicable anti-money-laundering regulations.
• Legitimate interests: We process technical and device data to protect the security and integrity of the Platform, to detect and prevent fraud, and to improve the player experience. Our legitimate interests in operating a secure, fair platform are balanced against your privacy rights.
• Consent: We send marketing communications only where you have provided explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5.1 Payment Processors. To process your deposits and withdrawals, we share the minimum necessary financial data with our payment processing partners, including local Indonesian bank transfer services (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI), e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja), and cryptocurrency payment gateways. These processors act as our data processors under contractual data processing agreements and are prohibited from using your data for their own purposes.

5.2 KYC and Identity Verification Providers. We use third-party identity verification services to automate the KYC process. These providers receive only the specific documents and data required for identity and liveness checks. All such providers are vetted for data security compliance before onboarding.

5.3 Game Content Providers. Game studios whose titles are available on the Platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive a session token and anonymized player identifier to initialise game sessions. They do not receive your full name, contact details, or financial information.

5.4 Regulatory and Law Enforcement Authorities. We may disclose your Personal Data to regulatory bodies, law enforcement agencies, or courts if required to do so by applicable law, valid legal process, or our licensing obligations. We will notify you of such disclosures where we are legally permitted to do so.

5.5 Business Transfers. In the event that wind4 undergoes a merger, acquisition, or sale of substantially all of its assets, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any material change to this Privacy Policy that results from it.

5.6 No Sale of Personal Data. wind4 does not sell, rent, or lease your Personal Data to any third party for their independent commercial or marketing purposes. Full stop.

6.1 Types of Cookies We Use. The Platform uses the following categories of cookies:

6.2 Managing Cookies. Strictly necessary and security cookies cannot be disabled as they are essential to Platform operation. You can control functional and analytics cookies through your browser settings. Most modern browsers allow you to block or delete cookies; however, doing so may affect your ability to log in or use certain Platform features. Refer to your browser's help documentation for instructions on managing cookie preferences.

6.3 No Third-Party Advertising Cookies. wind4 does not permit third-party advertising networks to place tracking cookies on the Platform. We do not participate in cross-site behavioural advertising programmes.

7.1 Active Accounts. We retain your Personal Data for as long as your Account remains active and for a period of at least five (5) years following account closure, in order to comply with our licensing obligations, anti-money-laundering requirements, and any applicable statute of limitations for legal claims.

7.2 KYC Documents. Identity verification documents are retained for a minimum of five (5) years following the date of verification or the date of account closure, whichever is later, as required by our international licensing and AML compliance obligations.

7.3 Transaction Records. Financial transaction records are retained for a minimum of five (5) years from the date of each transaction. Records relevant to an active dispute or legal proceeding are retained until that matter is fully resolved.

7.4 Communications. Customer support communications are retained for two (2) years from the date of the last interaction, unless the communication relates to a dispute, fraud investigation, or regulatory inquiry, in which case it is retained for the duration of that matter plus two (2) additional years.

7.5 Anonymized Analytics Data. Anonymized usage analytics, from which no individual can be identified, may be retained indefinitely for the purpose of long-term product analysis and improvement.

7.6 Deletion Requests. Upon receipt of a valid deletion request (subject to Clause 9), we will delete or anonymize your Personal Data within 30 days, except where retention is required by applicable law or legitimate business necessity as described above.

wind4 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• Encryption in transit: All data transmitted between your device and the Platform is encrypted using TLS 1.2 or higher (256-bit encryption). Our SSL certificate is maintained and renewed continuously.
• Encryption at rest: Sensitive Personal Data and KYC documents stored on our servers are encrypted at rest using AES-256 encryption.
• Access controls: Access to production systems containing Personal Data is restricted to authorised personnel only, enforced by role-based access controls, multi-factor authentication, and full audit logging of all access events.
• Network security: Our infrastructure is protected by firewalls, intrusion detection systems, and regular penetration testing conducted by independent security specialists.
• Payment security: We do not store raw payment credentials. All payment card and bank data is handled by our PCI-DSS-compliant payment processor partners.
• Incident response: wind4 maintains a documented data breach response plan. In the event of a breach that poses a risk to your rights, we will notify affected players and relevant authorities within the timeframe required by our licensing obligations.

As a player on the wind4 platform, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team at [email protected]. We will respond to all valid requests within 30 calendar days.

9.1 Verification. To protect your privacy, we will verify your identity before processing any rights request. You may be asked to provide a copy of your KTP or passport to confirm you are the Account holder before we release or modify any data.

9.2 Complaints. If you are unsatisfied with how we have handled a data rights request or a privacy concern, you may escalate your complaint to the relevant data protection authority in your jurisdiction or to our licensing authority.

The wind4 platform is strictly intended for adults aged 21 years and over. We do not knowingly collect Personal Data from any person under the age of 21. Our registration process includes age verification steps, and all accounts are subject to KYC review that confirms the account holder's date of birth against official identity documents.

If we become aware that Personal Data has been collected from a person under 21 without verifiable parental or guardian consent, we will take immediate steps to delete that data and permanently close the associated Account. If you believe that a minor has accessed this Platform, please notify us immediately at [email protected].

11.1 Cross-Border Processing. wind4 operates internationally and your Personal Data may be transferred to, stored, or processed in countries outside of Indonesia. This may occur when we engage Third-Party Processors such as KYC verification providers, payment gateways, or cloud infrastructure services that operate globally.

11.2 Transfer Safeguards. When transferring your Personal Data outside of Indonesia, wind4 takes steps to ensure that appropriate safeguards are in place, including contractual obligations on recipient organisations to provide a level of data protection equivalent to the standards applied within wind4's operating jurisdiction. These safeguards may include standard contractual clauses, binding corporate rules, or adequacy decisions.

11.3 Storage Location. Primary data storage is maintained on servers in certified data centres. Backup and redundancy systems may be located in geographically separate facilities to ensure data resilience and business continuity. All storage locations are subject to the same encryption and access control standards described in Clause 8.

12.1 Right to Amend. wind4 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our business operations. The effective date at the top of this document indicates when the current version came into force.

12.2 Notification of Changes. Where changes to this Privacy Policy are material — meaning they meaningfully affect how we collect, use, or share your Personal Data — we will notify registered players via email and/or a prominent notice on the Platform at least 14 days before the changes take effect.

12.3 Continued Use. Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not accept the updated policy, you should cease using the Platform and request Account closure in accordance with our Terms & Conditions.

12.4 Archives. Previous versions of this Privacy Policy are available on request by contacting [email protected]. Please include "Privacy Policy Archive Request" in your subject line.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy concern, please contact the wind4 Data & Privacy team using the details below. Our support team is available 24/7 with native Indonesian-speaking agents across all Indonesian time zones (WIB, WITA, and WIT).

For formal legal notices related to data protection, please address your correspondence to: wind4 International Ltd., Data Protection Office, and send it to the email above marked "Legal — Data Protection" in the subject line.