Privacy Policy

1Introduction & Scope

byd180 is committed to protecting the privacy and security of the personal information of every Member and visitor. This Policy sets out the types of personal data we process, the legal bases on which we rely, the purposes for which data is used, how long we retain it, and the rights available to you as a data subject.

This Policy applies to:

• All registered Members with an active or closed byd180 Account.
• Visitors to byd180.cam who have not registered but whose interaction data may be captured via cookies and server logs.
• Any individual who contacts byd180 customer support, whether or not they hold an Account.

This Policy does not apply to third-party websites linked from our Platform. We have no control over the data practices of external sites and encourage you to review their respective privacy policies before submitting personal information.

2Definitions

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" means byd180, the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means a third party that Processes Personal Data on behalf of byd180 under a written data-processing agreement.
• "Member" means any individual who holds or has held a registered Account on the Platform.
• "KYC Data" means identity and age-verification documents submitted by a Member as part of the Know Your Customer process.
• "Transaction Data" means records of deposits, withdrawals, bets placed, game outcomes, and account balance movements.
• "IDR" means Indonesian Rupiah, the functional currency of the Platform for Indonesian Members.

3Personal Data We Collect

The table below sets out the categories of Personal Data byd180 collects and the primary context in which each category arises:

4How We Collect Personal Data

byd180 collects Personal Data through the following channels:

4.1 Direct Submission

You provide data directly when you register an Account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or participate in a promotion. This is the primary source of Identity Data, Contact Data, KYC Documents, and Financial Data.

4.2 Automated Technologies

When you visit byd180.cam or use the Platform, our servers automatically record Technical Data including your IP address, browser type, pages visited, session duration, and referring URL. This data is collected via server logs, session cookies, and first-party analytics tools.

4.3 Third-Party Sources

We may receive supplementary identity or fraud-risk information from our licensed KYC verification partners, payment processors, and anti-fraud screening services. Such data is used solely for verification and security purposes and is handled with the same level of protection as directly submitted data.

4.4 Game Providers

Game studios integrated into our Platform (such as Pragmatic Play, Evolution Gaming, and Microgaming) may share anonymised session-level data with byd180 for the purposes of game performance monitoring, dispute resolution, and responsible gaming oversight. No identifiable Personal Data is shared from game providers to byd180 beyond what is technically necessary for these purposes.

5Purpose & Legal Basis for Processing

byd180 processes Personal Data only where a lawful basis exists. The table below maps each processing purpose to its legal basis:

6Data Sharing & Third-Party Disclosure

byd180 does not sell your Personal Data. We share data only in the following limited circumstances, and always under appropriate contractual data-protection obligations:

6.1 Service Providers (Data Processors)

We engage trusted third-party processors to assist with platform operations, including:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, and ShopeePay — to execute deposits and withdrawals.
• KYC verification providers: Licensed identity-verification services that authenticate government-issued documents including Indonesian KTP and passports.
• Fraud and AML screening services: To detect suspicious transaction patterns and prevent money laundering.
• IT infrastructure and cloud hosting providers: To operate, maintain, and secure the Platform's servers and databases.
• Customer support software providers: To manage live chat and ticketing systems.

All Data Processors are bound by written agreements that restrict their use of your data to the specific services they provide for byd180 and prohibit any independent use, resale, or further disclosure.

6.2 Game Studio Partners

Game providers integrated into the Platform (such as Pragmatic Play, Evolution Gaming, NetEnt, Pocket Games Soft, and Spribe) receive a session token and anonymised player ID necessary to deliver game content and record outcomes. They do not receive your full name, contact details, or financial information.

6.3 Legal and Regulatory Disclosures

We may disclose Personal Data to law enforcement agencies, regulators, courts, or other public authorities if we are legally compelled to do so, or if we believe disclosure is reasonably necessary to prevent serious harm, investigate fraud, or enforce our Terms & Conditions.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of byd180's business, Personal Data held by byd180 may be transferred to the acquiring entity. We will provide reasonable advance notice and ensure that any successor entity is bound by privacy commitments no less protective than those in this Policy.

7Data Retention

byd180 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply as general guidelines:

• Active Account Data (Identity, Contact, Financial): Retained for the lifetime of the Account and for a minimum of 5 years after Account closure, consistent with standard AML record-keeping requirements.
• KYC Documents: Retained for a minimum of 5 years after the Member relationship ends, in line with international anti-money-laundering obligations.
• Transaction Data: Retained for 7 years for financial audit and regulatory compliance purposes.
• Customer Support Records: Retained for 3 years after the resolution of the relevant support interaction or dispute.
• Technical & Log Data: Retained for up to 12 months for security and fraud-investigation purposes, then anonymised or deleted.
• Marketing Preferences: Retained until you withdraw consent or close your Account, plus 12 months thereafter for suppression-list purposes.

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

8Security Measures

byd180 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Our key technical and organisational safeguards include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data in transit between your device and our servers.
• Access Controls: Role-based access control (RBAC) ensures that staff can only access the data their specific role requires. All administrative access requires multi-factor authentication (MFA).
• Penetration Testing: We commission independent third-party penetration tests at least twice annually to identify and remediate vulnerabilities.
• Intrusion Detection: Automated intrusion detection and prevention systems (IDS/IPS) monitor platform traffic around the clock.
• Secure Development: Our development team follows OWASP secure-coding guidelines. All production releases undergo security code review prior to deployment.
• Incident Response: A documented incident response plan is maintained and tested regularly. In the event of a confirmed data breach, affected Members will be notified within 72 hours.

9Cookies & Tracking Technologies

byd180 uses cookies and similar technologies on the Platform. Below is a summary of the categories we deploy:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They manage your login session, maintain your Account state during play, and protect against cross-site request forgery (CSRF) attacks. They cannot be disabled without significantly impairing your ability to use the Platform.

9.2 Performance & Analytics Cookies

First-party analytics cookies help us understand how Members navigate the Platform — which pages are most visited, where users encounter errors, and how session flows are structured. This data is collected in aggregate and is not linked to your personal identity. We do not use Google Analytics or other third-party analytics trackers.

9.3 Functional Cookies

Functional cookies remember your preferences such as preferred language display, notification settings, and game lobby layout choices, improving your experience across sessions.

9.4 No Advertising Cookies

byd180 does not deploy advertising network cookies, cross-site tracking pixels, or behavioural profiling technologies. We do not share cookie data with advertising platforms.

9.5 Cookie Duration

Session cookies expire when you close your browser. Persistent functional cookies are set with a maximum lifespan of 12 months, after which they are automatically renewed upon your next login if you remain an active Member.

10Your Privacy Rights

Subject to applicable law and the terms of our gaming licence, you have the following rights in respect of your Personal Data held by byd180:

• Right of Access: You may request a copy of the Personal Data we hold about you. We will respond within 30 days of receiving a verified request.
• Right to Rectification: If any data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor corrections (such as email address changes) can be made directly in your Account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes collected, you have withdrawn consent, or we have no lawful basis to retain it. Note that AML and regulatory retention obligations may prevent full erasure for specified periods.
• Right to Restriction: You may request that we restrict Processing of your data while a dispute about its accuracy or our lawful basis is being resolved.
• Right to Data Portability: Where Processing is based on consent or contractual necessity and is carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to Object: You may object to Processing carried out on the basis of our legitimate interests. We will cease such Processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where Processing is consent-based (e.g., marketing communications), you may withdraw consent at any time without affecting prior lawful Processing.

To exercise any of the above rights, contact our Data Protection team at [email protected] with the subject line "Privacy Rights Request". We may need to verify your identity before processing the request. There is no charge for standard requests; we reserve the right to charge a reasonable administrative fee for manifestly excessive or repetitive requests.

11Minors & Age Policy

byd180 strictly prohibits use of the Platform by individuals under the age of 21. We do not knowingly collect Personal Data from anyone below this age threshold. If we become aware that a Member has provided false age information during registration and is in fact under 21, we will immediately:

• Suspend and permanently close the Account.
• Freeze and forfeit any Account Balance, consistent with our Terms & Conditions.
• Delete all Personal Data associated with the Account to the extent permissible under applicable law.
• Report the incident to relevant authorities if required under our licensing obligations.

If you are a parent or guardian and believe that your child under 21 has created an Account on byd180, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

12International Data Transfers

byd180 operates as an internationally licensed offshore platform. Your Personal Data may be transferred to and processed in countries outside Indonesia, including the jurisdiction in which byd180's licensing authority is based and the locations of our cloud infrastructure providers.

Where such transfers occur, byd180 ensures that adequate safeguards are in place, which may include:

• Contractual clauses with Data Processors that impose data-protection obligations equivalent to international best practice.
• Transfers only to jurisdictions that maintain recognised data-protection frameworks and adequate regulatory oversight of the financial services and gaming sectors.
• Internal data governance policies that enforce consistent data-handling standards regardless of the processing location.

By using the Platform, you acknowledge that your Personal Data may be transferred internationally in the manner described above. If you have concerns about specific transfer mechanisms, please contact our support team for further information.

13Changes to This Policy

byd180 may update this Privacy Policy periodically to reflect changes in our data practices, legal obligations, or Platform functionality. When material changes are made, we will notify registered Members by email and display a prominent notice on the Platform at least 14 days before the changes take effect.

The "Effective Date" at the top of this Policy indicates when the current version came into force. We encourage you to review this Policy whenever you visit the Platform. Your continued use of byd180 after the effective date of any revised Policy constitutes your acceptance of the updated terms. Previous versions of this Policy are available on request.

14Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy-related complaint, please contact the byd180 Data Protection team using the details below:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Privacy Rights Request" so we can route your message correctly.
• Live Chat: Available 24/7 via the in-platform chat widget. For privacy rights requests, our agents will escalate your query to the Data Protection team within 4 hours.
• Response Time: We aim to acknowledge all privacy-related enquiries within 24 hours and provide a substantive response within 30 days.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. For Indonesian residents, this may include referral to the relevant ministry overseeing personal data protection in Indonesia.

For general platform questions, account support, or responsible gaming assistance, please also refer to our FAQ page or our Responsible Gaming page.