Privacy Policy — How jos126 Protects Your Personal Data

≡ Table of Contents

Select any section heading to navigate directly to it.

This Privacy Policy applies to all users who access the jos126 platform at https://jos126.app, including registered account holders and visitors who browse without registering. By using the platform, you acknowledge that you have read, understood, and agreed to the practices described in this policy. This policy should be read alongside our Terms & Conditions.

1Definitions

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Platform" means the jos126 website accessible at https://jos126.app and all associated pages, features, account interfaces, game environments, and mobile-optimised views.
• "Company," "we," "us," or "our" refers to jos126 and its operators, officers, employees, agents, and data processors acting on its behalf.
• "User," "you," or "your" means any individual who accesses or uses the Platform in any capacity, whether as a registered account holder or an unregistered visitor.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, residential address, payment account details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "KYC" means Know Your Customer — the identity and age verification process the Company conducts in accordance with its compliance obligations.
• "Cookies" means small text files placed on your device by the Platform to store session state, preferences, and anonymised analytics data.
• "Third-Party Processor" means any external organisation engaged by the Company to process Personal Data on its behalf, including payment processors, KYC verification providers, and game studios.
• "IDR" means Indonesian Rupiah, the sole operating currency of the Platform.
• "Retention Period" means the defined duration for which the Company stores a given category of Personal Data before securely deleting or anonymising it.

2Data We Collect

2.1 Data You Provide Directly

When you register an account, complete KYC verification, make a deposit or withdrawal, or contact our support team, you provide us with Personal Data including:

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify you are 21 years of age or older).
• Indonesian residential address.
• Email address and mobile phone number.
• Username and hashed password (we never store passwords in plain text).
• Indonesian bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) or e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) used for deposits and withdrawals.
• Copies of identity documents uploaded for KYC (e.g., KTP — Indonesian national identity card — or passport).
• Any communication you send to the support team via live chat or email.

2.2 Data Collected Automatically

When you access the Platform, we automatically collect certain technical and behavioural data, including:

• IP address and approximate geolocation (city/region level — we do not collect GPS coordinates).
• Device type, operating system, browser name and version, and screen resolution.
• Session start and end times, pages visited, and features accessed.
• Betting and gaming activity data: markets wagered on, game titles played, wager amounts in IDR, outcomes, and session duration.
• Cookie identifiers and browser local storage values used for session management and fraud prevention.
• Referral source (the URL or marketing channel from which you arrived at the Platform, if applicable).

2.3 Data from Third Parties

We may receive supplementary Personal Data from authorised third parties in the following circumstances:

• KYC and identity verification providers may supply additional verification signals (e.g., document authenticity scores, sanctions screening results) alongside the documents you submitted.
• Payment processors may confirm transaction status, account holder name matching, and fraud risk scores for deposit and withdrawal requests.
• Responsible gaming partners may provide self-exclusion status data where you have registered with a third-party exclusion scheme recognised by the Company.

3How We Use Your Data

The Company processes your Personal Data for the following purposes and on the following legal bases:

4Data Sharing & Disclosure

4.1 Third-Party Processors

The Company shares Personal Data with carefully selected third-party processors only to the extent necessary to deliver the Services. All third-party processors are contractually obligated to process your data solely on the Company's instructions and to implement appropriate technical and organisational security measures. Categories of third-party processors include:

• Payment processors — to facilitate IDR deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC and identity verification providers — to verify your age, identity, and residential address in accordance with our compliance obligations.
• AML screening providers — to screen transactions and account holders against sanctions lists and politically exposed persons (PEP) databases.
• Game content providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft, which receive limited session data necessary to render their games within the Platform.
• Cloud hosting and infrastructure providers — who store Platform data on servers that meet recognised international security standards.
• Customer support platform providers — who power the live chat system used to deliver 24/7 Indonesian-speaking support.

4.2 Legal Disclosure

The Company may disclose your Personal Data to law enforcement agencies, regulatory bodies, courts, or other authorised government authorities when required to do so by applicable law, court order, or regulatory obligation. The Company will notify you of such disclosure where legally permitted to do so.

4.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's business, your Personal Data may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections. You will be notified of any such transfer via the Platform or by email to your registered address before the transfer takes effect.

5Data Retention

The Company retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is not technically feasible within a specific data store, the data is instead placed under restricted access controls and flagged for deletion at the next scheduled purge cycle.

6Security Measures

6.1 Technical Safeguards

The Company implements a comprehensive set of technical security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction:

• TLS/SSL Encryption: All data transmitted between your browser or app and the jos126 servers is encrypted using TLS 1.2 or higher, enforced via a valid SSL certificate issued by a recognised certificate authority.
• Password Hashing: Account passwords are never stored in plain text. They are hashed using a cryptographically strong one-way algorithm with unique per-account salting.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts for an additional layer of login security.
• Intrusion Detection Systems: Real-time monitoring tools flag unusual access patterns, including multiple failed login attempts, login from unfamiliar IP addresses, and atypical session behaviour.
• Database Encryption at Rest: Sensitive data fields — including identity document references and payment account details — are encrypted at the database level in addition to transport-layer encryption.
• Regular Security Audits: The Platform undergoes periodic security assessments conducted by independent third-party specialists to identify and remediate vulnerabilities.

6.2 Organisational Safeguards

Access to Personal Data within the Company is restricted on a strict need-to-know basis. Staff who handle Personal Data receive mandatory privacy and data security training. Access privileges are reviewed quarterly and revoked promptly upon staff departure or role change. The Company maintains an incident response plan to ensure timely detection of, response to, and notification of any data breach that affects users' Personal Data.

7Cookies & Tracking Technologies

7.1 What We Use Cookies For

Jos126 uses first-party cookies and similar technologies (such as browser local storage) for the following purposes:

7.2 What We Do Not Use Cookies For

Jos126 does not place cross-site advertising cookies, behavioural retargeting pixels, or third-party social media tracking tags on the Platform. We do not share cookie data with advertising networks or data brokers.

7.3 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies at any time. Please note that blocking strictly necessary cookies will impair the functionality of the Platform, including your ability to log in and maintain a session. Blocking functional cookies will prevent the Platform from remembering your preferences between sessions.

8Your Data Rights

As a user of the jos126 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team via live chat or the email address provided in Section 12.

The Company will acknowledge rights requests within 48 hours and aim to fulfil them within 30 calendar days. Where a request is particularly complex or where a high volume of requests is received simultaneously, this period may be extended by a further 30 days, and you will be notified accordingly. Certain rights may be limited where the Company is required to retain data by law or where fulfilling the request would prejudice the rights of another individual.

9Minors & Age Verification

The jos126 Platform is strictly intended for adults aged 21 years or older. The Company does not knowingly collect, process, or retain Personal Data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC process — no account will be approved for real-money play until the user's age has been confirmed via a government-issued identity document.

9.1 KYC Age Verification

During the KYC process, users are required to submit a valid Indonesian national identity card (KTP) or passport. The date of birth on the submitted document is cross-referenced against the date of birth provided at registration. Any discrepancy will result in the account being suspended pending further verification. Accounts found to belong to individuals under 21 years of age will be permanently closed and any funds in the account will be returned via the original deposit method, minus any bonuses claimed.

9.2 Parental Controls

If you believe a minor in your household has accessed or registered on the jos126 Platform, please contact our support team immediately via live chat or email. We will investigate promptly, close the account, and ensure all associated Personal Data is securely deleted in accordance with our data protection obligations. We encourage parents and guardians to make use of device-level parental control software to restrict access to online gambling platforms.

10Third-Party Links & Integrations

The Platform may display references to third-party game studios, payment processors, and sports data providers in the course of delivering its services. While the Company takes care to partner only with reputable third parties, please note the following:

• Game content delivered by studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft is rendered within the Platform environment. These studios may receive limited session tokens and game-state data necessary to operate their games. They are bound by data processing agreements with the Company and may not use this data for independent marketing or profiling purposes.
• Payment infrastructure providers (for BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja transactions) operate under their own privacy policies and regulatory frameworks. The Company shares only the minimum data necessary to initiate and confirm IDR transactions.
• Sports data and odds providers supply market data to the Sportsbook feature. They do not receive your Personal Data; the integration is purely data-feed based.
• The Company is not responsible for the privacy practices of any third-party organisation. If you choose to interact directly with a third-party website or service linked or referenced on the Platform, you do so under that third party's privacy policy, which the Company encourages you to review independently.

11Changes to This Privacy Policy

The Company reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law or regulation, updates to the Platform's data processing activities, changes in third-party processor relationships, or improvements in our privacy practices based on user feedback or internal review.

11.1 Notification of Changes

When material changes are made to this Privacy Policy, the Company will notify registered users via one or more of the following methods: a prominent notice displayed upon your next login to the Platform, an email to your registered email address, or an announcement on the Platform's news page. The "Last Updated" date at the top of the sidebar will be revised to reflect the date on which the new version takes effect.

11.2 Continued Use as Acceptance

Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should cease using the Platform and contact the support team to close your account and withdraw any remaining balance.

11.3 Version Archive

Previous versions of this Privacy Policy are retained on file by the Company. If you wish to review a prior version, you may request it by contacting the support team. The version currently published on this page is the binding version for all active users.

12Contact & Data Enquiries

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your Personal Data, please contact the jos126 support team through the channels below. When submitting a data rights request, please include your registered username, a description of your request, and any relevant account reference numbers to help us respond as efficiently as possible.