Privacy Policy

1. Introduction

9lapak operates the online gaming platform accessible at https://9lapak.cam and all associated sub-domains and mobile interfaces (collectively, the "Platform"). We are committed to protecting the privacy and personal data of every individual who interacts with our Platform, whether as a registered member, a visitor, or a prospective user. This Privacy Policy sets out the types of personal data we collect, the lawful grounds on which we process that data, the purposes for which it is used, the circumstances under which it may be shared with third parties, and the rights available to you as a data subject.

9lapak serves the Indonesian market, and our data-handling practices reflect international best practices for responsible data governance. We process personal data only to the extent necessary to deliver our gaming services, comply with applicable law, and protect the integrity of our platform. We never sell personal data to third-party marketers. All data is handled with strict confidentiality and protected by bank-grade technical and organizational security measures.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including names, identification numbers, location data, online identifiers, or any combination of factors specific to that person's identity.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Controller" means 9lapak as the entity that determines the purposes and means of processing personal data.
• "Processor" means any third party that processes personal data on behalf of 9lapak under a data-processing agreement.
• "Member" or "User" refers to any individual who has registered an account on the 9lapak Platform.
• "KYC" means Know Your Customer: the identity-verification procedures required before certain account privileges are granted.
• "Cookies" means small text files placed on your device by our Platform to store preferences and analytics data.

3. Personal Data We Collect

3.1 Identity and Contact Information

When you register an account with 9lapak, we collect your full legal name, date of birth, gender, residential address (including province and city within Indonesia), email address, and mobile telephone number. This information is required to create your account, verify your identity, and communicate with you about your account activity.

3.2 Identity Verification Documents (KYC)

To comply with anti-money laundering regulations and to ensure our services are provided exclusively to adults aged 21 and over, we collect scanned copies or photographs of your Indonesian National Identity Card (Kartu Tanda Penduduk / KTP), address-verification documents (such as a utility bill or bank statement dated within three months), and a selfie photograph holding your KTP. These documents are processed exclusively for identity verification and AML compliance purposes.

3.3 Financial Information

We collect information about the payment methods you use on 9lapak, including bank account names and numbers for Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet identifiers (DANA, OVO, GoPay, ShopeePay, LinkAja). We do not store full bank account credentials or card numbers directly; financial transaction data is processed through secure payment-processing partners.

3.4 Transactional and Gaming Activity Data

We maintain records of all deposits, withdrawals, bets, casino game sessions, lottery entries, and related transactions associated with your account. This includes bet amounts, game outcomes, bonus usage, win/loss history, and timestamps. Such records are necessary for account management, dispute resolution, fraud prevention, and regulatory compliance.

3.5 Technical and Device Data

We automatically collect certain technical data when you access our Platform, including your IP address, device type and model, operating system, browser type and version, referring URL, pages visited, session duration, and interactions with platform features. This data is used for security monitoring, fraud detection, performance optimization, and analytics.

3.6 Communications Data

If you contact our customer-support team via live chat, email ([email protected]), or any other channel, we retain records of those communications for quality assurance, dispute resolution, and training purposes. Communications are typically retained for 24 months.

The table below summarizes the principal data categories:

4. How We Collect Your Data

• Directly from you — when you complete the registration form, submit KYC documents, make deposits, place bets, redeem bonuses, or contact support.
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies as you browse and interact with the Platform.
• From third-party payment processors — BCA Virtual Account systems, BRI Direct Debit, and e-wallet APIs return transaction confirmation data to our servers.
• From game-content providers — Evolution Gaming, Pragmatic Play, and other licensed studios transmit session and outcome data to 9lapak for account-balance reconciliation.
• From identity verification services — we may use automated document-verification tools to authenticate KTP submissions, which process your identity data on our behalf as a data processor.

5. Purposes of Data Processing

9lapak processes personal data for the following specific and legitimate purposes:

1. Account management — creating, maintaining, and closing your gaming account; processing deposits and withdrawals; crediting and debiting winnings and bonuses.
2. Identity verification and KYC — confirming that you are at least 21 years of age and a resident of Indonesia, in compliance with our age-restriction policy.
3. Anti-money laundering (AML) and fraud prevention — monitoring transactions for suspicious patterns, reporting obligations, and protecting the integrity of the Platform.
4. Customer support — resolving queries, complaints, and disputes submitted via live chat or email.
5. Marketing communications — sending promotional offers, bonus notifications, and platform updates by email or in-platform messaging, subject to your communication preferences.
6. Platform improvement and analytics — analyzing usage patterns to improve user experience, fix bugs, and develop new features.
7. Legal compliance — meeting obligations imposed by applicable international gaming regulations and responding to lawful requests from competent authorities.
8. Security — detecting, investigating, and preventing unauthorized access, fraud, and other malicious activities.

6. Legal Basis for Processing

For each processing purpose, 9lapak relies on one or more of the following lawful grounds:

• Contractual necessity — processing required to perform the gaming services agreement you enter into when registering an account (account management, payments, gaming activity).
• Legal obligation — processing required to comply with anti-money laundering regulations, age-verification requirements, and lawful authority requests (KYC, AML monitoring).
• Legitimate interests — processing carried out for our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms (fraud prevention, security monitoring, analytics, platform improvement).
• Consent — processing based on your freely given, specific, and informed consent, which you may withdraw at any time (marketing communications, non-essential cookies).

7. Data Sharing and Disclosure

7.1 Third-Party Service Providers

We share personal data with carefully selected third-party processors who assist us in delivering our services under binding data-processing agreements that require them to protect your data at least as stringently as we do. Categories of processors include: payment-gateway providers facilitating BCA, BRI, BNI, Mandiri, and e-wallet transactions; KYC document-verification service providers; game-content and live-casino platform suppliers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming); cloud-infrastructure and hosting providers; and customer-support software vendors.

7.2 Legal and Regulatory Disclosure

We may disclose personal data to competent regulatory authorities, law enforcement agencies, courts, or governmental bodies where required by applicable law or where we believe in good faith that such disclosure is necessary to prevent serious harm, comply with legal process, or protect the rights and property of 9lapak and our members.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or other corporate restructuring involving 9lapak, personal data held by us may form part of the transferred assets. You will be notified via email and/or platform announcement before any such transfer and given the opportunity to exercise your rights in relation to your data.

7.4 No Sale of Personal Data

9lapak does not sell, rent, license, or otherwise commercially exploit your personal data to third-party marketers, data brokers, or advertising networks. Your data is processed only for the purposes described in this policy.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet our legal and regulatory obligations. Account-level personal data is retained for the duration of your account relationship with 9lapak plus a minimum of five years following account closure, in line with standard AML record-keeping requirements. KYC documents, financial transaction records, and gaming history are retained for a minimum of seven years post-closure to satisfy international anti-money laundering compliance obligations. Technical log data and device information are retained for 13 months. Customer-support communications are retained for 24 months. When personal data is no longer required, it is securely deleted or anonymized so that it can no longer be associated with any individual.

9. Security Measures

9lapak implements a comprehensive set of technical and organizational security controls to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers, equivalent to the standard used by major Indonesian banks such as BCA and Mandiri.
• Encryption at rest — sensitive data fields including KTP scans, bank account numbers, and e-wallet identifiers are encrypted in our databases using AES-256.
• Two-factor authentication (2FA) — available for all member accounts to prevent unauthorized logins.
• Access controls — personal data is accessible only to authorized 9lapak personnel on a strict need-to-know basis; all access is logged and audited.
• Penetration testing and vulnerability assessments — conducted by independent third-party security firms on a regular schedule.
• Intrusion detection and DDoS mitigation — real-time monitoring systems alert our security team to anomalous traffic or access attempts.
• Staff training — all 9lapak personnel handling personal data receive regular data-protection and security awareness training.

Despite these safeguards, no electronic transmission or storage system is completely infallible. If you become aware of any unauthorized access to your account, please contact us immediately at [email protected] so we can take prompt remedial action.

10. Cookies and Tracking Technologies

10.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They allow the site to recognize your device on subsequent visits, remember your preferences, and collect analytics data. 9lapak uses both first-party cookies (set by our own domain) and third-party cookies (set by our service providers).

10.2 Types of Cookies We Use

10.3 Managing Cookies

You may configure your browser to refuse or delete cookies at any time. Please note that disabling strictly necessary or fraud-prevention cookies may impair your ability to log in, place bets, or use certain features of the Platform. Analytics and functional cookies can be managed through your 9lapak account settings under the Privacy section.

11. Your Data Rights

Subject to applicable law and our legitimate interests as a regulated gaming operator, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification — you may request that we correct any inaccurate or incomplete personal data without undue delay.
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction — you may request that we restrict the processing of your data in certain circumstances, for example while a dispute is being resolved.
• Right to data portability — you may request a structured, commonly used, machine-readable copy of the personal data you have provided to us.
• Right to object — you may object to processing based on legitimate interests or direct marketing at any time.
• Right to withdraw consent — where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our data-protection team at [email protected] with the subject line "Data Rights Request." We will acknowledge your request within 72 hours and provide a substantive response within 30 calendar days. We may need to verify your identity before fulfilling any request.

12. Protection of Minors

9lapak's gaming services are strictly restricted to individuals who are at least 21 years of age. We do not knowingly collect personal data from anyone under the age of 21. Our KYC verification procedures are designed to identify and reject applications from minors. If we become aware that a member is under 21, the account will be immediately suspended, all funds will be frozen pending investigation, and the member's personal data will be deleted in accordance with our retention policy except where retention is required for legal reporting purposes.

Parents and guardians who believe their child may have registered an account on 9lapak should contact us immediately at [email protected]. We will investigate and take appropriate action within 24 hours of receiving such notification.

13. International Data Transfers

As an international gaming platform serving Indonesian players, certain personal data may be transferred to and processed by our third-party service providers in jurisdictions outside Indonesia — for example, cloud infrastructure providers or game-content suppliers operating data centers in Singapore, Europe, or elsewhere. Where such transfers occur, we ensure that appropriate safeguards are in place, including standard contractual clauses, binding corporate rules, or transfers to jurisdictions recognized as providing adequate data protection. By using the 9lapak Platform, you acknowledge and consent to such transfers for the purposes described in this Privacy Policy.

14. Amendments to This Policy

9lapak reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or platform features. When we make material changes, we will notify you by posting a prominent notice on the Platform and sending an email to the address registered on your account at least 14 days before the changes take effect. The "Last Updated" date at the top of this page will always reflect the most recent revision. We encourage you to review this policy periodically. Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised policy.

15. Contact and Data Protection Inquiries

If you have any questions, concerns, or complaints about this Privacy Policy or the way 9lapak handles your personal data, please reach out to our dedicated data-protection team: