Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Company" / "We" / "Us" — dewi13, the operator of https://dewi13.cam and all associated sub-domains and mobile-optimised interfaces.
• "Member" / "You" — any individual who registers an account on the dewi13 Platform or accesses the Platform as a visitor.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, including name, identity card number, email address, phone number, IP address, and payment account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Controller" — the entity that determines the purposes and means of processing Personal Data. dewi13 acts as the Controller for all Personal Data collected on this Platform.
• "Processor" — a third party that processes Personal Data on behalf of the Controller (e.g., payment processors, KYC verification providers, cloud hosting services).
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "Data Breach" — a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

2. Scope & Applicability

2.1 This Privacy Policy applies to all Personal Data collected by dewi13 in connection with the provision of its online betting and gaming services, including sports betting (covering BRI Liga 1, EPL, Champions League, Piala AFF, and Timnas Indonesia fixtures), live casino, togel (Indonesia's traditional numbers lottery) markets, slot gacor games, and esports betting on Mobile Legends MPL and Free Fire tournaments.

2.2 This policy covers Personal Data collected through the following channels: the dewi13 website, the mobile-optimised Platform, the customer support live chat system, email correspondence, and interactions with dewi13's WhatsApp support number.

2.3 This policy does not apply to third-party websites or services linked from the Platform. dewi13 is not responsible for the privacy practices of those third parties. Members are encouraged to review the privacy policies of any external service they interact with.

3. Personal Data We Collect

3.1 dewi13 collects the following categories of Personal Data:

3.1 Identity & Contact Data

• Full legal name (as it appears on your Indonesian National Identity Card, KTP)
• Date of birth
• Indonesian national identity number (NIK)
• Indonesian tax identification number (NPWP) where applicable
• Email address
• Indonesian mobile phone number
• Residential address

3.2 Financial Data

• Bank account name and number (for supported banks: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon)
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction history: deposit amounts, withdrawal requests, bet stakes, winnings, and bonus credits denominated in IDR

3.3 Technical & Usage Data

• IP address and approximate geolocation (city level)
• Device type, operating system, and browser version
• Session start and end timestamps
• Pages viewed, games played, and betting markets accessed
• Login history and authentication events

3.4 KYC Verification Documents

• Scanned or photographed copy of your KTP identity card
• Proof of payment method ownership (bank statement header or e-wallet profile screenshot)
• Selfie photograph with identity document, where requested by the compliance team

3.5 Communications Data

• Records of live chat conversations, email exchanges, and WhatsApp support interactions where consent to record has been given or where recording is required for regulatory compliance
• Feedback and survey responses submitted voluntarily

4. How Personal Data Is Collected

4.1 dewi13 collects Personal Data through the following mechanisms:

• Direct submission: Data you provide when registering an account, completing a deposit or withdrawal form, submitting KYC documents, or contacting customer support.
• Automatic collection: Technical data collected passively when you visit the Platform, including IP address, device identifiers, and session behaviour, via server logs and first-party analytics tools.
• Cookies and similar technologies: Session cookies, persistent cookies, and browser local storage used to maintain your login session, remember preferences, and analyse aggregated Platform usage patterns. See Clause 11 for the full cookie policy.
• Third-party verification providers: Identity data returned by licensed KYC service providers when we submit your documents for verification against government databases.
• Payment processors: Transaction confirmation data returned by payment processor APIs when you deposit or withdraw funds. dewi13 does not receive or store full bank account passwords or card CVV numbers.

5. Purposes of Processing

5.1 dewi13 processes Personal Data for the following specific purposes:

6. Legal Basis for Processing

6.1 dewi13 processes Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between dewi13 and the Member — including account management, payment processing, and KYC verification — cannot be refused without preventing the Member from using the Platform.
• Legal obligation: Processing required to comply with anti-money laundering laws, gaming licence conditions, tax reporting obligations, and lawful orders from regulatory or law enforcement authorities.
• Legitimate interests: Processing for fraud prevention, Platform security, and aggregated analytics, where those interests are not overridden by the Member's privacy rights.
• Consent: Processing for optional purposes such as promotional communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

7.1 dewi13 does not sell or rent your Personal Data to third parties. We may share data only in the following circumstances, and only to the minimum extent necessary:

• Payment processors: Your bank account details and transaction amounts are shared with the licensed payment gateway providers that process IDR deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC verification providers: Identity documents and supporting data are shared with our contracted KYC service partners solely for the purpose of age and identity verification.
• Game content providers: Aggregated, pseudonymised session data (game ID, bet amount, outcome) is shared with licensed game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Pocket Games Soft (PGS) for game-integrity and RTP auditing purposes. No directly identifying data is shared with game studios.
• Cloud and hosting infrastructure: Personal Data is stored on servers managed by our contracted cloud hosting providers, which are contractually bound to process data solely on dewi13's instructions and in accordance with equivalent data protection standards.
• Regulatory and law enforcement authorities: dewi13 will disclose Personal Data to regulators, tax authorities, or law enforcement agencies when required to do so by a valid legal order or under our gaming licence obligations. We will notify the affected Member of such a request where we are legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of the Company's assets, Personal Data may be transferred to the successor entity, subject to the same privacy protections described in this policy. Members will be notified of such a change at least 30 days in advance.

7.2 All third-party Processors are contractually required to implement security measures equivalent to those described in Clause 10 of this policy and to process Personal Data only on documented instructions from dewi13.

8. International Data Transfers

8.1 As an internationally operated platform serving members across Indonesia — including in Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Palembang, and Makassar — dewi13 may process or store Personal Data on servers located outside Indonesia.

8.2 Where Personal Data is transferred to a country that does not provide a level of data protection equivalent to Indonesian standards, dewi13 implements appropriate safeguards, which may include:

• Standard contractual clauses binding the recipient to equivalent data protection obligations.
• Binding corporate rules where the transfer is to a corporate affiliate within the same group.
• Specific Member consent, where required by applicable law and where no other safeguard applies.

8.3 A list of the countries in which our primary data processors are established is available on request by contacting the address in Clause 16.

9. Data Retention

9.1 dewi13 retains Personal Data only for as long as is necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law or our gaming licence conditions. The following standard retention periods apply:

9.2 Upon expiry of the applicable retention period, Personal Data is securely deleted from active systems. Where immediate deletion is not technically feasible (e.g., data held in encrypted backup archives), the data is anonymised and segregated until the next scheduled purge cycle.

10. Data Security

10.1 dewi13 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. Key technical and organisational measures include:

• Encryption in transit: All data transmitted between your browser or app and the dewi13 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). Our SSL certificate is renewed annually and validated by a recognised certificate authority.
• Encryption at rest: Sensitive Personal Data fields (identity numbers, financial account references) stored in our databases are encrypted at the field level using AES-256.
• Access controls: Access to production databases containing Personal Data is restricted to authorised personnel on a strict need-to-know basis, enforced via role-based access control (RBAC) and multi-factor authentication (MFA).
• Penetration testing: The Platform undergoes independent security penetration testing at least once per calendar year and after any major infrastructure change.
• Incident response: dewi13 maintains a documented Data Breach Response Plan. In the event of a confirmed breach affecting your Personal Data, we will notify you and the relevant supervisory authority within the timeframe required by applicable law — and in any event within 72 hours of becoming aware of the breach.
• Staff training: All employees and contractors with access to Personal Data undergo data protection training at onboarding and annually thereafter.

10.2 Notwithstanding the measures above, no internet-based system is entirely immune to security risk. Members are encouraged to use strong, unique passwords for their dewi13 account and to enable two-factor authentication (2FA) where offered.

11. Cookies & Tracking Technologies

11.1 dewi13 uses the following categories of cookies and similar client-side technologies on the Platform:

• Strictly necessary cookies: Required for core Platform functionality — maintaining your authenticated session, storing your language preference, and enabling the bet slip. These cannot be disabled without breaking the Platform. No consent is required for these cookies.
• Performance and analytics cookies: First-party analytics cookies that collect anonymised data on page load times, navigation paths, and feature usage. This data is used internally to identify and resolve performance bottlenecks. No Member-identifiable data is sent to third-party analytics platforms.
• Functional cookies: Cookies that remember your in-session preferences, such as your preferred deposit method (e.g., BCA vs. OVO) or your selected odds format. These persist for the duration of your login session.

11.2 dewi13 does not use cross-site tracking cookies, advertising retargeting pixels, or third-party behavioural analytics tools that share your browsing data with ad networks.

11.3 You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Disabling performance cookies has no impact on Platform functionality.

12. Your Data Rights

12.1 As a Member of dewi13, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact us using the details in Clause 16. We will acknowledge your request within 5 business days and complete it within 30 calendar days.

• Right of access: You may request a copy of all Personal Data we hold about you, together with information about how it is being processed.
• Right to rectification: You may request correction of any inaccurate or incomplete Personal Data. You may also update many data fields directly through your Account dashboard.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to overriding retention obligations under gaming licence and AML law (see Clause 9).
• Right to restriction of processing: You may request that we restrict processing of your data while a rectification or objection request is under review.
• Right to data portability: You may request a machine-readable export of the Personal Data you provided to us directly, in a structured, commonly used format (CSV or JSON).
• Right to object: You may object to processing based on legitimate interests (including profiling for responsible gaming monitoring). We will comply unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

12.2 All rights requests are handled free of charge. Where a request is manifestly unfounded or repetitive, dewi13 reserves the right to charge a reasonable administrative fee or decline the request, providing written reasons in either case.

13. Minors & Age Restriction

13.1 The dewi13 Platform is strictly intended for adults aged 21 years and over. We do not knowingly collect Personal Data from individuals under 21.

13.2 Age verification is conducted at registration and again before any withdrawal is processed. If the Company discovers that Personal Data has been collected from a person under 21, that data will be deleted immediately and the associated account permanently closed.

13.3 If you are a parent or guardian and believe that a minor in your care has registered an account or submitted Personal Data to dewi13, please contact us immediately at the address in Clause 16 so that we may take prompt remedial action.

14. Third-Party Services

14.1 The Platform may contain references to, or integrations with, third-party services including game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft), live sports data providers, and payment gateways. These third parties operate under their own privacy policies and data processing terms, which are independent of this Privacy Policy.

14.2 When you play a game provided by a third-party studio through the dewi13 Platform, that studio may receive pseudonymised session data (e.g., a hashed player ID, game round ID, bet amount, and outcome) for the purposes of game-integrity verification and RTP auditing. No directly identifying data such as your name, NIK, or bank account number is shared with game studios.

14.3 dewi13 is not responsible for the privacy or security practices of third-party services. We encourage Members to review the privacy policies of any third-party service they interact with directly, outside the dewi13 Platform.

15. Policy Amendments

15.1 dewi13 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, operational procedures, or applicable law. Material changes — defined as changes that affect the purposes for which data is processed, the categories of data collected, or Member rights — will be communicated via:

• A prominent notice on the Platform homepage for at least 14 days before the change takes effect.
• An email notification to the registered email address of all active Members at least 7 days before the effective date.

15.2 Non-material changes (such as clarifications of existing language or corrections of typographical errors) may be made without prior notice. The "Last Updated" date at the top of this policy will be revised on every amendment, material or otherwise.

15.3 Your continued use of the Platform after the effective date of an amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the amended policy, you must cease using the Platform and may request account closure under Clause 10.4 of the Terms & Conditions.

15.4 The current version of this Privacy Policy is always available at https://dewi13.cam/privacy-policy.

16. Contact & Complaints

16.1 For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your Personal Data, please contact the dewi13 Data Protection team through the following channels:

• Email: [email protected] — subject line: "Privacy Request – [Your Registered Name]"
• Live Chat: Available 24/7 via the Platform; request to be connected to the Data Protection team
• WhatsApp: +62 811 DEWI 13 (available during WIB business hours; for non-urgent privacy queries only)

16.2 We commit to acknowledging all privacy-related requests within 5 business days (WIB) and to completing them within 30 calendar days of receipt. Where the complexity of a request requires additional time, we will notify you before the initial 30-day period expires and provide an estimated completion date.

16.3 If you are not satisfied with our handling of your privacy request or complaint, you have the right to escalate the matter to the supervisory authority responsible for overseeing the Company's gaming licence jurisdiction, or to seek independent legal advice.