Privacy Policy

The following definitions apply throughout this Privacy Policy.

ind186 collects personal data across several categories, depending on the nature of your interaction with the Platform. The table below provides a comprehensive breakdown of the data categories, specific data points, and the operational context in which they are collected.

ind186 collects personal data through the following channels and mechanisms:

3.1 Data You Provide Directly

The majority of personal data ind186 holds is information you voluntarily submit during the following interactions:

• Account Registration: When you create an ind186 account, you provide your name, date of birth, email address, mobile number, and residential address.
• KYC Verification: When completing identity verification, you upload copies of your KTP, passport, or driving licence, and may provide proof of address and payment method ownership.
• Deposits and Withdrawals: When conducting financial transactions, your bank account details or e-wallet credentials are captured to facilitate processing and to verify that funds originate from an account registered in your name.
• Customer Support: When you contact our support team via live chat or email, the content of those communications — including any personal data you choose to share — is recorded and retained for audit and quality-assurance purposes.
• Promotions and Surveys: If you participate in surveys, prize draws, or promotional campaigns run by ind186, you may provide additional personal data in that context.

3.2 Data Collected Automatically

When you access the ind186 Platform, certain technical data is collected automatically through cookies, server logs, and similar tracking technologies. This includes your IP address, device fingerprint, browser configuration, and session activity. See Section 8 for a full explanation of our cookie practices.

3.3 Data from Third Parties

ind186 may receive personal data about you from the following third-party sources:

• KYC / Identity Verification Providers: Third-party services that cross-reference the identity documents you submit against national and international identity databases to confirm authenticity.
• Payment Processors: Banks and e-wallet platforms (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) may return confirmation data — such as transaction reference numbers, account name matches, and transfer timestamps — when processing your deposits or withdrawals.
• Fraud Prevention & AML Screening Services: ind186 subscribes to third-party financial crime screening databases that may flag politically exposed persons (PEPs), sanctioned individuals, or accounts associated with known fraud patterns.

ind186 processes your personal data only for defined, explicit, and legitimate purposes. The table below maps each processing purpose to the data categories involved and the corresponding legal basis (see Section 5 for legal basis definitions).

ind186 relies on the following legal bases to process your personal data. At least one legal basis applies to every processing activity carried out by ind186.

• Contractual Necessity: Processing required to perform the contract between you and ind186 — including creating and maintaining your account, processing bets, and handling deposits and withdrawals. Without this processing, ind186 cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable law, including anti-money-laundering (AML) legislation, counter-terrorism financing (CTF) regulations, and gaming licence conditions mandated by ind186's international licensing authority.
• Legitimate Interests: Processing carried out to pursue ind186's legitimate business interests — such as fraud detection, platform security, responsible gaming monitoring, and improving service quality — where those interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of direct marketing communications. You may withdraw consent at any time without detriment to your account standing.

ind186 does not sell your personal data. We share your data only in the circumstances described below, and only with parties who are contractually bound to process it in accordance with ind186's instructions and applicable data protection standards.

6.1 Service Providers (Data Processors)

ind186 engages trusted third-party service providers to support Platform operations. These providers act as data processors under written contracts that restrict their use of your data to the specific services they provide to ind186. Current categories of data processor include:

• KYC and identity verification platforms
• Payment processing gateways connected to Indonesian banks and e-wallets
• Cloud hosting and data storage infrastructure providers
• Fraud detection and AML screening services
• Customer support software providers
• IT security and penetration testing firms

6.2 Regulatory and Law Enforcement Authorities

ind186 may disclose personal data to competent regulatory bodies, gaming authorities, financial intelligence units, or law enforcement agencies where required to do so by applicable law, valid legal process, or a binding order from a court or authority of competent jurisdiction. ind186 will, where legally permitted, notify affected Members of such disclosures.

6.3 Business Transfers

In the event that ind186 undergoes a merger, acquisition, restructuring, or sale of all or a material part of its assets, Member personal data may be transferred to the successor entity as part of that transaction. ind186 will notify affected Members via their registered email address prior to any such transfer, and the successor entity will be bound by this Privacy Policy or a policy of equivalent or greater protection.

ind186 operates internationally, and some of your personal data may be processed in countries outside Indonesia by our data processors and hosting infrastructure providers. Where such transfers occur, ind186 ensures that appropriate safeguards are in place to maintain a level of data protection equivalent to applicable international standards, including:

• Contractual clauses that impose data protection obligations on the recipient party equivalent to those binding ind186.
• Transfer only to processors located in jurisdictions recognised by ind186's licensing authority as providing adequate data protection frameworks.
• Technical safeguards — including end-to-end encryption in transit and encryption at rest — that protect data regardless of geographic location.

By registering an account on ind186, you acknowledge and consent to the cross-border transfer of your personal data as described in this section, subject to the safeguards outlined above.

ind186 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, remember your preferences, and detect fraudulent or abusive activity. The following categories of cookies are used on the ind186 Platform:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the Platform. ind186 does not use third-party advertising or retargeting cookies.

ind186 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable law and licensing conditions. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

ind186 implements a comprehensive, layered security programme designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security controls include, but are not limited to:

• Transport Security: All data transmitted between your browser or app and ind186's servers is encrypted using TLS 1.3, the current industry gold standard for in-transit data protection.
• Encryption at Rest: Sensitive personal and financial data stored on ind186 infrastructure is encrypted using AES-256. Encryption keys are managed using a separate key management service with access restricted to authorised personnel only.
• Access Controls: ind186 operates a role-based access control (RBAC) model. Employee access to Member personal data is restricted to those whose job function explicitly requires it, and all access events are logged for audit purposes.
• Two-Factor Authentication (2FA): All internal ind186 staff accounts used to access systems containing Member data are protected by mandatory 2FA. Members are also strongly encouraged to enable 2FA on their own accounts.
• Penetration Testing: ind186 commissions independent third-party penetration tests of its Platform infrastructure at least annually, with critical vulnerabilities remediated within 72 hours of discovery.
• Incident Response: ind186 maintains a documented data breach response plan. In the event of a confirmed breach affecting Member personal data, affected Members will be notified within 72 hours of ind186 becoming aware, where technically feasible and legally required.

As a Member of ind186, you hold the following rights in relation to your personal data. These rights apply regardless of your account status — including after account closure. To exercise any right, submit a written request to [email protected] with the subject line "Data Rights Request" and your registered email address. ind186 will respond within 30 calendar days.

The ind186 Platform is strictly for adults aged 21 and above. ind186 does not knowingly collect personal data from individuals under the age of 21. If ind186 becomes aware that personal data has been submitted by or on behalf of a minor, that data will be deleted immediately and the associated account permanently closed.

Parents and guardians who believe that a minor may have registered an ind186 account, or that a minor's personal data may have been submitted to the Platform without their knowledge, are urged to contact ind186 immediately at [email protected]. ind186 will investigate and act on such reports as a priority within 24 hours of receipt.

The ind186 Platform does not contain links to third-party websites, apps, or services for general browsing purposes. However, in the course of processing payments, you may be redirected temporarily to the secure interface of a bank or e-wallet provider (such as BCA, BRI, GoPay, or DANA) to authenticate a transaction. These third-party interfaces operate under their own privacy policies, which are entirely independent of this Privacy Policy.

ind186 accepts no responsibility for the data practices of third-party payment platforms. We recommend reviewing the privacy policy of any third-party service you interact with during the deposit or withdrawal process.

ind186 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or licensing requirements. When changes are material — such as a change in the categories of personal data collected, a new category of data sharing, or a change in retention periods — ind186 will provide at least 14 days' advance notice by posting a prominent notice on the Platform and, where feasible, notifying active Members via their registered email address.

The version number and effective date displayed in the page header identify the current operative edition of this Privacy Policy. Your continued use of the ind186 Platform following the effective date of any amended version constitutes your acceptance of the updated policy. If you do not agree with any amendment, you may request account closure in accordance with the Terms & Conditions.

For any questions, concerns, or formal complaints relating to this Privacy Policy or ind186's data processing practices, please contact our Data Protection team using the details below. All contact information is provided as plain text only and is not a clickable link.

If you are not satisfied with ind186's response to a privacy complaint, you have the right to escalate your complaint to the data protection supervisory authority in the jurisdiction governing your account, as identified by ind186's international gaming licence. ind186 will provide contact details for the relevant authority upon request.