Privacy Policy — asa36

This Privacy Policy ("Policy") describes how asa36 ("we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("Members", "you") who access or use the asa36 online gaming platform, available at https://asa36.app (the "Platform").

This Policy applies to all personal data collected through the Platform, including data submitted during account registration, identity verification, financial transactions, customer support interactions, and general browsing activity. It applies equally to Members based in Jakarta, Surabaya, Bandung, Bali, Medan, and across Indonesia, as well as to any other individuals who access the Platform.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which form part of the broader agreement between you and asa36. By registering an account on the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

asa36 is committed to processing personal data responsibly, transparently, and in a manner consistent with internationally recognised data protection principles, including those reflected in the General Data Protection Regulation (GDPR) where applicable to our European-based processing operations.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, residential address, government-issued identification number, payment account details, and IP address.
• Processing: Any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• Data Controller: asa36, the entity that determines the purposes and means by which Personal Data is processed.
• Data Processor: A third-party service provider that processes Personal Data on behalf of asa36, subject to contractual obligations and data protection standards equivalent to those applied by asa36.
• Member: Any individual who has successfully registered an account on the asa36 Platform and whose account remains active.
• KYC: Know Your Customer — the identity and age verification process that asa36 conducts to confirm a Member's identity, age, and payment method ownership.
• Cookies: Small text files placed on your device by the Platform for the purposes of session management, analytics, personalisation, and fraud prevention.
• Sensitive Data: A subset of Personal Data warranting heightened protection, including financial account credentials, government-issued ID numbers, and any data that could be used to identify a minor.

asa36 collects the following categories of Personal Data in the course of operating the Platform:

We do not collect or store full payment card numbers. Where Visa or Mastercard transactions are supported, card data is handled exclusively by PCI-DSS-compliant third-party payment processors and is never stored on asa36 servers.

asa36 collects Personal Data through the following channels:

• Direct Submission: Data you voluntarily provide when registering an account, completing KYC, making a deposit or withdrawal, submitting a support request, or responding to a promotional survey.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, browser fingerprint data, and session activity logs. This collection occurs through server-side logging and client-side cookies and tracking technologies.
• Payment Processor Callbacks: Transaction status data returned by payment processors (including GoPay, OVO, DANA, BCA Virtual Account gateways, and other third-party payment intermediaries) following a deposit or withdrawal instruction.
• Third-Party Identity Verification Services: Where asa36 engages a third-party KYC provider to perform document authentication or biometric verification, that provider may return enriched identity data (e.g., verification status, document authenticity score) to asa36.
• Game Provider Data Feeds: Game session outcome and wagering data relayed by licensed game providers such as Evolution Gaming, Pragmatic Play, PG Soft, Spribe, Microgaming, and NetEnt through secure API integrations.
• Publicly Available Sources: In limited circumstances and for fraud prevention purposes, asa36 may cross-reference publicly available information (such as sanctions lists or adverse media) against Member identity data.

asa36 processes Personal Data only where a valid legal basis exists. The following table summarises the primary purposes of processing and the corresponding legal bases:

Where processing is based on your consent, you have the right to withdraw that consent at any time by updating your account notification preferences or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

asa36 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share Personal Data only in the following circumstances and only to the extent strictly necessary:

• Payment Processors: Financial Data is shared with payment gateway providers (including those facilitating GoPay, OVO, DANA, ShopeePay, and Indonesian bank transfers) solely to execute payment instructions you have authorised.
• KYC and Identity Verification Providers: Identity Data and documents submitted for verification are shared with contracted KYC service providers who are bound by data processing agreements and confidentiality obligations equivalent to those applied by asa36.
• Licensed Game Providers: Gaming session data is exchanged with game providers (Evolution Gaming, Pragmatic Play, PG Soft, Spribe, etc.) through encrypted API connections to enable game functionality, wager settlement, and jackpot processing.
• Fraud Prevention and Security Partners: Technical Data and transaction metadata may be shared with fraud detection service providers to identify and prevent fraudulent activity, account takeover attempts, and bonus abuse.
• Legal and Regulatory Authorities: asa36 may disclose Personal Data to competent authorities, law enforcement bodies, or regulatory bodies where required by applicable law, court order, or binding regulatory directive, and where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or asset sale involving asa36, Member data may be transferred to the successor entity, subject to equivalent privacy protections. Members will be notified of any such transfer in advance.

asa36 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. The following standard retention periods apply:

• Account and Identity Data: Retained for the duration of the active account and for a minimum of five (5) years following account closure, to satisfy applicable anti-money-laundering (AML) record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping best practices and applicable legal requirements.
• Gaming Activity Logs: Retained for three (3) years from the date of each session, or longer where required for dispute resolution or responsible gaming monitoring purposes.
• Customer Support Communications: Retained for two (2) years from the date of the final communication, unless the matter relates to an ongoing dispute, regulatory investigation, or legal proceeding.
• Technical and Cookie Data: Session cookies are deleted at the end of each browser session. Persistent analytics cookies are retained for a maximum of 12 months from the date of placement.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that makes re-identification impossible. Anonymised data may be retained indefinitely for aggregate statistical and platform improvement purposes.

asa36 implements a layered, defence-in-depth security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the asa36 Platform is encrypted using industry-standard TLS 1.2 or higher, ensuring that your credentials, payment data, and personal information cannot be intercepted in transit.
• Encrypted Data Storage: Personal Data and financial records stored on asa36 servers are encrypted at rest using AES-256 encryption. Database access is restricted to authorised personnel through role-based access controls (RBAC).
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA on their accounts. Internal asa36 systems require mandatory 2FA for all staff with access to Member data.
• Real-Time Anomaly Detection: Automated systems continuously monitor login patterns, transaction volumes, and gameplay behaviour for indicators of account compromise, fraud, or bot activity. Suspicious activity triggers an immediate security review and, where necessary, temporary account restriction.
• Regular Security Audits: asa36 engages independent third-party security firms to conduct penetration testing and vulnerability assessments on a regular basis. Critical findings are remediated within defined SLA timelines.
• Strict Data Access Controls: Access to Member Personal Data is granted only to asa36 employees and contractors with a documented operational need. All access is logged and subject to periodic review.

asa36 uses cookies and similar tracking technologies to operate the Platform effectively, improve your user experience, and maintain platform security. The following categories of cookies are in use:

Strictly Necessary cookies are placed without requiring your explicit consent, as they are essential for the secure and functional operation of the Platform. All other cookie categories are placed only where you have provided consent (indicated during your first visit or via your account settings). You may withdraw consent for non-essential cookies at any time through your browser settings or account preferences panel; however, doing so may affect certain Platform features and personalisation.

asa36 does not use third-party advertising cookies or share cookie-derived data with external advertising networks.

asa36 operates a strictly adults-only platform. Access to the Platform is permitted only to individuals who are 21 years of age or older. We do not knowingly collect or process the Personal Data of individuals under the age of 21.

As part of our KYC process, all Members are required to verify their date of birth using a government-issued identity document (Indonesian National Identity Card — KTP, or valid passport). Where age verification cannot be completed satisfactorily, the relevant account will be suspended and any funds held in the account will be dealt with in accordance with our Terms & Conditions.

If asa36 becomes aware or reasonably suspects that a Member is under the age of 21, we will immediately suspend the account, initiate a full KYC review, and — where the suspicion is confirmed — close the account and report the matter as required by applicable policy. Any Personal Data collected from an individual who is determined to have been under 21 at the time of registration will be deleted as promptly as legally permissible, subject to any mandatory retention obligations.

As a Member of asa36, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please submit a written request to [email protected]. We will respond to all valid requests within 30 calendar days of receipt.

As an internationally operated platform, asa36 may transfer your Personal Data to servers or service providers located outside Indonesia. Such transfers may occur in connection with cloud hosting infrastructure, KYC verification services, game provider API integrations, or fraud detection platforms.

Where Personal Data is transferred internationally, asa36 ensures that appropriate safeguards are in place to protect your data, including contractual protections equivalent to GDPR Standard Contractual Clauses (SCCs), binding corporate rules, or transfers to jurisdictions that have been assessed as providing an adequate level of data protection.

By registering an account and submitting Personal Data to asa36, you acknowledge that your data may be transferred to, stored in, and processed in countries outside Indonesia where data protection laws may differ from those applicable in your home jurisdiction. asa36 takes all reasonable steps to ensure that such transfers are conducted with appropriate care and in a manner consistent with this Privacy Policy.

asa36 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify active Members via email or through a prominent notice on the Platform at least 14 days before the changes take effect.

The effective date and version number displayed at the top of this Policy will be updated with each revision. We encourage you to review this Policy periodically to stay informed about how we are protecting your data.

Your continued use of the Platform following the publication of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material changes, you may request account closure in accordance with the process described in our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by asa36, please contact our Data Protection team using the details below:

For general enquiries about your account, deposits, withdrawals, or platform features, you may also consult our FAQ page for quick answers to the most common questions.