spy4d Privacy Policy

spy4d ("we", "us", "our") operates Indonesia's premier online sports betting and casino platform, accessible at https://spy4d.org. As part of delivering a secure, fair, and personalised gaming experience to Indonesian players, spy4d necessarily collects and processes certain personal data belonging to registered users and visitors.

This Privacy Policy ("Policy") sets out in plain, professional English exactly what personal data we collect, the lawful bases on which we process it, how long we keep it, with whom we share it, and the rights available to you as a data subject. This Policy applies to all services offered through the spy4d Platform, including the sportsbook, live casino, slots, crash games, and all customer-support interactions.

By registering a spy4d account or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood its contents. If you do not agree with any part of this Policy, you must cease using the Platform and contact live chat support to initiate account closure.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference.

spy4d collects personal data in the following categories. We apply a data-minimisation principle: we collect only what is genuinely necessary for the stated purpose and do not retain it longer than required.

spy4d collects personal data through the following channels:

• Direct Registration: When you create a spy4d account, you voluntarily provide identity and contact data through the registration form. This data is transmitted over a TLS-encrypted connection from the moment you submit the form.
• KYC Submission: When you initiate the identity verification process — required before your first withdrawal — you upload government-issued identity documents directly through the secure document portal on the Platform.
• Deposit and Withdrawal Transactions: Financial data is collected each time you initiate a deposit or withdrawal via a local Indonesian bank transfer or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja). Transaction metadata is logged automatically by our payment processing partners and relayed to spy4d's systems.
• Platform Interaction: Technical and usage data is collected automatically as you navigate the spy4d website and use its products, through server logs, session tracking, and first-party analytics tools.
• Cookies and Similar Technologies: Cookies and pixel tags placed on your device by the Platform collect session and preference data. See Section 8 for full details on cookie categories and your opt-out options.
• Customer Support: When you contact spy4d via live chat, email ([email protected]), or any other support channel, the content of your communication and any documents you share are recorded and stored.
• Third-Party Verification Services: We may receive identity confirmation data back from licensed KYC vendors and AML screening databases that we use to verify your identity and screen for financial crime risk. spy4d does not purchase marketing lists or third-party consumer profiles.

spy4d processes personal data for the following specific, documented purposes. We do not use your data for any purpose that is incompatible with those listed below:

• Account Creation and Management: To register your account, verify your identity, maintain your account settings, and provide access to all Platform products and services.
• Transaction Processing: To facilitate deposits and withdrawals via Indonesian local bank transfers (BCA, BRI, BNI, Mandiri, and others) and e-wallets, and to maintain an accurate transaction record in your account history.
• KYC and AML Compliance: To satisfy our Know Your Customer obligations and to detect, investigate, and report suspicious financial activity in accordance with applicable international anti-money laundering standards.
• Fraud Prevention and Security: To identify and prevent fraudulent account activity, unauthorised access attempts, multi-accounting, bonus abuse, and other prohibited conduct described in our Terms & Conditions.
• Responsible Gaming: To monitor for indicators of problem gambling behaviour and to administer player protection tools including deposit limits, loss limits, cooling-off periods, and self-exclusion requests.
• Personalisation: To tailor your experience on the Platform — including personalised game recommendations, relevant promotional offers, and preferred payment method shortcuts — based on your usage patterns.
• Customer Support: To respond to your queries, resolve disputes, process complaints, and provide technical assistance through live chat and email channels.
• Marketing Communications: To send promotional emails, SMS notifications, and in-app messages about bonuses, new game launches, and Platform updates — only where you have given separate consent to receive such communications, and only to your registered contact details.
• Platform Improvement: To analyse aggregate usage patterns, game performance metrics, and site navigation data in order to improve the Platform's features, design, and reliability.
• Legal Compliance: To meet our obligations under applicable international gaming regulations, financial crime prevention laws, and data protection frameworks.

spy4d processes personal data on one or more of the following legal bases for each processing activity:

• Contractual Necessity: Processing required to perform the contract between you and spy4d — specifically, to provide the betting and gaming services you have requested, to process your transactions, and to manage your account.
• Legitimate Interests: Processing necessary for spy4d's legitimate business interests, provided those interests are not overridden by your fundamental privacy rights. Legitimate interests include fraud prevention, platform security, product analytics, and responsible gaming monitoring.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML compliance obligations, identity verification requirements, and records retention mandates imposed by our international gaming licence conditions.
• Consent: Where no other legal basis applies — primarily for optional marketing communications — we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent for marketing communications at any time by clicking the "unsubscribe" link in any promotional email or by contacting live chat support.

spy4d does not sell, rent, or trade your personal data to any third party for their own commercial purposes. Data is shared only in the limited circumstances described below, and only with parties who are contractually bound to process it under spy4d's instructions with appropriate security safeguards in place:

• Payment Processors: Indonesian bank transfer intermediaries and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial account data necessary to execute your requested deposits and withdrawals. Each is a regulated financial institution operating under Indonesian financial authority oversight.
• KYC and AML Vendors: Licensed identity verification and AML screening service providers receive identity document data and transaction metadata solely for the purpose of completing mandatory verification checks.
• Game Studio Providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, PG Soft, Microgaming, Spribe, and Pocket Games Soft) may receive a session token and anonymised player identifier to authenticate your game session. These studios do not receive your full name, financial data, or contact details.
• Cloud Infrastructure and Hosting Providers: Encrypted personal data is stored on servers operated by our infrastructure partners under strict data processing agreements that prohibit any use of the data beyond hosting and delivery.
• Legal and Regulatory Authorities: spy4d may be required to disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies in response to a lawful order, court subpoena, or binding regulatory request. Where permitted by law, spy4d will notify you of such a disclosure.
• Professional Advisors: Lawyers, auditors, and compliance consultants engaged by spy4d may access personal data to the minimum extent necessary to provide professional advice, subject to professional confidentiality obligations.

All third-party data processors are assessed by spy4d for data security standards before engagement and are reviewed periodically thereafter. Agreements with all processors include contractual obligations consistent with leading international data protection frameworks.

spy4d uses first-party cookies and similar browser-storage technologies to operate the Platform reliably and improve your experience. We do not use third-party advertising cookies or cross-site tracking pixels.

You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies will prevent you from logging into your account. Disabling performance cookies does not affect your ability to use the Platform but does limit spy4d's ability to identify and fix technical issues that may affect your experience.

spy4d retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law or our gaming licence conditions. The following retention schedule applies:

• Active Account Data: Retained for the full duration of your account's active status. This includes identity data, contact data, transaction history, and usage data.
• Closed Account Data: Following account closure, personal data is retained for a minimum of five (5) years to satisfy AML record-keeping obligations under our international licence conditions and to support any post-closure dispute resolution.
• KYC Verification Documents: Identity documents submitted for KYC are retained for five (5) years from the date of submission or account closure, whichever is later.
• Financial Transaction Records: All deposit and withdrawal records are retained for a minimum of seven (7) years from the date of each transaction, in line with international financial record-keeping standards.
• Support Communications: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction, or longer if the communication is relevant to an open dispute or regulatory inquiry.
• Marketing Consent Records: Records of your consent to receive marketing communications are retained for the duration of your account plus three (3) years, to demonstrate that communications were lawfully sent.
• Technical / Log Data: Server logs and IP address records are retained for a maximum of 12 months unless a security investigation requires longer retention.

When data reaches the end of its applicable retention period, it is securely deleted or irreversibly anonymised such that it can no longer be associated with any individual.

spy4d implements a comprehensive, layered security programme designed to protect personal data against unauthorised access, accidental loss, alteration, and unlawful destruction. Key measures include:

• Transport Encryption: All data transmitted between your device and the spy4d Platform is encrypted using TLS 1.3, the current industry-leading transport security protocol. No data is ever transmitted in plain text.
• Data-at-Rest Encryption: All databases containing personal data are encrypted at rest using AES-256, the same standard applied by international financial institutions and regulated operators.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff access to customer data requires multi-factor authentication and is logged and audited. Administrative access privileges are reviewed quarterly.
• Password Security: Account passwords are never stored in plain text. spy4d applies a one-way cryptographic hashing algorithm with a unique per-account salt, meaning that even in the event of a data breach, plaintext passwords cannot be recovered.
• Intrusion Detection: The Platform is monitored 24/7 by automated intrusion detection systems that flag and block anomalous access patterns, including brute-force login attempts, credential-stuffing attacks, and unusual API activity.
• Regular Security Audits: spy4d commissions independent third-party penetration tests and security audits on a regular basis. Critical findings are remediated within defined SLA timeframes.
• Incident Response: In the event of a confirmed personal data breach that poses a risk to affected individuals, spy4d will notify affected Players and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with leading international data breach notification standards.

As a Player whose personal data is processed by spy4d, you hold the following rights. These rights are not absolute — they are subject to applicable legal limitations and our regulatory obligations — but spy4d is committed to responding to all valid requests promptly and transparently.

To exercise any of the above rights, contact us via live chat or email at support@spy4d.org with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and provide a substantive response within 30 calendar days. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 30 days, with prior notification to you.

The spy4d Platform is strictly for adults aged 21 and over. spy4d does not knowingly collect personal data from individuals under the age of 21. Registration is blocked for users who declare a date of birth indicating they are under 21, and age verification is a mandatory step of the KYC process for all accounts before withdrawal rights are granted.

If spy4d discovers that personal data has been collected from a user who is under 21, we will immediately suspend the account, void any pending transactions, and permanently delete all associated personal data. Any winnings generated during a period where a user's underage status was concealed or undetected are subject to forfeiture in accordance with our Terms & Conditions.

If you believe a person under 21 has registered or is using a spy4d account, please notify us immediately via live chat or at support@spy4d.org. We take every such report seriously and investigate all cases on a priority basis.

spy4d reviews this Privacy Policy at least annually and updates it whenever there is a material change to our data processing practices, a change in applicable law, or an update to our service offering that affects how personal data is used.

• All changes will be published on this page with an updated Effective Date clearly displayed at the top of the document.
• For material changes — those that significantly affect your privacy rights or introduce new categories of data processing — spy4d will provide at least seven (7) days' advance notice via a notification displayed on login and, where applicable, via email to your registered address.
• Your continued use of the Platform following the Effective Date of any revised Policy constitutes your acceptance of the updated terms.
• If you object to any change, you must cease using the Platform and submit a data deletion request via live chat or email before the revised Policy takes effect.

We recommend bookmarking this page and checking it periodically, particularly after receiving a notification from spy4d about policy updates.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data spy4d holds about you, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly on the Platform. This is the fastest channel for urgent data rights requests. Our Indonesian-speaking agents can typically connect you with the data protection team within 60 seconds.
• Email: Send your query to support@spy4d.org with the subject line "Privacy Policy Enquiry" or "Data Rights Request". We respond to all emails within one (1) business day during standard operating hours (WIB, UTC+7).
• Written Correspondence: For formal legal notices, you may submit your request in writing via live chat and request escalation to our Data Protection Officer. Responses to formal written requests are provided within 30 calendar days as specified in Section 11.