Privacy Policy — nos12 Online Gaming Platform

The following definitions apply throughout this Privacy Policy. Capitalised terms not defined here carry the meanings assigned to them in the nos12 Terms & Conditions.

nos12 collects only the Personal Data that is strictly necessary for the purposes described in Section 4 of this Policy. We do not collect data speculatively or sell data to marketing brokers. The categories of Personal Data we collect are as follows:

2.1 Registration Data — When you create a nos12 account, we collect your full legal name, date of birth, residential address (city, province, and postcode — which for Indonesian players will reference cities such as Jakarta, Surabaya, Bandung, Medan, Bali, or Yogyakarta), valid email address, and a password you create. This data is mandatory; an account cannot be created without it.

2.2 Identity Verification (KYC) Data — To process withdrawals and to comply with our anti-money-laundering obligations, we collect copies of government-issued identity documents (Indonesian KTP, passport, or SIM), proof of residential address, and proof of ownership of the payment method used. This data is handled by our KYC processor under strict confidentiality obligations.

2.3 Financial Data — We collect records of all deposit and withdrawal transactions, the payment methods used (bank account numbers for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, and Bank Danamon; and e-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja), transaction timestamps, and transaction amounts denominated in Indonesian Rupiah (IDR / Rp). We do not store full bank account passwords or e-wallet PINs.

2.4 Gaming Activity Data — We maintain a complete record of all bets placed, games played, wager amounts, outcomes, session durations, and product verticals used (sportsbook, live casino, slots, togel (Indonesia's traditional numbers lottery), and Andar Bahar). This record is used for dispute resolution, responsible gaming monitoring, and platform improvement.

2.5 Technical & Device Data — We automatically collect IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, clickstream data, and session duration. This data is collected via cookies and server logs as described in Section 8.

2.6 Communications Data — We retain records of all communications between you and nos12, including live chat transcripts, WhatsApp messages directed to our support number, and email correspondence. These records are retained for dispute resolution and service quality purposes.

2.7 Preference & Marketing Data — Where you have opted in to receive promotional communications, we record your stated preferences (preferred game categories, preferred deposit method, language preference) to personalise the promotions we send you. You may withdraw this consent at any time via your account settings.

nos12 collects Personal Data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact our support team, or participate in a promotion.
• Automatically via the Platform — through cookies, web beacons, server logs, and similar tracking technologies operating in the background of every Platform session. See Section 8 for full details.
• From Third-Party Payment Processors — our payment partners (covering Indonesian bank transfers and e-wallet transactions) transmit transaction confirmation data and status updates to our platform in real time. We receive only the data elements necessary to confirm or decline a transaction; we do not receive your full bank login credentials.
• From KYC Verification Providers — our identity verification partner returns a pass/fail result and a verified-name confirmation to nos12 upon completion of document review. The underlying document images are held by the KYC provider under their own data protection obligations.
• From Publicly Available Sources — in certain fraud investigation scenarios, nos12 may consult publicly available records (for example, company registries or court records) to verify a Player's identity or to investigate suspected prohibited conduct.

nos12 processes your Personal Data only for the following specific, defined purposes:

nos12 processes your Personal Data on one or more of the following lawful bases:

• Contractual Necessity: Processing that is required to perform the contract between you and nos12 — including account creation, deposit and withdrawal processing, game access, and customer support. Without this processing, nos12 cannot provide the services you have requested.
• Legal Obligation: Processing required to comply with applicable legal obligations, including anti-money laundering regulations, identity verification requirements, and lawful authority requests. nos12 cannot waive these obligations at a Player's request.
• Legitimate Interests: Processing carried out for nos12's legitimate business interests — including fraud detection, security monitoring, responsible gaming oversight, and Platform analytics — where those interests are not overridden by your privacy rights. nos12 conducts a proportionality assessment before relying on this basis.
• Consent: Where nos12 relies on your consent as the legal basis (primarily for personalised marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Consent withdrawal does not affect your account status or your access to nos12 services.

nos12 shares your Personal Data only where sharing is strictly necessary for a defined purpose and is governed by a written agreement with the receiving party. The categories of third parties with whom nos12 shares data are as follows:

• Payment Processors: Indonesian bank transfer aggregators and e-wallet payment gateways receive the transaction data elements necessary to initiate, confirm, and settle deposit and withdrawal transactions. These processors are bound by their own regulatory obligations under Indonesian financial services regulation.
• KYC & Identity Verification Providers: Our identity verification partner receives the documents you submit for KYC review and returns a verified-identity confirmation to nos12. The partner is contractually prohibited from using your documents for any purpose other than identity verification on nos12's behalf.
• Game Content Providers: Game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe) receive an anonymised session token and wager data necessary to deliver game content and to calculate outcomes. They do not receive your name, email, or financial account details.
• Customer Support Platforms: Our live chat and WhatsApp support infrastructure providers receive communication data necessary to operate the support channel. These providers are contractually bound to process data solely for the purpose of delivering support services to nos12.
• Legal & Regulatory Authorities: nos12 will disclose Personal Data to competent governmental or regulatory authorities where required by law, by lawful court order, or where nos12 has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or another serious legal violation.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of nos12's assets, Player Personal Data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and of any material change to this Privacy Policy that results from it, at least 30 days in advance.

nos12 retains your Personal Data for as long as is necessary for the purpose for which it was collected, subject to the minimum retention periods set out below:

Upon expiry of the applicable retention period, nos12 will securely delete or irreversibly anonymise your Personal Data. Where anonymisation is applied, the resulting data no longer constitutes Personal Data and may be retained indefinitely for aggregate statistical analysis.

nos12 uses cookies and similar tracking technologies to operate the Platform effectively and to improve the experience for every Player. The following categories of cookies are in use:

• Strictly Necessary Cookies: These are essential to the Platform's core functionality — maintaining your authenticated login session, remembering your cart or active game session, and delivering security features. These cookies cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: These cookies collect anonymised data about how Players navigate the Platform — which pages are visited most frequently, where sessions originate, and how long Players spend on each section. This data informs Platform improvement decisions. No personally identifying information is transmitted via these cookies.
• Functionality Cookies: These cookies remember your stated preferences — such as preferred language display, previously used deposit method, and notification settings — so that you do not need to reconfigure them on each visit.
• Targeting & Personalisation Cookies: Where you have opted in to personalised promotions, these cookies allow nos12 to present promotions relevant to your gaming activity and stated preferences. These cookies are activated only upon your explicit consent and can be withdrawn via your account preferences at any time.

Most browser settings include controls to manage, restrict, or delete cookies. Disabling strictly necessary cookies will prevent you from logging in to your nos12 account. nos12 does not use third-party advertising cookies or share cookie data with external marketing networks.

nos12 implements a layered security architecture to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. The principal security measures in place include:

• 256-Bit SSL/TLS Encryption in Transit: All data transmitted between your device and the nos12 Platform is encrypted using 256-bit SSL/TLS protocols. This applies to all sessions — login, gameplay, deposit, withdrawal, and support interactions.
• AES-256 Encryption at Rest: Personal Data and financial records stored on nos12's servers are encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the encrypted data and are rotated on a defined schedule.
• Access Controls: Access to Personal Data within nos12's internal systems is granted on a strict need-to-know basis. All internal access is logged, audited, and subject to periodic review. Former employees' access is revoked immediately upon termination.
• Two-Factor Authentication: nos12 supports two-factor authentication (2FA) for Player accounts. nos12 strongly recommends enabling 2FA via your account settings to add an additional layer of protection against unauthorised access.
• Penetration Testing & Security Audits: The nos12 Platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a data breach that poses a risk to Players' Personal Data, nos12 will notify affected Players and relevant authorities within 72 hours of becoming aware of the breach, in accordance with applicable incident response obligations.

As a nos12 Player, you hold the following rights with respect to your Personal Data. nos12 will respond to any rights request within 30 calendar days of receipt. Requests may be submitted via live chat, WhatsApp, or email to [email protected].

Please note that certain rights are subject to exceptions — for example, the right to erasure cannot override nos12's mandatory legal obligation to retain financial transaction records for a minimum of 5 years under anti-money laundering regulations. nos12 will clearly explain any applicable exception when responding to your rights request.

The nos12 Platform is strictly for adults aged 21 years and older. nos12 does not knowingly collect Personal Data from any person under the age of 21. The minimum age requirement of 21+ is enforced through mandatory date-of-birth verification at registration and through documentary KYC verification prior to any withdrawal.

If nos12 discovers or has reasonable grounds to believe that Personal Data has been submitted by a person under the age of 21, the following steps will be taken immediately:

1. The account will be suspended without prior notice.
2. All associated Personal Data will be flagged for review and deleted upon confirmation of underage status.
3. Any deposits made will be returned to the source payment method. No winnings generated during the underage period will be paid.
4. The incident will be logged and reviewed as part of nos12's age-verification audit process.

If you are a parent or guardian and believe that your child under 21 has created a nos12 account or submitted Personal Data to the Platform, please contact nos12 support immediately via live chat or at [email protected]. nos12 will investigate and respond within 24 hours.

nos12's primary data processing infrastructure is hosted in data centres selected for their security standards, geographic redundancy, and compliance posture. In the course of providing the nos12 service, your Personal Data may be transferred to and processed in jurisdictions outside Indonesia — for example, where a third-party game studio or KYC verification partner operates its servers.

Whenever Personal Data is transferred internationally, nos12 ensures that adequate safeguards are in place, including:

• Written data processing agreements with all Third-Party Processors that include binding data protection obligations equivalent to those applicable in Indonesia.
• Transfer only to processors operating in jurisdictions that maintain an adequate level of data protection, as assessed by nos12's data protection team.
• Contractual clauses that require the recipient to notify nos12 of any data breach affecting transferred Personal Data within 24 hours of discovery.

nos12 does not transfer Personal Data to jurisdictions where it would be accessible to government surveillance programs without judicial oversight, except where legally compelled to do so by a lawful authority request.

nos12 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When a material amendment is made — meaning an amendment that significantly affects the way nos12 collects, uses, or shares your Personal Data — nos12 will:

• Publish the updated Privacy Policy on this page with a revised "Last Updated" date at the top of the document.
• Send a notification to the email address registered to your nos12 account at least 14 days before the amendment takes effect.
• Display a prominent notice on the nos12 Platform for at least 14 days following the update.

Non-material amendments — such as corrections of typographical errors, clarifications of existing language, or updates to contact details — may be published without advance notice and take effect immediately.

Your continued use of the nos12 Platform after the effective date of any amendment to this Privacy Policy constitutes your acceptance of the updated Policy. If you do not accept the amended Policy, you must cease using the Platform and contact nos12 support to close your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way nos12 processes your Personal Data, please contact the nos12 support team through any of the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line so that your enquiry is routed directly to our data protection team.
• Live Chat: Available 24 hours a day, 00:00 to 23:59 WIB, every day of the year — accessible directly via the nos12 Platform.
• WhatsApp: +62 811 NOS12 — available 08:00 to 24:00 WIB daily. Please note that WhatsApp is a support channel; do not transmit sensitive documents such as KYC files via WhatsApp — use the secure in-platform upload facility instead.

nos12 aims to acknowledge all privacy-related enquiries within 24 hours and to provide a full substantive response within 30 calendar days. Where a request is particularly complex or voluminous, nos12 may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it before the initial 30-day period expires.