Privacy Policy — vip33

01 Introduction & Scope

vip33 is an internationally licensed online betting and gaming platform that serves a primary user base in Indonesia. We operate this platform as an English-language service, and we are committed to handling all personal data entrusted to us with the highest standards of care, transparency, and security.

This Policy applies to all personal data collected through the vip33 website (https://vip33.cam), any mobile-optimised versions of the site, and any associated communications between vip33 and its registered users — including support emails, promotional messages, and account notifications.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of your overall agreement with vip33. In the event of a conflict between this Policy and the Terms & Conditions on matters of data privacy, this Policy prevails.

02 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, either on its own or in combination with other data held by vip33.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction, whether by automated or manual means.
• "Data Controller" — vip33, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — a third party that processes Personal Data on vip33's behalf under a contractual data-processing agreement, such as KYC verification providers, payment processors, and cloud infrastructure providers.
• "KYC" — Know Your Customer: the identity and age verification process required before vip33 processes any withdrawal from a User's account.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a User's agreement to the processing of their Personal Data for a stated purpose.
• "Sensitive Personal Data" — a subset of Personal Data that warrants heightened protection, including government-issued identity document numbers, financial account details, and data relating to health conditions (e.g., problem gambling disclosures).

03 Data We Collect

The categories of personal data vip33 collects from or about you are set out in the table below, along with the context in which each category arises:

04 How We Collect Data

vip33 collects personal data through the following channels:

• Direct submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or adjusting your responsible gaming settings.
• Automated technical collection: Data generated automatically when you visit or interact with the vip33 platform, including IP addresses, device identifiers, session logs, and clickstream data collected via server logs and first-party analytics tools.
• Third-party verification providers: Identity and age verification data returned from KYC providers in response to the documents you submit. These providers do not originate the data — they verify it against authoritative sources.
• Payment processors: Transaction confirmation data (reference numbers, timestamps, status codes) returned by Indonesian bank transfer gateways and e-wallet APIs following a deposit or withdrawal instruction.
• Fraud and risk systems: Risk-scoring signals generated by third-party fraud-detection engines based on behavioural patterns during your platform session, such as unusual login locations or atypical transaction velocity.

05 Purposes of Processing

vip33 processes your personal data for the following specific, documented purposes:

1. Account creation and management: To establish and maintain your registered account, authenticate your identity at login, and manage your account preferences and responsible gaming settings.
2. Identity and age verification (KYC): To confirm that you are at least 21 years of age, a legitimate account holder, and not subject to any self-exclusion or regulatory restriction that would prevent you from using the Platform.
3. Payment processing: To facilitate deposits from and withdrawals to your registered Indonesian bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP, Bank Danamon) and e-wallet services (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain accurate financial records.
4. Platform security and fraud prevention: To detect, investigate, and prevent unauthorised access, account takeover, money laundering, bonus abuse, collusion, and other fraudulent or prohibited conduct.
5. Regulatory compliance: To fulfil our obligations under applicable international gaming licensing conditions, anti-money laundering (AML) requirements, and Know Your Customer (KYC) obligations.
6. Customer support: To respond to your enquiries, resolve complaints, and provide assistance in connection with your account, deposits, withdrawals, or any aspect of the Platform.
7. Responsible gaming: To monitor account activity for indicators of problem gambling, administer limit and self-exclusion tools you activate, and comply with our responsible gaming obligations.
8. Platform improvement and analytics: To understand how users interact with vip33, identify usability issues, and improve the platform's performance, design, and feature set. Analytics data is aggregated and does not identify individual users in reports.
9. Promotional communications: Where you have provided explicit consent, to send you information about bonuses, seasonal promotions (including Idul Fitri and Ramadhan offers), and platform updates. You may withdraw this consent at any time.

06 Legal Basis for Processing

vip33 processes personal data on the following legal bases, each mapped to the processing purposes described in Section 5:

• Contractual necessity: Processing required to fulfil our obligations to you under the Terms & Conditions — including account management, payment processing, KYC verification, and customer support (Purposes 1, 2, 3, 6).
• Legitimate interests: Processing necessary for vip33's legitimate business interests, including fraud detection, platform security, AML monitoring, and responsible gaming oversight, where those interests are not overridden by your fundamental privacy rights (Purposes 4, 7, 8).
• Legal obligation: Processing required by applicable licensing conditions, AML regulations, and Know Your Customer obligations imposed on vip33 by its international operating licence (Purpose 5).
• Consent: Processing for promotional and marketing communications, which is conducted only where you have given explicit, informed consent and which you may withdraw at any time without affecting your account status (Purpose 9).

07 Data Sharing & Disclosure

vip33 does not sell, rent, or transfer your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances, and only to the minimum extent necessary for each purpose:

• KYC and identity verification providers: To verify your identity, age, and address against authoritative databases. These providers operate under data-processing agreements with vip33 and are contractually prohibited from using your data for any purpose other than the verification task.
• Payment processors and banking partners: To execute deposit and withdrawal transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja. Relevant financial data is shared only as required to complete the specific transaction.
• Fraud detection and risk services: To identify patterns of fraudulent, abusive, or money-laundering activity. Risk signals may be shared with industry-wide fraud-prevention networks on an anonymised or pseudonymised basis.
• Cloud infrastructure and hosting providers: vip33 uses cloud infrastructure to host the platform. Infrastructure providers process data on our behalf under strict data-processing agreements and have no independent right to access your data.
• Game content providers: Where required for game integrity or jackpot verification, limited transaction identifiers may be shared with game providers (including Pragmatic Play, Evolution Gaming, Microgaming, Spribe). No personally identifiable contact or financial data is included in such sharing.
• Legal and regulatory authorities: Where required by a valid legal order, regulatory directive, or law enforcement request under applicable jurisdiction. vip33 will, where legally permitted to do so, notify you of such disclosure.
• Business transfer: In the event of a merger, acquisition, or sale of substantially all of vip33's assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Users will be notified of any such transfer and given the opportunity to close their account if they do not wish their data to be transferred.

08 Data Retention

vip33 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

Once the applicable retention period expires, data is securely deleted or irreversibly anonymised. Where anonymisation is not technically feasible, data is archived in an encrypted, access-restricted state until secure deletion is possible.

09 Security Measures

vip33 implements a layered security architecture designed to protect your personal data against unauthorised access, accidental loss, alteration, and destruction. Our primary technical and organisational measures include:

• Transport encryption: All data in transit is encrypted using TLS 1.3. Downgrade to older protocol versions is disabled at the server level.
• Data at rest: Sensitive personal data stored on vip33 servers is encrypted using AES-256. Encryption keys are managed separately from the encrypted data.
• Password security: Account passwords are hashed using bcrypt with individual per-account salts. Plain-text passwords are never stored or transmitted.
• Two-factor authentication (2FA): Available to all users and strongly recommended. 2FA is mandatory for accounts that have requested elevated withdrawal limits.
• Access controls: Internal access to personal data is granted on a strict need-to-know basis. All internal access is logged and reviewed in regular audits.
• Penetration testing: The vip33 platform undergoes regular independent security assessments, including penetration testing and vulnerability scanning.
• Incident response: vip33 maintains a documented data breach response procedure. In the event of a breach materially affecting your personal data, we will notify you as promptly as operationally possible and in accordance with applicable regulatory requirements.

10 Cookies & Tracking Technologies

vip33 uses cookies and similar technologies to support platform functionality and, where you have consented, to understand how users interact with the Platform. We do not use third-party advertising cookies, cross-site tracking pixels, or retargeting tags.

The cookies vip33 uses fall into the following categories:

• Strictly necessary cookies: Required for the platform to function — including session authentication tokens, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Remember your preferences such as your selected language setting and responsible gaming alert configurations. These do not track activity across other websites.
• Analytical cookies: Where you have consented, first-party analytics cookies collect aggregated, anonymised data about page views, navigation paths, and session duration. This data helps us improve the platform. No individual-level behavioural profiles are created from analytical data.
• Security cookies: Support fraud-detection systems by identifying anomalous session behaviour, unusual login patterns, and multiple-account indicators.

You may manage cookie preferences through your browser settings. Blocking all cookies will impair platform functionality, including the ability to log in.

11 Your Rights Over Your Personal Data

Subject to applicable law and our legal retention obligations, you hold the following rights over your personal data held by vip33:

• Right of access: You may request a copy of all personal data we hold about you. We will respond within 30 days of receiving a verified request.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some corrections (e.g., changes to your legal name) may require supporting documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where we no longer have a legitimate purpose or legal obligation to retain it. Note that AML and KYC obligations require us to retain certain data for defined periods even after account closure.
• Right to restriction: You may request that we restrict processing of your data to storage only, pending resolution of a dispute about its accuracy or our legal basis for processing it.
• Right to data portability: You may request a structured, machine-readable copy of the personal data you have provided to vip33, where processing is based on consent or contractual necessity.
• Right to object: You may object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, please contact our support team at [email protected]. We will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days. We may need to verify your identity before processing a data request.

12 Minors

vip33 is strictly an adults-only (21+) platform. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process. If vip33 discovers that personal data has been collected from a person under 21, that account will be suspended immediately, all data will be deleted to the extent legally permissible, and any deposited funds will be returned to the originating payment method.

Parents and guardians who believe their child has registered an account on vip33 should contact our support team immediately at [email protected].

13 International Data Transfers

vip33 operates as an internationally licensed platform. Some of our Data Processors — including cloud infrastructure providers, KYC verification services, and fraud-detection vendors — may be located in, or process data in, jurisdictions outside Indonesia. Where such transfers occur, vip33 ensures that adequate safeguards are in place, including:

• Binding contractual clauses in data-processing agreements that require overseas processors to apply data protection standards equivalent to or exceeding those applicable to vip33.
• Transfers only to jurisdictions that provide a recognised adequate level of data protection under applicable frameworks.
• Regular assessments of processor security posture and compliance with contractual data protection obligations.

No international transfer of personal data is made to a third party for its own marketing, analytics, or commercial purposes. All transfers are strictly limited to operational necessity.

14 Policy Amendments

vip33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, operational procedures, legal obligations, or regulatory environment. Where changes are material, we will provide advance notice via the email address registered to your account and/or via a prominent in-platform notification, with a minimum of seven (7) days before the revised Policy takes effect.

The "Last updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of a revised Policy constitutes your acknowledgement of the changes.

15 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by vip33, please contact us through the following channel. All privacy-related enquiries are handled by our dedicated Data Protection function:

For questions specifically about responsible gaming, self-exclusion, deposit limits, or problem gambling support, please visit our dedicated Responsible Gaming page.