Privacy Policy

1Definitions

The following definitions apply throughout this Privacy Policy:

• "apiwin" / "we" / "us" / "our" — the operator of the online gaming and sports-betting platform accessible at apiwin.cam and all associated services.
• "Player" / "User" / "you" / "your" — any individual who visits, registers on, or interacts with the apiwin platform in any capacity.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, telephone number, residential address, payment details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, organization, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — apiwin, as the entity that determines the purposes and means by which Personal Data is processed.
• "Third Party" — any natural or legal person that is not the Player or apiwin, including payment processors, game providers, analytics vendors, and regulatory bodies.
• "KYC Data" — identity and address verification documents submitted by a Player in fulfilment of apiwin's Know Your Customer obligations, including national identity cards, selfie images, and proof-of-address documents.
• "Cookies" — small text files placed on a Player's device by the apiwin platform or its third-party partners for the purposes described in Clause 9 of this policy.

2Data We Collect

apiwin collects Personal Data across several categories, depending on how you interact with the platform:

2.1 Registration Data

When you create an apiwin Account, we collect the information you provide, which includes your full legal name, date of birth, email address, mobile telephone number, residential address in Indonesia, and chosen username.

2.2 Identity Verification (KYC) Data

To activate withdrawal functionality and comply with responsible gaming requirements, we collect copies of your Indonesian National Identity Card (KTP), proof of residential address, and selfie verification images. Where enhanced due diligence is required, we may also collect documentation evidencing your source of funds.

2.3 Financial Data

We collect records of all financial transactions conducted through your Account, including deposit amounts, withdrawal requests, bonus credits, wagering history, and the payment method identifiers (bank account numbers, e-wallet phone numbers) associated with transactions. We do not store full payment card numbers on our servers.

2.4 Usage and Behavioral Data

We automatically collect technical and behavioral data when you use the platform, including:

• IP address and approximate geographic location (city-level)
• Device type, operating system, and browser version
• Pages visited, game sessions played, betting patterns, and session duration
• Timestamps of login and logout events
• Referral source (the website or link that directed you to apiwin)

2.5 Communications Data

We retain records of communications between you and our support team, including live chat transcripts, email correspondence, and WhatsApp messages, for quality assurance, dispute resolution, and compliance purposes.

2.6 Responsible Gaming Data

Where you voluntarily set deposit limits, request cooling-off periods, or submit a self-exclusion request, we record and maintain those preferences as part of our responsible gaming obligations.

3How We Collect Data

apiwin collects Personal Data through the following channels:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal, participate in promotions, or contact our support team.
• Automatically through the platform: Via server logs, cookies, and session-tracking technologies that record usage data as described in Clause 9.
• From payment processors: When a payment is initiated via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, or other partner channels, transaction confirmation data is shared with us by those providers.
• From identity verification partners: Where we use third-party KYC verification tools, those partners may share verification outcomes and risk scores with us.
• From fraud-detection systems: Automated risk management systems may flag accounts and provide signals based on behavioral patterns, which we may cross-reference with data already held.

4Purposes of Processing

We process your Personal Data only for legitimate, clearly defined purposes. The table below summarizes the primary processing activities:

apiwin does not sell your Personal Data to any third party and does not use your data for profiling purposes unrelated to the operation o f the platform or responsible gaming safeguards.

5Legal Basis for Processing

apiwin processes Personal Data on one or more of the following legal bases:

• Contract Performance: Processing is necessary to deliver the services you have requested through your apiwin Account, including account creation, bet settlement, and payment processing.
• Legal Obligation: Processing is required to comply with applicable anti-money laundering (AML) regulations, responsible gaming legislation, and other legal duties imposed on apiwin as a licensed operator.
• Legitimate Interest: Processing is necessary for our legitimate interests in preventing fraud, ensuring platform security, improving user experience, and maintaining the integrity of our services, provided those interests are not overridden by your fundamental rights.
• Consent: Where we process data for marketing communications or optional analytics features, we do so only with your explicit opt-in consent, which you may withdraw at any time.

6Data Sharing & Disclosure

apiwin does not sell, rent, or trade your Personal Data. However, we may share data with carefully selected third parties in the following circumstances:

6.1 Service Providers

We engage third-party service providers to perform functions on our behalf, including payment processing (bank and e-wallet providers), identity verification (KYC partners), customer support platforms, cloud hosting providers, and cybersecurity vendors. These partners process your data only under strict contractual obligations and solely for the purposes we authorize.

6.2 Game and Content Providers

Your gameplay data is shared with licensed game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others) to the extent necessary to deliver game sessions and calculate outcomes. These providers are bound by confidentiality and data protection obligations.

6.3 Regulatory and Legal Authorities

We may disclose your Personal Data to regulatory authorities, law enforcement agencies, or courts where required by applicable law, court order, or regulatory instruction. This includes disclosures for the purposes of preventing money laundering, combating fraud, or protecting public safety.

6.4 Corporate Transactions

In the event of a merger, acquisition, asset sale, or corporate restructuring involving apiwin, your Personal Data may be transferred to the successor entity, subject to equivalent privacy protections.

7Data Retention

apiwin retains your Personal Data for as long as necessary to fulfil the purposes outlined in this policy, or as required by applicable legal and regulatory obligations. Our standard retention periods are:

• Active Accounts: All data is retained while your Account remains active and in good standing.
• Closed Accounts (voluntary): Registration and transactional data are retained for a minimum of six (6) years following account closure to comply with financial record-keeping and AML requirements. KYC documents are retained for five (5) years post-closure.
• Closed Accounts (violation): Where an account is closed for breach of Terms, fraud, or suspicious activity, all data is retained indefinitely for security, legal defense, and regulatory reporting purposes.
• Marketing Communications: If you unsubscribe from promotional emails, your contact data is immediately suppressed from marketing lists but retained in a do-not-contact register to honor your opt-out preference.
• Communications Logs: Live chat, email, and WhatsApp support transcripts are retained for three (3) years for quality assurance and dispute resolution purposes.

At the end of the applicable retention period, Personal Data is securely deleted or anonymized such that it can no longer be attributed to an identifiable individual.

8Security Measures

apiwin implements industry-standard technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 (Transport Layer Security). Sensitive data at rest, including KYC documents and payment details, is encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Employees and contractors with access to customer data are bound by confidentiality agreements and undergo regular security training.
• Infrastructure Security: Our servers are hosted in secure data centers with 24/7 monitoring, intrusion detection systems, and redundant backup protocols. Regular penetration testing and vulnerability assessments are conducted by independent security firms.
• Payment Security: We do not store full credit or debit card numbers. Payment processing is delegated to PCI-DSS compliant payment gateways that tokenize payment data.
• Account Security: Player accounts are protected by password authentication. We strongly recommend using a unique, complex password and enabling any additional security features offered through your account settings.

9Cookies & Tracking Technologies

The apiwin platform uses cookies and similar tracking technologies to enhance user experience, analyze site traffic, and deliver personalized content. A cookie is a small text file stored on your device that allows us to recognize you on return visits.

Types of Cookies We Use:

• Essential Cookies: Required for the platform to function properly, including session management, login authentication, and secure transaction processing. These cookies cannot be disabled without preventing core platform functionality.
• Performance Cookies: Collect anonymous usage data to help us understand how visitors interact with the platform, which pages are most popular, and where users encounter errors. This data is used solely to improve site performance.
• Functional Cookies: Remember your preferences, such as language settings, timezone, and display options, to provide a more personalized experience.
• Analytics Cookies: Used by third-party analytics platforms to generate aggregated reports on visitor behavior, traffic sources, and conversion funnels. No personally identifiable information is shared with analytics providers.

Managing Cookies:

Most browsers allow you to view, manage, and delete cookies through their settings menu. However, disabling essential cookies will prevent you from accessing key platform features, including account login and payment processing. Disabling performance or functional cookies may degrade your user experience but will not prevent core platform use.

10Your Rights

Subject to applicable data protection law, you hold the following rights with respect to your Personal Data:

• Right of Access: You may request confirmation of whether apiwin is processing your Personal Data and obtain a copy of that data in a structured, commonly used format.
• Right of Rectification: You may request correction of inaccurate or incomplete Personal Data. Many account details can be updated directly through your account settings.
• Right of Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (for consent-based processing). This right is subject to legal retention obligations that require us to maintain certain records for specified periods.
• Right to Restriction of Processing: You may request that we suspend processing of your data while a dispute about accuracy or lawfulness is being resolved.
• Right to Data Portability: Where processing is based on consent or contract performance and carried out by automated means, you may request a machine-readable export of your data.
• Right to Object: You may object to processing based on legitimate interest grounds, including profiling and direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time by using the unsubscribe link in emails or contacting support.

To exercise any of these rights, please contact our Data Protection Officer at [email protected] with "Data Privacy Request" in the subject line. We will respond to all requests within thirty (30) days.

11Protection of Minors

The apiwin platform is strictly prohibited to individuals under the age of 21. We do not knowingly collect or process Personal Data from minors. Where we become aware that an individual under 21 has registered an account, we will immediately suspend the account, forfeit all balances, and delete all associated Personal Data in accordance with our legal obligations.

If you are a parent or guardian and believe your child has provided Personal Data to apiwin, please contact us immediately at [email protected] so that we can take appropriate action.

12Third-Party Services

The apiwin platform may contain links to third-party websites, services, or applications operated by game providers, payment processors, or affiliate partners. This Privacy Policy applies only to Personal Data processed by apiwin directly. We are not responsible for the privacy practices of third-party sites, and we encourage you to review the privacy policies of any external service before providing them with your information.

When you initiate a payment through BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja, you will be redirected to that provider's secure payment interface. Your interaction with that provider is governed by their privacy policy, not ours.

13International Data Transfers

apiwin operates an internationally licensed platform with technical infrastructure hosted across multiple jurisdictions. Your Personal Data may be transferred to, stored on, and processed by servers and service providers located outside Indonesia. Where such transfers occur, apiwin ensures that equivalent data protection standards are maintained through contractual safeguards, standard data protection clauses, or other legally recognized transfer mechanisms.

By using the apiwin platform, you acknowledge and consent to the international transfer of your data as described in this clause.

14Policy Amendments

apiwin reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. Material changes will be communicated to registered Players via email notification to the address on file at least seven (7) days before the revised policy takes effect. Continued use of the platform following the effective date constitutes acceptance of the amended policy.

The current version of this policy is always available at apiwin.cam/privacy-policy and is identified by the Effective Date at the top of this page. We recommend reviewing this policy periodically to stay informed of how your data is protected.

15Contact & Data Inquiries

If you have questions, concerns, or complaints regarding this Privacy Policy or how your Personal Data is processed, please contact our Data Protection Officer through any of the following channels:

• Email: [email protected] (Subject line: "Privacy Inquiry" or "Data Protection Request")
• Live Chat: Available 24/7 on every page of the platform — our Indonesian-speaking support team can escalate privacy matters to the Data Protection Officer
• VIP WhatsApp: +62 812 3456 7890 (for urgent privacy concerns)

We aim to respond to all privacy inquiries within four (4) business hours during standard operational periods (WIB, UTC+7) and within forty-eight (48) hours for complex requests requiring technical investigation or legal review.

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.