Privacy Policy — nobu98

nobu98 ("nobu98", "the Platform", "we", "us", "our") is committed to protecting the privacy of every person who interacts with our platform. This Policy sets out the categories of personal data we collect, the purposes for which that data is processed, the legal bases on which we rely, and the rights available to you as a data subject.

nobu98 primarily serves players located in Indonesia. We recognise that Indonesian players — particularly those using international-brand betting platforms — place high value on discretion and data security, and we have designed our data practices accordingly. This Policy is written in plain, accessible English so that every player can understand exactly how their information is handled.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform, and our Responsible Gaming policy, which outlines how we use behavioural data to protect player welfare.

The following definitions apply throughout this Policy:

nobu98 collects Personal Data across the following categories. We collect only the minimum data required to deliver the service, meet our legal obligations, and protect the integrity of the Platform.

3.1 Identity & Registration Data

When you register a nobu98 account, we collect:

Date of birth is collected specifically to verify that you meet the 21+ age requirement. We do not collect your full residential address at registration unless required for enhanced KYC.

3.2 Identity Verification (KYC) Data

Prior to your first withdrawal, we collect:

KYC documents are processed by our compliance team and, in some cases, by a licensed third-party KYC verification provider. Documents are stored encrypted and access is restricted to authorised personnel only.

3.3 Financial & Transaction Data

We record all financial activity on your account, including deposit amounts, withdrawal requests, payment methods used (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, Mastercard, USDT), transaction timestamps, and net win/loss positions. We do not store full card numbers or e-wallet PINs — payment tokenisation is handled by the respective payment providers.

3.4 Betting & Gaming Activity Data

We log all betting and gaming activity on your account, including markets selected, stakes placed, odds accepted, game sessions played, session durations, and aggregate win/loss history. This data is used to operate the Platform, settle bets accurately, and monitor for responsible gaming signals.

3.5 Technical & Device Data

Technical data is collected automatically when you access the Platform. It is used for security monitoring, fraud detection, and platform performance optimisation. IP address data is also used to detect access from Restricted Territories.

3.6 Communication Data

We retain records of all communications between you and nobu98 support staff, including live chat transcripts and email correspondence. This data is used for quality assurance, dispute resolution, and staff training purposes.

nobu98 collects Personal Data through the following channels:

• Directly from you: During account registration, KYC submission, deposit and withdrawal requests, customer support interactions, and any voluntary submissions (e.g., responsible gaming self-assessments).
• Automatically: Via server logs, cookies, and similar tracking technologies when you access or navigate the nobu98 Platform.
• From third-party processors: Payment confirmation data is received from payment providers (e.g., BCA Virtual Account confirmation, OVO transaction status). KYC results may be received from our licensed verification partner. Fraud signals may be received from our fraud-detection service provider.

nobu98 processes your Personal Data for the following purposes, each supported by a corresponding legal basis:

nobu98 does not sell, rent, or trade your Personal Data to third parties for their own commercial use. We share data with the following categories of recipient only to the extent strictly necessary for the stated purpose:

• Payment Processors: Indonesian bank transfer networks (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja), and international card networks (Visa, Mastercard) receive the transaction data required to process your deposit or withdrawal. These providers operate under their own privacy policies.
• KYC & Compliance Providers: Where nobu98 uses a licensed third-party identity verification service, your KYC documents are transmitted to that service under a data processing agreement that prohibits use of your data for any purpose other than identity verification on behalf of nobu98.
• Fraud Detection Services: Anonymised or pseudonymised technical signals (IP address, device fingerprint, behaviour patterns) may be shared with fraud prevention partners to protect the Platform and its players from financial crime.
• Cloud Infrastructure Providers: nobu98's platform data is hosted on encrypted cloud servers. Our infrastructure provider has access to hosting environments but operates under strict data processing contracts and has no rights to use player data independently.
• Legal & Regulatory Authorities: nobu98 will disclose Personal Data to law enforcement agencies, courts, or regulators where required to do so by applicable law, court order, or in connection with a legitimate investigation of financial crime.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of nobu98's assets, player data may be transferred to the acquiring entity, subject to equivalent privacy protections.

nobu98 retains Personal Data for as long as necessary to fulfil the purposes described in this Policy and to meet our legal obligations. The following retention schedule applies:

• Account & Registration Data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in accordance with AML record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission, or from the date of the last transaction on the account, whichever is later.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Betting & Gaming Activity Logs: Retained for a minimum of three (3) years for dispute resolution purposes.
• Customer Support Communications: Retained for two (2) years from the date of the last communication in a support thread.
• Technical & Log Data: Retained for up to twelve (12) months for security and fraud monitoring purposes, then deleted or anonymised.
• Marketing Consent Records: Retained for the duration of the account relationship and for one (1) year following opt-out, as evidence of consent management.

Following the expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised such that re-identification is not possible.

nobu98 implements a multi-layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit TLS/SSL encryption on all data transmitted between your device and our servers.
• At-rest encryption for all stored Personal Data and KYC documents.
• Role-based access controls limiting data access to authorised personnel with a documented operational need.
• Two-factor authentication (2FA) on all internal administrative systems.
• Regular penetration testing and vulnerability assessments conducted by independent security firms.
• Incident response procedures that require notification of affected players within 72 hours in the event of a confirmed data breach that poses a risk to their rights and freedoms.

nobu98 uses cookies and similar browser-based technologies to improve your experience on the Platform. The following cookie categories are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without disrupting your use of the Platform.
• Functional Cookies: Store your preferences such as language settings, last-visited page, and preferred display options to personalise your experience on return visits.
• Performance & Analytics Cookies: Collect anonymised data about how users navigate the Platform — which pages are visited most, where errors occur, and how load times compare across devices. This data is used to improve Platform stability and usability.

You may configure your browser to refuse all cookies or to alert you when cookies are being sent. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features.

As a Data Subject, you have the following rights with respect to your Personal Data held by nobu98. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". We will respond to all verified requests within 30 calendar days.

Please note that some rights are subject to exceptions under applicable law. For example, nobu98 cannot delete transaction records that are required by law to be retained for AML compliance purposes. Where a right cannot be fully exercised, we will explain the reason in our response.

If you are a parent or guardian and have reason to believe that a minor in your household has registered a nobu98 account, please contact us immediately at [email protected]. We take underage gambling seriously and will act swiftly on any credible report.

nobu98 operates internationally, and your Personal Data may be processed or stored on servers located outside Indonesia. Wherever data is transferred to a jurisdiction that does not have a data protection framework equivalent to international best practice, nobu98 implements appropriate safeguards, including:

• Data processing agreements with all third-party processors that include standard contractual clauses aligned with international data transfer requirements.
• Encryption of all data in transit and at rest, regardless of the jurisdiction in which it is stored.
• Restrictions on sub-processing that require prior written approval from nobu98 and equivalent contractual obligations on the sub-processor.

The nobu98 Platform may contain content or functionality provided by third-party services, including live game studios (such as Pragmatic Play, Evolution Gaming, Microgaming, Pocket Games Soft, and Spribe) and payment infrastructure providers. When you interact with these third-party components, some data may be processed directly by that third party under their own privacy policy.

nobu98 is not responsible for the privacy practices of third-party game studios or payment providers beyond the contractual obligations we have imposed on them as processors. We encourage you to review the privacy policies of any third-party service whose content you access through our Platform.

nobu98 reserves the right to update this Privacy Policy at any time. Where a material change is made — such as a new category of data collection, a new third-party processor, or a change in retention periods — we will notify registered players by posting a notice on the Platform and, where practicable, sending an email to the registered account address.

The effective date and version number at the top of this Policy identify the current operative version. Your continued use of the nobu98 Platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you object to any change, you may close your account in accordance with the account closure process described in our Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a concern about how your Personal Data is being handled, please contact the nobu98 data team through the following channel: