Privacy Policy — ks303

ks303 ("we", "us", "our") operates the online betting and gaming platform accessible at https://ks303.cam. This Privacy Policy describes how we collect, use, store, protect, and share personal data relating to individuals ("you", "your") who visit our website, create an account, or otherwise interact with our services.

ks303 primarily serves English-preference players located across Indonesia — including major cities such as Jakarta, Surabaya, Bandung, Medan, Semarang, and Bali — and our data practices are designed with the expectations of that audience in mind, while remaining consistent with internationally recognized privacy standards.

By accessing the Platform or creating an account, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree, you must not register an account or use the Platform.

This policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, all of which form part of the overall agreement between you and ks303.

The data controller responsible for your personal data is the legal entity operating ks303 under its international gaming license. As data controller, we determine the purposes for which and the manner in which personal data is processed.

For all privacy-related inquiries, requests, and complaints, the designated point of contact is our Data Protection Team, reachable at:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: "Privacy Request — [Your Registered Email]"
• Response time: We aim to respond to all privacy requests within 30 calendar days of receipt.

We collect personal data through several channels: information you provide directly, data generated automatically through your use of the Platform, and data received from third-party service providers. The categories are set out below.

3.1 Data You Provide Directly

3.2 Data Collected Automatically

When you access the Platform, our servers and analytics systems automatically collect the following technical data:

• Device & Browser Data: IP address, browser type and version, operating system, device type (mobile or desktop), screen resolution.
• Usage Data: Pages visited, time spent on each page, links clicked, search queries entered within the Platform, game sessions initiated, bet slips viewed.
• Session Data: Login timestamps, session duration, logout method (manual or timeout), geographic location inferred from IP address (country and city level only — we do not use GPS).
• Cookie Data: See Section 7 for a full breakdown of the cookies we use and how to manage them.

3.3 Data Received from Third Parties

We may receive data about you from the following external sources to supplement or verify the information you have provided:

• KYC/Identity Verification Providers: Results of automated identity checks, document authenticity scores, and age verification outcomes.
• Payment Processors: Transaction status updates, fraud flags, and chargeback notifications from partner banks and e-wallet providers.
• Fraud & AML Screening Services: Risk scores and sanctions/PEP (Politically Exposed Person) screening results.
• Analytics Partners: Aggregated and anonymized audience-segment data used to improve the Platform experience (no individual profiling for advertising purposes).

We use the personal data we collect only for the purposes described below. We do not use your data for any purpose incompatible with these stated purposes without first obtaining your separate consent.

• Account Management: Creating and maintaining your ks303 account, authenticating your login, and managing your account settings and preferences.
• Identity & Age Verification (KYC): Confirming that you are a real person, that you meet the 21+ age requirement, and that you are the legitimate owner of the payment methods linked to your account.
• Payment Processing: Executing deposits and withdrawals in IDR via your chosen bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and maintaining accurate financial records.
• Service Delivery: Providing access to betting markets (football, togel lottery draws, live casino, slots), calculating and paying out winnings, and resolving bet disputes.
• Fraud Prevention & AML Compliance: Detecting, investigating, and preventing fraudulent activity, money laundering, and other financial crimes, in accordance with our licensing obligations.
• Responsible Gaming: Monitoring play patterns to identify potential problem gambling behavior, enforcing player-set limits, and administering self-exclusion requests.
• Customer Support: Responding to inquiries, resolving complaints, and maintaining records of support interactions for quality-assurance purposes.
• Legal & Regulatory Compliance: Meeting our obligations under our international gaming license, including record-keeping, audit cooperation, and reporting to competent authorities where legally required.
• Platform Improvement: Analyzing anonymized usage data to identify bugs, optimize page performance, and develop new features.
• Marketing Communications: Sending promotional emails and in-Platform notifications about bonuses, new games, and seasonal offers — only to players who have not opted out. See Section 10 for opt-out instructions.

Every instance of data processing by ks303 rests on one of the following recognized legal bases:

ks303 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for each purpose.

6.1 Service Providers (Data Processors)

We engage carefully vetted third-party companies to perform specific functions on our behalf. These processors may only use your data under our documented instructions and may not use it for their own independent purposes:

• Payment Processors: Partner banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data needed to execute each payment.
• KYC & Identity Verification Providers: Receive copies of identity documents and selfie images for automated authenticity checks.
• AML Screening Providers: Receive name, date of birth, and nationality to run sanctions and PEP screening.
• Cloud Infrastructure & Hosting Providers: Store encrypted account and transaction data on our behalf in secured data centers.
• Customer Support Platform: Processes live chat and email ticket content to facilitate support interactions.
• Analytics Providers: Receive anonymized, aggregated behavioral data (no name, email, or financial data) for platform optimization.

6.2 Legal & Regulatory Disclosure

We may disclose your personal data to government authorities, law enforcement agencies, financial intelligence units, or our licensing authority where we are required to do so by law, court order, or regulatory direction. Where legally permissible, we will notify you of such a disclosure request before complying; however, in AML-related matters, we are frequently prohibited by law from notifying you that a disclosure has been made.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the successor entity as part of the transaction. We will notify registered players via email at least 14 days before any such transfer takes effect, and your rights under this Privacy Policy will continue to apply.

ks303 uses cookies and similar tracking technologies (local storage, session tokens) to operate the Platform effectively and to understand how it is used. A cookie is a small text file stored on your device by your browser.

Most browsers allow you to refuse cookies or delete existing cookies through their settings menus. Refusing strictly necessary cookies will prevent you from logging in to ks303. Refusing analytics cookies will not affect your ability to use the Platform.

ks303 implements a layered security architecture designed to protect your personal data against unauthorized access, accidental loss, alteration, or destruction. Our technical and organizational measures include:

• Transport Encryption: All data exchanged between your browser and our servers is encrypted using TLS 1.3. We enforce HTTPS on every page and use HSTS headers to prevent downgrade attacks.
• Data-at-Rest Encryption: Sensitive fields — including identity document images, bank account numbers, and KYC results — are stored using AES-256 encryption in access-controlled database environments.
• Access Controls: Internal access to production systems and personal data is governed by the principle of least privilege. Only personnel with a documented need can access identifiable player records, and all access is logged and periodically audited.
• Password Security: Account passwords are stored as salted cryptographic hashes. We never store passwords in plain text and cannot retrieve them — only reset them.
• Penetration Testing: We commission independent security assessments on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach that is likely to pose a risk to your rights, we will notify you and relevant authorities within the timeframes required by our licensing jurisdiction.

We retain personal data for no longer than is necessary for the purposes for which it was collected, subject to the minimum retention periods mandated by our licensing and AML obligations.

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized so that it can no longer be linked to you as an individual.

As a data subject, you have the following rights in relation to your personal data held by ks303. These rights are subject to applicable legal limitations — for example, we cannot delete data that we are legally required to retain under our AML obligations.

To exercise any of the above rights, contact our Data Protection Team at [email protected] with the subject line "Privacy Request — [Your Registered Email]". We will respond within 30 calendar days. We may need to verify your identity before processing certain requests — this is to protect you against unauthorized access to your records.

ks303 operates on infrastructure hosted in data centers outside Indonesia. By using the Platform, you acknowledge that your personal data may be transferred to, stored in, and processed in countries other than Indonesia. These countries may have data protection laws that differ from those in Indonesia.

Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data, including:

• Contractual clauses with third-party processors that impose equivalent data protection obligations.
• Selection of processors that operate in jurisdictions recognized as providing adequate levels of data protection by international standards.
• Technical security measures (encryption in transit and at rest) that apply regardless of the jurisdiction in which data is stored.

If you would like further information about the safeguards applicable to any specific international transfer, please contact our Data Protection Team.

ks303 is strictly an adults-only platform. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes age-verification steps designed to prevent minors from creating accounts.

If we discover or are notified that an account has been registered by a person under 21, we will:

• Immediately suspend and permanently close the account.
• Void all bets placed and forfeit any balance held in the account.
• Securely delete all personal data associated with the account as quickly as our legal obligations permit.
• Report the incident to our licensing authority.

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the features we offer. The current version is always accessible at https://ks303.cam/privacy-policy, and the effective date and version number at the top of the document are updated with each revision.

Where a change is material — meaning it significantly affects your rights or the way we use your data — we will notify you by email to your registered address at least 14 days before the change takes effect. Non -material changes (such as clarifying language or correcting typographical errors) may take effect immediately upon publication.

Your continued use of the Platform after a notified change takes effect constitutes your acceptance of the revised Privacy Policy. If you do not accept the changes, you must stop using the Platform and may request account closure by contacting support.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data we hold about you, please contact our Data Protection Team using the details below:

• Platform: ks303 — https://ks303.cam
• Email: [email protected]
• Subject line format: "Privacy Request — [Your Registered Email Address]"
• Response time: Within 30 calendar days of receipt
• Support hours: 24 hours a day, 7 days a week (WIB, UTC+7)