Privacy Policy — d06h5

In this Privacy Policy, the following terms carry the meanings set out below:

• "Platform" means the d06h5 website accessible at https://d06h5.net, including all sub-pages, mobile-optimised views, and any associated applications operated by d06h5.
• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data — including name, email address, date of birth, device identifiers, and payment account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing — for this Platform, that is d06h5.
• "Data Processor" means any third party that Processes Personal Data on d06h5's behalf under a written data processing agreement.
• "User" / "You" means any individual who accesses the Platform, whether as a registered member or as an anonymous visitor.
• "KYC" means Know Your Customer — the identity, age, and address verification process required before withdrawals are processed.
• "Cookies" means small text files placed on your device by the Platform for session management, analytics, and personalisation purposes.
• "IDR" means Indonesian Rupiah (Rp), the sole base currency of the Platform.

d06h5 acts as the Data Controller in respect of all Personal Data collected from Users of the Platform. As Data Controller, d06h5 determines the purposes for which your Personal Data is collected and the manner in which it is processed, stored, and protected.

All data processing activities carried out by d06h5 are governed by this Privacy Policy. Where d06h5 engages third-party Data Processors — such as payment processors, KYC verification providers, and analytics platforms — those parties operate under binding data processing agreements that restrict their use of your data to the specific purposes for which they have been engaged.

If you have any questions about how your Personal Data is handled, or wish to exercise any of the rights described in Clause 11, you may contact d06h5's data team via the channels set out in Clause 14.

d06h5 collects the following categories of Personal Data, depending on how you interact with the Platform:

d06h5 does not intentionally collect Special Category Data (such as health data, racial or ethnic origin, religious beliefs, or biometric identifiers) from its Users. If any such data is incidentally contained within identity documents submitted during KYC, it is used solely for verification purposes and is not retained beyond the legally required period.

d06h5 collects Personal Data through the following methods:

• Direct Submission: Data you provide when creating an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or completing a survey or promotion entry form.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP addresses, browser fingerprints, session duration, pages visited, and click-path data. This collection occurs through first-party server logs and Cookies as described in Clause 8.
• Third-Party Payment Processors: Transaction confirmation and payment status data received from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• KYC Verification Partners: Identity verification outcomes and document authenticity status returned by licensed KYC service providers following submission of your identity documents.
• Fraud Prevention Systems: Risk signals and device reputation data from fraud detection services used to protect the integrity of the Platform and its members.

d06h5 processes your Personal Data only for the specific, legitimate purposes listed below. We do not process Personal Data in a manner incompatible with these stated purposes without providing prior notice and, where required, obtaining your consent.

• Account Creation and Management: To register your account, verify your identity and age (21+), maintain your account settings, and provide you with access to the Platform's gaming, sportsbook, esports betting, and live casino products.
• Transaction Processing: To process deposits and withdrawals denominated in IDR via local Indonesian bank transfers and e-wallets, and to maintain accurate records of your financial activity on the Platform.
• KYC and Age Verification: To verify that you meet the minimum age requirement of 21 years, confirm your identity, and satisfy our obligations under our international operating licence.
• Anti-Money Laundering (AML) and Fraud Prevention: To monitor transactions and gameplay for unusual patterns, comply with anti-money laundering obligations, and protect both the Platform and its Users from fraudulent activity.
• Customer Support: To respond to your enquiries, resolve account disputes, process complaints, and activate responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion.
• Responsible Gaming Monitoring: To identify behavioural signals that may indicate problem gambling and, where appropriate, proactively offer access to responsible gaming tools or restrict account activity in line with our player protection commitments.
• Platform Improvement: To analyse aggregate usage data, identify technical issues, optimise game performance, and improve the overall user experience on d06h5.
• Marketing Communications: To send promotional offers, bonus announcements, and platform updates to Users who have opted in to receive marketing communications. Marketing is always opt-in and can be withdrawn at any time.
• Legal and Regulatory Compliance: To fulfil d06h5's obligations under applicable international law, respond to lawful requests from regulatory or law enforcement authorities, and defend or assert legal claims.

d06h5 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to deliver the services you have contracted for — including account management, game access, and transaction processing — is carried out on the basis that it is necessary for the performance of the contract between you and d06h5.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations — including KYC verification, AML monitoring, and record-keeping requirements — is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and aggregate analytics is carried out on the basis of d06h5's legitimate interests in operating a safe, fair, and commercially sustainable platform. We balance these interests against your rights and freedoms before relying on this basis.
• Consent: Processing for marketing communications and non-essential Cookies is carried out on the basis of your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

d06h5 does not sell, rent, or trade your Personal Data to any third party for their own independent marketing or commercial purposes. Data sharing is limited strictly to the following categories of recipients and only to the extent necessary for the stated purpose:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to process your deposit or withdrawal transactions.
• KYC Verification Providers: Licensed identity verification partners receive your identity document images and personal details for the sole purpose of verifying your age and identity. These partners operate under binding data processing agreements and are not permitted to use your data for any other purpose.
• Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive pseudonymised session data (such as an internal player ID and stake amounts) necessary to deliver their games and calculate results. They do not receive your full identity or contact data.
• Fraud Prevention and Security Services: Specialist fraud detection providers may receive Technical Data (IP address, device fingerprint, session behaviour) to assess risk signals. No identity documents or payment account details are shared with fraud prevention providers beyond what is technically necessary.
• Regulatory and Law Enforcement Authorities: d06h5 will disclose Personal Data to relevant authorities where required to do so by applicable law, court order, or lawful regulatory request. We will notify affected Users of such disclosures where legally permitted to do so.
• Professional Advisers: Legal counsel, auditors, and compliance consultants may access Personal Data on a strictly need-to-know basis, subject to binding confidentiality obligations.

All third-party Data Processors engaged by d06h5 are required to implement appropriate technical and organisational security measures consistent with applicable data protection standards and the sensitivity of the data shared with them.

d06h5 uses Cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your authenticated session, and — with your consent — analyse usage patterns to improve the platform experience.

You may manage your Cookie preferences at any time through your browser settings. Disabling strictly necessary Cookies will prevent you from logging in to and using the Platform. Disabling analytics and marketing Cookies will not affect your ability to access games, place bets, or process transactions.

d06h5 does not use third-party advertising networks or cross-site tracking technologies that share your browsing behaviour with unrelated external platforms.

d06h5 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following default retention periods apply:

• Account and Identity Data: Retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure, to satisfy AML record-keeping obligations.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years following the completion of the verification process, or five (5) years following account closure, whichever is later.
• Gaming Activity Data: Retained for five (5) years following the last recorded activity on the account. Aggregate, anonymised gaming statistics may be retained indefinitely for platform analytics.
• Customer Support Communications: Retained for three (3) years from the date of the last support interaction, to enable dispute resolution.
• Marketing Preference Data: Retained for the duration of the active account, plus one (1) year following unsubscription or account closure, to maintain accurate suppression lists and demonstrate consent compliance.
• Technical and Log Data: Retained for up to twelve (12) months for security and fraud monitoring purposes, after which it is anonymised or deleted.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with d06h5's data disposal procedures. Anonymised data is not considered Personal Data and may be retained and used for aggregate analytics purposes without restriction.

d06h5 implements a layered set of technical and organisational security measures designed to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. These measures include, but are not limited to:

• Transport Encryption: All data transmitted between your browser and the Platform is encrypted using TLS 1.2 or higher. The Platform enforces HTTPS across all pages and rejects unencrypted HTTP connections.
• Password Security: User passwords are stored as salted cryptographic hashes using industry-standard algorithms. Plain-text passwords are never stored or transmitted by d06h5's systems.
• Two-Factor Authentication (2FA): Registered members are strongly encouraged to enable 2FA via SMS OTP or an authenticator application. This is available at no cost from the Account Security settings within the platform dashboard.
• Access Controls: Access to systems holding Personal Data is restricted to authorised d06h5 personnel on a documented need-to-know basis. All internal access is logged and subject to regular review.
• Infrastructure Security: The Platform's server infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability assessments conducted by qualified security personnel.
• Incident Response: d06h5 maintains a documented data breach response procedure. In the event of a Personal Data breach that poses a risk to affected Users, d06h5 will notify impacted individuals without undue delay.

As a User of the d06h5 Platform, you hold the following rights in respect of your Personal Data. These rights may be exercised at any time by contacting our support team via the channels described in Clause 14:

• Right of Access: You may request a copy of the Personal Data d06h5 holds about you, together with information about the purposes for which it is processed and the categories of third parties with whom it has been shared.
• Right to Rectification: If you believe that any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected. Corrections to identity-related data may require submission of updated documentation.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing), or where the processing is unlawful. This right is subject to our legal retention obligations under AML and financial record-keeping requirements, which may require us to retain certain data regardless of a deletion request.
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that we provide your Personal Data to you in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests at any time on grounds relating to your particular situation. You may also object to the processing of your Personal Data for direct marketing purposes at any time, without providing a reason.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

d06h5 will respond to all valid data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and its reasons within the initial 30-day period. There is no charge for exercising your data rights, unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

The d06h5 Platform is strictly intended for adults aged 21 and above. d06h5 does not knowingly collect Personal Data from any individual under the age of 21. Access to the Platform by minors is prohibited, and we take active steps — including age verification during KYC — to enforce this restriction.

If d06h5 discovers or is notified that Personal Data belonging to an individual under the age of 21 has been collected through the Platform, we will immediately suspend the associated account, delete the relevant data as quickly as operationally possible, and take steps to prevent recurrence. If you believe that a minor has registered an account on d06h5, please notify us immediately via the contact channels in Clause 14.

d06h5 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the operational structure of the Platform. The "Last Reviewed" date at the top of this page will be updated whenever a material change is made.

Where changes are material — affecting the categories of data collected, the purposes of processing, or your rights — d06h5 will notify registered members via email to the address associated with their account at least seven (7) days before the updated policy takes effect. For non-material amendments (such as clarifications, corrections, or additions of new defined terms), changes take effect immediately upon publication.

Your continued use of the Platform after any revised Privacy Policy has taken effect constitutes your acknowledgement of and agreement to the updated terms. If you do not agree with a revised Privacy Policy, you must cease using the Platform and may close your account by contacting our support team.

We encourage you to review this Privacy Policy periodically to remain informed about how d06h5 handles your Personal Data. All previous versions of this Privacy Policy are available on request from our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which d06h5 processes your Personal Data, please contact us through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the Platform. Our support team includes Indonesian-speaking agents available throughout all hours. Response target for data rights enquiries: within 24 hours of initial contact.
• Support Email: [email protected]
• Service Hours: 00:00 – 24:00 WIB (UTC+7) daily, including Indonesian public holidays (Idul Fitri, Nyepi, Indonesian Independence Day, and all gazetted national holidays).

When contacting us about a data rights request, please include your registered username and a description of your request to allow us to locate your account and respond efficiently. We may need to verify your identity before acting on any request that would result in the disclosure or deletion of Personal Data.

For concerns about our data handling practices that cannot be resolved through our internal process, you may escalate the matter to the relevant data protection authority in the jurisdiction applicable to d06h5's international operating licence.