Privacy Policy

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

papafa acts as the Data Controller in respect of the Personal Data collected through the papafa platform. As Data Controller, papafa determines the purposes and means of processing your Personal Data and is responsible for ensuring that such processing complies with this Privacy Policy and applicable data protection standards.

All enquiries regarding how papafa processes your Personal Data, including requests to exercise your data rights, should be directed to our dedicated privacy team using the contact details set out in Clause 16 of this Policy.

papafa collects the following categories of Personal Data in the course of providing its services:

papafa collects Personal Data through the following means:

• Direct Interactions: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, participating in promotions, or contacting our support team.
• Automated Technologies: Technical and Usage Data collected automatically as you navigate the Platform, including through cookies, web beacons, pixel tags, and server-side logging.
• Third-Party Sources: Identity and financial verification data from KYC service providers; fraud-screening data from risk management partners; analytics data from platform analytics tools.
• Payment Processors: Transaction confirmation data from your bank or e-wallet provider, including BCA, BRI, OVO, DANA, GoPay, ShopeePay, and others, strictly limited to what is necessary to process and reconcile your transactions.

papafa processes your Personal Data for the following purposes:

• Account Management: To register your account, verify your identity and age, and maintain your account in good standing.
• Service Delivery: To provide access to gaming products, process bets and wagers, handle deposits and withdrawals in IDR, and deliver promotional benefits.
• KYC & AML Compliance: To verify your identity, confirm your eligibility as an Indonesian resident aged 21 or over, and fulfil our Anti-Money Laundering obligations.
• Customer Support: To respond to your enquiries, resolve complaints, and maintain records of your support interactions.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and other security threats.
• Responsible Gaming: To monitor account activity for signs of problem gambling, enforce self-exclusion requests, apply deposit and session limits, and refer users to welfare support where appropriate.
• Platform Improvement: To analyse usage patterns, diagnose technical issues, and develop new features that improve the experience for Indonesian players.
• Marketing Communications: To send you relevant promotional offers, seasonal campaigns (such as Idul Fitri, Nyepi, and Independence Day specials), and platform updates — where you have opted in to receive such communications.
• Legal Obligations: To comply with applicable laws, respond to lawful requests from regulatory or law-enforcement authorities, and enforce our Terms & Conditions.

papafa processes your Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — including account registration, service delivery, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC, AML, and responsible gaming obligations.
• Legitimate Interests:: Processing necessary for papafa's legitimate business interests, including fraud prevention, platform security, and service improvement — provided those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for optional marketing communications. You may withdraw consent at any time by contacting [email protected] or updating your account preferences.

papafa does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share your data only in the following strictly limited circumstances:

• Payment Processors: We share necessary financial data with your chosen payment provider — such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja — solely to process your deposit or withdrawal transaction.
• Identity Verification Partners: We share identity documents with licensed KYC and AML screening providers to verify your eligibility and comply with our due-diligence obligations.
• Game Software Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive limited session data (such as a pseudonymous player token) necessary to deliver their games within the papafa platform. These providers are contractually prohibited from using such data for any other purpose.
• Analytics Providers: Aggregated and anonymised usage data may be shared with analytics partners to help us understand platform performance and improve the user experience.
• Legal & Regulatory Authorities: We may disclose your Personal Data to law-enforcement agencies, regulators, or courts where we are legally required or compelled to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, your Personal Data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

papafa operates as an internationally licensed platform, and some of our service providers and infrastructure partners are located outside of Indonesia. As a result, your Personal Data may be transferred to and processed in countries other than Indonesia.

Where such transfers occur, papafa ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that require the recipient to provide a level of data protection equivalent to the standards described in this Policy.
• Transfers only to service providers operating in jurisdictions that maintain recognised data protection frameworks.
• Ongoing due diligence on international data-processing partners to ensure continued compliance.

By using the papafa platform, you acknowledge and consent to the international transfer of your Personal Data as described in this clause.

papafa retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

When Personal Data is no longer required, papafa will securely delete or anonymise it in accordance with our internal data destruction procedures.

papafa implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the papafa platform is encrypted using industry-standard TLS protocols.
• Encrypted Data Storage: Sensitive data fields — including passwords and financial identifiers — are stored using strong one-way hashing and encryption algorithms.
• Access Controls: Access to Personal Data within papafa's systems is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all staff.
• Intrusion Detection: Our infrastructure is monitored continuously by automated intrusion-detection and anomaly-alerting systems, with 24/7 security operations coverage.
• Regular Security Audits: papafa conducts periodic internal and third-party security audits, penetration tests, and vulnerability assessments to identify and remediate risks proactively.
• Incident Response: In the event of a data security incident, papafa maintains a documented incident-response plan and will notify affected users and relevant authorities in accordance with applicable obligations.

papafa uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session authentication cookies and security tokens. They cannot be disabled without impairing your ability to use the service.
• Functional Cookies: Used to remember your preferences such as language settings, time-zone defaults (WIB/UTC+7), and responsible gaming tool configurations.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform, helping us improve navigation, content, and feature design.
• Marketing Cookies: Used to deliver relevant promotional content, including seasonal campaigns, to users who have opted in to marketing communications. These cookies are only set with your explicit consent.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling certain categories of cookies may affect the functionality of the papafa platform. Clearing cookies will not delete any Personal Data held on our servers.

As a user of the papafa platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact us using the details in Clause 16:

papafa will respond to all valid data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, and you will be notified of the extension and the reason for it.

The papafa platform is strictly intended for adults aged 21 and over. papafa does not knowingly collect Personal Data from individuals under the age of 21. Age verification is conducted as part of the account registration and KYC process to enforce this restriction.

If papafa becomes aware that Personal Data has been collected from a person under the age of 21 without appropriate consent, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered an account on the papafa platform, please notify us immediately at [email protected].

The papafa platform may contain references to third-party services such as payment providers and game studios. papafa does not control the privacy practices of third-party platforms and is not responsible for the content or privacy policies of any external website or service.

We encourage you to review the privacy policy of any third-party service you interact with in connection with your use of papafa, particularly your chosen banking or e-wallet provider (such as BCA, BRI, OVO, or GoPay).

papafa reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. Where changes are material, we will provide advance notice via the platform or by email to your registered address.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically. Your continued use of the papafa platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a complaint about how papafa handles your Personal Data, please contact our privacy team using the details below:

• Email: [email protected]
• Subject Line: Please use "Privacy Enquiry" or "Data Rights Request" for priority routing.
• Response Time: papafa aims to acknowledge all privacy enquiries within 3 business days and to issue a substantive response within 30 days (WIB, UTC+7).
• Language: Enquiries may be submitted in English or Bahasa Indonesia. All formal responses will be issued in English.

If you are not satisfied with papafa's response to your privacy complaint, you may have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. papafa will cooperate fully with any such authority in the resolution of complaints.