Privacy Policy

1.1 Raja9 is committed to protecting the privacy and personal data of all players who access and use the raja9 Platform. This Policy sets out, in clear and plain language, the categories of personal data we collect, the purposes for which we process it, the legal bases on which we rely, the parties with whom we may share it, the measures we take to keep it secure, and the rights you hold over your own information.

1.2 This Policy applies to all personal data collected by raja9 in connection with the operation of the Platform at raja9.club, including data collected during Account registration, identity verification (KYC), payment processing, gameplay, customer support interactions, and marketing communications.

1.3 This Policy should be read alongside the raja9 Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with the Platform.

1.4 Raja9 primarily serves players based in Indonesia. Indonesian players are subject to the data protection requirements applicable under raja9's international gaming licence, and this Policy reflects those requirements. Where Indonesian law imposes additional obligations on the handling of Indonesian personal data, raja9 will endeavour to comply with those obligations to the extent applicable to its operations.

2.1 In this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means raja9, which determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of raja9, pursuant to a written agreement that imposes data protection obligations.
• "KYC" (Know Your Customer) means the identity and age verification process required by raja9's licensing authority and anti-money-laundering obligations.
• "Consent" means freely given, specific, informed, and unambiguous agreement by a Player to the Processing of their Personal Data for a stated purpose.
• "Cookie" means a small text file placed on a user's device by a website to store session or tracking information.

3.1 Raja9 collects the following categories of Personal Data, depending on how you interact with the Platform:

3.2 Raja9 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. If such data is incidentally included in documents submitted for KYC verification (for example, a national ID card that records religion), it is not extracted, stored separately, or used for any purpose beyond identity verification.

4.1 Directly from you: When you register an Account, complete KYC verification, make deposits or withdrawal requests, contact the support team, or update Account preferences.

4.2 Automatically: When you access the Platform, certain Technical Data and Usage Data are collected automatically through server logs, session management systems, and cookies (see Clause 6 for the full Cookie Policy).

4.3 From third-party identity verification providers: Raja9 works with licensed KYC verification service providers who may cross-reference the identity documents you submit against public and licensed identity databases to confirm authenticity.

4.4 From payment processors: When you make a deposit or request a withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja, those providers may share limited transaction confirmation data with raja9 to facilitate payment processing and fraud prevention.

4.5 From fraud prevention services: Raja9 may receive risk signals from licensed anti-fraud and AML screening services to identify and prevent fraudulent account activity, money laundering, and other prohibited conduct.

5.1 Raja9 processes Personal Data only for specified, explicit, and legitimate purposes. The table below sets out each processing purpose and the legal basis on which we rely:

6.1 Raja9 uses cookies and similar tracking technologies (local storage, session tokens, pixel tags) to operate and improve the Platform. The categories of cookies used are set out below:

• Strictly necessary cookies: Required for the Platform to function, including session management, login state, and security tokens. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Store your language preferences, game lobby layout preferences, and notification settings to personalise your experience across sessions.
• Analytics cookies: Collect anonymised or pseudonymised data about how players navigate the Platform, which pages are most visited, and where technical errors occur. This data is used solely for internal product improvement.
• Security cookies: Used to detect and prevent fraudulent login attempts, account takeover, and bot activity.

6.2 Raja9 does not use third-party advertising or retargeting cookies. No cookie data collected on raja9.club is shared with external advertising networks.

6.3 You may manage cookie preferences via your browser settings. Disabling strictly necessary cookies will impair or prevent Platform access. Disabling functional or analytics cookies will affect personalisation and may reduce the quality of certain features, but will not prevent Platform access.

6.4 A first-time visit to the Platform will display a cookie notice summarising this Policy. Continued use of the Platform constitutes acceptance of necessary cookies as described in this Clause.

7.1 Raja9 does not sell, rent, or disclose your Personal Data to third parties for commercial marketing purposes. Personal Data is shared only in the following circumstances and only to the extent necessary:

• Game studios and platform providers: Limited session and account data (e.g., a pseudonymous player ID, wallet balance, and bet history) is shared with licensed game studios (Evolution Gaming, Pragmatic Play, PG Soft, etc.) solely to enable gameplay. These studios do not receive your identity documents, financial account details, or contact information.
• Payment processors: Financial Data is shared with the relevant payment provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, etc.) solely to process the specific transaction you have initiated.
• KYC and identity verification providers: Identity Data and Verification Documents are shared with licensed third-party KYC service providers under strict data processing agreements for the purpose of verifying your identity and age.
• Fraud prevention and AML screening services: Limited Technical Data and Financial Data may be shared with licensed fraud prevention and AML screening services to identify and prevent prohibited conduct.
• Legal and regulatory authorities: Raja9 will disclose Personal Data to government authorities, regulators, courts, or law enforcement agencies where required to do so by applicable law, a valid court order, or the requirements of our gaming licence.
• Professional advisors: Raja9's legal counsel, auditors, and accountants may have access to Personal Data to the limited extent necessary to provide professional advice, subject to professional confidentiality obligations.

7.2 All third-party Data Processors engaged by raja9 are required to enter into data processing agreements that impose data protection obligations no less stringent than those described in this Policy.

8.1 Raja9 operates internationally, and certain Data Processors (including game studios and KYC verification providers) may be located in jurisdictions outside Indonesia. Personal Data may therefore be transferred to and processed in countries that have different data protection standards from those applicable in Indonesia.

8.2 Where Personal Data is transferred internationally, raja9 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses that impose data protection obligations on the receiving party
• Transfer to jurisdictions that have been assessed as providing an adequate level of data protection
• Technical and organisational measures (including encryption in transit and at rest) that protect the data regardless of where it is processed

8.3 By using the Platform, you acknowledge that your Personal Data may be transferred, stored, and processed outside Indonesia in accordance with this Clause and the safeguards described herein.

9.1 Raja9 retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and licensing obligations, and to defend against potential legal claims. The general retention principles are as follows:

• Active Account data: Retained for the duration of the Account and for a minimum of five (5) years following Account closure, in line with standard AML record-keeping requirements applicable to licensed gaming operators.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• KYC and identity documents: Retained for a minimum of five (5) years following Account closure, or longer if required by applicable law.
• Customer support records: Retained for three (3) years from the date of the last interaction, unless the record relates to an unresolved dispute, in which case it is retained until final resolution plus one (1) year.
• Marketing preference records: Retained for the duration of the Account and updated in real time as you modify preferences.
• Technical and session logs: Retained for up to twelve (12) months in accessible form; anonymised or deleted thereafter.

9.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

10.1 Raja9 implements a layered set of technical and organisational security measures designed to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the raja9 Platform is encrypted via TLS 1.2 or higher (256-bit SSL). Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at rest: Sensitive data categories — including identity documents, financial account details, and password hashes — are encrypted at rest using AES-256 encryption.
• Access controls: Internal access to Personal Data is restricted on a need-to-know basis. Staff with access to sensitive data categories are subject to background checks and data protection training.
• Two-factor authentication (2FA): Raja9 supports 2FA for Player Accounts and requires it for internal staff access to production systems.
• Intrusion detection and monitoring: The Platform is monitored continuously for anomalous access patterns, potential intrusions, and data exfiltration attempts.
• Penetration testing: Regular independent security assessments are conducted to identify and remediate vulnerabilities in the Platform's infrastructure.
• Incident response: Raja9 maintains a documented data breach response procedure. In the event of a breach that presents a risk to Player rights, affected Players will be notified without undue delay in accordance with applicable requirements.

11.1 Subject to applicable law and the limitations described in this Policy, you hold the following rights over Personal Data that raja9 holds about you:

• Right of Access: You may request a copy of the Personal Data raja9 holds about you, together with information about how it is processed.
• Right of Rectification: You may request that inaccurate or incomplete Personal Data be corrected. You may update basic Account information (such as your email address and contact number) directly via Account Settings at any time.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing only), or where the data has been unlawfully processed. Note that this right is subject to raja9's legal obligation to retain certain data for AML and licensing compliance purposes as described in Clause 9.
• Right to Restrict Processing: You may request that raja9 restricts the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is being verified following a rectification request.
• Right to Data Portability: You may request a machine-readable copy of the Personal Data you have provided to raja9, for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming monitoring, where you believe your individual circumstances override raja9's stated interests.
• Right to Withdraw Consent: Where processing is based on your consent (primarily marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal. Marketing opt-out is available directly in Account Settings.

11.2 To exercise any of the above rights, please contact the raja9 support team via live chat or by emailing [email protected]. Raja9 will acknowledge your request within five (5) business days and respond substantively within thirty (30) calendar days of receipt.

11.3 Raja9 may need to verify your identity before processing a data rights request. This is to protect your data against requests made by unauthorised parties.

12.1 The raja9 Platform is strictly for adults aged 21 and over. Raja9 does not knowingly collect Personal Data from individuals under the age of 21.

12.2 If raja9 becomes aware that Personal Data has been collected from a Minor, that Account will be immediately closed, all associated data will be deleted (subject to any legal obligations to retain evidence of the violation), and any funds deposited by the Minor will be returned where possible or handled in accordance with applicable AML requirements.

12.3 Parents or guardians who believe their child may have registered an Account on the Platform are asked to contact the raja9 support team immediately so that the matter can be investigated and resolved promptly.

13.1 Raja9 may send promotional emails, push notifications, and in-Platform messages to Players who have opted in to marketing communications during Account registration or subsequently via Account Settings.

13.2 Marketing communications from raja9 may include information about new games, promotions, deposit bonuses, sportsbook offers, and seasonal campaigns relevant to Indonesian players (such as Idul Fitri, Ramadhan, or Independence Day promotions).

13.3 You may withdraw your consent to receive marketing communications at any time by:

• Updating your preferences in Account Settings → Notifications
• Clicking the unsubscribe link in any marketing email
• Contacting the support team and requesting removal from the marketing list

13.4 Withdrawal of marketing consent does not affect the receipt of transactional communications — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — which are necessary for the operation of your Account and cannot be disabled while your Account is active.

13.5 Raja9 does not share Player contact details with third-party marketers or advertising networks. All marketing communications originate from raja9 and relate exclusively to raja9 products and promotions.

14.1 The raja9 Platform does not contain links to external third-party websites. However, game studios integrated into the Platform operate their own game interfaces, which may have their own privacy practices. Raja9 is not responsible for the data practices of third-party game studio interfaces and encourages Players to review the privacy policies of any third-party services they interact with directly.

14.2 Payment channels (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) have their own privacy policies governing how they handle your financial data. Raja9 recommends reviewing those policies, as the data you provide directly to those providers during payment initiation is governed by their own terms, not by this Policy.

15.1 Raja9 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or licensing requirements. When material changes are made, we will notify Players via a notice displayed on the Platform or by email to the registered Account address, with reasonable advance notice before the changes take effect.

15.2 The effective date at the top of this Policy will be updated each time the Policy is revised. Continued use of the Platform following the effective date of any revision constitutes acceptance of the updated Policy.

15.3 The most current version of this Policy is always available at raja9.club/privacy-policy.

16.1 For any questions, concerns, or requests relating to this Privacy Policy or raja9's handling of your Personal Data, please contact the raja9 Data Protection team via any of the following channels:

• Live chat: Available 24/7 via the raja9 Platform (WIB through WIT)
• Email: [email protected] — responses within 1–2 business days

16.2 If you are not satisfied with raja9's response to a privacy complaint or data rights request, you may escalate the matter to the data protection supervisory authority designated under raja9's gaming licence jurisdiction, or to the relevant Indonesian regulatory authority with oversight of data protection matters, as applicable to your circumstances.

16.3 Raja9 is committed to resolving all privacy complaints promptly and in good faith. We do not charge fees for processing data rights requests under normal circumstances.