Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below unless context requires otherwise:

napi68 collects the following categories of Personal Data in connection with your use of the Platform. We collect only what is necessary for the stated purposes and do not retain data beyond the periods described in Section 7.

napi68 collects Personal Data through the following channels:

• Direct Submission: Information you provide when creating an Account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated Technologies: Data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and analytics software. This data is used to maintain session security, detect fraud, and improve Platform performance;
• Third-Party Sources: Identity and address verification data received from our KYC and fraud-prevention partners in the course of verifying your eligibility to use the Platform. These partners are bound by confidentiality obligations and applicable data protection law;
• Payment Processors: Transaction confirmation data (such as payment status, amount in IDR, and bank or e-wallet identifier) received from our integrated payment processors including the supported Indonesian banks and e-wallet providers;
• Public Sources: In certain fraud-investigation scenarios, napi68 may cross-reference publicly available information to verify the accuracy of data you have provided.

We do not purchase Personal Data from data brokers or marketing list providers for the purpose of targeting individuals who have not previously interacted with the Platform.

napi68 processes your Personal Data only where a valid legal basis exists. The primary purposes and corresponding legal bases are set out below:

• Account Management & Service Delivery (Contract): Processing necessary to create and manage your Account, authenticate your identity at login, process deposits and withdrawals in IDR, and deliver the betting and gaming services you have requested;
• KYC & Regulatory Compliance (Legal Obligation): Processing necessary to fulfil identity verification, anti-money-laundering (AML), and counter-terrorism financing (CTF) obligations under applicable international gaming regulations;
• Fraud Prevention & Security (Legitimate Interest): Monitoring Platform activity to detect and prevent fraud, unauthorised account access, collusion, and other prohibited conduct as defined in the napi68 Terms & Conditions. This interest does not override your rights where you have a reasonable expectation of privacy;
• Customer Support (Contract / Legitimate Interest): Retaining records of communications to resolve disputes, respond to enquiries, and improve support quality;
• Platform Analytics & Improvement (Legitimate Interest): Analysing aggregated and anonymised usage data to improve Platform performance, game selection, and the overall Player experience;
• Responsible Gaming (Legal Obligation / Legitimate Interest): Using betting and deposit history to identify Players who may be exhibiting patterns consistent with problem gambling, for the purpose of offering responsible gaming support tools;
• Marketing Communications (Consent): Sending promotional offers, bonus announcements, and event-based campaigns — including seasonal Indonesian promotions tied to Idul Fitri, Ramadhan, and Chinese New Year (Imlek) — only where you have explicitly opted in. You may withdraw consent at any time.

napi68 does not sell, rent, or trade your Personal Data. We share data only in the following limited circumstances:

• Payment Processors: Financial data necessary to process deposits and withdrawals is shared with our integrated Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These entities process data under their own privacy policies and applicable Indonesian banking regulations;
• KYC & Fraud Detection Partners: Identity and document verification data is shared with licensed KYC service providers solely for the purpose of verifying your eligibility to use the Platform. These providers operate under strict confidentiality and data processing agreements with napi68;
• Game Content Providers: Aggregated, anonymised gameplay data (such as game session counts and bet volumes) may be shared with game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft for the purpose of game performance reporting. No personally identifiable information is shared with game studios;
• IT & Infrastructure Providers: Technical data is processed by cloud hosting and cybersecurity partners who support Platform operations under binding data processing agreements that require them to maintain the same level of data protection as napi68;
• Legal & Regulatory Authorities: napi68 will disclose Personal Data to law enforcement, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, a valid court order, or a binding regulatory request. Where legally permissible, napi68 will endeavour to notify the affected Player prior to disclosure;
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of napi68's business assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

napi68 operates internationally, and your Personal Data may be transferred to and processed in countries outside Indonesia where our servers, group companies, or Third-Party Processors are located. These countries may have data protection laws that differ from those applicable in Indonesia.

Where such transfers occur, napi68 ensures that adequate safeguards are in place, which may include:

• Standard contractual clauses or data transfer agreements with the receiving entity that impose obligations equivalent to those in this Privacy Policy;
• Processing only in jurisdictions that our licensing authority has assessed as providing an adequate level of data protection;
• Technical and organisational measures ensuring the ongoing security and confidentiality of transferred data.

By registering an Account and accepting the napi68 Terms & Conditions, you acknowledge that your Personal Data may be transferred in accordance with this section.

napi68 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is used, the resulting data no longer constitutes Personal Data and may be retained for statistical purposes without time limit.

Depending on applicable law and the circumstances of your request, you may have the following rights in relation to your Personal Data held by napi68. To exercise any of these rights, contact us using the details in Section 14.

napi68 aims to respond to all valid data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it. We may request proof of identity before processing any data rights request to prevent unauthorised disclosure.

napi68 uses cookies and similar tracking technologies to operate and improve the Platform. The following cookie categories are in use:

napi68 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts that follow you across other websites. You can control non-essential cookies through your browser settings at any time. Note that disabling functional cookies may affect the Platform experience, such as requiring you to re-enter preferences on each visit.

napi68 applies a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational security measures include:

• Encryption in Transit: All data exchanged between your device and the Platform is encrypted using TLS 1.3 / 256-bit SSL. Any connection attempt via an unencrypted protocol is automatically redirected to HTTPS;
• Encryption at Rest: Sensitive Personal Data fields (including identity documents and financial identifiers) are encrypted at the database level using AES-256 encryption;
• Access Controls: Access to production systems containing Personal Data is restricted to authorised personnel on a strict need-to-know basis. Multi-factor authentication is mandatory for all administrative access;
• Penetration Testing: The Platform undergoes periodic third-party security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited;
• Incident Response: napi68 maintains a documented data breach response plan. In the event of a breach likely to result in risk to Players, we will notify affected individuals and the relevant regulatory authority within the timeframe required by applicable law;
• Employee Training: All personnel with access to Personal Data receive regular training on data protection obligations, phishing awareness, and secure data handling procedures.

The napi68 Platform is strictly intended for adults aged 21 years and over. napi68 does not knowingly collect Personal Data from individuals under the age of 21. Registration by underage individuals is a material breach of the napi68 Terms & Conditions and is prohibited.

If napi68 becomes aware that Personal Data has been collected from a person under the age of 21, we will promptly close the associated Account, delete the collected data, and return any deposited real-money balance to the original payment source where technically possible.

If you are a parent or guardian and believe your child has registered on the Platform without your knowledge, please contact our support team immediately using the contact details in Section 14. We will investigate and act on all such reports as a matter of priority.

The Platform may contain references to third-party services, including payment providers and game studios. Where links to external services are present, please be aware that napi68 has no control over the privacy practices or content of those third-party sites and services.

This Privacy Policy applies solely to Personal Data collected and processed by napi68 in connection with the Platform. We strongly encourage you to review the privacy policies of any third-party service you access in connection with your use of the Platform, including those of your chosen payment provider (such as BCA, BRI, OVO, or GoPay), as their data-handling practices are governed independently.

napi68 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-handling practices, applicable law, or Platform functionality. Material changes will be communicated to registered Players via the email address on their Account no fewer than seven (7) days prior to the revised policy taking effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We recommend reviewing this Privacy Policy periodically to stay informed of how your data is handled. The most current version of this policy is always available at https://napi68.cam/privacy-policy.

Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not accept the revised policy, you must cease using the Platform and may request closure of your Account in accordance with the process described in Section 8.

For any questions, requests, or concerns relating to this Privacy Policy or the handling of your Personal Data by napi68, please contact our Data Protection team using the details below. Our customer support agents, including Indonesian-speaking staff, are available daily from 07:00 to 24:00 WIB.

If you are not satisfied with our response to your data rights request or complaint, you have the right to escalate the matter to the relevant data protection supervisory authority or the dispute resolution body designated by napi68's licensing jurisdiction. We will provide details of the applicable authority upon request.