Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings assigned to them below. Where a term is already defined in the rp123 Terms & Conditions, it retains that meaning here unless the context requires otherwise.

• "rp123", "we", "us", "our" — the operator of the rp123 online gaming platform accessible at https://rp123.ws.
• "Platform" — the rp123 website, mobile-optimised web application, and any associated sub-domains or services operated by rp123.
• "Player", "you", "your" — any individual who visits, registers on, or interacts with the Platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, contact details, financial data, device identifiers, and behavioral data collected during Platform use.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "KYC" — Know Your Customer: the identity and age verification process required before a Player may make their first withdrawal.
• "Account" — a registered Player account on the rp123 Platform.
• "Cookies" — small text files placed on your device by the Platform to store session information and usage preferences.
• "Third-Party Providers" — game studios, payment processors, analytics providers, and other vendors whose services are integrated into the Platform.

2.1 Identity. rp123 acts as the data controller for all Personal Data collected from Players accessing the Platform. As data controller, rp123 determines the purposes and means of Processing your Personal Data in accordance with this Privacy Policy.

2.2 Contact. All data-related inquiries, requests to exercise your rights, and formal complaints regarding the handling of your Personal Data should be directed to:

2.3 Response commitment. rp123 will acknowledge all privacy-related requests within 48 hours and will provide a substantive response within 14 calendar days of receipt of a complete, verified request.

3.1 Registration data. When you open an Account with rp123, we collect the personal information you provide during registration, including:

• Full legal name as it appears on your Indonesian National Identity Card (KTP) or passport
• Date of birth (used to verify you are 21 or older)
• Residential address in Indonesia (city, province, postal code)
• Email address
• Indonesian mobile phone number
• Chosen username and encrypted password hash

3.2 KYC and verification data. During the identity verification process, we collect:

• Scanned image or photograph of your KTP or Indonesian passport
• Proof of address documents (utility bill, bank statement, or official correspondence issued within 90 days)
• Images or screenshots of bank cards or e-wallet accounts (OVO, DANA, GoPay, ShopeePay, LinkAja) used for deposits
• Selfie or liveness-check image where required by our verification provider

3.3 Financial transaction data. We record all financial activity associated with your Account, including:

• Deposit and withdrawal amounts (in Indonesian Rupiah, IDR)
• Payment method details — bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), masked account numbers, and e-wallet identifiers
• Transaction timestamps, reference numbers, and processing status
• Bonus credits, wagering activity, and Account balance history

3.4 Gaming and behavioral data. We collect data about how you use the Platform:

• Games played, bet amounts, win/loss outcomes, session durations
• Sportsbook markets accessed, bet selections, and settlement results
• Live casino table participation and dealer interaction logs
• Search queries, navigation paths, and feature interactions on the Platform

3.5 Technical and device data. We automatically collect certain technical data when you access the Platform:

3.6 Communications data. We retain records of communications you send to our support team — including live chat transcripts, emails to [email protected], and any documents or screenshots you attach to support requests — for the purposes of quality assurance, dispute resolution, and compliance.

4.1 Directly from you. The majority of your Personal Data is collected directly from you when you: register an Account; complete KYC verification; make a deposit or withdrawal; contact our support team; opt in to promotional communications; or use any interactive feature of the Platform.

4.2 Automatically. When you visit or interact with the Platform, our servers and analytics tools automatically record technical and behavioral data as described in clauses 3.4 and 3.5. This data is collected regardless of whether you are logged in to an Account.

4.3 From third-party providers. We may receive Personal Data about you from third-party sources in the following circumstances:

• Payment processors: Transaction confirmation data from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity verification providers: Confirmation of identity document authenticity and age from our third-party KYC vendor.
• Fraud and risk intelligence providers: Device fingerprint scores, IP reputation data, and behavioral risk flags from our fraud-prevention partners.
• Game providers: Session logs from game studios (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe) for game integrity and dispute resolution purposes.

4.4 From publicly available sources. In limited circumstances and where necessary for fraud prevention, rp123 may verify information using publicly available sources, including public records and commercially available databases.

rp123 processes your Personal Data only where a recognised legal basis exists. The primary bases we rely on are set out below:

6.1 Account administration. We use your registration and contact data to create and maintain your Account, authenticate your identity at login, send account activity notifications (deposit confirmations, withdrawal updates, security alerts), and manage Account closures or suspensions in accordance with the rp123 Terms & Conditions.

6.2 Payment processing. Your financial data is used exclusively to process deposits and withdrawals through your nominated Indonesian bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), to reconcile transaction records, and to investigate and resolve payment disputes.

6.3 Identity and fraud prevention. We use KYC documents, device data, IP addresses, and behavioral signals to verify that you are who you claim to be, to detect and prevent fraudulent account activity, bonus abuse, multi-accounting, and money laundering, and to fulfil our obligations under applicable anti-money-laundering regulations.

6.4 Responsible gaming. Gaming and behavioral data — including session duration, wagering volume, deposit frequency, and loss patterns — is monitored by our responsible gaming system to identify players who may be exhibiting signs of problematic gambling behavior. Where such patterns are identified, rp123 may contact the Player proactively, apply cooling-off interventions, or escalate the matter in accordance with our Responsible Gaming policy.

6.5 Customer support. Communications data is used by our support agents — including native Indonesian-speaking staff available 24/7 — to resolve queries, investigate disputes, and provide technical assistance. Support records are retained as described in clause 10.

6.6 Marketing and personalisation. With your consent, we use Account data and behavioral data to deliver personalised promotional offers — including seasonal campaigns around Idul Fitri, Ramadhan, and Indonesian Independence Day — relevant game recommendations, and loyalty reward notifications. Marketing consent can be withdrawn at any time through your Account settings.

6.7 Platform analytics and improvement. Aggregated and anonymised behavioral data is used to analyse Platform performance, identify technical issues, test new features, and improve the overall player experience. In its anonymised form, this data cannot be used to identify any individual Player.

6.8 Legal and regulatory compliance. We use your data as necessary to comply with applicable law, respond to lawful requests from regulatory and law enforcement authorities, and enforce the rp123 Terms & Conditions.

7.1 We do not sell your data. rp123 does not sell, rent, or trade your Personal Data to any third party for their own marketing purposes. Full stop.

7.2 Service providers. We share Personal Data with carefully selected third-party service providers who process data on our behalf and under our instructions. These providers are contractually bound to handle your data securely and may not use it for any purpose beyond providing services to rp123. Categories of service provider include:

• Payment processors and Indonesian banking partners — to execute deposit and withdrawal transactions
• KYC and identity verification providers — to verify age, identity, and address documents
• Fraud prevention and risk management vendors — to detect and block fraudulent activity
• Game content providers (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe) — to deliver game sessions and settle game outcomes
• Cloud hosting and infrastructure providers — to store data securely on servers protected by industry-standard security controls
• Analytics platforms — to process aggregated, anonymised usage data for Platform improvement
• Customer support software vendors — to operate our live chat and ticketing systems

7.3 Legal and regulatory disclosures. rp123 may disclose Personal Data to government authorities, regulators, law enforcement agencies, or financial intelligence units where required to do so by applicable law, court order, or our licensing obligations. Such disclosures will be made without prior notice to the Player where legally required or where prior notice would compromise an active investigation.

7.4 Business transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of rp123's business, Personal Data held by rp123 may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and the privacy practices of the acquiring entity before your data is transferred, to the extent practicable.

8.1 What are cookies. Cookies are small text files stored on your device by your web browser when you visit the Platform. rp123 uses cookies and similar tracking technologies (including local storage and session storage) to operate the Platform correctly, maintain your login session, remember your preferences, and gather analytics data.

8.2 Types of cookies we use.

8.3 Managing cookies. You can control and delete cookies through your browser settings. Most modern browsers allow you to block third-party cookies, clear existing cookies on exit, and receive a notification before a cookie is placed. Please note that disabling strictly necessary cookies will prevent you from logging in to your rp123 Account and will impair core Platform functionality.

8.4 Do Not Track. Some browsers transmit a "Do Not Track" (DNT) signal. rp123 currently does not respond to DNT signals because there is no consistent industry standard for how they should be interpreted. You may use the cookie management options in clause 8.3 to limit tracking independently of the DNT signal.

9.1 Technical measures. rp123 employs the following technical security controls to protect your Personal Data against unauthorised access, loss, alteration, or disclosure:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and rp123 servers is encrypted using TLS 1.3, the current industry standard for secure web communication.
• 256-bit AES encryption: Sensitive data at rest — including KYC documents and financial records — is stored with AES-256 encryption on access-controlled servers.
• Password hashing: Account passwords are never stored in plain text. We use bcrypt with a high work factor to hash all passwords at the point of creation.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA via their registered Indonesian mobile number. rp123 staff accounts require mandatory 2FA.
• Access controls: Personal Data is accessible only to rp123 personnel and service providers who have a documented operational need. Access is governed by role-based access controls and logged for audit purposes.
• Penetration testing: The Platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.

9.2 Organisational measures. Beyond technical controls, rp123 maintains internal privacy and security policies, conducts regular staff training on data handling obligations, and requires all third-party service providers to sign data processing agreements with equivalent security standards before receiving access to any Player data.

9.3 Data breach response. In the event of a Personal Data breach that poses a risk to the rights and freedoms of affected Players, rp123 will notify affected Players without undue delay — and in any event within 72 hours of becoming aware of the breach — via the email address registered to their Account. The notification will describe the nature of the breach, the categories of data affected, and the steps rp123 is taking to address it.

10.1 Retention periods. rp123 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The principal retention periods are:

10.2 Deletion. Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. KYC documents are deleted from our primary systems and any backup copies are overwritten within 90 days of the retention period end date.

10.3 Account closure. When a Player requests voluntary account closure, all active sessions are terminated immediately. The Account is placed in a deactivated state while the applicable retention periods run. During this period, the data is not accessible to the Player but is retained in a secure, access-controlled archive for compliance purposes only.

As a Player, you hold the following rights over your Personal Data held by rp123. To exercise any of these rights, submit a written request to [email protected] with the subject line "Privacy Request — [Right Type]" and include your registered Account username. rp123 will verify your identity before processing any request.

• Right of access: You may request a copy of the Personal Data rp123 holds about you, together with information about how it is used and with whom it is shared.
• Right to rectification: If any Personal Data we hold is inaccurate or incomplete, you may request that it be corrected. You can update most Account details directly through your Account settings; for KYC document corrections, contact support.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. Note that this right is subject to our legal retention obligations — for example, transaction records required for AML compliance cannot be deleted before the mandatory retention period expires.
• Right to restriction of processing: In certain circumstances — for example, while a dispute about data accuracy is being resolved — you may request that rp123 restrict the Processing of your data to storage only.
• Right to data portability: You may request a copy of the Personal Data you provided to rp123 in a structured, commonly used, machine-readable format (e.g., CSV or JSON), for the purpose of transmitting it to another service provider.
• Right to object: You may object to Processing based on legitimate interests or for direct marketing purposes at any time. Marketing opt-out is available immediately through your Account settings.
• Right to withdraw consent: Where Processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of Processing carried out before the withdrawal.

12.1 Cross-border processing. As an internationally licensed gaming platform serving players across Indonesia — from Jakarta and Surabaya to Bali, Medan, and Makassar — rp123 operates infrastructure and uses service providers located in multiple jurisdictions. Personal Data may therefore be transferred to, and processed in, countries outside Indonesia.

12.2 Transfer safeguards. Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that applicable in Indonesia, rp123 ensures appropriate safeguards are in place. These safeguards include:

• Data processing agreements incorporating standard contractual clauses (SCCs) with all international service providers
• Technical security requirements (encryption in transit and at rest, access controls) mandated contractually for all data processors
• Regular audits of international service providers' data security practices

12.3 Game providers. Game content providers including Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, and Spribe may process limited gameplay data (session logs, bet records) on their own internationally hosted infrastructure for the purposes of game delivery, RNG certification, and dispute resolution. Such Processing is governed by data processing agreements between rp123 and each provider.

13.1 Age restriction. The rp123 Platform is strictly intended for adults aged 21 and over. rp123 does not knowingly collect Personal Data from any individual under the age of 21. If you are under 21, you are not permitted to register an Account or use any service on the Platform.

13.2 Discovery of minor's data. If rp123 discovers or is notified that it has inadvertently collected Personal Data from an individual under the age of 21, it will immediately suspend the relevant Account, permanently delete all associated Personal Data to the extent not required to be retained for legal compliance purposes, and report the incident in accordance with applicable regulatory requirements.

13.3 Parental guidance. Parents and guardians of individuals under 21 years of age who are concerned that their child may have accessed or registered on the Platform are encouraged to contact rp123 immediately at [email protected]. rp123 will prioritise investigation and resolution of all such reports.

14.1 Integrated third-party providers. The rp123 Platform integrates services from third-party providers including game studios, payment gateways, analytics platforms, and customer support tools. While rp123 carefully vets all providers before integration, each third-party service operates under its own privacy policy in respect of data it independently controls.

14.2 Payment partners. When you initiate a deposit or withdrawal via an Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the transaction is processed by the relevant financial institution under its own terms and privacy policy. rp123 receives only a transaction confirmation and masked payment reference — we do not receive or store your full bank account credentials.

14.3 Game studio data. Game studios may independently retain session logs and RNG certification data for their own regulatory compliance and game integrity purposes. rp123 is not responsible for the privacy practices of individual game studios in respect of data they independently process. Players are encouraged to review the privacy policies of the relevant game providers.

14.4 No responsibility for external sites. The rp123 Platform does not link to external websites. However, if you independently navigate to a third-party website, rp123 bears no responsibility for the privacy practices or content of that site. This Privacy Policy applies solely to the rp123 Platform at https://rp123.ws.

15.1 Right to amend. rp123 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, Platform functionality, or our data processing practices. The "Last reviewed" date at the top of this page will be updated each time a material change is made.

15.2 Notification of material changes. Where a change to this Privacy Policy materially affects your rights or the way in which your Personal Data is processed, rp123 will notify registered Players via the email address associated with their Account at least 14 days before the change takes effect. Continued use of the Platform after the effective date of an amended Privacy Policy constitutes acceptance of the revised terms.

15.3 Version history. Prior versions of this Privacy Policy are available upon written request to [email protected]. Please include "Privacy Policy Version Request" in the subject line.

16.1 Privacy inquiries. For any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please contact rp123's support team:

16.2 Formal complaints. If you are not satisfied with rp123's response to a privacy request or complaint, you have the right to escalate the matter to the relevant data protection authority or the licensing body under whose jurisdiction rp123 operates. Details of the applicable regulatory body are available upon request from our support team.

16.3 Governing law. This Privacy Policy is governed by and construed in accordance with internationally recognised data protection principles and the laws of the jurisdiction in which rp123 is licensed and regulated. Any dispute arising under this Privacy Policy that cannot be resolved through rp123's internal complaints process shall be referred to binding arbitration under the rules of a recognised international arbitration body.