Privacy Policy for
jos257

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly — including but not limited to name, email address, phone number, national identity number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data — including collection, recording, storage, use, disclosure, transmission, erasure, or destruction — whether by automated or manual means.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, the Data Controller is jos257.
• "Data Processor" means any third party that processes Personal Data on behalf of the Data Controller under a formal written agreement.
• "KYC Data" means identity verification documentation, including copies of a Player's Indonesian National Identity Card (KTP), passport, or supporting proof-of-address documents submitted during the Know Your Customer process.
• "Cookies" means small text files placed on your device by the jos257 website that enable the Platform to remember your session preferences and analyse usage patterns.
• "IDR" means Indonesian Rupiah — the sole transaction currency on the jos257 Platform.

Data Controller

jos257 is the Data Controller responsible for your Personal Data collected through this Platform. As Data Controller, jos257 determines the purposes for which your data is collected and the means by which it is processed.

All data-related enquiries, subject access requests, and complaints may be directed to our dedicated Data Privacy contact:

• Email: [email protected]
• Response Time: We aim to respond to all data privacy enquiries within 30 calendar days of receipt.

Where jos257 engages third-party Data Processors (e.g., payment processors, identity verification providers, cloud hosting companies), those parties act under written data processing agreements that restrict their use of your data to the specific purposes authorised by jos257.

Personal Data We Collect

jos257 collects Personal Data across several categories, depending on your level of engagement with the Platform. The table below summarises the categories of data we collect and representative examples within each category:

How We Collect Your Data

jos257 collects Personal Data through the following channels:

• Direct Input: When you complete the registration form, update your profile, submit KYC documents, make a deposit or withdrawal request, or contact our support team, you provide data directly to jos257.
• Automated Technologies: When you visit the jos257 Platform, our servers automatically record Technical Data and Usage Data including your IP address, browser type, session duration, and the pages you visit. This data is collected via server logs and first-party cookies.
• Payment Processors: When you deposit or withdraw funds using local Indonesian payment methods — such as BCA virtual account, BRI direct transfer, OVO, DANA, GoPay, or ShopeePay — limited transaction confirmation data is shared between jos257 and the relevant payment processor to verify and reconcile transactions.
• Identity Verification Providers: If your KYC documents are processed through a third-party identity verification partner, that partner may share verification results (pass/fail/flagged) with jos257. Raw document data is handled in accordance with that partner's own certified data-security practices.
• Fraud Prevention Systems: jos257 employs automated fraud-detection tools that may analyse patterns across Technical Data, Transaction Data, and Usage Data to flag suspicious activity. These tools do not make fully automated decisions with legal effect — a human review is always conducted before any account action is taken.

Purpose & Legal Basis for Processing

jos257 processes your Personal Data only where a valid legal basis exists. The purposes for which we process data, and the corresponding legal basis for each, are set out below:

• Account Creation & Management (Contractual Necessity): To create and maintain your jos257 account, verify your identity, process deposits and withdrawals in IDR, settle bets, and communicate essential account information.
• KYC & Anti-Money Laundering Compliance (Legal Obligation): To verify that you are at least 21 years of age, to confirm your identity before enabling withdrawals, and to comply with applicable anti-money laundering (AML) and counter-financing of terrorism (CFT) obligations.
• Fraud Detection & Platform Security (Legitimate Interest): To detect, investigate, and prevent fraudulent activity, account takeovers, bonus abuse, and multi-accounting.
• Responsible Gaming (Legal Obligation / Legitimate Interest): To monitor gaming behaviour for indicators of problem gambling, to enforce self-exclusion requests, and to apply deposit or loss limits at your request or where required by our licensing obligations.
• Customer Support (Contractual Necessity): To respond to your enquiries, resolve disputes, and improve the quality of our support services.
• Marketing Communications (Consent): To send you promotional emails, bonus offers, and product updates — but only where you have explicitly opted in to receive such communications. You may withdraw consent at any time by updating your notification preferences in your Account settings or by contacting our support team.
• Platform Analytics & Improvement (Legitimate Interest): To analyse how Players navigate and use the Platform so that we can improve user experience, fix bugs, and optimise performance. Analytics data is aggregated and pseudonymised wherever possible.

Third-Party Disclosure

jos257 does not sell, rent, or trade your Personal Data to any third party for commercial gain. We may, however, share your data with carefully selected third-party service providers who assist us in operating the Platform, subject to strict confidentiality and data-processing agreements. The categories of third parties with whom data may be shared are as follows:

• Payment Service Providers: Indonesian bank transfer processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to process your deposit or withdrawal transaction.
• Identity Verification Partners: Third-party KYC and age-verification services receive your KYC documents solely for the purpose of identity verification. These partners are contractually prohibited from retaining or re-using your documents beyond the scope of their service.
• Cloud Infrastructure & Hosting Providers: The jos257 Platform is hosted on secure cloud infrastructure. Hosting providers may have incidental access to data stored on their servers but are bound by data processing agreements that restrict any independent use of that data.
• Game Studios: Game providers such as Pragmatic Play, Evolution Gaming, Microgaming, Spribe, NetEnt, and Pocket Games Soft receive a pseudonymous Player identifier and session token to facilitate game delivery. Your full name, contact data, and financial data are not passed to game studios.
• Fraud Prevention & Security Vendors: Specialist anti-fraud and cybersecurity partners may process Technical Data and Usage Data to identify suspicious patterns. All such partners operate under data processing agreements aligned with recognised international security standards.
• Legal & Regulatory Authorities: jos257 will disclose Personal Data to law enforcement agencies, courts, or regulatory bodies when required to do so by applicable law, a valid court order, or our licensing obligations — and only to the extent required by such obligation.

All third-party Data Processors engaged by jos257 are required to implement appropriate technical and organisational security measures and are prohibited from processing your data for any purpose other than those explicitly authorised by jos257.

Cookies & Tracking Technologies

The jos257 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain your login session, and to understand how Players use the site so that we can improve the experience over time.

The categories of cookies used by jos257 are as follows:

• Strictly Necessary Cookies: These are essential for the Platform to function. They enable session management (keeping you logged in), security token validation, and language preference storage. These cookies cannot be disabled without impairing core Platform functionality.
• Performance & Analytics Cookies: These collect pseudonymous data about how Players navigate the Platform — which pages are visited most frequently, where errors occur, and how long sessions last. This data helps us improve Platform performance. Analytics cookies are only placed with your consent.
• Functionality Cookies: These remember your preferences — such as your preferred odds format (European decimal, fractional, or Indonesian money-line), display settings, and notification preferences — so that you do not need to reset them on each visit.
• Security Cookies: These help jos257 detect and prevent fraudulent activity, including bot traffic, credential-stuffing attacks, and session hijacking attempts.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. For more information on how to manage cookies in your specific browser, refer to your browser's official help documentation.

Data Retention

jos257 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and our licensing obligations. The table below sets out our standard retention periods by data category:

Upon expiry of the applicable retention period, Personal Data is either securely deleted (for digital records) or securely destroyed (for any physical copies), or — where deletion is not technically feasible — permanently anonymised such that the data can no longer be linked to any identifiable individual.

Security Measures

jos257 implements a layered security architecture to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. Our key technical and organisational security measures include:

• 256-Bit SSL/TLS Encryption: All data in transit between your browser and the jos257 Platform is encrypted using industry-standard TLS 1.2 or higher, preventing interception by third parties.
• Encryption at Rest: Sensitive data stored on our servers — including KYC documents and financial account details — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Internal access rights are role-based, regularly reviewed, and require multi-factor authentication for sensitive data environments.
• Penetration Testing: jos257 conducts regular third-party penetration tests and vulnerability assessments on its Platform infrastructure to identify and remediate security weaknesses before they can be exploited.
• Incident Response: jos257 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected Players and relevant authorities within the timeframe required by applicable law.
• Staff Training: All jos257 personnel who handle Personal Data receive mandatory data privacy and security training upon onboarding and on an annual basis thereafter.

While jos257 takes all reasonable steps to protect your Personal Data, no online system can be guaranteed to be 100% secure. You are responsible for keeping your Account credentials confidential and for notifying us immediately if you suspect unauthorised access to your Account.

Your Data Rights

As a data subject, you hold the following rights with respect to your Personal Data held by jos257. You may exercise any of these rights at any time by contacting our support team at [email protected]:

jos257 will respond to all valid data rights requests within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days, in which case we will notify you of the extension within the initial 30-day window.

Please note that certain rights are subject to limitations where processing is required by law — for example, we cannot delete KYC or transaction records that we are legally obligated to retain.

Children's Privacy

The jos257 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect Personal Data from any person under the age of 21. Registration requires a declaration that you are at least 21 years of age, and KYC verification confirms this prior to the activation of withdrawal functionality.

If jos257 becomes aware that Personal Data has been collected from a person under the age of 21, that Account will be immediately suspended, all associated data will be deleted in accordance with our data retention procedures, and any deposits will be returned to their source.

If you are a parent or guardian and believe that a minor in your care may have registered an Account on jos257, please contact us immediately at [email protected] and we will take prompt action.

International Data Transfers

jos257 operates internationally and may, in the course of providing its services, transfer your Personal Data to servers or service providers located outside of Indonesia. Such transfers may occur in connection with cloud hosting, identity verification, fraud prevention, or customer support operations.

Where Personal Data is transferred internationally, jos257 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that applicable under recognised international data protection frameworks. These safeguards may include:

• Standard Contractual Clauses approved by relevant supervisory authorities, incorporated into our agreements with international Data Processors.
• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection.
• Binding Corporate Rules where transfers occur within a corporate group that has adopted an internationally recognised privacy governance framework.

You may request further information about the specific safeguards applied to any international transfer of your data by contacting our Data Privacy team.

Amendments to This Policy

jos257 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. Where changes are material — for example, where we introduce a new purpose for processing your data or engage a new category of third-party processor — we will notify you via email to your registered address or via a prominent on-screen notice at login.

The effective date at the top of this Policy will be updated to reflect the date on which the revised version takes effect. Your continued use of the jos257 Platform following the effective date of any revision constitutes your acknowledgement of the updated Policy.

We recommend reviewing this page periodically. All previous versions of this Privacy Policy are archived and available on request by contacting our support team.

Contact & Complaints

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a concern about how jos257 has handled your Personal Data, please contact us using the details below:

• Email: [email protected]
• Support Hours: English-language support 24/7; Indonesian-speaking agents available 09:00–22:00 WIB.
• Response Commitment: All data privacy enquiries will receive an initial acknowledgement within 5 business days and a substantive response within 30 calendar days.

If you are not satisfied with our response to a data privacy complaint, you have the right to escalate the matter to the relevant supervisory authority or data protection regulator in your jurisdiction.

This Privacy Policy was last updated on 1 January 2026 and supersedes all prior versions. All previous versions are archived and available upon written request to [email protected].