Privacy Policy

fb303 ("we", "us", "our") operates the online betting platform accessible at https://fb303.onl (the "Platform"). As a platform that processes personal data in order to provide sports betting, live casino, togel (Indonesia's traditional numbers lottery), esports wagering, and slot gaming services to players across Indonesia, fb303 is committed to responsible and transparent data stewardship.

This Privacy Policy sets out the categories of personal data we collect from you, the purposes for which that data is processed, the legal bases on which processing rests, how long we retain your data, the circumstances under which it may be shared with third parties, your rights as a data subject, and the security measures we have in place to protect your information.

This Policy applies to all users of the fb303 Platform, including visitors who browse without registering, registered account holders, and former account holders whose data is retained in accordance with legal and regulatory obligations. By accessing or using the fb303 Platform, you acknowledge that you have read, understood, and accept the practices described in this Privacy Policy.

This Privacy Policy should be read alongside the fb303 Terms & Conditions and Responsible Gaming Policy, which together constitute the full agreement governing your use of the Platform.

For the purposes of this Privacy Policy, the following terms have the meanings assigned below:

• "Personal Data" — any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or one or more factors specific to their identity.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, fb303 is the data controller in respect of the personal data of all Platform users.
• "Data Processor" — any third party that processes personal data on behalf of fb303 under a written data processing agreement, including payment processors, KYC verification providers, and analytics service providers.
• "Consent" — any freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data for a stated purpose.
• "KYC" — Know Your Customer; the identity verification process applied to player accounts to comply with anti-money laundering and fraud prevention obligations.
• "Cookie" — a small text file placed on your device by the fb303 Platform when you visit, used to maintain session state, remember preferences, and support analytics and fraud prevention functions.

fb303 collects personal data across several categories depending on how you interact with the Platform. The table below summarises the main data types we hold:

fb303 does not collect sensitive personal data beyond what is strictly necessary for identity verification and responsible gaming compliance. We do not collect biometric data, racial or ethnic origin data, or political opinion data. Where KYC documents incidentally contain sensitive information beyond what is required, that information is not extracted, stored separately, or used for any purpose.

fb303 collects personal data through the following channels:

• Direct Submission: Information you provide when you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team, or respond to a promotional offer.
• Automated Technical Collection: Data collected automatically when you access the Platform, including your IP address, device identifiers, browser fingerprint, and session logs. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 8.
• Payment Processors: When you complete a financial transaction, our payment processing partners — including local bank transfer gateways and e-wallet providers such as OVO, DANA, and GoPay — transmit transaction confirmation data to fb303's systems. We receive only the data necessary to confirm, reconcile, and record the transaction; we do not store full payment card numbers.
• KYC Verification Partners: Where we use a third-party identity verification service to authenticate your submitted documents, that partner returns a verification result and relevant identity data points to fb303. The third-party provider acts as a data processor under a contractual data processing agreement.
• Game Studio Providers: Third-party game studios integrated into the fb303 Platform (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may transmit session and wager data back to fb303 for wallet reconciliation and responsible gaming monitoring purposes.
• Fraud and Risk Monitoring Systems: Automated systems monitor Platform activity in real time and generate risk scores and flags based on behavioural patterns. These systems process Technical Data and Betting & Gaming Data to detect fraud, money laundering, and multi-accounting.

fb303 processes your personal data only for specified, explicit, and legitimate purposes. The primary purposes for which we use your data are set out below:

• Account Creation and Management: To register your account, verify your identity, maintain accurate account records, and provide you with access to all fb303 platform features.
• Service Delivery: To process your bets and wagers, credit winnings to your Wallet, execute deposit and withdrawal transactions, and deliver a personalised gaming experience across all products including sportsbook, live casino, slots, and togel.
• KYC and Regulatory Compliance: To verify your identity and age in accordance with anti-money laundering (AML) obligations, to comply with applicable international financial crime prevention requirements, and to fulfil record-keeping obligations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, unauthorised access, money laundering, match-fixing, and any other conduct prohibited under our Terms & Conditions or applicable law.
• Responsible Gaming: To monitor your betting patterns for indicators of problem gambling, to enforce deposit limits, self-exclusion periods, and cool-down requests you have activated, and to identify accounts that may require proactive responsible gaming intervention.
• Customer Support: To respond to your enquiries, process complaints, and maintain records of your support interactions to improve service quality and ensure continuity of assistance.
• Marketing and Promotions: Where you have opted in to marketing communications, to send you information about promotions, bonuses, seasonal offers (such as Idul Fitri or Indonesian Independence Day promotions), and new product launches. You may withdraw marketing consent at any time by contacting support.
• Platform Improvement and Analytics: To analyse aggregate, anonymised usage data to improve Platform performance, user interface design, game selection, and overall user experience.
• Legal Proceedings: To establish, exercise, or defend legal claims in any forum, including arbitration proceedings or regulatory investigations.

fb303 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to enter into and perform our contractual obligations to you under the Terms & Conditions — including account creation, bet processing, and payment execution.
• Legal Obligation: Processing required to comply with applicable legal requirements, including KYC and AML obligations, regulatory record-keeping, and court or arbitration orders.
• Legitimate Interests: Processing carried out for fb303's legitimate business interests, where those interests are not overridden by your fundamental rights and freedoms. This includes fraud detection, platform security, responsible gaming monitoring, and internal analytics. We conduct a balancing assessment for each legitimate interest processing activity.
• Consent: Processing based on your explicit, freely given consent — primarily for direct marketing communications. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

fb303 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data only in the following limited circumstances:

• Payment Service Providers: Your financial data is shared with our partner payment processors — including local Indonesian bank transfer gateway operators and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) — solely to execute the financial transactions you initiate. These processors act as data processors under contractual agreements that require them to protect your data and use it only for transaction execution.
• Identity Verification Providers: During KYC verification, your identity documents and relevant personal data are transmitted to our contracted third-party verification partner. That partner returns a pass/fail result and is contractually prohibited from using your data for any purpose beyond identity verification.
• Game Studio Providers: Session identifiers and wager data are transmitted to integrated game studios (including Evolution Gaming, Pragmatic Play, and others) to the extent necessary to operate the games and reconcile results. Game studios do not receive your full identity or financial data.
• Fraud and Risk Management Services: Anonymised or pseudonymised technical data may be processed by specialist fraud detection systems to generate risk scores. Any data processed through these systems is subject to strict data processing agreements.
• Legal and Regulatory Authorities: fb303 will disclose personal data to law enforcement agencies, regulatory bodies, or judicial authorities where required by applicable law, pursuant to a valid legal order, or where necessary to protect the rights, property, or safety of fb303, its employees, or its users.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of fb303's business, personal data held by fb303 may be transferred to the acquiring entity, subject to that entity undertaking equivalent data protection obligations. Affected users will be notified of any such transfer in advance where required by applicable law.

All third parties with whom fb303 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only in accordance with fb303's instructions and applicable data protection law.

fb303 uses cookies and similar tracking technologies (including pixel tags and local storage objects) to operate and improve the Platform. The following categories of cookies are used:

You can control and manage cookies through your browser settings. Please note that disabling strictly necessary or fraud prevention cookies will impair your ability to use the fb303 Platform, including logging in and placing bets. Disabling functional and analytics cookies will not affect core Platform functionality but may result in a less personalised experience.

fb303 does not use cookies for third-party advertising or cross-site tracking purposes. We do not share cookie data with advertising networks or social media platforms.

fb303 retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, and in any event for no longer than is required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account and for a period of five (5) years following account closure, to satisfy AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in line with financial record-keeping obligations.
• KYC Verification Documents: Retained for five (5) years following account closure or the most recent KYC re-verification, whichever is later.
• Betting and Gaming History: Retained for the duration of your active account and for three (3) years following account closure, for dispute resolution and responsible gaming audit purposes.
• Support Communication Records: Retained for three (3) years from the date of the most recent interaction, for quality assurance and dispute resolution purposes.
• Technical and Log Data: Retained for up to twelve (12) months from collection, after which it is deleted or anonymised for aggregate analytics purposes.
• Marketing Consent Records: Retained for as long as you remain opted in to marketing communications, and for two (2) years following any withdrawal of consent, as evidence of prior consent and the withdrawal thereof.

Where retention beyond these standard periods is required by a specific legal obligation, court order, or ongoing regulatory investigation, fb303 will extend the retention period accordingly and will document the justification for doing so.

When personal data is no longer required and its retention period has expired, fb303 will securely delete or anonymise the data using methods appropriate to the sensitivity of the data involved.

fb303 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the fb303 Platform is encrypted in transit using industry-standard TLS protocols, protecting your personal and financial data from interception.
• Encrypted Data Storage: Sensitive personal data — including identity documents, financial account details, and password credentials — is stored with encryption at rest. Passwords are stored as salted cryptographic hashes and are never stored in plain text.
• Access Controls: Access to personal data within fb303's systems is restricted to authorised personnel who require it to perform specific job functions. Role-based access controls and multi-factor authentication are enforced for all internal systems handling personal data.
• Device Recognition and Anomaly Detection: Automated systems monitor for unusual login locations, device changes, and access patterns that may indicate account compromise, generating real-time alerts for the security team.
• Penetration Testing and Security Audits: The fb303 Platform undergoes periodic security assessments, including penetration testing by independent security specialists, to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: fb303 maintains a documented data breach response procedure. In the event of a confirmed breach affecting your personal data, we will assess the severity, contain the breach, and notify affected players without undue delay where required by applicable law.

As a data subject, you hold the following rights in respect of your personal data held by fb303. To exercise any of these rights, please contact the fb303 support team via live chat or by emailing [email protected], clearly stating the right you wish to exercise and providing sufficient information to verify your identity.

• Right of Access: You have the right to request a copy of the personal data fb303 holds about you, together with information about the purposes for which it is processed, the categories of data held, and the recipients to whom it has been disclosed.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data be corrected or completed without undue delay. If you believe the personal data we hold about you is incorrect, please contact support with the corrected information.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your personal data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent on which processing is based; or the data has been unlawfully processed. This right is subject to fb303's legal obligations to retain certain data for regulatory compliance periods.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or have objected to processing pending verification of our legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted directly to another controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Rights Related to Automated Decision-Making: Where fb303 makes decisions about you solely by automated means that produce legal or similarly significant effects — such as automated account suspension based on fraud detection — you have the right to request human review of that decision.

fb303 will respond to all verified rights requests within thirty (30) calendar days of receipt. Where a request is complex or there are a high number of simultaneous requests, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it.

The fb303 Platform is strictly intended for adults aged 21 years and over. fb303 does not knowingly collect, store, or process personal data from any individual under the age of 21. Age verification is applied as part of the account registration process, and additional age confirmation checks are conducted during KYC verification.

If fb303 becomes aware that personal data has been submitted by, or on behalf of, an individual under the age of 21, that data will be deleted immediately, the associated account will be suspended, and any funds deposited will be handled in accordance with our Terms & Conditions underage-player provisions.

If you are a parent or guardian and have reason to believe that a minor in your care has registered on the fb303 Platform or submitted personal data to us, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

The fb303 Platform may, from time to time, contain references to or integrations with third-party services — including game studio platforms, payment gateway interfaces, and responsible gaming support resources. These third parties operate under their own privacy policies, which fb303 does not control and for which fb303 accepts no responsibility.

We encourage you to review the privacy policy of any third-party service you interact with in connection with your use of the fb303 Platform. The inclusion of a third-party service within the fb303 ecosystem does not constitute an endorsement of that party's data practices.

fb303 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The "Last Updated" date at the top of this page indicates when the current version took effect.

Where changes are material — for example, a new category of data collection, a new purpose of processing, or a change in data retention periods — fb303 will notify registered Players via the email address on file and/or via a prominent notice on the Platform no less than 14 days before the changes take effect. For non-material updates such as clarifications of existing practices or corrections of typographical errors, the revised Policy will take effect immediately upon publication.

Your continued use of the fb303 Platform following the effective date of any amendment constitutes your acknowledgement of the revised Privacy Policy. If you do not accept the revised Policy, you must cease using the Platform and may request account closure in accordance with Section 12 of the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or want to report a potential data breach or privacy concern, please contact the fb303 Privacy Team through any of the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line and provide your registered username and a description of your request.
• Live Chat: Available 24/7 via the fb303 Platform. Our Indonesian-speaking support agents are on hand around the clock across all time zones (WIB, WITA, and WIT) to assist with privacy-related enquiries.

fb303 is committed to resolving all privacy concerns promptly and professionally. We aim to acknowledge all written privacy requests within two (2) business days and to provide a substantive response within thirty (30) calendar days, as described in Section 11.