Privacy Policy of 37win

1Definitions

In this Privacy Policy, the following terms carry the meanings set out below unless the context clearly requires otherwise:

2Data We Collect

37win collects only the minimum data necessary to operate a safe, compliant, and high-quality gaming platform. The categories of Personal Data we collect are as follows:

3How We Collect Data

37win collects Personal Data through the following channels:

• Direct interactions: When you register an Account, complete the KYC process, make a deposit or withdrawal, place a bet, contact our support team, or fill in any form on the platform, you provide data directly to us.
• Automated technologies: As you browse and interact with the 37win platform, we automatically collect Technical Data and Usage Data via cookies, server logs, and similar tracking technologies. See Clause 7 for full details.
• Third-party KYC providers: We use licensed identity-verification services to cross-check the documents you submit during KYC. These providers may return enriched identity-match scores to 37win, which we retain as part of your KYC record.
• Payment processors: When you transact via BCA, BRI, BNI, Mandiri, or any supported e-wallet, the relevant payment provider shares transaction confirmation data with 37win, including transaction reference numbers and timestamps.
• Fraud-prevention services: We work with specialist fraud-detection partners who may supply device-fingerprinting signals and risk-scoring outputs to help us identify suspicious activity on your Account.
• Publicly available sources: We may, where permitted and necessary, verify certain details against publicly available government or commercial registers for anti-money-laundering (AML) compliance purposes.

4Purposes of Processing

37win processes your Personal Data for the following purposes. Where a specific legal basis applies under applicable data-protection law, it is noted alongside each purpose (see also Clause 5):

5Legal Basis for Processing

37win processes your Personal Data on one or more of the following legal bases, depending on the purpose:

• Contractual necessity: Processing that is necessary to perform our contract with you — i.e., to operate your Account, accept bets, and process IDR transactions — is carried out on this basis.
• Legitimate interests: We process certain data (such as fraud-detection signals, platform analytics, and security logs) where we have a legitimate business interest that is not overridden by your data-protection rights.
• Legal obligation: KYC, AML screening, and record-keeping obligations are carried out because they are required by our international gaming licence and applicable financial-crime regulations.
• Consent: Marketing communications, optional cookies, and any processing not covered by the above bases are carried out only with your prior consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

6Data Sharing

37win does not sell, rent, or trade your Personal Data. We share your data only in the limited circumstances described below, and always with appropriate contractual safeguards in place:

• Payment processors: To process deposits and withdrawals, we share the minimum necessary financial and identity data with the relevant bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers act as independent data controllers for their own regulated payment operations.
• KYC and fraud-prevention partners: Licensed identity-verification and fraud-detection services receive copies of the documents and signals you submit, solely for verification purposes. All such partners are bound by data-processing agreements that restrict their use of your data.
• Game studios: When you play a game powered by a third-party studio (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe, and others), your session data is shared with that studio to render the game and record results. Studios do not receive your full identity or financial data.
• Analytics providers: Anonymized or pseudonymized usage and technical data may be processed by analytics platforms to help us understand platform performance. These providers receive no data that directly identifies you.
• Legal and regulatory authorities: We will disclose Personal Data to law enforcement agencies, courts, or regulatory bodies where required by a valid legal order, warrant, or our licensing obligations — and only to the extent required by that order.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 37win's business, your Personal Data may be transferred to the acquiring entity, subject to the same protections described in this Policy.

7Cookies & Tracking Technologies

37win uses cookies and similar technologies to ensure the platform functions correctly, to maintain your session, and — where you have consented — to analyze usage patterns and deliver relevant promotional content.

You may manage your cookie preferences through your browser settings. Disabling analytics or marketing cookies will not prevent you from using any core 37win feature. Note that clearing all cookies will log you out of your current session.

8Data Retention

37win retains Personal Data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active membership and for a minimum of five (5) years after Account closure, in accordance with our AML and gaming-licence record-keeping obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in line with financial-crime regulations applicable to licensed gaming operators.
• KYC documents: Retained for a minimum of five (5) years after the KYC process is completed or after Account closure, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the last interaction, to allow us to resolve any dispute that may arise after your last contact.
• Technical and usage logs: Retained for a maximum of thirteen (13) months in identifiable form, after which they are aggregated and anonymized.
• Marketing preference records: Retained for as long as your Account is active, or until you withdraw consent, plus one (1) year to allow us to demonstrate compliance with your preference.

When a retention period expires, data is securely deleted using industry-standard methods or irreversibly anonymized so that it can no longer be linked to you. Where legal proceedings or regulatory investigations are ongoing, relevant data may be preserved beyond these periods until the matter is resolved.

9Security Measures

37win applies technical, organizational, and procedural security measures appropriate to the sensitivity and volume of the personal data we process. These measures include, but are not limited to:

• Encryption in transit: All data exchanged between your device and 37win's servers is encrypted using TLS 1.2 or higher (256-bit SSL). Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at rest: Sensitive data fields (including hashed passwords, payment identifiers, and KYC document files) are encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to systems containing Personal Data is restricted on a strict need-to-know basis. All staff with access undergo background screening and receive regular data-protection training.
• Two-factor authentication (2FA): 37win supports and strongly encourages 2FA on all Member Accounts. Administrative access to backend systems requires 2FA without exception.
• Vulnerability management: 37win conducts regular penetration testing and vulnerability scanning of its platform. Critical findings are remediated within defined service-level timelines.
• Incident response: 37win maintains a documented data-breach response procedure. In the event of a breach that is likely to result in material risk to affected individuals, we will notify relevant Members without undue delay and take immediate steps to contain the breach.

10Your Rights

As a member of 37win, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 72 hours and fulfill it within 30 calendar days, or inform you of any legally permitted extension.

11Minors

37win strictly prohibits access to its platform by anyone under the age of 21 years. We do not knowingly collect Personal Data from individuals under 21. Our registration and KYC processes include automated age-screening checks, and we require a valid government-issued photo identity document that confirms date of birth before any withdrawal is approved.

If we become aware, or have reasonable grounds to believe, that Personal Data has been collected from an individual under the age of 21, we will immediately close the associated Account, delete or quarantine the data, void any winnings, and return any real-money deposits to the originating payment source wherever technically possible. If you are a parent or guardian and believe your child has registered on 37win, please contact us immediately at [email protected] with the subject line "Underage Account Report".

12International Data Transfers

37win operates as an internationally licensed platform. Some of the third-party processors we use — including KYC verification services, fraud-detection providers, and game studios — may be located in, or process data in, jurisdictions outside Indonesia. Where such transfers occur, 37win ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses or binding corporate rules with the relevant processor, requiring them to apply protections equivalent to those set out in this Privacy Policy.
• Transfers to processors located in jurisdictions that have been assessed by 37win as providing an adequate level of data protection for the specific data categories transferred.
• Where required by applicable law, your explicit consent to the transfer prior to any data being sent outside Indonesia.

By registering an Account and accepting these terms, you acknowledge that your Personal Data may be processed in countries outside Indonesia as described in this clause, subject always to the safeguards outlined above.

13Amendments

37win reserves the right to update this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or our licensing obligations. When material changes are made, we will notify active Members via the email address registered on their Account and display a prominent notice on the platform, with a minimum of seven (7) calendar days before the changes take effect.

Your continued use of the 37win platform after the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy. If you do not agree to the amended terms, you must stop using the platform and may request Account closure in accordance with the Terms & Conditions. The current version of this Privacy Policy is always accessible at https://37win.cam/privacy-policy, and the "Last Updated" date at the top of this page will reflect the most recent revision.

14Contact

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 37win processes your Personal Data, please reach out to our dedicated data-protection team using the details below. We are committed to responding to all privacy-related enquiries within five (5) business days.