Privacy Policy — gsc11

1. Definitions

Throughout this Privacy Policy, the following terms carry the specific meanings defined below. Capitalised terms not defined here carry the meaning given to them in the gsc11 Terms & Conditions.

2. Data We Collect

2.1 Registration Data

When you create an account on gsc11, we collect your full legal name, date of birth, email address, mobile phone number (Indonesian prefix), chosen username, and a hashed version of your password. This information is required to open and maintain your account.

2.2 Identity Verification (KYC) Data

To comply with anti-money-laundering requirements and to confirm that you are at least 21 years of age, we may collect copies of government-issued identity documents — specifically your Indonesian National Identity Card (KTP), driver's licence (SIM), or passport — along with a recent utility bill or bank statement confirming your registered address.

2.3 Financial Data

We record the bank account numbers and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) associated with your deposits and withdrawals, together with transaction amounts denominated in Indonesian Rupiah (IDR). We do not store full card numbers. Payment card data, where applicable, is tokenised and held exclusively by our PCI-DSS-compliant payment partners.

2.4 Usage & Behavioural Data

We automatically collect data about how you interact with the Platform, including IP address, browser type and version, operating system, device model, session duration, pages visited, games launched, bet amounts, and click-stream data. This data is used to personalise your experience, detect fraud, and improve platform performance.

2.5 Communication Data

If you contact our support team via email, WhatsApp, or Live Chat, we retain a record of those communications — including the content of messages and any attachments — for a minimum of two years, in order to maintain continuity of service and to resolve any subsequent disputes.

2.6 Responsible Gaming Data

Where you activate self-exclusion, deposit limits, loss limits, or cooling-off periods via the Platform's responsible gaming tools, we record those elections as Sensitive Data. This information is shared with our responsible gaming monitoring systems and, where legally required, with relevant self-exclusion registers.

3. How We Use Your Data

gsc11 uses the Personal Data described in Clause 2 for the following purposes:

gsc11 does not use Personal Data for automated individual decision-making that produces legal or similarly significant effects, except in the limited context of real-time fraud-scoring, where decisions may be reviewed by a human agent upon your request.

4. Legal Basis for Processing

gsc11 processes your Personal Data on one or more of the following legal grounds:

• Contractual necessity: Processing required to perform the contract between you and gsc11 — specifically, account creation, gameplay, and payment processing.
• Legal obligation: Processing required to comply with applicable law, including anti-money-laundering regulations, KYC requirements, and record-keeping obligations imposed by our international gaming licence.
• Legitimate interests: Processing necessary for gsc11's legitimate interests in fraud prevention, platform security, and service improvement — provided those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, informed consent — primarily for marketing communications and optional analytics cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

5.1 Payment Processors

To process deposits and withdrawals in Indonesian Rupiah, gsc11 shares the minimum necessary financial and identity data with local bank transfer intermediaries and e-wallet providers — including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja. These entities act as Processors and are bound by their own regulatory obligations under Indonesian financial law.

5.2 KYC & Identity Verification Partners

Identity document data collected for KYC purposes is processed by a licensed third-party verification vendor. The vendor receives only the data required to complete the verification check and is contractually prohibited from using that data for any other purpose.

5.3 Game Studios & Technology Providers

Game studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft — may receive pseudonymous player identifiers and session data to enable game functionality, calculate jackpots, and audit RTP compliance. No directly identifying Personal Data such as your full name or KTP number is shared with game studios.

5.4 Legal & Regulatory Disclosure

gsc11 may disclose Personal Data to law enforcement agencies, regulatory authorities, or courts where required by a valid legal order, warrant, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of gsc11's assets, Personal Data held by gsc11 may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy practices of the successor entity prior to the transfer taking effect, and you will have the option to close your account and request data deletion at that time.

5.6 No Sale of Personal Data

gsc11 does not sell, rent, lease, or otherwise commercially exploit your Personal Data to third-party advertisers, data brokers, or marketing agencies. This is an unconditional commitment.

6. Cookies & Tracking Technologies

6.1 Types of Cookies Used

gsc11 uses the following categories of cookies and similar tracking technologies on the Platform:

gsc11 does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts.

6.2 Managing Cookies

You may withdraw consent for functional and analytics cookies at any time via the cookie preference centre in your account settings. Additionally, all major browsers allow you to block or delete cookies through their built-in privacy settings. Note that disabling strictly necessary cookies will prevent the Platform from operating correctly.

7. Data Retention

gsc11 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a baseline:

Upon expiry of the relevant retention period, Personal Data is securely deleted or irreversibly anonymised. Where deletion is not technically feasible within backup systems, data is isolated from active Processing and deleted at the next scheduled backup rotation.

8. Security Measures

gsc11 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational measures include:

• Transport Security: All data in transit is encrypted using TLS 1.2 or TLS 1.3 with 256-bit AES cipher suites.
• Password Storage: Passwords are hashed using bcrypt with a minimum cost factor of 12. Plain-text passwords are never stored.
• Two-Factor Authentication (2FA): Players may activate TOTP-based 2FA from the account security settings panel.
• Database Encryption: Sensitive Data fields — including identity document references and bank account numbers — are encrypted at rest using AES-256.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis, enforced through role-based access control (RBAC) and comprehensive audit logging.
• Penetration Testing: The Platform undergoes independent penetration testing at least annually, with critical findings remediated within 30 days of disclosure.
• Incident Response: gsc11 maintains a documented security incident response plan. In the event of a data breach that poses a high risk to your rights, we will notify you without undue delay.

9. Your Privacy Rights

As a registered Player on gsc11, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact us as described in Clause 13.

• Right of Access: You may request confirmation of whether gsc11 holds Personal Data about you, together with a copy of that data and information about how it is used.
• Right to Rectification: If Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction: You may request that we restrict the Processing of your Personal Data in certain circumstances — for example, while you contest the accuracy of that data.
• Right to Data Portability: Where Processing is based on consent or contractual necessity and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to Object: You may object to Processing based on legitimate interests at any time. You have an absolute right to object to Processing for direct marketing purposes.
• Right to Withdraw Consent: Where Processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior Processing.

gsc11 will respond to all substantive privacy rights requests within 30 calendar days. In complex cases, this period may be extended by a further 60 days, with notice provided to you within the initial 30-day window.

10. Minors & Age Verification

gsc11 is a platform strictly for adults. We do not knowingly collect Personal Data from any individual under 21 years of age. Age verification is performed at the point of registration using automated screening, and KYC document verification is required for all withdrawals.

If gsc11 discovers — through KYC, a complaint, or any other means — that a registered account belongs to a person under 21, the account will be immediately suspended, all associated Personal Data quarantined and then deleted in accordance with our data minimisation obligations, and all funds returned to the originating payment method after identity confirmation.

11. International Data Transfers

gsc11 operates under an international gaming licence and uses technology infrastructure hosted in data centres outside Indonesia. As a result, your Personal Data may be transferred to and processed in countries whose data protection laws differ from those of Indonesia.

Where such transfers occur, gsc11 ensures that appropriate safeguards are in place — including data processing agreements that incorporate standard contractual clauses — to provide a level of data protection substantially equivalent to that required under applicable international privacy standards.

By registering on gsc11, you acknowledge and consent to the transfer of your Personal Data to the jurisdictions described in this clause. You may withdraw this consent by closing your account; however, doing so will prevent you from accessing the Platform's services.

12. Policy Amendments

gsc11 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. Where changes are material, we will provide at least 7 days' advance notice by posting a prominent notice on the Platform and, where practicable, by sending an email notification to your registered address.

The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the Platform following the effective date of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree, you should cease using the Platform and close your account before the amendment takes effect.

13. Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the way gsc11 handles your Personal Data, please contact our Data Protection team through the following channels. All contacts must be initiated by the registered account holder.

• Email: [email protected]  —  use subject line "Privacy Request" for data rights enquiries
• WhatsApp: +62 811 0000 1111
• Live Chat: Available 24/7 via the Platform, staffed by Indonesian-speaking agents in WIB (UTC+7)

gsc11 acknowledges all privacy rights requests within 5 business days and provides a substantive response within 30 calendar days, as set out in Clause 9.