gb007 Privacy Policy

This Privacy Policy is issued by gb007 ("gb007", "we", "us", "our") and governs the collection, storage, processing, and disclosure of personal data relating to all users ("you", "Player", "User") of the gb007 online gaming platform accessible at https://gb007.vip and all associated mobile browser interfaces (collectively, the "Platform").

gb007 is committed to protecting the personal data of Indonesian players and all other users of the Platform. We process personal data in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. Our obligations extend to maintaining robust technical and organisational security measures appropriate to the risk presented by our data processing activities.

By accessing or using the Platform — including browsing the website without registering — you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree with any part of this policy, you must discontinue use of the Platform immediately.

gb007 collects personal data across the following categories. We collect only what is necessary for the stated purpose and do not process data beyond what is required to operate the Platform securely and lawfully.

gb007 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious or philosophical beliefs, biometric data for identification purposes beyond government-ID photographs submitted during KYC, or health data. If you voluntarily disclose such information in a support chat, it will be handled with heightened care and not used for profiling.

Personal data is collected through the following mechanisms:

• Direct submission: Data you provide when registering an Account, completing KYC, making a deposit or withdrawal, contacting customer support, or opting in to marketing communications.
• Automated technical collection: Technical data such as IP addresses, device identifiers, and browser information is collected automatically when you access the Platform. This is standard practice for all internet-based services and is necessary for security monitoring and fraud prevention.
• Cookies and similar technologies: gb007 uses first-party session cookies and persistent preference cookies to maintain your logged-in state, remember your language preference, and deliver a consistent user experience. See Section 8 for detailed cookie information.
• Payment processors: When you make a deposit or withdrawal via Indonesian banks (BCA, BRI, BNI, Mandiri, etc.) or e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processing partners return confirmation data — such as transaction reference numbers and masked account identifiers — to gb007. We do not receive or store your full bank account credentials.
• Identity verification providers: During KYC, document images are processed by our secure identity verification system. Verification results (pass/fail, document type confirmed) are retained; raw document images are deleted once verification is complete unless retention is required by our compliance obligations.
• Analytics systems: gb007 uses internal analytics tools to aggregate and analyse Platform usage patterns. These systems do not create individual behavioural profiles for sale or disclosure to third parties.

gb007 processes your personal data for the following specific purposes:

1. Account creation and management: To register your Account, authenticate your identity at login, maintain your session, and manage Account settings including responsible gaming controls such as deposit limits and self-exclusion.
2. Identity verification (KYC): To verify that you are at least 21 years of age, are a resident of Indonesia, and are who you claim to be, in accordance with our anti-fraud and anti-money-laundering obligations.
3. Payment processing: To process deposits and withdrawals in Indonesian Rupiah via your nominated bank account or e-wallet, and to maintain an accurate record of all financial transactions on your Account.
4. Game and sportsbook service delivery: To record wagers, calculate outcomes, credit winnings, apply bonus terms, and maintain a fair and accurate gaming environment across all Platform products including live casino tables, slots, and the sportsbook.
5. Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and provide assistance via live chat and email.
6. Responsible gaming: To monitor for signs of problem gambling behaviour, enforce self-exclusion requests, apply deposit and session time limits you have set, and proactively reach out if our systems detect patterns consistent with harmful gambling.
7. Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorised Account access, money laundering, bonus abuse, multi-accounting, and other prohibited conduct as described in our Terms & Conditions.
8. Legal and regulatory compliance: To comply with applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and to maintain records required by our international gaming licence.
9. Marketing communications (consent-based): To send you promotional emails, bonus offers, and Platform updates — strictly only where you have given explicit prior consent. You may withdraw this consent at any time.
10. Platform improvement: To analyse aggregated, anonymised usage data in order to improve the Platform's performance, user experience, and product range.

gb007 relies on the following legal bases for processing your personal data, depending on the purpose involved:

• Contractual necessity: Processing that is necessary to perform the contract between you and gb007 (i.e., to provide you with gaming services under our Terms & Conditions), including Account management, KYC, payment processing, and game service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money-laundering checks, age verification, and the maintenance of financial transaction records.
• Legitimate interests: Processing necessary for gb007's legitimate business interests that are not overridden by your rights — specifically, fraud prevention, security monitoring, and Platform analytics. We conduct a balancing assessment before relying on this basis to ensure your interests and fundamental rights are properly considered.
• Consent: Processing for marketing communications, which requires your explicit prior consent and which you may withdraw at any time without affecting the lawfulness of prior processing.

gb007 does not sell, rent, or commercially disclose your personal data to third parties. We share data only in the following limited and controlled circumstances:

• Payment processors and banking partners: Sharing of transaction-relevant data (name, account reference, amount in IDR) with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) strictly to execute your requested financial transactions.
• Identity verification providers: Submission of KYC documents to our trusted identity verification service provider solely for the purpose of confirming your identity and age. This provider operates under a strict data processing agreement with gb007 and is not permitted to use your data for any other purpose.
• Game content providers: Aggregated, anonymised game-play data may be shared with our licensed game studio partners (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) for game performance analytics. No personally identifiable data is shared with game studios.
• Regulatory and law enforcement authorities: Disclosure to competent authorities where required by applicable law, court order, or lawful regulatory request. gb007 will notify you of any such disclosure unless prohibited from doing so by law.
• Corporate group entities: Personal data may be shared within the gb007 corporate group for internal administrative purposes, including group-level compliance monitoring and consolidated fraud detection. All group entities are bound by equivalent data protection standards.
• Professional advisers: Lawyers, auditors, and insurers engaged by gb007 on a confidential basis, where necessary for the exercise or defence of legal claims or for regulatory audit purposes.

gb007 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any individual. Anonymised, aggregated data may be retained indefinitely for statistical analysis and Platform improvement without privacy implications.

gb007 uses cookies and similar browser storage technologies to operate the Platform effectively. Cookies are small text files placed on your device by the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in as you navigate between pages, and security tokens that protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without disabling core Platform functionality.
• Preference cookies: Store your personal preferences such as language setting and notification configuration. These improve your experience on repeat visits. Disabling them will cause the Platform to revert to default settings on each visit.
• Analytics cookies: First-party analytics cookies help gb007 understand how players navigate the Platform — which pages are visited most frequently, where users encounter difficulty, and which features are most used. This data is aggregated and anonymised. No third-party advertising analytics cookies are deployed on the Platform.
• Security and fraud-prevention cookies: Used to detect and block automated bots, credential-stuffing attacks, and other malicious traffic patterns. These are strictly necessary for Platform integrity.

gb007 does not use third-party advertising cookies, tracking pixels from social media platforms, or any cookie-based technology that creates a cross-site behavioural profile of individual users for advertising purposes.

You can manage cookie settings through your browser's privacy controls. Clearing all cookies will log you out of your Account and reset your preferences. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

gb007 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• TLS 1.3 encryption: All data in transit between your device and gb007's servers is encrypted using Transport Layer Security 1.3, the current industry standard for web communications.
• AES-256 encryption at rest: Sensitive personal data fields — including identity document references, financial account identifiers, and hashed credentials — are encrypted at rest using AES-256.
• Password hashing: Account passwords are never stored in plain text. gb007 uses a modern adaptive hashing algorithm (bcrypt with a suitable cost factor) to store password hashes. Even in the unlikely event of a database compromise, your plain-text password cannot be recovered from the stored hash.
• Two-factor authentication (2FA): gb007 strongly encourages all players to enable 2FA on their Accounts. When enabled, 2FA adds an additional layer of protection requiring a time-based one-time password (TOTP) in addition to your username and password at each login.
• Access controls: Internal access to personal data is governed by strict role-based access controls. Only personnel with a documented business need are granted access to specific categories of personal data. All access events are logged and audited.
• Penetration testing and vulnerability management: gb007 commissions periodic external security assessments of the Platform and promptly remediates identified vulnerabilities in accordance with a defined risk-based patching schedule.
• Incident response: gb007 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to your rights and freedoms, we will notify affected players without undue delay and provide guidance on protective steps you can take.

As a user of the gb007 Platform, you hold the following rights with respect to your personal data. gb007 is committed to honouring these rights in a timely and transparent manner:

To exercise any of the above rights, please contact gb007 support via live chat or email at [email protected]. All rights requests will be acknowledged within 48 hours and actioned within thirty (30) days. gb007 will not charge any fee for processing a rights request unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

The gb007 Platform is strictly intended for adults aged 21 and above. gb007 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the Account registration and KYC process.

If gb007 becomes aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated Account, returning any deposited funds to the originating payment method after appropriate verification. Any winnings accrued through an underage Account will be voided.

If you believe that a person under 21 has registered an Account on the Platform, please notify us immediately via live chat or at [email protected] and we will investigate promptly.

gb007's primary servers and data storage infrastructure are located in data centres that maintain internationally recognised security certifications. In the course of providing gaming services to Indonesian players, personal data may be processed by our service providers in jurisdictions outside Indonesia — for example, identity verification providers, payment processing infrastructure, and game content delivery networks.

Where personal data is transferred internationally, gb007 ensures that appropriate safeguards are in place to protect that data to at least the same standard as is required within Indonesia. These safeguards include:

• Contractual data processing agreements incorporating standard data protection clauses that impose equivalent obligations on the receiving party.
• Transfer only to service providers who maintain ISO 27001 or equivalent information security certifications.
• Regular audits of third-party data processors to confirm ongoing compliance with their contractual data protection obligations.

gb007 does not transfer personal data to jurisdictions or entities that cannot provide an adequate level of data protection. If you have questions about specific international transfer arrangements, please contact us at the details provided in Section 15.

The gb007 Platform does not contain links to external third-party websites as a matter of policy. However, if you navigate to a third-party website from a source that referenced gb007 — for example, an affiliate or a search engine results page — please be aware that those websites operate under their own privacy policies, for which gb007 accepts no responsibility.

gb007's game content providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) deliver their game engines directly within the gb007 Platform. These game engines operate under separate data processing agreements with gb007. The game studios do not have independent access to your Account-level personal data; they receive only the anonymised session and game-round data necessary to render the game and calculate outcomes.

gb007 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory guidance, or the introduction of new Platform features. When material changes are made, gb007 will:

• Update the "Effective Date" and "Version" fields at the top of this page.
• Send a notification email to all registered players' verified email addresses at least seven (7) days before the changes take effect.
• Display a prominent notice on the Platform's homepage for a minimum of seven (7) days prior to the new version taking effect.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you must cease using the Platform and request Account closure before the effective date. Your Wallet Balance will be returned to your verified payment method upon closure.

We encourage you to review this page periodically even in the absence of a notification, as minor non-material updates (such as clarifications of existing practices or corrections of typographical errors) may be made without formal notification.

If you have any questions, concerns, or requests relating to this Privacy Policy or to gb007's handling of your personal data, please contact our Data Privacy team through the following channels:

• Live Chat: Available 24/7 via the live chat widget on the gb007 Platform. This is the fastest route to a response for Account-specific privacy queries. Our native Indonesian-speaking support agents are available around the clock, including during public holidays such as Idul Fitri, Nyepi, and throughout the Ramadhan period.
• Email: [email protected] — for formal written privacy requests, data subject rights exercises, and complaints. Please mark the subject line "Privacy Request" so that your message is directed to the appropriate team. We aim to acknowledge all privacy emails within 24 hours and to provide a substantive response within thirty (30) days.

If you are not satisfied with gb007's response to a privacy concern, you have the right to escalate the matter to a senior member of our compliance team by stating this clearly in your follow-up communication. gb007 is committed to resolving all privacy complaints fairly and transparently, and will provide a final written determination within five (5) business days of an escalation request being received.