gbo4d Privacy Policy

1.1   gbo4d ("we", "us", "our") operates the online gaming platform accessible at https://gbo4d.vu (the "Platform"). As the data controller for personal information processed through the Platform, gbo4d takes its data protection obligations seriously and has designed its data practices to reflect the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

1.2   This Privacy Policy applies to all current and prospective Players of the Platform, as well as to visitors who browse the Platform without registering an Account. It covers all personal data processed in connection with the use of gbo4d services, including account registration, identity verification (KYC), financial transactions, customer support interactions, and promotional communications.

1.3   This Privacy Policy should be read in conjunction with gbo4d's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference into the overall agreement between you and gbo4d.

2.1   For the purposes of this Privacy Policy, the following terms have the meanings set out below:

3.1   gbo4d collects only the Personal Data that is reasonably necessary to provide a safe, compliant, and enjoyable gaming experience. The categories of Personal Data we collect are as follows:

3.2   gbo4d does not collect or store sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data beyond what is strictly required for facial liveness verification during KYC. Biometric liveness data is processed by the KYC service provider and is not retained by gbo4d after verification is complete.

4.1   Directly from you. The majority of Personal Data we hold is provided directly by you during account registration, KYC submission, deposit and withdrawal requests, support interactions, and when you update your Account profile.

4.2   Automatically during Platform use. Technical Data and Usage Data are collected automatically as you browse and interact with the Platform, through server logs, session tracking technology, and first-party cookies. This data collection is necessary to maintain platform security, detect fraud, and ensure game integrity.

4.3   From third-party service providers. gbo4d receives limited Personal Data from authorised third parties, including:

• KYC identity verification providers, who return a verification status (pass/fail) and the identity attributes used to confirm your identity.
• Payment processors (including the Indonesian bank networks and e-wallet providers listed above), who transmit transaction confirmation data — including your account name and transaction amount — to enable deposit crediting and withdrawal processing.
• Anti-fraud and anti-money-laundering (AML) screening services, which flag accounts or transactions that match risk profiles in their databases.
• Analytics providers, which supply aggregated and anonymised behavioural data to help gbo4d improve platform usability and game selection. gbo4d uses only anonymised aggregates from these providers; individual player-level data is not shared outbound for analytics purposes.

5.1   gbo4d processes your Personal Data for the following specific purposes:

5.2   gbo4d will not process your Personal Data for any purpose that is incompatible with the purposes set out in clause 5.1 without first obtaining your explicit consent or being required to do so by law.

6.1   Contractual necessity. Processing for account registration, KYC, deposit and withdrawal handling, and game delivery is necessary for the performance of the contract between gbo4d and the Player (as set out in the Terms & Conditions). Without this processing, gbo4d cannot provide its services to you.

6.2   Legal obligation. Processing for AML compliance, fraud prevention, and regulatory reporting is required by the laws and regulations applicable to gbo4d's international gaming licence. gbo4d has no discretion to opt out of this processing.

6.3   Legitimate interests. Processing for platform security, responsible gaming monitoring, customer support quality assurance, and aggregated analytics is carried out on the basis of gbo4d's legitimate interests in operating a safe, fair, and commercially sustainable gaming platform. These legitimate interests have been balanced against your privacy rights and do not override them.

6.4   Consent. Processing for promotional communications (including promotional email, SMS, and WhatsApp marketing) is based on your explicit opt-in consent, given at the point of registration or subsequently through your Account settings. You may withdraw this consent at any time by updating your Marketing Preferences in your Account dashboard or by contacting support.

7.1   gbo4d may share your Personal Data with the following categories of authorised third parties:

• KYC verification providers: Identity Data is shared with our contracted KYC partner to verify your government-issued ID and confirm your date of birth and residential details. The KYC partner processes this data under a strict data processing agreement and may not use it for any other purpose.
• Payment service providers: Financial Data and Identity Data are shared with Indonesian bank transfer networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to facilitate deposit crediting and withdrawal disbursement.
• AML and fraud screening services: Transaction Data and Identity Data are screened against sanctions lists, politically exposed persons (PEP) databases, and fraud risk registers by our contracted compliance partners.
• Game content providers: Anonymised game session identifiers — not your name or financial data — are transmitted to game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe, and others) to authenticate game sessions and record results. These studios do not receive your personal identity or payment data.
• Customer support tooling: Communications Data may be stored in our contracted customer support platform (a ticketing and live chat system) which processes data on gbo4d's behalf under a data processing agreement.
• Regulatory authorities: gbo4d may be legally required to disclose Personal Data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction. In such cases gbo4d will disclose only the minimum data required and will notify the affected Player where legally permissible.
• Corporate restructuring: In the event of a merger, acquisition, or sale of gbo4d's business or assets, Player Personal Data may be transferred to the successor entity, subject to the same privacy protections set out in this policy. Players will be notified of any such transfer.

7.2   All third-party Data Processors engaged by gbo4d are contractually bound to: (a) process Personal Data only on gbo4d's documented instructions; (b) implement appropriate technical and organisational security measures; (c) not sub-process data without gbo4d's prior written consent; and (d) assist gbo4d in responding to Player data rights requests within the applicable timeframe.

8.1   gbo4d retains your Personal Data for as long as your Account remains active and for a defined period thereafter, in accordance with the retention schedule below:

8.2   Where a Player's Account has been suspended or closed as a result of a suspected AML or fraud breach, gbo4d may retain relevant Personal Data beyond the standard retention periods for as long as is necessary for active investigation, legal proceedings, or regulatory inquiry.

8.3   At the end of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification.

9.1   gbo4d applies a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the gbo4d Platform — the same encryption standard used by Indonesia's leading banks including BCA and BRI.
• Encrypted-at-rest storage for all Personal Data and Financial Data held on gbo4d servers. Encryption keys are managed under a strict key management policy with regular rotation.
• Access controls: Personal Data is accessible only to gbo4d staff who require it to perform their specific job function. All staff access is role-based, logged, and subject to periodic audit.
• Multi-factor authentication (MFA) is enforced for all internal systems that hold Player Personal Data.
• Intrusion detection systems (IDS) and 24/7 security monitoring are in place to detect and respond to anomalous access patterns in real time.
• Regular penetration testing by independent security firms to identify and remediate vulnerabilities before they can be exploited.
• Secure software development lifecycle (SSDLC) practices, including code review, dependency scanning, and security testing integrated into the Platform's development pipeline.

9.2   In the event of a personal data breach that is likely to result in a risk to your rights or interests, gbo4d will notify affected Players without undue delay and will take all reasonable steps to contain and mitigate the impact of the breach.

9.3   While gbo4d implements robust technical and organisational security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own Account credentials. gbo4d will never ask you for your password via email, live chat, or phone.

10.1   gbo4d uses first-party cookies and similar tracking technologies to operate the Platform and improve the Player experience. We do not use third-party advertising cookies or cross-site behavioural tracking cookies. The cookies deployed by gbo4d fall into the following categories:

10.2   You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging into your Account. Disabling functional or analytics cookies will not affect your ability to use the core Platform but may result in a less personalised experience.

11.1   As a Player whose Personal Data is processed by gbo4d, you hold the following rights with respect to your information:

• Right of access: You may request a copy of all Personal Data that gbo4d holds about you. gbo4d will provide this within 30 days of receiving a valid request.
• Right to rectification: If any Personal Data gbo4d holds about you is inaccurate or incomplete, you may request that it be corrected. Players may update their contact details directly through the Account dashboard; changes to KYC-verified identity data require a formal support request and re-verification.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where processing is unlawful. Note that gbo4d may be required by law to retain certain categories of data (particularly KYC and financial records) for up to 5 years after Account closure, and erasure requests cannot override these legal retention obligations.
• Right to restriction of processing: You may request that gbo4d restrict processing of your Personal Data while a rectification request is being evaluated or where you contest the lawfulness of processing.
• Right to data portability: You may request a copy of the Personal Data you provided to gbo4d in a structured, commonly used, machine-readable format (such as CSV or JSON), where processing is based on consent or contractual necessity.
• Right to object: You may object to processing carried out on the basis of legitimate interests. gbo4d will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.
• Right not to be subject to automated decision-making: gbo4d uses automated systems for fraud detection and responsible gaming risk scoring. Where an automated decision has a significant effect on your Account (e.g., Account suspension triggered by an automated AML alert), you have the right to request human review of that decision by contacting our support team.

11.2   To exercise any of the above rights, please contact the gbo4d Data Privacy team by email at [email protected] (plain text — not a clickable link) with the subject line "Data Rights Request — [Your Account Username]". gbo4d will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case gbo4d will notify you of the extension.

12.1   The gbo4d Platform is strictly intended for adults aged 21 and over. gbo4d does not knowingly collect Personal Data from individuals under 21 years of age. Age verification is a mandatory step in the Account registration and KYC process.

12.2   If gbo4d discovers, at any point, that an Account has been created by or on behalf of a person under the age of 21, the Account will be immediately suspended, all deposits returned to the verified payment source, all winnings voided, and all Personal Data associated with the Account deleted without undue delay (subject only to any mandatory AML reporting obligations).

12.3   Parents and guardians who are concerned about a minor accessing the gbo4d Platform should consider implementing device-level content filtering tools. gbo4d cooperates fully with any verified request from a parent or guardian to close an Account held by a minor.

13.1   gbo4d operates as an internationally licensed gaming platform. Some of the third-party service providers engaged by gbo4d — including KYC verification partners, cloud infrastructure providers, and game studios — may process Personal Data in jurisdictions outside Indonesia.

13.2   Where Personal Data is transferred internationally, gbo4d ensures that appropriate safeguards are in place, including contractual clauses that impose data protection obligations equivalent to those applied within gbo4d's own operations. gbo4d does not transfer Personal Data to jurisdictions that lack an adequate level of data protection without first implementing such contractual safeguards.

13.3   All Personal Data transferred to payment service providers — including Indonesian bank networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) — is processed within Indonesia's domestic payment infrastructure and is subject to Bank Indonesia's regulatory framework.

14.1   gbo4d may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. Where an update is material — meaning it significantly changes how we use your Personal Data or affects your rights — gbo4d will notify all registered Players by email at least 14 days before the amendment takes effect.

14.2   Non-material updates (such as clarifications, typographical corrections, or changes to contact details) may be published without advance notice and take effect from the date of publication. The "Last Updated" date at the top of this page will reflect the date of the most recent revision.

14.3   Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not accept the amended terms, you should close your Account and cease using the Platform before the effective date.

14.4   The current version of this Privacy Policy is always accessible at https://gbo4d.vu/privacy-policy. Prior versions are available on request by contacting our support team.

15.1   If you have any questions about this Privacy Policy, wish to exercise a data right, or have a concern about how gbo4d processes your Personal Data, please contact us through any of the following channels:

• Live Chat: Available 24/7 via the live chat widget on any page of the gbo4d Platform. For data privacy matters, please open the chat and request to speak with the Data Privacy team.
• WhatsApp: Available 08:00–24:00 WIB. Contact details are provided in your Account dashboard after login.
• Email: [email protected] (plain text — not a clickable link). Use the subject line "Privacy Enquiry — [Your Account Username]". Response time: 2–12 hours, 24/7.

15.2   gbo4d takes all privacy complaints seriously. Upon receiving a complaint, gbo4d will: (a) acknowledge receipt within 3 business days; (b) investigate the matter thoroughly; (c) provide a substantive written response within 20 business days; and (d) where the complaint is upheld, take immediate remedial action and notify you of the steps taken.

15.3   If you are not satisfied with gbo4d's response to your complaint, you have the right to escalate the matter to the relevant data protection authority or the dispute resolution body specified under gbo4d's international gaming licence. gbo4d will cooperate fully with any such authority in the investigation of a complaint.