Privacy Policy — t6vip

The following defined terms are used throughout this Privacy Policy:

• "Platform" — the t6vip website at https://t6vip.vu, its mobile web interface, and all associated sub-services including the sports betting, live casino, slots, and togel (Indonesia's traditional numbers lottery) products.
• "Company" / "We" / "Us" — t6vip, the entity that owns and operates the Platform as an internationally licensed online gaming operator.
• "Member" / "You" — any individual who has registered an account on the Platform or who accesses any part of the Platform as a visitor.
• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, including name, date of birth, national identity number, phone number, email address, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "KYC" — Know Your Customer — the identity and document verification process required before withdrawals are processed or account limits are increased.
• "Cookies" — small text files placed on a Member's device by the Platform for the purposes of session management, analytics, and personalisation.
• "IDR" / "Rp" — Indonesian Rupiah, the sole currency in which t6vip accounts are denominated.

t6vip collects Personal Data across several categories depending on the nature of your interaction with the Platform. The table below provides a structured overview:

We do not collect sensitive categories of Personal Data such as racial or ethnic origin, political opinions, religious beliefs, health data (beyond responsible gaming self-disclosures you initiate), or biometric data.

t6vip collects Personal Data through the following channels:

• Direct Submission: When you register an account, complete your Member profile, submit KYC documents, make a deposit or withdrawal request, contact our support team via live chat or email, or opt into a promotion.
• Automated Collection: When you visit or interact with the Platform, our servers and analytics tools automatically record Technical Data and Gaming Data as described above. This occurs regardless of whether you are logged in.
• Payment Processors: When you initiate a transaction via GoPay, OVO, DANA, ShopeePay, LinkAja, or any supported Indonesian bank transfer channel, our payment processing partners transmit the minimum transaction data necessary to process and confirm your payment.
• Identity Verification Partners: Where t6vip uses a third-party KYC verification service, that provider may share the output of its verification check (pass/fail/flag) and associated identity data with us in accordance with its own privacy policy and applicable data protection agreements.
• Cookies and Similar Technologies: As detailed in Section 9 of this Policy, Cookies and similar client-side technologies collect Technical Data on your device when you access the Platform.

t6vip processes your Personal Data only for the specific, explicit, and legitimate purposes listed below. We do not process your data in any manner incompatible with these stated purposes:

• Account Creation and Authentication: To register your Member account, verify your identity at login, and maintain the security and integrity of your account session.
• KYC Compliance: To verify that you meet the minimum age requirement of 21 years, to confirm your identity before processing withdrawals, and to meet the Company's anti-money-laundering (AML) and counter-financing-of-terrorism (CFT) obligations.
• Payment Processing: To process deposits and withdrawals via Indonesian payment channels including GoPay, OVO, DANA, BCA, BRI, BNI, Mandiri, and other supported methods, and to maintain a complete and accurate IDR transaction history for your account.
• Platform Operation and Game Delivery: To operate the sports betting, live casino, slots, and togel products; to record bet placement and settlement; to calculate and credit winnings; and to maintain RNG audit logs for game integrity purposes.
• Customer Support: To respond to your enquiries, resolve disputes, and provide assistance through our 24/7 live chat support channel, including via Indonesian-speaking agents.
• Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behaviour; to enforce deposit limits, cool-off periods, and self-exclusions you have set; and to proactively reach out where our systems flag a concern, in line with our Responsible Gaming obligations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, multi-account abuse, bot activity, collusion, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory Compliance and Reporting: To meet our reporting obligations to the relevant gaming licensing authority and to respond to lawful requests from competent authorities.
• Platform Improvement and Analytics: To analyse aggregated, anonymised usage data in order to improve the performance, functionality, and user experience of the Platform.
• Marketing Communications: Where you have given explicit consent, to send you promotional offers, bonus announcements, and seasonal campaign communications (e.g., Idul Fitri, Ramadhan, Indonesian Independence Day promotions). You may withdraw this consent at any time via your Account settings or by contacting our support team.

t6vip processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between you and t6vip — including operating your account, processing deposits and withdrawals, and settling bets — is carried out on the basis that it is necessary to fulfil our contractual obligations to you as a Member.
• Legal Obligation: Processing required to comply with applicable AML/CFT regulations, gaming licence conditions, and lawful requests from competent regulatory or law-enforcement authorities is carried out on the basis that it is legally required.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics is carried out on the basis of the Company's legitimate interest in operating a safe, secure, and compliant platform, provided that this interest is not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and for the placement of non-essential Cookies is carried out on the basis of your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

t6vip does not sell, rent, or license your Personal Data to any third party for commercial marketing purposes. We share your Personal Data only in the following limited and controlled circumstances:

• Payment Service Providers: GoPay, OVO, DANA, ShopeePay, LinkAja, and our banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) receive only the minimum transaction data necessary to process your deposits and withdrawals. These providers are contractually bound to process your data solely for payment fulfilment purposes.
• KYC and Identity Verification Providers: Where we engage a third-party identity verification service, we share the identity documents and data you submit for KYC purposes. These providers are bound by strict data-processing agreements and are prohibited from using your data for any purpose other than verifying your identity for t6vip.
• Game Content Providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive session identifiers and game-interaction data necessary to deliver their game content and maintain RNG audit trails. They do not receive your full identity data.
• IT Infrastructure and Security Providers: Cloud hosting, DDoS protection, content delivery network (CDN), and cybersecurity providers who process Technical Data as part of their service delivery, under appropriate data-processing agreements.
• Regulatory Authorities: We will disclose Personal Data to gaming regulators, financial intelligence units, law enforcement agencies, or courts where we are legally compelled to do so or where we believe in good faith that disclosure is necessary to prevent fraud, money laundering, or serious harm.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or a material portion of the Company's assets, your Personal Data may be transferred to the acquiring entity, subject to the acquiring party providing equivalent data protection commitments.

t6vip retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or our gaming licence conditions. The following retention periods apply:

When the applicable retention period expires, Personal Data is securely deleted or irreversibly anonymised. Anonymised, aggregated data that cannot be used to identify any individual may be retained indefinitely for statistical and platform-improvement purposes.

t6vip applies a layered, defence-in-depth approach to data security. The key technical and organisational measures in place include:

• TLS 256-bit Encryption: All data transmitted between your device and the t6vip Platform is encrypted using Transport Layer Security (TLS) with a minimum 256-bit cipher — the same standard used by major Indonesian banks including BCA and Mandiri for their online banking portals.
• Password Hashing: Member passwords are never stored in plain text. We use an industry-standard adaptive hashing algorithm (bcrypt) with a per-user salt to render password databases meaningless in the event of an unauthorised access incident.
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA via SMS OTP (one-time password) to their registered Indonesian mobile number. 2FA significantly reduces the risk of unauthorised account access even if login credentials are compromised.
• Access Controls: Access to Member Personal Data within t6vip's internal systems is restricted on a strict need-to-know basis. All staff with access to Personal Data undergo data protection training and are bound by confidentiality obligations.
• DDoS Protection and Web Application Firewall (WAF): The Platform is protected by enterprise-grade DDoS mitigation and a WAF to prevent injection attacks, cross-site scripting (XSS), and other common web security vulnerabilities.
• Regular Security Audits: t6vip engages independent security professionals to conduct periodic penetration testing and vulnerability assessments of the Platform infrastructure.
• Incident Response: In the event of a data breach that poses a risk to Member rights and freedoms, t6vip will notify affected Members and the relevant supervisory authority within the timeframe required by applicable law, and will provide clear guidance on steps Members can take to protect themselves.

t6vip uses Cookies and similar client-side technologies to operate the Platform effectively, to remember your preferences, and to understand how Members interact with the Platform. The categories of Cookies we use are as follows:

You may manage your Cookie preferences at any time through your Account settings panel. Please note that disabling strictly necessary Cookies will prevent you from logging in and using core Platform features. Most modern browsers also provide native controls for managing Cookies; however, browser-level Cookie deletion will not override your account-level consent settings on the Platform side.

Subject to applicable law and the conditions set out below, you hold the following rights in relation to the Personal Data t6vip holds about you:

• Right of Access: You have the right to request a copy of all Personal Data t6vip holds about you, along with information about how it is being processed. We will respond to access requests within 30 days of receipt of a verifiable identity check.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic contact information directly through your Account settings panel.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other legal basis for processing; or you object to processing and there is no overriding legitimate interest. Note that this right is limited where retention is required by law — for example, KYC and financial transaction data must be retained for the periods specified in Section 7.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data — meaning we store it but do not actively use it — while a dispute, rectification request, or objection is pending resolution.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive a structured, machine-readable copy of your Personal Data that you may transmit to another data controller.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent — including for marketing communications and non-essential Cookies — you may withdraw that consent at any time via your Account settings. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact our Data Protection contact via live chat at support@t6vip.vu (displayed as plain text — not a clickable link). We will verify your identity before processing any rights request. There is no charge for exercising your rights unless requests are manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable administrative fee or decline to act.

Age verification is enforced at three distinct points in the Member lifecycle:

1. At registration — the date of birth field is mandatory, and any submission indicating an age below 21 will be rejected automatically and the registration attempt logged.
2. At KYC verification — government-issued identity documents confirming date of birth (Indonesian KTP or valid passport) are reviewed before withdrawal functionality is activated.
3. At withdrawal — if an age discrepancy is identified at any point, the Account will be suspended pending investigation.

If t6vip discovers or has reason to believe that a Member is under 21 years of age, we will immediately suspend the Account, void all Bets placed during the underage period, return the original deposit amount to the originating payment method, and delete all Personal Data collected from the underage individual to the fullest extent permitted by our legal obligations. We may also report the registration attempt to relevant authorities where required by law.

If you are a parent or guardian and believe your child has registered an account on t6vip, please contact our support team immediately via live chat. We will investigate and act on all such reports within 24 hours (WIB).

t6vip operates as an internationally licensed gaming platform. As a result, some of your Personal Data may be transferred to, stored in, or processed in countries outside of Indonesia — including the jurisdiction in which the Company holds its gaming licence and the locations of our cloud hosting and payment processing infrastructure.

Where Personal Data is transferred internationally, t6vip implements one or more of the following safeguards to ensure your data receives an adequate level of protection equivalent to that which it would receive in Indonesia:

• Data processing agreements with all third-party processors that incorporate binding data protection obligations consistent with applicable international privacy standards.
• Standard contractual clauses or equivalent transfer mechanisms recognised under applicable data protection frameworks.
• Transfers only to countries or entities that have been assessed by the Company as providing an adequate level of data protection for the categories of data being transferred.

You may request further information about the specific safeguards in place for international transfers by contacting our support team at support@t6vip.vu (plain text — not a clickable link).

t6vip reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our gaming licence conditions. When material changes are made, we will:

• Post the updated Privacy Policy on this page with a revised effective date at the top of the document.
• Display a prominent notice on the Platform homepage for a minimum of 14 days following the update.
• Where practicable and where the change materially affects your rights, notify you via the email address registered to your Account.

Your continued use of the Platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of and, where applicable, consent to the updated terms. If you do not agree with any material change to this Policy, you may request Account closure by contacting our support team via live chat. We will process your request in accordance with our account closure procedure and applicable data retention obligations.

We recommend reviewing this Privacy Policy periodically — particularly before making a deposit or initiating a withdrawal — to ensure you remain fully informed about how your Personal Data is handled.

If you have any questions, concerns, or complaints regarding this Privacy Policy, the processing of your Personal Data, or the exercise of your data subject rights, please contact the t6vip privacy team through the following channels:

• Live Chat: Available 24/7 directly on the Platform — the fastest way to reach a t6vip agent, including Indonesian-speaking staff who can assist with privacy enquiries in Bahasa Indonesia.
• Email: support@t6vip.vu (plain text only — not a clickable link). Please mark the subject line of your email with "Privacy Enquiry" or "Data Subject Request" to ensure prompt routing to the appropriate team. Response within 24 hours (WIB, UTC+7).
• Support Hours: 24 hours a day, 7 days a week — including Indonesian public holidays such as Idul Fitri, Indonesian Independence Day (17 August), Nyepi, and Waisak.

For data subject rights requests (access, rectification, erasure, portability), please be prepared to verify your identity by confirming your registered username, email address, and the last four digits of the primary payment method linked to your account. This verification step is necessary to protect your data from unauthorised disclosure.

If you are not satisfied with t6vip's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction in which the Company holds its gaming licence.