Privacy Policy — rp667

Introduction

This Privacy Policy ("Policy") describes how rp667 ("we," "us," "our," or the "Platform") collects, processes, stores, and — where applicable — shares the personal data of individuals ("you" or the "Member") who register an account, access, or otherwise interact with the rp667 website at https://rp667.cam and its associated services.

rp667 is committed to handling personal data responsibly, transparently, and in compliance with internationally recognized data protection principles. We operate in the Indonesian market and take seriously our obligations to each member who entrusts us with their information.

By registering an rp667 account or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood the practices described herein. Where rp667 relies on your consent as a legal basis for processing, you will be asked to provide that consent expressly and separately at the relevant point of collection.

Definitions

The following terms carry the meanings assigned below throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable individual. This includes direct identifiers such as your name, KTP number, and email address, as well as indirect identifiers such as your IP address or device ID when these can be linked to you.
• "Processing" — Any operation performed on personal data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, rp667 is the Data Controller of all personal data collected through the Platform.
• "Data Processor" — A third party that processes personal data on behalf of rp667 under a binding contractual arrangement, for example a cloud hosting provider or payment gateway.
• "KYC" (Know Your Customer) — The identity and age-verification procedure rp667 conducts to confirm that Members are who they claim to be and meet the eligibility requirements set out in the Terms & Conditions.
• "Sensitive Personal Data" — A subset of personal data that warrants heightened protection, including copies of government-issued identity documents (KTP), biometric data, and financial account information.
• "Cookie" — A small text file placed on your device by the rp667 Platform to facilitate session management, security, analytics, and personalization.
• "Third Party" — Any individual or entity that is not rp667 and is not acting under rp667's direct authority as a Data Processor.

Data Controller Identity

rp667 is the Data Controller responsible for your personal data. The Platform operates the website at https://rp667.cam and all services accessible through that domain. All data protection queries, subject access requests, and erasure requests should be directed to the rp667 data protection contact detailed in Clause 14 of this Policy.

Where rp667 engages third-party Data Processors — such as payment gateway providers, cloud infrastructure vendors, or identity verification services — those parties process data strictly on rp667's instructions, under written data-processing agreements, and may not use your personal data for any purpose of their own.

Personal Data We Collect

rp667 collects personal data through three primary channels: information you provide directly, information generated automatically by your use of the Platform, and — in limited circumstances — information received from trusted third-party verification services.

4.1 Data You Provide Directly

• Registration Data: Full legal name, date of birth, city of residence (e.g., Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta), email address, and a self-selected username and password.
• KYC Documentation: A scanned or photographed copy of your Indonesian KTP (Kartu Tanda Penduduk), a selfie photograph holding your KTP, proof of residential address (such as a recent BCA, BRI, BNI, or Mandiri bank statement), and proof of payment method ownership where requested.
• Financial Information: Bank account details for the accounts you designate for deposits and withdrawals (bank name, account number, account holder name). For e-wallet users, the registered phone number associated with your OVO, DANA, GoPay, ShopeePay, or LinkAja account.
• Communications: The content of any messages you send to rp667 via live chat, email, or WhatsApp, including support requests, complaints, and account queries.

4.2 Data Generated Automatically

• Technical Data: IP address, approximate geolocation (derived from IP), device type and model, operating system, browser version, and unique device identifiers.
• Session and Usage Data: Pages visited, features accessed, game sessions initiated, wagers placed, session duration, login timestamps, and navigation paths through the Platform.
• Cookie and Tracking Data: Data gathered via first-party cookies and similar technologies as described in Clause 8 below.

4.3 Data Received from Third Parties

In cases where rp667 requires additional identity verification beyond the documents provided by the Member, we may use regulated third-party identity verification services to cross-reference the information you have supplied. These services return only a verification outcome (confirmed / unconfirmed) and do not supply additional personal data beyond what you have already provided to rp667.

How We Use Your Personal Data

rp667 uses your personal data for the following purposes, always within the scope of the legal bases described in Clause 6:

• Account Creation and Management: Setting up, maintaining, and administering your rp667 Member account, including processing deposits and withdrawals in IDR and managing your account Balance.
• Identity and Age Verification (KYC): Confirming that you meet rp667's eligibility requirements — in particular that you are at least 21 years of age and a resident of Indonesia — and meeting our anti-money-laundering obligations.
• Transaction Processing: Executing deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja, and processing withdrawal requests to your designated account.
• Fraud Prevention and Security: Monitoring account activity, detecting and investigating suspicious behavior, preventing multi-account abuse, and protecting rp667 and its members from financial crime.
• Responsible Gaming Monitoring: Analyzing usage patterns to identify Members who may be at risk of developing problematic gambling behaviors, and triggering outreach as described in our Responsible Gaming Policy.
• Customer Support: Responding to your support queries, resolving complaints, and maintaining a record of communications for quality assurance and regulatory purposes.
• Legal and Regulatory Compliance: Meeting our obligations under applicable anti-money-laundering, counter-terrorism financing, and data protection laws, including responding to lawful requests from regulatory or law enforcement authorities.
• Platform Improvement: Analyzing aggregated and anonymized usage data to understand how Members use the Platform and to improve performance, usability, and the range of games and markets offered.
• Marketing Communications (Opt-in Only): Sending promotional emails or notifications about rp667 bonuses, new games, and seasonal promotions where you have explicitly opted in to receive such communications. You may withdraw this consent at any time by contacting support.

Legal Bases for Processing

rp667 processes your personal data only where a recognized legal basis exists for doing so. The legal bases we rely upon are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between you and rp667 — primarily account registration, deposit and withdrawal processing, KYC verification, and the delivery of gaming services.
• Legal Obligation: Processing that rp667 is required to carry out under applicable law, including anti-money-laundering record-keeping, identity verification, and cooperation with authorized regulatory or law enforcement requests.
• Legitimate Interests: Processing that serves rp667's legitimate business interests — such as fraud prevention, platform security, and improving the Member experience — where those interests are not overridden by your data protection rights.
• Consent: Processing that is based solely on your freely given, informed, and specific consent — in particular, marketing communications. Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of prior processing.

Sharing Your Personal Data

rp667 does not sell your personal data to any third party. We share personal data only in the circumstances described below, and only to the minimum extent necessary for each purpose:

• Payment Service Providers: To process deposits and withdrawals, rp667 shares necessary financial and identity information with the relevant payment gateway or local bank partner (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay). These providers are bound by their own regulatory obligations and by contractual data-processing terms with rp667.
• Identity Verification Services: Where supplementary KYC checks are required, anonymized or hashed identity data may be shared with regulated third-party verification providers solely for the purpose of confirming Member identity. These providers return only a pass/fail result.
• Cloud Infrastructure and Hosting Providers: rp667's Platform and data are hosted on secure cloud infrastructure. Our infrastructure providers act as Data Processors and process data only on rp667's documented instructions under binding agreements.
• Legal and Regulatory Authorities: rp667 will disclose personal data to regulators, law enforcement agencies, courts, or other government bodies where required to do so by a valid legal obligation, court order, or lawful authority request. Where permitted, rp667 will notify the affected Member before making such a disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of rp667's assets, personal data held by rp667 may be transferred to the acquiring entity as part of that transaction. Affected Members will be notified in advance and the acquiring entity will be required to process Member data in accordance with this Policy or notify Members of any material changes.

rp667 does not share your personal data with advertisers, data brokers, or any entity for the purpose of targeted advertising on third-party platforms.

Cookies & Tracking Technologies

rp667 uses first-party cookies and similar browser-based technologies to operate the Platform securely and to improve the Member experience. We do not deploy third-party advertising cookies or cross-site tracking technologies on the rp667 Platform.

The types of cookies rp667 uses are:

• Strictly Necessary Cookies: These are essential for the Platform to function. They manage your login session, maintain your Balance display, route your traffic to the correct server, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: These remember your preferences — such as your preferred language setting or last-visited game category — so you do not need to reconfigure them on each visit. Disabling these cookies may reduce personalization but will not prevent you from using the Platform.
• Analytics Cookies: rp667 uses anonymized, first-party analytics data to understand how Members navigate the Platform, which pages and games are most popular, and where technical errors occur. This data is aggregated and cannot be used to identify you individually.

Most browsers allow you to control cookie settings through their privacy or settings menu. Blocking strictly necessary cookies will prevent you from logging in to your rp667 account. rp667 does not respond to browser-level "Do Not Track" signals because the Platform does not use third-party cross-site tracking.

Data Retention

rp667 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected or to comply with applicable legal, regulatory, and operational requirements. The retention periods below represent our standard schedules; specific data categories may be retained for longer where required by a lawful order or ongoing investigation.

• Active Account Data: Retained for the full duration of your rp667 membership and for a period of five years following voluntary account closure or the last transaction, whichever is later — in line with standard anti-money-laundering record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five years from the date of account closure. Where an account is the subject of a regulatory investigation, documents will be retained until the investigation is formally concluded.
• Transaction Records: Individual deposit and withdrawal records are retained for five years from the date of each transaction.
• Customer Support Communications: Live chat transcripts, email correspondence, and support ticket records are retained for three years from the date of the communication.
• Technical and Log Data: Server logs and IP address records are retained for 12 months unless a security incident requires their preservation for a longer period.
• Marketing Consent Records: Records of your marketing opt-in or opt-out status are retained for the duration of your membership and for three years following account closure.

Once a retention period has elapsed, personal data is securely and irreversibly deleted or anonymized so that it can no longer be linked to any individual Member.

Your Data Protection Rights

As an rp667 Member, you hold a set of rights in relation to your personal data. These rights may be subject to certain conditions and exemptions — for example, rp667 may decline an erasure request where retention is required by applicable law — but we will always respond to your request in good faith and explain any limitation that applies.

To exercise any of the above rights, please contact the rp667 data protection team using the contact details in Clause 14. We will acknowledge your request within 3 business days and provide a substantive response within 30 calendar days. Where a request is particularly complex, we may extend this period by a further 30 days and will notify you of the extension and the reason for it.

Data Security Measures

rp667 implements a layered security architecture designed to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• Transport Encryption: All data transmitted between your device and the rp667 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). The rp667 website enforces HTTPS on every page and uses HTTP Strict Transport Security (HSTS) to prevent protocol downgrade attacks.
• Encryption at Rest: Sensitive personal data — including KYC documents, financial records, and password hashes — is stored using AES-256 encryption on rp667's servers. Passwords are hashed using a modern adaptive hashing algorithm and are never stored in plain text.
• Access Controls: Access to Member personal data within rp667's internal systems is restricted to staff whose roles require it, under a principle of least privilege. All internal access to production data is logged and subject to regular audit.
• Two-Factor Authentication (2FA): rp667 strongly recommends that all Members activate 2FA on their accounts. All rp667 staff with access to Member data are required to use 2FA on internal systems.
• Penetration Testing and Security Audits: rp667 conducts periodic third-party penetration testing and internal security reviews of the Platform. Critical vulnerabilities identified through these reviews are remediated on a priority basis.
• Incident Response: rp667 maintains a documented incident response procedure. In the event of a personal data breach that poses a risk to your rights, rp667 will notify affected Members via their registered email address within a reasonable timeframe and implement containment measures immediately.

Minors & Age Verification

rp667 does not knowingly collect personal data from any individual under the age of 21. The Platform is designed exclusively for adults aged 21 and above, consistent with the eligibility requirements set out in the rp667 Terms & Conditions. Age verification is a mandatory step in the KYC process for all new Members.

If rp667 discovers or has reason to believe that a Member is under the age of 21, the relevant account will be immediately suspended, all personal data associated with the account will be flagged for deletion (subject to any lawful retention obligations), and any deposits made will be returned to the originating payment method following verification that no fraudulent activity has occurred.

Parents and guardians who believe that a minor may have registered an rp667 account are encouraged to contact our support team immediately using the contact details in Clause 14. rp667 will treat all such reports with the highest priority and take prompt action to investigate and remediate the situation.

Changes to This Privacy Policy

rp667 reviews this Privacy Policy regularly and reserves the right to update it at any time. The date of the most recent revision is displayed prominently at the top of this page. We categorize changes into two tiers:

• Material Changes — Changes that significantly alter how your personal data is used, introduce new categories of processing, affect your rights, or expand the categories of third parties with whom your data is shared. For material changes, rp667 will provide at least 7 days' advance notice by email to your registered email address before the updated Policy takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
• Minor Changes — Typographical corrections, clarifications that do not alter the substance of the Policy, or updates required by changes in applicable law that do not alter Member rights. Minor changes take effect immediately upon publication and may not be notified individually. The updated Policy date at the top of this page will reflect any such change.

rp667 recommends that you bookmark this page and review the Policy periodically. Previous versions of the Privacy Policy are available upon request by contacting the rp667 support team.

Contact & Data Protection Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or the personal data rp667 holds about you, please use the following contact channels. When submitting a data subject access request or any other rights request, please include your registered Member username and email address so that the team can locate your account promptly.

• Email: [email protected] — Responses within 4 hours during 09:00–21:00 WIB; all data protection requests acknowledged within 3 business days.
• Live Chat: Available 24 hours a day, 7 days a week via the rp667 Platform. For formal data protection requests, please follow up in writing by email so that a secure record of your request is created.
• WhatsApp: +62 811 9667 001 — Available 09:00–21:00 WIB. Formal data protection requests should be confirmed via email for record-keeping purposes.

rp667 will use reasonable endeavors to resolve all data protection requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by up to a further 30 days and will inform you of the extension and its reason within the initial 30-day window.