nobu98 Privacy Policy

nobu98 ("nobu98", "we", "us", or "our") operates the online betting and gaming platform accessible at nobu98.pro (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits, registers with, or otherwise interacts with our Platform.

This Privacy Policy ("Policy") describes how nobu98 collects, uses, stores, discloses, and protects personal data relating to our Members and site visitors. It applies to all products and services offered through the Platform, including sports betting, slots, live casino, and togel (Indonesia's traditional numbers lottery) games.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. By accessing the Platform or registering an Account, you acknowledge that you have read, understood, and accepted the practices described in this Policy.

If you do not agree with any part of this Policy, you must cease using the Platform and contact us at [email protected] to request Account closure.

The following defined terms are used consistently throughout this Policy:

nobu98 collects only the Personal Data that is necessary to operate the Platform, comply with legal obligations, prevent fraud, and deliver a high-quality, personalized betting experience to Members across Indonesia and internationally. The categories of data we collect are set out below:

nobu98 collects Personal Data through the following methods and sources:

4.1 Direct Collection. The majority of Personal Data we hold is provided directly by you when you: (a) complete the Account registration form; (b) submit KYC verification documents; (c) make a deposit or request a withdrawal; (d) claim a bonus or promotional offer; (e) contact our support team via live chat or email; (f) configure responsible gaming settings within your Account; or (g) submit any feedback, complaint, or review.

4.2 Automated Technical Collection. When you access the Platform — whether or not you are logged in — our servers and analytics systems automatically collect Technical Data and Usage Data. This includes your IP address, device identifiers, browser characteristics, session duration, and page-level navigation data. This collection occurs via server logs, first-party analytics tools, and session tracking technologies described in Clause 11 (Cookies & Tracking).

4.3 Third-Party Sources. nobu98 may receive Personal Data about you from the following categories of third-party sources:

• Payment Processors: Transaction confirmation data, payment status updates, and fraud risk scores from Indonesian payment networks including BCA, BRI, BNI, Mandiri, CIMB Niaga, and e-wallet providers OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC Verification Partners: Identity verification status, document authenticity results, and age confirmation outcomes from licensed KYC service providers.
• Game Studios: Game session identifiers, RNG seed references, and game outcome data from studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — used solely for bet settlement and dispute resolution.
• Fraud Prevention Services: Device fingerprinting scores, IP reputation data, and behavioral risk signals used to detect and prevent fraudulent activity on the Platform.

4.4 Publicly Available Sources. nobu98 may, in the context of a fraud investigation or KYC review, cross-reference data you have provided against publicly available sources such as public registers or sanctions lists to verify accuracy and confirm the absence of financial crime risk.

nobu98 processes Personal Data only for specified, explicit, and legitimate purposes. The table below sets out the primary processing purposes, the categories of data used, and the legal basis for each:

nobu98 will not use your Personal Data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a new legitimate legal basis.

nobu98 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We share Personal Data only with the following categories of recipients, strictly on a need-to-know basis and under appropriate contractual safeguards:

6.1 Payment Service Providers. We share transaction-related Personal Data (name, account number, transaction amount in IDR) with Indonesian payment partners — including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja — solely to process your deposit and withdrawal instructions. These providers are independent data controllers for their own processing under their respective privacy policies.

6.2 KYC and Identity Verification Partners. We share Identity Data and KYC Document Data with licensed third-party identity verification services to fulfill our age and identity verification obligations. These providers act as Processors under a written data processing agreement with nobu98.

6.3 Game Studio Partners. We share anonymized session identifiers and bet reference data with game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft for the purposes of game delivery, RNG certification, and bet outcome verification. Studios do not receive your full identity or financial data.

6.4 Fraud Prevention and Security Partners. We share Technical Data and behavioral signals with fraud detection and cybersecurity service providers to protect the Platform and all Members from unauthorized access, account takeover, and financial crime.

6.5 Cloud Infrastructure Providers. Personal Data is stored on secure cloud servers provided by enterprise-grade infrastructure partners. These providers act as Processors and are contractually prohibited from accessing or using your data for any purpose other than storage and delivery of Platform services.

6.6 Legal and Regulatory Authorities. nobu98 will disclose Personal Data to law enforcement agencies, regulatory bodies, financial intelligence units, or courts when legally compelled to do so, or when nobu98 has a good-faith belief that disclosure is necessary to prevent a crime, protect a person's safety, or comply with a binding legal obligation. Where legally permitted, nobu98 will notify affected Members of such disclosures.

6.7 Corporate Transactions. In the event of a merger, acquisition, restructuring, or sale of all or part of nobu98's business, Personal Data may be transferred to the acquiring entity as part of the transaction. Affected Members will be notified in advance, and the receiving entity will be bound by terms no less protective than this Policy.

nobu98 operates as an internationally licensed platform. Some of the service providers and Processors we work with — including cloud infrastructure providers and game studio partners — may be located in jurisdictions outside Indonesia. Where Personal Data is transferred internationally, nobu98 applies the following safeguards to ensure your data remains adequately protected:

• Standard Contractual Clauses: We require all international Processors to execute binding data processing agreements that incorporate internationally recognized standard contractual clauses equivalent to those used under major data protection frameworks.
• Technical Safeguards: All data in transit across borders is encrypted using TLS 1.3 with 256-bit AES encryption. Data at rest on international servers is encrypted using AES-256.
• Adequacy Assessment: Before engaging any international Processor, nobu98's compliance team conducts a data transfer impact assessment to evaluate the data protection standards of the destination jurisdiction and the specific Processor's security posture.

nobu98 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, to comply with applicable legal obligations, and to resolve disputes. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in accordance with nobu98's data disposal procedures. Anonymized aggregate data (from which individual Members cannot be identified) may be retained indefinitely for statistical and analytical purposes.

Dormant Accounts. Where an Account has been inactive (no login, deposit, or wager) for 12 consecutive months, nobu98 may close the Account. Personal Data associated with the closed Account will be retained for the periods set out above from the date of closure, not from the date of last activity.

nobu98 implements a layered, defense-in-depth approach to data security. Our technical and organizational security measures include:

• Transport Encryption: All data transmitted between your device and the nobu98 Platform is encrypted using TLS 1.3 with 256-bit AES ciphers. HTTP connections are automatically redirected to HTTPS. Our SSL certificate is renewed and monitored continuously.
• Data-at-Rest Encryption: Personal Data and KYC documents stored on nobu98's servers and cloud infrastructure are encrypted using AES-256 at the storage layer, providing protection even against physical media compromise.
• Access Controls: Access to Personal Data is restricted to nobu98 staff with a legitimate operational need, enforced through role-based access control (RBAC), strong authentication requirements including multi-factor authentication (MFA) for all administrative systems, and comprehensive access audit logs.
• Intrusion Detection: Our infrastructure is monitored 24/7 by automated intrusion detection and prevention systems (IDS/IPS), anomalous traffic analysis, and a dedicated security operations team.
• Penetration Testing: nobu98 conducts regular third-party penetration testing of Platform infrastructure and application code to identify and remediate security vulnerabilities before they can be exploited.
• Staff Training: All nobu98 personnel with access to Personal Data receive mandatory data protection and information security training upon onboarding and on an annual basis thereafter.
• Incident Response: nobu98 maintains a documented data breach response plan. In the event of a security incident that results in unauthorized access to your Personal Data, we will notify affected Members and relevant authorities within the timeframes required by applicable law.

As a data subject, you hold the following rights over your Personal Data held by nobu98. These rights may be subject to legal limitations and exceptions where processing is required by law or is necessary for the prevention of fraud or financial crime:

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request", your full name, registered email address, and a clear description of the right you wish to exercise. nobu98 may request additional identity verification before processing a rights request to protect against fraudulent submissions. We will acknowledge your request within 5 business days and provide a substantive response within 30 days (extendable to 60 days for complex requests with prior notice).

nobu98 uses cookies and similar tracking technologies to operate the Platform efficiently, secure Member sessions, analyze Platform usage, and deliver relevant promotional content. The following categories of cookies are in use:

Managing Cookies. You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair or prevent your ability to log in and use core Platform features. For analytics and marketing cookies, you may also opt out directly through your nobu98 Account settings under "Privacy Preferences".

Do Not Track. nobu98 respects Do Not Track (DNT) browser signals where technically feasible. When a DNT signal is detected from your browser, nobu98 will not deploy marketing or retargeting cookies during that session.

nobu98 employs the following measures to enforce its 21+ age restriction and protect minors from accessing gambling services:

• Age Declaration at Registration: All registrants are required to confirm their date of birth during the registration process. The system automatically rejects registrations where the declared age is below 21.
• KYC Age Verification: Government-issued identity documents (KTP, passport, SIM) submitted during KYC verification are cross-checked to confirm the Member's date of birth. Any Account where the verified age is below 21 is immediately suspended and all funds returned to the payment method used for deposit.
• Parental Controls Guidance: nobu98 recommends that parents and guardians use third-party parental control software to restrict access to gambling websites on devices shared with or accessible to minors. Tools such as Net Nanny, Qustodio, and similar solutions are effective at the device level.
• Reporting Underage Access: If you believe a minor has accessed the nobu98 Platform, please report this immediately to [email protected] with the subject line "Underage Access Report". We will investigate promptly and take immediate action to suspend any Account identified as belonging to a minor.

If nobu98 discovers — whether through KYC review, complaint, or its own investigation — that Personal Data has been collected from an individual under the age of 21, we will immediately suspend the relevant Account, void any outstanding wagers, return net deposits to the source payment method, and permanently delete the minor's Personal Data from our systems within 72 hours of confirmation, except to the extent that a brief retention period is required to satisfy a legal obligation or process the refund.

The nobu98 Platform may, from time to time, contain references to third-party services — including game studios, payment processors, and sports data providers — whose own websites or applications operate independently of nobu98. This Privacy Policy applies exclusively to Personal Data processed by nobu98 through the Platform. It does not govern the data practices of any third-party service, regardless of whether that service is accessed via a link or integration within the Platform.

nobu98 is not responsible for the privacy practices, security standards, or content of any third-party website, application, or service. We strongly encourage you to review the privacy policy of any third-party service you interact with before providing any Personal Data to that service.

Where nobu98 embeds third-party content (such as live game iframes from licensed studios), those studios may independently set cookies or collect Technical Data within their embedded environment. nobu98 has contractual data processing agreements in place with all game studio partners, but their processing within their own infrastructure is subject to their own privacy policies.

nobu98 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or Platform functionality. All changes will be published on this page with an updated "Last Updated" date at the top of the Policy.

Material Changes. Where a proposed amendment constitutes a material change to how nobu98 processes your Personal Data — for example, adding a new category of data, a new processing purpose, or a new class of third-party recipient — nobu98 will provide advance notice to affected Members via the email address registered to their Account at least 14 days before the change takes effect. Where processing relies on consent, we will seek fresh consent before applying the material change to your data.

Non-Material Changes. Minor amendments — such as clarifications to existing language, corrections of typographical errors, or structural reorganization that does not affect the substance of the Policy — may be published without individual notification. The updated Policy will take effect immediately upon publication.

Continued Use. Your continued use of the nobu98 Platform after the effective date of any Policy update constitutes your acceptance of the revised terms. If you do not accept a material change, you must notify us at [email protected] and cease using the Platform. We will process an Account closure and data deletion request in accordance with Clause 8 (Data Retention).

The current version of this Policy is always available at nobu98.pro/privacy-policy. We recommend bookmarking this page and reviewing it periodically.

If you have any questions, concerns, or requests relating to this Privacy Policy or nobu98's handling of your Personal Data, please contact our data protection team through the following channels:

• General Privacy Enquiries: [email protected] — subject line "Privacy Enquiry". We aim to respond within 24 hours for general questions.
• Data Rights Requests (SAR, Erasure, Rectification, Portability): [email protected] — subject line "Data Rights Request". Include your full name, registered email, and a clear description of your request. We will acknowledge within 5 business days and respond substantively within 30 days.
• Data Breach Reports: If you believe your Account has been compromised or you have identified a potential security vulnerability, contact us immediately at [email protected] — subject line "Security Report".
• Responsible Gaming & Self-Exclusion: [email protected] — subject line "Responsible Gaming". Self-exclusion and limit requests are actioned immediately upon identity verification. See our Responsible Gaming Policy for full details.
• Live Chat: Available 24/7 within the nobu98 Platform for immediate assistance. Our support team includes native Indonesian-speaking agents available around the clock (WIB, UTC+7).

nobu98 is committed to resolving all privacy-related concerns promptly and transparently. If you are not satisfied with our response to your complaint or rights request, you have the right to escalate the matter to the relevant data protection authority or the dispute resolution process provided by nobu98's licensing authority.