1 Definitions
In this Privacy Policy, the following terms have the meanings set out below:
"Personal Data"
Any information relating to an identified or identifiable natural person, including name, email address, date of birth, national identity number, IP address, and device identifiers.
"Processing"
Any operation performed on Personal Data — including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
"Controller"
won110, which determines the purposes and means of Processing your Personal Data.
"Processor"
Any third-party service provider that processes Personal Data on won110's behalf under a data processing agreement (e.g., payment processors, KYC verification providers, customer support platforms).
"Platform"
The won110 website, mobile interface, and all associated services accessible at won110.org.
"Player / You"
Any individual who registers an account, accesses the Platform, or submits personal information to won110 in any other context (e.g., contacting support).
"KYC"
Know Your Customer — the identity and document verification process required under anti-money laundering obligations before withdrawal requests are fulfilled.
2 Scope & Data Controller
This Privacy Policy applies to all Personal Data collected by won110 in connection with the operation of the Platform, including data collected through account registration, identity verification, payment processing, customer support interactions, and marketing communications.
won110 is the data Controller for Personal Data processed under this Policy. Our primary service area is Indonesia, and this Policy is designed to reflect the data protection principles applicable to Indonesian residents, as well as internationally recognised privacy standards.
Scope Note: This Policy does not govern the data practices of third-party studios, game providers (such as Pragmatic Play or Evolution Gaming), or payment processors. Those parties operate under their own privacy policies, which we encourage you to review independently.
3 Personal Data We Collect
won110 collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:
| Category |
Examples |
When Collected |
| Identity Data |
Full legal name, date of birth, gender, nationality, KTP / passport number |
Registration & KYC |
| Contact Data |
Email address, mobile number, residential address (city, province, postal code) |
Registration |
| Financial Data |
Bank account name & number (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata), e-wallet account (OVO, DANA, GoPay, ShopeePay, LinkAja) |
Deposit / Withdrawal |
| Verification Documents |
Photographs of government-issued ID, selfie for liveness check, proof-of-address documents |
KYC Verification |
| Transaction Data |
Deposit and withdrawal history, bet records, game session data, bonus usage |
Ongoing platform use |
| Technical Data |
IP address, browser type, device OS, screen resolution, session duration, pages visited |
Automatic — on each visit |
| Communications Data |
Live chat transcripts, email correspondence, support ticket content |
When you contact support |
| Marketing Preferences |
Opt-in / opt-out status for promotional emails and SMS |
Registration or account settings |
4 How We Collect Your Data
won110 collects Personal Data through the following channels:
- Directly from you: When you register an account, complete KYC, make a deposit or withdrawal request, contact our support team, or update your account settings.
- Automatically: When you visit or interact with the Platform, our servers and analytics tools automatically log Technical Data including IP address, browser fingerprint, session identifiers, and behavioural metrics. This is standard practice for all web-based services.
- From third-party verification providers: When we engage a KYC or AML screening provider to verify your identity, that provider may return additional data points (such as watch-list status or document authenticity results) that are added to your account record.
- From payment processors: When you deposit or withdraw via a local bank or e-wallet, the payment processor confirms transaction status and may share the account holder name and partial account details for reconciliation and fraud prevention.
5 Legal Basis for Processing
won110 processes your Personal Data on one or more of the following legal grounds:
- Contractual necessity: Processing is required to fulfil the contract between you and won110 — specifically, to create and manage your account, process deposits and withdrawals, and deliver the betting and gaming services you have requested.
- Legal obligation: We are required to collect and retain certain data to comply with anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer (KYC) obligations applicable to gaming operators.
- Legitimate interests: We process Technical Data and Transaction Data to protect the Platform from fraud, detect prohibited conduct (such as bonus abuse and multi-accounting), improve platform performance, and conduct internal analytics. These legitimate interests do not override your fundamental privacy rights.
- Consent: Where we send you marketing communications by email or SMS, we do so on the basis of your prior explicit consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.
6 How We Use Your Personal Data
won110 uses collected Personal Data for the following specific purposes:
- Account creation and management: To register your account, authenticate your identity at login, maintain your balance record, and process account settings changes.
- Identity verification (KYC): To verify that you meet the eligibility requirements (21 years of age and Indonesian residence) and to fulfil mandatory AML / CTF obligations.
- Payment processing: To execute deposit and withdrawal transactions via your nominated bank account or e-wallet, reconcile transactions, and investigate payment disputes.
- Fraud prevention and platform integrity: To detect duplicate accounts, identify suspicious betting patterns, investigate potential money laundering, and enforce the Prohibited Conduct provisions in our Terms & Conditions.
- Customer support: To respond to your enquiries, resolve complaints, process Responsible Gaming tool requests (such as self-exclusion), and maintain a record of support interactions.
- Platform improvement: To analyse aggregated, anonymised usage data that helps us improve the user experience, optimise page performance, and develop new features.
- Responsible Gaming: To monitor account activity for indicators of problem gambling behaviour, enforce deposit limits and self-exclusion orders, and comply with Responsible Gaming obligations.
- Marketing communications (opt-in only): To send you personalised promotional offers, bonus notifications, and event updates by email or SMS, where you have provided explicit consent. won110 does not send unsolicited marketing.
7 Data Sharing & Third-Party Disclosure
won110 does not sell your Personal Data. We may share Personal Data with the following categories of recipients under strictly controlled conditions:
- Payment processors and banks: To facilitate IDR transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. These processors receive only the data required to execute the specific transaction.
- KYC and AML screening providers: To verify identity documents, perform watch-list checks, and assess fraud risk. These providers are contractually bound to process data only for the purposes specified in their data processing agreements with won110.
- Game technology providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, and Pocket Games Soft (PG Soft) may receive a session token and player-tier information necessary to launch their games within the Platform. They do not receive your full Personal Data profile.
- Customer support platforms: Our live chat and ticketing system providers process communications data on our behalf. These processors are based in jurisdictions with adequate data protection standards.
- Legal and regulatory authorities: won110 will disclose Personal Data to competent authorities where required to do so by applicable law, court order, or in connection with the investigation of criminal activity affecting the Platform.
No Cross-Border Transfers Without Safeguards: Where Personal Data is transferred to a Processor located outside Indonesia, won110 ensures that appropriate contractual safeguards are in place to protect your data to an equivalent standard as it would receive under Indonesian data protection principles.
8 Cookies & Tracking Technologies
won110 uses cookies and similar tracking technologies to operate the Platform and improve the player experience. The cookies we use fall into the following categories:
- Strictly necessary cookies: Required for the Platform to function. These include session cookies that keep you logged in and security tokens that protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core functionality.
- Performance and analytics cookies: Used to measure page load times, identify broken pages, and understand how players navigate the Platform. Data collected by these cookies is aggregated and anonymised before analysis.
- Functional cookies: Remember your preferences, such as your preferred display language, notification settings, and Responsible Gaming limit confirmations, so you do not have to re-enter them on each visit.
- Marketing cookies: Used, with your consent, to track interactions with promotional campaigns and personalise bonus offers shown to you on the Platform. You may opt out of marketing cookies at any time via your browser settings.
Managing Cookies: You can control or disable non-essential cookies through your browser's privacy settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform normally.
9 Data Retention
won110 retains Personal Data only for as long as is necessary for the purposes for which it was collected, subject to any mandatory legal retention requirements. The following retention periods apply as a general guide:
- Active account data: Retained for the duration of your account plus a minimum of five (5) years after account closure, to comply with AML record-keeping obligations.
- KYC documentation: Retained for a minimum of five (5) years following the completion of the relevant transaction or the closure of your account, whichever is later.
- Transaction records: Retained for a minimum of five (5) years, consistent with financial record-keeping requirements.
- Support communications: Retained for a minimum of two (2) years from the date of the last interaction, to allow us to review complaint histories and identify repeat issues.
- Marketing preferences: Retained until you withdraw consent or close your account. After withdrawal of consent, a suppression record is maintained indefinitely to prevent inadvertent re-subscription.
- Technical / server log data: Retained for a maximum of twelve (12) months before automated deletion, unless retained as evidence in connection with a specific fraud or security investigation.
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to you.
10 Your Data Rights
Subject to applicable law and the specific circumstances of your request, you have the following rights in respect of your Personal Data held by won110:
- Right of Access: You may request a copy of the Personal Data we hold about you. We will respond within 30 days of receiving a verified request.
- Right of Rectification: If any Personal Data we hold is inaccurate or incomplete, you may request that it be corrected. You may also update some data directly in your account settings.
- Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data. This right is subject to legal retention obligations — we cannot erase data that we are required to retain under AML or financial record-keeping law, but we will delete all data that is no longer legally required.
- Right to Restriction: You may request that we restrict Processing of your data while a rectification or objection request is under review.
- Right to Data Portability: You may request a copy of the Personal Data you provided to us in a structured, commonly used, machine-readable format.
- Right to Object: You may object to Processing carried out on the basis of our legitimate interests. We will assess your objection and cease Processing unless we have compelling legitimate grounds that override your interests.
- Right to Withdraw Consent: Where Processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without penalty.
To exercise any of the above rights, please contact our support team via live chat or send a written request to [email protected]. We will verify your identity before processing any data rights request and will respond within 30 calendar days.
11 Security Measures
won110 implements a layered set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, and destruction:
- Transport Layer Security (TLS 1.2+): All data transmitted between your device and our servers is encrypted in transit using industry-standard TLS protocols.
- At-rest encryption: Sensitive fields in our databases — including identity document data and financial account details — are encrypted at rest using AES-256.
- Access controls: Internal access to Personal Data is governed by a least-privilege model. Staff members access only the data required for their specific role. All access is logged and periodically audited.
- Two-factor authentication (2FA): All staff accounts with access to systems containing Personal Data are required to use two-factor authentication.
- Penetration testing: The Platform undergoes regular third-party security assessments, including penetration testing and vulnerability scanning.
- Incident response: won110 maintains a formal data breach response procedure. In the event of a breach affecting your Personal Data, we will notify affected players within 72 hours of becoming aware of the incident, where technically and legally feasible.
Your Role in Security: While won110 maintains robust platform-side security, you also play an important role. Use a strong, unique password for your won110 account, never share your login credentials, and contact support immediately if you suspect unauthorised access to your account.
12 Children & Minors
The won110 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that Personal Data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.
If you believe that a person under the age of 21 has registered an account or provided Personal Data to won110, please notify our support team immediately at [email protected].
13 Third-Party Links & Services
The Platform may contain links to game studios, content partners, or informational resources operated by third parties. These third-party services are not governed by this Privacy Policy. won110 does not control how third parties collect or use your Personal Data, and we accept no responsibility or liability for their privacy practices.
We recommend reviewing the privacy policy of any third-party service you access through or alongside the Platform before submitting personal information to that service.
14 Amendments to This Policy
won110 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The "Last Updated" date at the top of this page will be revised accordingly whenever a material change is made.
Where changes are material — for example, where we introduce a new purpose for Processing or a new category of data sharing — we will notify registered Players via the email address on file or via an in-platform notification prior to the change taking effect. Continued use of the Platform following any amendment constitutes acceptance of the revised Policy.
We encourage you to review this page periodically to stay informed about how won110 protects your Personal Data.
15 Contact & Complaints
If you have any questions, concerns, or complaints about this Privacy Policy or the way won110 handles your Personal Data, please contact our Data Protection team through any of the following channels:
- Live Chat: Available 24/7 via the Platform. Indonesian-speaking agents are on duty at all hours and can triage data rights requests to the appropriate team.
- Email: [email protected] — please include "Privacy Request" in the subject line. This address is displayed as plain text and is not a clickable link; please copy it manually into your email client.
We will acknowledge all privacy-related enquiries within 24 hours and aim to provide a substantive response within 14 calendar days. For complex data rights requests (such as full data access or erasure requests), the response period may be extended to 30 calendar days, in which case we will inform you of the extension and the reason for it.
Escalation: If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. won110 will cooperate fully with any such investigation.