Privacy Policy — cika4

cika4 ("we", "us", "our") is committed to protecting the privacy and security of all personal data entrusted to us by our Members. This Privacy Policy sets out a transparent and comprehensive account of our data processing practices in relation to the cika4 online sports betting and casino platform accessible at https://cika4.cam (the "Platform").

This Policy applies to all personal data we collect about you when you: visit the Platform (including as an unregistered visitor); register and maintain a cika4 Account; interact with customer support; participate in promotions or surveys; or otherwise communicate with us by any means.

cika4 serves a primarily Indonesian audience — including Members based in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, Makassar, Palembang, and other cities across the Indonesian archipelago. All personal data processing is conducted in accordance with applicable international data protection standards and the requirements of our licensing authority. We are committed to meeting standards equivalent to, or exceeding, the requirements set out in Indonesia's Personal Data Protection Law (UU PDP) and comparable international frameworks.

Where this Policy uses the term "personal data", it means any information that identifies, or could reasonably be used to identify, a living individual — directly or indirectly. This includes names, contact details, financial information, identity documents, device identifiers, and behavioural data generated through use of the Platform.

For the purposes of this Privacy Policy, the following terms have the meanings assigned below:

• "Controller" means cika4, in its capacity as the entity that determines the purposes and means of processing your personal data.
• "Member" / "You" means any registered user of the cika4 Platform, or any individual whose personal data cika4 processes in connection with the Platform.
• "Personal Data" means any information relating to an identified or identifiable natural person, as described in Section 1 above.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Processor" means any third party that processes personal data on behalf of cika4 under a written data processing agreement.
• "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data used for identification, or financial account details.
• "Cookie" means a small text file placed on your device by the Platform for the purposes described in Section 11.
• "KYC" means Know Your Customer identity verification, as described in the Terms & Conditions.

cika4 collects the following categories of personal data, depending on how you interact with the Platform:

cika4 does not intentionally collect sensitive data (as defined in Section 2) beyond what is strictly required for KYC compliance and anti-money-laundering (AML) obligations. Identity documents submitted for KYC are used solely for verification purposes and are not retained longer than required by applicable law.

cika4 collects personal data through the following mechanisms:

• Direct collection: Data you provide voluntarily when registering an Account, completing KYC, submitting payment details, contacting support, or participating in promotions.
• Automated collection: Technical and behavioural data collected automatically as you navigate the Platform, via cookies, server logs, and analytics tools (see Section 11).
• Third-party sources: Identity verification data obtained from authorised third-party KYC and AML service providers; fraud prevention signals from payment processors; geolocation data from IP address databases. All third-party sources are under contractual obligations consistent with this Policy.
• Payment providers: Transaction confirmation data received from your bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) when you make deposits or withdrawals.

cika4 processes your personal data only for specified, explicit, and legitimate purposes. The primary purposes are:

1. Account management: Creating, maintaining, securing, and (where applicable) closing your cika4 Account.
2. Identity verification (KYC): Confirming your identity and age (21+ requirement) in compliance with AML and responsible gaming obligations.
3. Transaction processing: Handling deposits and withdrawals in Indonesian Rupiah (IDR) via supported local banks and e-wallets; detecting and preventing payment fraud.
4. Service delivery: Operating the sports betting, live casino, slot, togel (Indonesia's traditional numbers lottery), and other gaming products on the Platform.
5. Customer support: Responding to your queries, complaints, and requests through live chat, email, and WhatsApp.
6. Security and fraud prevention: Monitoring for unauthorised account access, collusion, bonus abuse, money laundering, and other prohibited activities.
7. Legal and regulatory compliance: Meeting obligations under our international gaming licence, AML regulations, and data protection law.
8. Responsible gaming: Monitoring betting patterns to identify indicators of problem gambling and operating self-exclusion, deposit limit, and session-time tools.
9. Marketing and promotions (where you have consented): Sending you personalised bonus offers, seasonal promotions (Idul Fitri, Ramadhan, Indonesian Independence Day, BRI Liga 1 season openers), and Platform news. You may withdraw consent at any time.
10. Platform improvement: Analysing aggregated, anonymised behavioural data to improve product features, odds presentation, payment flows, and user experience.

cika4 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract we have with you under the Terms & Conditions — including account management, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with AML legislation, KYC regulatory requirements, tax record-keeping obligations, and the conditions of our international gaming licence.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics — where our interests do not override your fundamental rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookies, where we have obtained your explicit, freely given, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

cika4 does not sell, rent, or otherwise disclose your personal data to unaffiliated third parties for their own independent marketing or commercial purposes. Personal data is shared only in the following strictly limited circumstances:

• Service providers (Processors): Trusted third-party vendors who process data on our behalf under binding data processing agreements — including KYC and identity verification providers, payment gateway operators, fraud detection services, cloud infrastructure providers, and customer support platform vendors. These parties are contractually prohibited from using your data for any purpose other than performing services for cika4.
• Payment providers: Transaction data shared with your chosen payment provider (e.g., BCA, BRI, OVO, DANA) solely to execute deposit and withdrawal instructions.
• Regulatory and law enforcement authorities: Where cika4 is legally required to disclose data to government agencies, regulatory bodies, courts, or law enforcement authorities — including disclosure required under AML legislation or a valid court order. cika4 will notify you of such disclosures where legally permitted to do so.
• Business succession: In the event of a merger, acquisition, or sale of substantially all assets of cika4, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer.
• With your explicit consent: Any disclosure not covered above requires your prior explicit consent.

cika4 operates internationally and may transfer personal data to service providers located outside Indonesia. When personal data is transferred to a country that does not offer a level of data protection equivalent to Indonesia's standards, cika4 implements appropriate safeguards — including standard contractual clauses, binding corporate rules, or equivalent mechanisms — to ensure your data remains protected in transit and at the destination.

You may request information about the specific safeguards applied to international transfers of your personal data by contacting our data protection team at the address set out in Section 16.

cika4 retains personal data only for as long as necessary to fulfil the purposes described in Section 5, or as required by applicable law. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data cannot be deleted due to technical constraints (for example, in archived backup systems), it is isolated from active processing and deleted at the earliest practicable opportunity.

cika4 employs a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our technical and organisational security measures include:

• Encryption in transit: All data transmitted between your device and the Platform is protected by 256-bit SSL/TLS encryption.
• Encryption at rest: Sensitive data fields (including financial account details and identity document metadata) are encrypted in the database using AES-256.
• Access controls: Staff access to personal data is granted on a strict need-to-know basis. Multi-factor authentication (MFA) is required for all administrative access to production systems.
• Penetration testing: Independent third-party security audits and penetration tests are conducted at least annually to identify and remediate vulnerabilities.
• Incident response: cika4 maintains a documented data breach response plan. In the event of a breach affecting your personal data, we will notify you and the relevant authority within the timeframe required by applicable law.
• Employee training: All staff with access to personal data receive mandatory data protection training on joining and annually thereafter.

cika4 uses cookies and similar technologies (such as local storage and session tokens) to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. Cookies do not contain executable code and cannot access other files on your device.

We use the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. They enable session management, authentication, and core security features. These cannot be disabled without preventing you from using the Platform.
• Functional cookies: Remember your preferences (such as language settings and display options) to personalise your experience across sessions.
• Analytics cookies: Collect aggregated, anonymised data about how Members use the Platform — which pages are visited most, session durations, and navigation paths. This helps us improve product design and performance. Analytics data is not linked to your identity.
• Security cookies: Detect and prevent fraudulent activity, including cross-site request forgery (CSRF) attacks and session hijacking attempts.

cika4 does not place third-party advertising or tracking cookies that share your behavioural data with external advertising networks. Non-essential cookies (functional and analytics) are deployed only with your consent, obtainable through the cookie management panel. You may withdraw or modify your cookie consent at any time through your browser settings or the Platform's privacy controls.

Subject to applicable law and verification of your identity, you have the following rights in relation to your personal data held by cika4:

• Right of access: You may request a copy of all personal data cika4 holds about you, along with information about how it is processed.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. For account-level corrections, you may update most details directly via your Account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes collected, where consent is withdrawn, or where processing is unlawful. This right is subject to legal retention obligations (see Section 9).
• Right to restriction: You may request that cika4 temporarily suspend processing of your data while a dispute regarding accuracy or lawfulness is resolved.
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring. You may also object to direct marketing communications at any time, at no cost.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected]. cika4 will respond within 30 calendar days of receiving a valid request. Where a request is complex or involves a large volume of data, the response period may be extended by a further 30 days; you will be informed of any extension within the initial 30-day window.

cika4 does not knowingly collect or process personal data from any individual under the age of 21. During registration and KYC, date of birth is verified against government-issued identity documentation. Where cika4 becomes aware that personal data of a person under 21 has been collected, that data will be deleted without delay and the associated Account closed.

If you are a parent or guardian and believe that a minor has registered on the Platform using falsified information, please contact us immediately at [email protected]. We will investigate and act on confirmed reports promptly.

The cika4 Platform integrates third-party services to deliver certain features, including game content from studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft; payment processing through Indonesian bank and e-wallet infrastructure; and identity verification via authorised KYC providers.

Each third-party service provider is required to enter into a data processing agreement with cika4 that restricts their use of your data to the specific service they provide, prohibits onward disclosure without authorisation, and requires security standards consistent with this Policy.

Please note that third-party game providers may collect technical data (such as session duration and game action logs) for their own game-performance and fairness-auditing purposes. This data is subject to those providers' own privacy policies and is not within cika4's direct control once transmitted. cika4 selects only reputable, internationally certified providers to minimise data privacy risk.

cika4 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features. Where amendments are material — for example, changes to the categories of data collected, the purposes for which it is used, or your rights — cika4 will notify registered Members by email at least 14 days before the revised Policy takes effect and will post a prominent notice on the Platform.

For minor, non-material changes (such as typographical corrections or clarifications that do not affect the substance of the Policy), cika4 may update the Policy without specific notification, updating the "Last Updated" date at the top of this page to reflect the revision date.

Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy. Previous versions of this Policy are available upon request by contacting our data protection team.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a concern about how cika4 handles your personal data, please contact our data protection team through the following channels:

• Email (data protection enquiries): [email protected] — please include "Privacy Request" or "Data Protection" in the subject line. This is a plain-text address and is not a clickable link.
• Live Chat: Available 24 hours a day, 7 days a week via the cika4 Platform dashboard. Our Indonesian and English-speaking support team aims to respond within 2 minutes.
• WhatsApp: +62 811 2345 6789 — available 07:00–23:00 WIB. This is a display-only number and is not a clickable link.

cika4 will acknowledge written data protection requests within 5 business days and provide a substantive response within 30 calendar days. If you are dissatisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.