Privacy Policy — noya99

noya99 ("we", "us", "our") operates the online gaming and sports-betting platform accessible at noya99.pro (the "Platform"). In delivering our services to Members located primarily in Indonesia, we necessarily collect and process certain categories of personal data. This Privacy Policy sets out, in plain and precise terms, the nature of that data, the purposes for which it is processed, the parties with whom it may be shared, and the rights that Members hold in relation to their own information.

This Policy is incorporated by reference into the noya99 Terms & Conditions and should be read alongside that document. Where any conflict exists between this Policy and the Terms & Conditions, the Terms & Conditions shall prevail.

We periodically review and update this Privacy Policy to reflect changes in our data practices, applicable law, or platform functionality. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of the Platform following any update constitutes acceptance of the revised Policy.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or one or more factors specific to that person.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" means noya99, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third-party entity that processes Personal Data on behalf of noya99 pursuant to a written data-processing agreement.
• "Member" / "you" means a natural person who has registered an Account on the noya99 Platform.
• "KYC Data" means identity-verification documentation submitted by a Member, including government-issued photo identification, proof of address, and payment method verification materials.
• "Cookies" means small text files or similar tracking technologies placed on your device when you visit the Platform, used to remember preferences and enable analytic and marketing functions.

noya99 collects Personal Data across the following categories. We collect only the data that is necessary for the stated purpose — no more, no less.

We collect your Personal Data through the following channels:

• Direct Submission: Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated Technical Collection: Data generated automatically when you access and use the Platform, including IP address logs, browser fingerprinting, session-activity records, and Cookie data. This collection occurs regardless of whether you are logged in to your Account.
• Third-Party Verification Services: Identity and address verification data returned to noya99 by licensed KYC service providers following submission of your identity documents. noya99 does not share your raw documents with external parties beyond the designated verification processor.
• Payment Processors: Transaction reference data (excluding full card or account numbers) returned by local Indonesian bank transfer processors and e-wallet platforms such as OVO, DANA, GoPay, and ShopeePay following a completed deposit or withdrawal.
• Game Studios: Aggregated gameplay session data returned by third-party game providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) relating to game rounds initiated under your Account.

noya99 processes your Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing that is required to perform the contract between noya99 and you (the Terms & Conditions), including Account administration, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC/AML identity verification requirements, record-keeping obligations, and responses to lawful orders from competent authorities.
• Legitimate Interests: Processing that serves noya99's legitimate business interests — such as fraud prevention, Platform security, responsible gaming monitoring, and service optimisation — where those interests are not overridden by your own data-protection rights and expectations.
• Consent: Processing of your data for marketing and promotional communications, where such processing relies entirely on your prior, freely given, specific, and informed consent. You may withdraw consent at any time by contacting support or adjusting your Account notification preferences, without affecting the lawfulness of processing carried out before withdrawal.

The Personal Data we hold about you is used exclusively for the following purposes:

• Creating, maintaining, and administering your noya99 Account, including authentication and access control.
• Processing deposits and withdrawals through your nominated Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay) and maintaining accurate transaction records.
• Verifying your identity and age (21+) through KYC procedures to comply with applicable regulations and to prevent underage participation.
• Detecting, investigating, and preventing fraud, money laundering, account takeover, bonus abuse, and other forms of prohibited conduct as described in the Terms & Conditions.
• Monitoring gameplay patterns to identify indicators of problem gambling and, where appropriate, triggering responsible gaming interventions such as usage alerts or temporary account restrictions.
• Providing customer support in both English and Indonesian (Bahasa Indonesia), including responding to complaints, account queries, and withdrawal requests.
• Personalising your experience on the Platform, including game recommendations, bonus offers relevant to your activity, and localised content for your region (Jakarta, Surabaya, Bali, Bandung, and other major Indonesian cities).
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts) and, where consented, promotional communications about bonuses, seasonal offers (including campaigns around Idul Fitri, Chinese New Year, and Ramadhan), and new product launches.
• Complying with applicable laws and responding to lawful requests from regulatory and law-enforcement authorities.
• Improving the Platform through analysis of aggregated, anonymised usage data and technical performance metrics.

noya99 shares your Personal Data only with the categories of recipients described below, and only to the extent necessary for the stated purpose:

• KYC & Identity Verification Providers: Licensed third-party services that process the identity documents you submit during KYC verification. These providers operate under strict data-processing agreements and are prohibited from using your data for any purpose beyond verification.
• Payment Processors: Local Indonesian bank transfer gateways and e-wallet operators (OVO, DANA, GoPay, ShopeePay) that facilitate your deposits and withdrawals. Each processor handles only the minimum data required to complete the relevant transaction.
• Game Content Studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and other licensed game providers whose software runs within the noya99 Platform. Data shared is limited to session tokens and account-level parameters required to initialise and record game rounds.
• IT Infrastructure Providers: Cloud hosting, content delivery, database management, and cybersecurity service providers that support Platform operations. These providers are engaged as Data Processors under binding agreements.
• Legal & Regulatory Authorities: Competent courts, law-enforcement bodies, regulatory agencies, and other public authorities when noya99 is legally required or permitted to disclose data, or when disclosure is necessary to protect the rights, property, or safety of noya99, its Members, or the public.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of noya99's business, your Personal Data may be transferred to the relevant successor entity, subject to continued compliance with this Privacy Policy.

All third-party Data Processors engaged by noya99 are contractually required to implement appropriate technical and organisational security measures and to process Personal Data solely in accordance with noya99's documented instructions.

noya99 uses Cookies and similar technologies (including pixel tags and local storage) to operate and improve the Platform. The following categories of Cookies are in use:

• Strictly Necessary Cookies: Essential for the Platform to function. They enable core features such as user authentication, session management, and security checks. These Cookies cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: Collect anonymised information about how Members interact with the Platform — pages visited, links clicked, session duration, and error events. This data is used exclusively to improve Platform performance and user experience.
• Functionality Cookies: Remember your preferences such as language settings and whether you have previously dismissed certain notifications, to provide a more personalised experience.
• Marketing & Targeting Cookies: Used, where you have provided consent, to track your browsing activity across sessions and deliver promotional content relevant to your gaming interests. You may withdraw consent for these Cookies at any time via your Account notification settings.

Most web browsers allow you to control Cookie behaviour through your browser settings, including blocking or deleting Cookies. Please be aware that disabling strictly necessary Cookies will prevent you from accessing your Account and using the Platform.

noya99 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of your Account and for a minimum of five (5) years following permanent Account closure, to satisfy anti-money-laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the relevant transaction, in compliance with financial record-keeping regulations.
• KYC Documents: Retained for five (5) years from Account closure or from the date of the last transaction, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the communication, or until resolution of any related dispute, whichever is later.
• Marketing Consent Records: Retained for the duration of your Account plus two (2) years, to document the basis on which marketing communications were sent.
• Technical & Log Data: Retained for up to twelve (12) months, after which it is aggregated or anonymised for analytical purposes.

Following expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where deletion is not immediately technically feasible (for example, data held in encrypted backup archives), the data is isolated from active processing and deleted at the earliest practicable opportunity.

noya99 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• SSL/TLS Encryption: All data transmitted between your browser and the noya99 Platform is encrypted using industry-standard SSL/TLS protocols. This protects your login credentials, financial data, and personal information in transit.
• Encryption at Rest: Sensitive Personal Data — including KYC documents and financial records — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Internal access to Member Personal Data is restricted on a strict need-to-know basis. Staff access is governed by role-based access controls, and all access events are logged and auditable.
• Multi-Factor Authentication: Administrative access to systems holding Member data requires multi-factor authentication. Members are also encouraged to enable any available two-factor authentication options on their Accounts.
• Penetration Testing & Vulnerability Management: noya99 conducts periodic security assessments, including third-party penetration tests, to identify and remediate potential vulnerabilities in Platform infrastructure.
• Incident Response: In the event of a confirmed data breach that poses a risk to Member rights and freedoms, noya99 will take immediate containment action and notify affected Members without undue delay.

As a Member whose Personal Data is processed by noya99, you hold the following rights. To exercise any of these rights, contact our support team using the details in Section 15. We will respond to all verified requests within 30 days.

noya99 will not charge a fee for handling rights requests in ordinary circumstances. We may request proof of identity before processing any request to ensure we disclose or modify data only to the Account holder.

The noya99 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect, store, or process Personal Data belonging to individuals under the age of 21. Our registration process includes mandatory age declaration, and KYC verification procedures are in place to confirm age eligibility before any withdrawal is processed.

If noya99 discovers or is notified that Personal Data belonging to a person under 21 has been collected — whether through misrepresentation at registration or any other means — we will immediately suspend the associated Account, delete the minor's Personal Data to the fullest extent permitted by applicable law, and take any further action required under the circumstances. If you believe a minor may have created an Account on our Platform, please notify us immediately at the contact address in Section 15.

noya99 operates globally and may engage Data Processors whose infrastructure is located outside of Indonesia. When your Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that applicable in your country of residence, noya99 will ensure that appropriate safeguards are in place to protect the data. These safeguards may include:

• Standard contractual clauses approved by a relevant supervisory authority, incorporated into the data-processing agreements with the relevant third party.
• Binding corporate rules applicable to intra-group transfers within noya99's affiliated entities.
• Such other legally recognised transfer mechanisms as may be applicable and available under relevant law from time to time.

By using the noya99 Platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Indonesia. noya99 will always ensure such transfers are carried out with appropriate protective measures in place.

noya99 reserves the right to update this Privacy Policy at any time to reflect changes in data practices, applicable law, platform functionality, or regulatory guidance. When material changes are made, we will:

• Post the revised Policy on this page with an updated "Last Updated" date.
• Where practicable, send an email notification to all registered Members summarising the key changes.
• Display a prominent notice on the Platform for a reasonable period following the update.

Your continued use of the noya99 Platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree to any amended terms, you should cease using the Platform and may request Account closure in accordance with the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or want to raise a concern about how noya99 handles your Personal Data, please contact our Privacy team using the details below. We are committed to addressing all enquiries promptly and thoroughly.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. noya99 will cooperate fully with any such authority in the investigation of a complaint.

For responsible gaming support — including requests for deposit limits, session time controls, cooling-off periods, or self-exclusion — please visit our dedicated Responsible Gaming page or mention your request explicitly when contacting support.