Privacy Policy — pos4g

In this Privacy Policy, the following terms carry the meanings set out below:

• "pos4g" / "we" / "us" / "our" — the Operator of the pos4g Platform, accessible at https://pos4g.cam.
• "Platform" — the pos4g website, mobile-optimized interface, and all associated digital services.
• "Member" / "you" / "your" — any individual who has registered an account on the pos4g Platform or who visits the Platform without registering.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, email address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, and deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. For purposes of this Policy, the Data Controller is the Operator.
• "Data Processor" — a third party that Processes Personal Data on behalf of the Data Controller under a binding data processing agreement.
• "KYC" — Know Your Customer verification procedures, including identity and address verification.
• "IDR / Rp" — Indonesian Rupiah, the primary currency denomination used for Indonesian Member accounts.
• "Cookies" — small text files placed on your device by the Platform to enable certain functionality and collect usage analytics.

This Privacy Policy applies to all Personal Data collected and processed by pos4g in connection with your use of the Platform, including when you visit the Platform without registering, when you register as a Member, when you make deposits or withdrawals, when you contact customer support, and when you participate in promotions.

The Data Controller for all Personal Data processed under this Policy is the Operator of the pos4g Platform — an internationally licensed entity operating under its offshore gaming authorization. The Operator is responsible for determining the purposes for which your Personal Data is collected and the manner in which it is processed.

Indonesian Context: While Indonesia has enacted Law No. 27 of 2022 on Personal Data Protection (UU PDP), which came into force progressively through 2024, pos4g processes data under the legal framework of its licensing jurisdiction. Indonesian Members are entitled to the data subject rights set out in Section 11 of this Policy, which align substantially with internationally recognized data protection standards.

pos4g collects Personal Data through multiple channels. The categories of data collected, and the context in which each is gathered, are set out in the table below.

pos4g does not collect or process sensitive personal data categories such as racial or ethnic origin, religious beliefs, political opinions, biometric data, or health information, except where health-related information is voluntarily disclosed by a Member in the context of a responsible gaming self-exclusion request.

pos4g uses Personal Data only for the purposes for which it was collected. The principal uses are:

• Account Creation and Management: To register your account, verify your identity, maintain your profile, and administer your use of the Platform.
• Transaction Processing: To process deposits via BCA, BRI, BNI, Mandiri, and supported e-wallets; to process withdrawal requests to verified bank accounts; and to maintain accurate financial records.
• KYC and Regulatory Compliance: To verify your identity and age (minimum 21 years), to satisfy anti-money laundering (AML) obligations, and to meet any reporting requirements under the Operator's licensing jurisdiction.
• Fraud Prevention and Platform Security: To detect, investigate, and prevent fraudulent transactions, collusion, bonus abuse, multiple account registration, and unauthorized access to accounts.
• Customer Support: To respond to your enquiries, resolve complaints, and manage formal dispute processes.
• Responsible Gaming: To monitor for indicators of problem gambling behaviour, to apply deposit limits or self-exclusion restrictions requested by Members, and to proactively contact Members whose activity suggests they may need support.
• Platform Improvement: To analyze aggregate usage data, identify performance issues, and improve the features and usability of the pos4g Platform.
• Marketing Communications: To send promotional offers, bonus notifications, and Platform updates to Members who have opted in to receive them. You may opt out at any time.
• Legal Obligations: To comply with any court order, regulatory requirement, or lawful request from a competent authority in the Operator's licensing jurisdiction.

pos4g processes Personal Data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between pos4g and the Member — including account registration, deposit processing, withdrawal execution, and customer support — is carried out on the basis of contractual necessity. Without this processing, pos4g cannot provide its services.
• Legal Obligation: Processing required to comply with applicable laws and regulations — including KYC identity verification, AML transaction monitoring, and regulatory reporting — is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, abuse detection, and aggregate analytics is carried out on the basis of the Operator's legitimate interests in operating a secure and commercially viable platform, balanced against Members' privacy rights. Where legitimate interests are relied upon, pos4g conducts an assessment to ensure Member interests are not overridden.
• Consent: Processing for marketing communications is carried out only where the Member has provided explicit, informed, freely given consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

pos4g does not sell, rent, or trade your Personal Data. We share data with third parties only in the following limited circumstances:

• Payment Processors: Deposit and withdrawal transactions require sharing relevant financial identifiers with Indonesian banking partners (BCA, BRI, BNI, Mandiri, and others) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These entities act as independent Data Controllers for their own payment processing operations.
• KYC and Identity Verification Providers: pos4g may engage third-party identity verification services to assist with document authentication. These providers operate as Data Processors under binding data processing agreements that restrict their use of your data to the stated verification purpose.
• Technology and Infrastructure Providers: Cloud hosting providers, database management services, and cybersecurity vendors who support the operation of the Platform may have access to Personal Data in their role as Data Processors. All such providers are contractually bound by confidentiality and data protection obligations.
• Fraud Prevention and AML Platforms: pos4g uses third-party fraud detection and AML screening tools that process Member transaction and identity data to identify suspicious activity. These providers act as Data Processors.
• Legal and Regulatory Authorities: pos4g will disclose Personal Data to courts, regulators, or law enforcement agencies when required to do so by a valid legal order, judicial request, or regulatory obligation in the Operator's licensing jurisdiction.
• Corporate Restructuring: In the event of a merger, acquisition, asset sale, or other restructuring of the Operator, Personal Data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

In all cases where data is shared with third-party processors, pos4g requires those parties to implement appropriate technical and organizational security measures consistent with the standards described in Section 9 of this Policy.

Personal Data is retained only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable regulatory and legal obligations. The standard retention periods applied by pos4g are:

Upon expiry of the applicable retention period, Personal Data is securely and permanently deleted or anonymized such that it can no longer be linked to any individual. Anonymized aggregate data may be retained indefinitely for statistical analysis and Platform improvement.

The pos4g Platform uses cookies and similar tracking technologies (collectively, "Cookies") to enable essential functionality, remember your session preferences, and collect analytics data that helps us improve the Platform. The categories of Cookies used by pos4g are:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, security tokens, and load-balancing identifiers. These cannot be disabled without preventing Platform use.
• Functional Cookies: Remember your account preferences — such as language settings, display preferences, and session duration warnings — to personalize your experience on subsequent visits.
• Analytics Cookies: Collect aggregate, anonymized usage data about how Members navigate the Platform, which features are used most frequently, and where technical errors occur. This data is used solely to improve Platform performance and is not linked to individual identities.
• Security and Fraud Prevention Cookies: Used to identify suspicious access patterns, detect automated bot traffic, and protect against cross-site request forgery (CSRF) attacks.

pos4g does not use third-party advertising or behavioural targeting cookies. You may configure your browser settings to reject non-essential Cookies; however, doing so may affect certain Platform features. As pos4g does not use advertising cookies, no cross-site tracking of your browsing behaviour occurs.

pos4g implements technical and organizational security measures designed to protect Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Key measures include:

• Encryption in Transit: All data transmitted between your device and pos4g servers is protected by TLS 1.2 or higher (256-bit SSL).
• Encryption at Rest: Sensitive Personal Data stored in pos4g databases — including identity documents, financial account references, and password hashes — is encrypted using AES-256.
• Access Controls: Access to Personal Data within pos4g's internal systems is restricted to authorized personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication for all staff system logins.
• Password Hashing: Member account passwords are never stored in plain text. They are hashed using a modern one-way hashing algorithm (bcrypt) with per-account salt values.
• Penetration Testing: pos4g engages independent security firms to conduct periodic penetration testing on the Platform infrastructure. Critical and high-severity findings are remediated within defined SLA windows.
• Incident Response: pos4g maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to Members, affected individuals will be notified promptly and appropriate steps taken to contain and remediate the incident.

Despite these measures, no digital system is entirely impenetrable. pos4g encourages all Members to use strong, unique passwords, enable two-factor authentication on their accounts, and report any suspected unauthorized access immediately to the support team.

As an internationally operated platform, pos4g may transfer Personal Data to, and process it in, countries other than Indonesia. These include the Operator's country of incorporation and the locations of third-party Data Processors such as cloud hosting providers, KYC verification services, and AML screening tools.

When Personal Data is transferred to jurisdictions outside Indonesia, pos4g ensures that appropriate safeguards are in place. These safeguards may include binding contractual clauses between pos4g and the receiving party that require them to process the data with equivalent protections to those described in this Policy, or other recognized international transfer mechanisms.

By registering a pos4g account, you acknowledge and consent to the international transfer of your Personal Data under the conditions described in this Section.

As a Member of the pos4g Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact pos4g support in writing using the contact details in Section 15.

• Right of Access: You may request a copy of the Personal Data that pos4g holds about you, along with information about the purposes for which it is processed and the categories of third parties with whom it is shared.
• Right to Rectification: You may request that inaccurate or incomplete Personal Data be corrected. You can also update most account information directly through your account settings without submitting a formal request.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis exists), or where it has been processed unlawfully. Note that we may be required to retain certain data to comply with regulatory obligations (e.g., AML record-keeping), which takes precedence over deletion requests for the duration of the mandatory retention period.
• Right to Restriction of Processing: You may request that pos4g restrict the processing of your Personal Data in certain circumstances — for example, while an accuracy dispute is being resolved.
• Right to Data Portability: Where processing is carried out by automated means on the basis of consent or contract, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests. pos4g will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

pos4g will respond to all valid data subject rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will inform you of the extension and the reason for it.

The pos4g Platform is strictly intended for adults aged 21 and over. pos4g does not knowingly collect Personal Data from any individual under the age of 21. If we become aware that a Member has provided false age information during registration and is in fact under 21, we will immediately close the account, delete all associated Personal Data to the extent not required for regulatory retention, and return any deposited funds via the original payment method.

If you are a parent or guardian and believe your child has registered on pos4g, please contact our support team immediately at the address in Section 15 so that the account can be closed and the data removed without delay.

The pos4g Platform does not contain links to third-party websites. In the event that any such link is ever included in an informational context, pos4g takes no responsibility for the privacy practices or data handling of those external sites. This Privacy Policy applies solely to the pos4g Platform and its associated services.

Payment processing interactions that redirect Members to third-party banking or e-wallet interfaces (such as BCA's internet banking portal or the OVO app) are governed by the privacy policies of those respective services. pos4g recommends reviewing those policies directly.

pos4g may update this Privacy Policy from time to time to reflect changes in our data practices, Platform features, regulatory requirements, or applicable law. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

When material changes are made to this Policy, pos4g will notify Members via a prominent notice on the Platform and, where practical, via email to the registered address associated with your account. We encourage you to review this Policy periodically.

Continued use of the pos4g Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree with any change, you should cease using the Platform and contact support to arrange account closure.

For any enquiries, requests, or complaints relating to this Privacy Policy or to the processing of your Personal Data by pos4g, please contact us through any of the following channels:

• Live Chat: Available 24/7 within the Platform interface. For privacy-related matters, request to speak with the Compliance or Data Protection team.
• Email: [email protected] — plain text, not a clickable link. Use the subject line "Privacy Request — [Your Username]" for formal data subject rights requests. Typical response: within 2 business days for acknowledgement; full resolution within 30 days.
• WhatsApp: +62 811 0000 4G — plain text, not a clickable link. Available 08:00–24:00 WIB for informal queries; formal requests should be submitted via email for record-keeping purposes.

If you are dissatisfied with pos4g's response to a privacy complaint, you may escalate the matter to the data protection supervisory authority of the Operator's licensing jurisdiction. Details of the relevant supervisory authority are available on request from the Compliance team.