Privacy Policy

1 Introduction

frywin operates the online gaming platform accessible at https://frywin.cam. In the course of providing our services — which include casino games, sports betting, e-wallet transactions, and customer support — we necessarily collect and process personal data belonging to our Members and site visitors. We take this responsibility seriously.

This Privacy Policy has been drafted to meet internationally recognized data protection standards, including principles analogous to those set out in the European Union General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (UU PDP No. 27 Tahun 2022). We apply these standards because our primary user base consists of Indonesian players whose privacy we are obligated to protect, and because operating to a high international standard reflects our commitment to being a trustworthy platform.

We do not sell, rent, or trade your personal data to any external party for that party's own commercial use. The only sharing that occurs is strictly necessary for delivering our services — for example, transmitting your bank account name to a payment processor to complete a withdrawal to your BCA or Mandiri account. All such sharing is governed by data processing agreements that require the receiving party to handle your data with equivalent care.

2 Definitions

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data. This includes your name, email address, device IP address, and bank account number.
• "Processing" — Any operation performed on Personal Data, including collection, storage, organization, retrieval, use, disclosure, erasure, and destruction.
• "Data Controller" — The entity that determines the purposes and means of Processing Personal Data. For this platform, the Data Controller is frywin.
• "Data Processor" — A third party that Processes Personal Data on behalf of frywin under a data processing agreement (e.g., a payment gateway provider).
• "Member" — A natural person who has completed account registration on the frywin platform.
• "Cookies" — Small data files placed on your device by the Platform that help us remember your preferences and analyze usage patterns.
• "Sensitive Data" — A subset of Personal Data that warrants additional protection, including identity document scans, financial account numbers, and any health-related information disclosed in the context of responsible gaming requests.

3 Data Controller

The Data Controller responsible for your Personal Data is frywin, operating the platform at https://frywin.cam. For all data protection inquiries, rights requests, and complaints, you may contact our designated Data Protection contact point using the details provided in Section 16 of this policy.

frywin is licensed to operate internationally and maintains its principal data processing infrastructure in secure data centers subject to industry-standard physical and logical access controls. A description of our security measures is provided in Section 12 of this policy.

4 Data We Collect

frywin collects Personal Data through several distinct channels. The categories of data collected, the channel through which each is obtained, and the primary purpose for collection are summarized in the table below:

We collect only the minimum data necessary for each stated purpose. We do not collect data about race, ethnicity, political opinions, religious beliefs, or biometric identifiers beyond the photograph present on a government-issued identity document submitted for KYC purposes.

5 Legal Basis for Processing

frywin relies on the following legal bases when processing your Personal Data:

• Contractual Necessity: Processing required to create and manage your account, execute deposits and withdrawals, settle bets, and deliver all core Platform services. Without this processing, we cannot provide the service you have registered for.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML) obligations, identity verification requirements, and fraud prevention standards mandated by our licensing authority.
• Legitimate Interests: Processing undertaken for purposes that are in our legitimate business interest and do not override your fundamental rights — for example, security monitoring, platform analytics to improve user experience, and fraud detection. We balance our interests against your privacy rights before relying on this basis.
• Consent: Processing for non-essential marketing communications (promotional emails, SMS notifications of bonus offers). You may withdraw this consent at any time by updating your notification preferences in your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6 How We Use Your Data

The Personal Data we collect is used exclusively for the purposes described below. We do not use your data for automated decision-making that produces significant legal effects without human review.

• Account Management: Creating, authenticating, and maintaining your Member account, including password recovery and session management.
• Payment Processing: Verifying that deposits originate from a payment method registered in your name and routing withdrawal proceeds to your confirmed bank account (BCA, BRI, BNI, Mandiri, and others) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity Verification (KYC): Confirming that you are who you claim to be, that you are at least 21 years of age, and that your account has not been duplicated in violation of our one-account policy.
• Fraud & Security: Detecting and preventing unauthorized account access, bonus abuse, money laundering, multi-accounting, and other activities prohibited by our Terms & Conditions.
• Service Improvement: Analyzing aggregated and anonymized usage data to identify technical issues, optimize platform performance, and improve the overall gaming experience.
• Customer Support: Responding to inquiries, resolving disputes, processing responsible gaming requests (such as self-exclusion and deposit limit adjustments), and maintaining records of support interactions for quality assurance.
• Marketing Communications (consent-based only): Sending personalized promotional offers, bonus notifications, and platform updates via email or SMS where you have opted in to receive such communications.
• Regulatory Compliance: Retaining records required by our licensing authority and cooperating with lawful requests from competent authorities.

7 Data Sharing & Disclosure

frywin does not sell, rent, or otherwise commercially exploit your Personal Data. We share data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Processors & Banking Partners: We share your name, bank account details, and transaction amounts with payment processing partners to execute deposits and withdrawals. All such partners are bound by contractual data protection obligations at least as stringent as those described in this policy.
• Identity Verification Providers: KYC document checks may be processed by a third-party identity verification service. This provider receives only the documents necessary to complete verification and is contractually prohibited from using your data for any other purpose.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized session identifiers necessary for game delivery and fairness certification. They do not receive your name, contact details, or financial data.
• Fraud Prevention Networks: We may share limited account identifiers with shared fraud prevention databases to protect the Platform and its Members from known bad actors.
• Legal & Regulatory Authorities: We will disclose Personal Data to law enforcement or regulatory bodies where we are compelled to do so by a valid legal process (e.g., court order, regulatory direction). Where permitted, we will notify you before complying with such a request.
• Corporate Restructuring: In the event of a merger, acquisition, or sale of substantially all of frywin's assets, your Personal Data may be transferred to the successor entity, which will be bound by a privacy policy providing at least equivalent protections to this one.

8 Cookies & Tracking Technologies

frywin uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, and to gather analytics data that helps us improve our services. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies manage your login session, maintain your account authentication state, and enable core security features such as CSRF protection. They cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: Remember your preferences — such as your preferred currency display format (IDR / Rp), chosen language, and game lobby filter settings — so that you do not need to re-enter these preferences on each visit.
• Analytics Cookies: Collect anonymized data about how Members use the Platform (pages visited, session duration, click paths). This data is used in aggregate to identify areas for improvement. No individual Member is identified in our analytics reports.
• Security Cookies: Support our fraud detection systems by identifying unusual patterns of access (e.g., rapid login attempts from multiple IP addresses, which may indicate a credential-stuffing attack).

You may manage cookie preferences through your browser settings. Disabling functional or analytics cookies will not prevent you from using the Platform but may reduce the quality of your experience. Disabling strictly necessary cookies will prevent login and account functionality from operating correctly.

9 Data Retention

frywin retains Personal Data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of your membership plus a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later.
• Transaction Records: Deposit, withdrawal, and wagering records are retained for a minimum of five (5) years from the date of each transaction.
• Support Communications: Chat transcripts and email records are retained for three (3) years from the date of the interaction.
• Marketing Consent Records: Records of your consent to (or withdrawal from) marketing communications are retained for the lifetime of your account plus two (2) years.
• Technical & Server Logs: IP address logs and access logs are retained for ninety (90) days, after which they are automatically purged unless required for an ongoing fraud or security investigation.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual. Anonymized data may be retained indefinitely for statistical analysis.

10 International Data Transfers

frywin's platform infrastructure and some of its third-party service providers operate outside Indonesia. Accordingly, your Personal Data may be transferred to and processed in countries other than your country of residence. Such countries may have data protection laws that differ from those applicable in Indonesia.

Whenever we transfer Personal Data internationally, we implement appropriate safeguards to ensure that the receiving party provides a level of protection equivalent to the standards described in this policy. These safeguards may include:

• Contractual clauses that require the recipient to handle your data in accordance with internationally recognized data protection principles.
• Selecting service providers that are certified under recognized security and privacy frameworks (e.g., ISO/IEC 27001).
• Restricting the scope of data transferred to only what is strictly necessary for the service being provided by the recipient.

By registering an account and providing your Personal Data, you acknowledge that your data may be transferred internationally for the purposes described in this policy.

11 Your Data Rights

As a Member of frywin, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact us using the details in Section 16. We will respond to all rights requests within 30 calendar days of receipt, and at no charge for reasonable requests.

12 Security Measures

frywin employs a multi-layered security framework to protect your Personal Data against unauthorized access, accidental loss, destruction, or alteration. Our key security controls include:

• Transport Encryption: All data transmitted between your device and the frywin platform is encrypted using TLS 1.2 or TLS 1.3 (256-bit SSL). This includes login sessions, deposit forms, and any page on which Personal Data is submitted.
• Data-at-Rest Encryption: Sensitive data stored in our databases — including KYC documents, financial account references, and identity data — is encrypted using AES-256 encryption at rest.
• Access Controls: Internal access to Member Personal Data is restricted on a strict need-to-know basis. Staff who require access to fulfill support or compliance functions are subject to role-based access controls, mandatory security training, and confidentiality agreements.
• Intrusion Detection: Our infrastructure is monitored 24 hours a day by automated intrusion detection systems that flag anomalous access patterns for human review within minutes.
• Penetration Testing: We commission independent security audits and penetration tests on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed data breach affecting Member Personal Data, frywin will notify affected Members within 72 hours of becoming aware of the breach, providing details of what data was affected and the steps we are taking to contain and remediate the incident.

13 Minors

The frywin platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from persons under the age of 21. Registration by minors is prohibited under our Terms & Conditions and violates applicable responsible gaming standards.

If frywin discovers or is notified that a Member account belongs to a person under 21 years of age, we will immediately suspend the account, conduct a review, delete any Personal Data associated with that account that we are not legally required to retain, and return any real-money deposits to the source payment method.

If you are a parent or guardian and believe that a person under your care has registered an account with frywin, please contact our support team immediately using the details in Section 16 so that we can take prompt action.

14 Third-Party Services

The frywin platform integrates content and services provided by third parties, including game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) and payment infrastructure partners. While we select these partners carefully and require them to meet our data protection standards contractually, each third party operates under its own privacy policy for data it collects directly.

frywin does not link to external websites and does not embed social media widgets or advertising networks that track your activity across the internet. The only third-party code executing on the frywin platform is directly related to game delivery, payment processing, and internal analytics — all subject to the data sharing restrictions described in Section 7.

15 Policy Amendments

frywin reserves the right to update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will provide at least seven (7) days' advance notice by posting a prominent notice on the Platform and, where practicable, by sending an email to all registered Members.

The "Last Updated" date at the top of this policy indicates when the most recent revision took effect. We encourage you to review this policy periodically. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised policy. If you do not agree with the amended terms, you may request account closure by contacting our support team.

16 Contact & Complaints

For any questions, concerns, or rights requests relating to this Privacy Policy or frywin's data practices, please reach out to our support team through the following channels. All privacy-related inquiries will receive an acknowledgment within 24 hours and a substantive response within 30 calendar days:

• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform. Select "Privacy & Data" as the inquiry category for fastest routing.
• Email: [email protected] — please include "Privacy Request" in the subject line and your registered account email address in the body of the message.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to a relevant data protection supervisory authority in your jurisdiction. We will cooperate fully with any such authority in the investigation of a complaint.