Privacy Policy

1Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

2Data We Collect

rvip1 collects only the Personal Data that is necessary for the purposes described in this Policy. The categories of data we collect are:

2.1 Identity & Contact Data

When you register a Player Account, we collect your full legal name as it appears on your Indonesian KTP, date of birth, residential address, Indonesian mobile number, and email address. This data is used to create and manage your account and to fulfil KYC and AML obligations.

2.2 Identity Verification Documents

To complete KYC verification, we may collect a scanned copy or photograph of your Indonesian national identity card (KTP), taxpayer identification number (NPWP) where applicable, a selfie image for facial comparison, and proof of payment method ownership (e.g., a screenshot of an e-wallet account or bank statement header). These documents are processed in an isolated verification environment and are not used for any purpose beyond identity verification and regulatory compliance.

2.3 Financial Transaction Data

We record the details of all deposits and withdrawals made on your account, including amounts in Indonesian Rupiah (IDR), timestamps, transaction reference numbers, and the payment channel used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja). Full payment card numbers are never stored on rvip1's own servers.

2.4 Gameplay & Wagering Data

We record all betting activity on your account, including game titles played, wager amounts, outcomes, session durations, and cumulative win/loss positions. This data is used for account management, bonus calculation, responsible gaming monitoring, and dispute resolution.

2.5 Technical & Device Data

When you access the Platform, we automatically collect your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, and session timestamps. This data is used for security monitoring, fraud detection, and platform optimisation.

2.6 Communications Data

If you contact rvip1 via live chat, email, or any other channel, we retain records of that correspondence — including chat transcripts — for quality assurance, dispute resolution, and training purposes. Call recordings (if applicable) are retained for a maximum of 90 days before being automatically purged unless required for an ongoing investigation.

3How We Collect Data

rvip1 collects Personal Data through the following means:

• Direct Collection: Information you voluntarily provide when completing the registration form, submitting KYC documents, contacting support, or participating in promotions.
• Automated Collection: Technical and device data collected automatically via server logs, cookies, pixel tags, and similar tracking technologies when you browse the Platform (see Clause 7 for full cookie details).
• Transaction Records: Financial data generated when you initiate a deposit or withdrawal through one of our integrated payment channels (BCA, BRI, OVO, DANA, etc.).
• Third-Party KYC Providers: Where rvip1 uses a third-party identity verification vendor to perform document checking and facial comparison, that vendor may return verification scores, risk flags, and document authenticity assessments to rvip1. The vendor processes only the specific documents you submit for verification purposes.
• Fraud & Risk Screening: rvip1 may receive risk signals and fraud alerts from third-party screening services in connection with account creation, login attempts, or financial transactions.

4How We Use Your Data

rvip1 processes your Personal Data for the following purposes:

rvip1 will not process your Personal Data for any purpose that is incompatible with those listed above without obtaining your prior consent or establishing a separate legal basis under applicable data protection law.

5Legal Basis for Processing

rvip1 processes your Personal Data only where it has a valid legal basis to do so. The primary legal bases we rely on are:

• Contractual Necessity: Processing your identity, contact, and financial data is necessary to fulfil our contractual obligations to you under the rvip1 Terms & Conditions — including opening your account, processing deposits, settling withdrawals, and administering bonus offers.
• Legal Obligation: KYC verification, AML record-keeping, and certain data retention obligations are required by the regulatory framework under which rvip1 is licensed. We must process and retain this data regardless of your preferences in order to comply with applicable law.
• Legitimate Interests: Fraud detection, security monitoring, platform analytics, and responsible gaming monitoring are carried out on the basis of rvip1's legitimate interest in operating a secure, fair, and sustainable gaming platform. We have assessed that these interests do not override your fundamental privacy rights in each case.
• Consent: Sending you promotional communications and deploying non-essential cookies are carried out only with your explicit, freely given, and withdrawable consent. You may withdraw consent at any time without affecting any other processing based on a different legal basis.

6Data Sharing & Disclosure

rvip1 does not sell your Personal Data. We share it only in the following circumstances and with the following categories of recipient:

6.1 Payment Processors & Banks

To facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja, we share necessary transaction data with the respective financial institution or payment gateway. Each provider operates under its own privacy and data security standards and applicable Indonesian banking regulations.

6.2 KYC & AML Vendors

rvip1 may engage licensed third-party KYC and AML service providers to assist with document verification, facial recognition matching, and transaction risk scoring. These vendors process only the data needed to perform the verification task and are contractually prohibited from using your data for any other purpose.

6.3 Game Content Providers

Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised or pseudonymised game-session data (e.g., game ID, session duration, bet amounts) to operate their games and detect technical errors. These providers do not receive your name, KTP number, or contact details unless required for a specific investigation.

6.4 Regulatory Authorities

rvip1 will disclose Personal Data to any competent regulatory, law-enforcement, or governmental authority where required to do so by applicable law, valid court order, or licensing condition. We will notify you of such a disclosure to the extent permitted by law.

6.5 Affiliated Entities & Successors

Your data may be shared within the rvip1 group of companies for internal administrative purposes under equivalent data protection standards. In the event of a merger, acquisition, or sale of assets, your Personal Data may be transferred to the successor entity subject to this Privacy Policy continuing to apply or an equivalent policy being adopted.

7Cookies & Tracking Technologies

rvip1 uses cookies and similar technologies on the Platform. Below is a summary of the cookie categories we deploy:

You may control cookie preferences via your browser settings. Disabling strictly necessary cookies will prevent you from logging into and using the Platform. Withdrawing consent for analytics cookies will not affect your ability to play games or access any features.

8Data Retention

rvip1 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory obligations. The following retention schedule applies as a default:

When data is no longer required, it is securely deleted or anonymised so that it can no longer be attributed to any individual. Self-exclusion records are retained for the full duration of the exclusion period plus an additional 5 years to prevent re-registration.

9Security Measures

rvip1 maintains a comprehensive information security programme designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• Transport Security: All data in transit is encrypted using TLS 1.2 or TLS 1.3 with 256-bit cipher suites. HTTP is automatically redirected to HTTPS. HSTS (HTTP Strict Transport Security) is enforced with a minimum one-year max-age.
• Data-at-Rest Encryption: All databases and file storage volumes containing Personal Data are encrypted using AES-256. Encryption keys are managed by a dedicated key management service with quarterly rotation.
• Access Controls: Production systems are access-controlled on a strict least-privilege basis. Multi-factor authentication (MFA) is mandatory for all rvip1 personnel with access to Player data. Access logs are retained for a minimum of 12 months and are reviewed monthly.
• Penetration Testing: rvip1 engages independent security specialists to perform annual penetration tests and vulnerability assessments on the Platform. Critical findings must be remediated within 14 days; high-severity findings within 30 days.
• Incident Response: In the event of a confirmed Personal Data breach that poses a risk to your rights and freedoms, rvip1 will notify the relevant supervisory authority within 72 hours of discovery and will notify affected Players without undue delay where the breach is likely to result in a high risk to those individuals.
• Employee Training: All rvip1 staff who handle Personal Data are trained on data protection principles, phishing awareness, and secure data handling procedures at onboarding and annually thereafter.

10Your Rights

As a data subject, you have the following rights with respect to your Personal Data held by rvip1. To exercise any of these rights, contact our support team via live chat or email — see Clause 15 for contact details. We will respond within 30 days of receiving a verifiable request.

rvip1 will not charge a fee for exercising any of the above rights in ordinary circumstances. We may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive. Where we are unable to fulfil a request (e.g., due to a conflicting legal obligation to retain data), we will explain the reason clearly and in writing.

11Minors & Age Restriction

rvip1 operates a strict 21+ age restriction on all accounts and services. The Platform is not directed at, and does not knowingly collect Personal Data from, any individual under the age of 21. Age verification is a mandatory step in the KYC process, and any account found to be registered by a person under 21 will be immediately closed and any deposits returned to the source payment method.

If you have reason to believe that a minor has registered an account or is accessing the rvip1 Platform, please contact us immediately at [email protected] so that the account can be investigated and closed. Parents and guardians are encouraged to use parental control tools available on major operating systems and browsers to restrict access to online gaming websites for minors in their household.

12Third-Party Services

The rvip1 Platform integrates with a number of third-party service providers to deliver its full range of features. Each of these providers operates under its own privacy policy and is independently responsible for its own data processing practices. rvip1 performs due diligence on all third-party partners before integration and reviews their data protection standards periodically.

12.1 Game Content Providers

When you launch a game from studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft, your device establishes a direct connection to that studio's game server. The studio may collect technical session data (device type, browser, IP address, game-session identifiers) to operate the game and detect errors. Game studios do not receive your name, KTP, or financial account details.

12.2 Payment Gateways

Deposit and withdrawal transactions are processed through integrated payment gateways connected to Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). Each payment provider operates under Indonesian financial services regulations and its own privacy policy. rvip1 shares only the minimum transaction data necessary to initiate or verify a payment.

12.3 Analytics Providers

rvip1 may use privacy-respecting analytics tools to understand aggregate Platform usage patterns. Any analytics data shared with these tools is anonymised or pseudonymised before transmission, and we do not permit analytics providers to use this data for their own commercial purposes. We do not use analytics tools that build individual advertising profiles.

12.4 Infrastructure & Cloud Providers

The Platform is hosted on enterprise-grade cloud infrastructure. Our infrastructure provider processes Personal Data as a Data Processor on our behalf under a written data processing agreement that includes standard contractual clauses and security obligations at least as stringent as those described in Clause 9 of this Policy.

13International Data Transfers

rvip1's primary servers are located in jurisdictions with robust data protection frameworks. However, some of our third-party service providers — including game studios and KYC vendors — may be headquartered or operate infrastructure outside of Indonesia. When your Personal Data is transferred internationally, rvip1 ensures that appropriate safeguards are in place, including one or more of the following mechanisms:

• Standard Contractual Clauses (SCCs): Legally binding contractual obligations between rvip1 and the recipient entity that impose data protection standards equivalent to those applied within Indonesia.
• Adequacy Assessments: Where a recipient country has been assessed as providing an adequate level of data protection by the relevant supervisory authority, no additional safeguard is required.
• Binding Corporate Rules: Where data is transferred to an entity within the same corporate group, binding corporate rules approved by a competent authority may serve as the safeguard.
• Necessity for Contract Performance: In limited cases, an international transfer may be necessary to fulfil your contract with rvip1 — for example, processing a deposit via an internationally headquartered payment gateway.

You may request information about the specific safeguards in place for any particular international transfer by contacting support as described in Clause 15.

14Changes to This Privacy Policy

rvip1 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform features. When material changes are made — that is, changes that meaningfully affect your rights or the way we process your data — we will notify you by:

• Displaying a prominent notice on the rvip1 homepage or in your account dashboard for a period of at least 14 days before the change takes effect;
• Sending an email notification to the address registered on your account; and/or
• Requesting renewed consent where the change affects a processing activity for which consent is the legal basis.

Non-material changes — such as typographical corrections, clarifications, or formatting updates — may be made without advance notice and will take effect immediately upon publication. The "Last Updated" date at the top of this page always reflects the date of the most recent revision.

Your continued use of the rvip1 Platform after any amended Privacy Policy has taken effect constitutes your acknowledgement of the amended terms. If you do not agree to an amendment, you must stop using the Platform and contact support to request account closure before the effective date of the change.

15Contact & Data Protection Officer

If you have any questions, concerns, or complaints about this Privacy Policy or the way rvip1 processes your Personal Data, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the rvip1 Platform. Our Indonesian-speaking support agents can handle general enquiries, while privacy-specific requests are escalated to the data team.
• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request — [Your Account Username]" to ensure prompt routing. We aim to respond to all privacy-related emails within 5 business days (WIB business hours).

For formal data subject rights requests — including access, rectification, erasure, restriction, portability, or objection — please email us with a clear description of your request and include a copy of your account verification so we can confirm your identity before processing the request. We will respond within 30 calendar days of receiving a verifiable request, and will extend this period by up to an additional 60 days where the complexity or volume of requests requires it, notifying you of the extension within the initial 30-day window.

rvip1 takes privacy complaints seriously. If you believe we have not handled your Personal Data in accordance with this Policy, please raise the matter with our support team in the first instance. If you remain unsatisfied after our response, you have the right to escalate your complaint to the relevant supervisory or data protection authority in your jurisdiction.