Privacy Policy

1. Definitions

In this Privacy Policy the following terms carry the meanings defined below. All other capitalised terms not defined here carry the same meanings as set out in the Terms & Conditions.

• "ahha4d", "we", "us", "our" — the ahha4d gaming platform and its operating entities accessible at https://ahha4d.cam.
• "Platform" / "Services" — the ahha4d website, any associated mobile applications, and all online gaming services made available through them.
• "User", "you", "your" — any individual who visits, registers with, or uses the Platform.
• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, including name, email address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "KYC" — Know Your Customer verification procedures used to confirm your identity, age, and residency.

2. Information We Collect

ahha4d collects Personal Data through several channels. We limit collection strictly to information that is necessary for the purposes described in Section 3.

2.1 Information You Provide Directly

• Registration data: Full legal name, date of birth, Indonesian national identity number (NIK from your KTP Nasional), email address, mobile phone number, and residential address.
• KYC documents: Photographs or scans of government-issued identification (KTP, passport), proof-of-address documents (utility bills, bank statements), and selfie images for facial verification.
• Payment information: Bank account details for BCA, BRI, BNI, Mandiri, CIMB Niaga, and OCBC NISP transfers; e-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja. We do not store full card numbers; payment credentials are tokenised by our payment processors.
• Communications: Messages, emails, live-chat transcripts, and other correspondence you send to our support team.
• Preferences and settings: Responsible-gaming limits you voluntarily set, preferred language and currency, notification preferences.

2.2 Information Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Usage and log data: Pages visited, features used, games played, bet amounts, session duration, time stamps, and clickstream data.
• Location data: Approximate geographic location derived from your IP address, used for fraud prevention and compliance with jurisdiction restrictions.
• Cookies and similar technologies: Session cookies, persistent cookies, and local storage tokens. See Section 8 for full details.

2.3 Information from Third Parties

• Identity verification providers: We may receive verification results and risk scores from third-party KYC and anti-fraud services.
• Payment processors: Transaction confirmations, reference numbers, and flagged-transaction alerts from our banking and e-wallet partners.
• Game providers: Game-session results and bet histories from Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and other integrated studios for account-history and dispute-resolution purposes.

3. How We Use Your Information

We use the Personal Data we collect for the following purposes:

Purpose	Data Used	Legal Basis
Account creation and management	Registration data, KYC documents	Contract performance
Age and identity verification (KYC)	ID documents, selfie images, NIK	Legal obligation / contract
Processing deposits and withdrawals	Payment information, bank account details	Contract performance
Delivering gaming services	Usage data, game-session data	Contract performance
Fraud prevention and security	Device data, IP address, location, usage patterns	Legitimate interest / legal obligation
Regulatory compliance and AML	Identity data, transaction history	Legal obligation
Customer support	Communications, account data	Contract performance / legitimate interest
Responsible gaming monitoring	Gaming history, self-set limits, usage patterns	Legal obligation / legitimate interest
Platform analytics and improvement	Aggregated, anonymised usage data	Legitimate interest
Marketing communications (opt-in only)	Email address, communication preferences	Consent

4. Legal Basis for Processing

ahha4d processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to, including account management, gaming services, and payment processing.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) rules, age-verification requirements, and data-retention mandates.
• Legitimate interests: Processing necessary for our legitimate business interests — fraud detection, platform security, service improvement, and responsible-gaming monitoring — provided those interests are not overridden by your rights.
• Consent: Processing based on your freely given, specific, informed consent, such as receiving marketing emails. You may withdraw consent at any time by contacting support or updating your account preferences.

5. Sharing of Your Information

ahha4d does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share data only in the ci rcumstances described below:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the transaction data necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers receive the identity documents and biometric data required to complete your account verification. These providers are contractually bound to process data solely for verification purposes.
• Game providers: Integrated studios such as Pragmatic Play, Evolution Gaming, NetEnt, and Microgaming receive your account identifier and session data to deliver games and record results. They do not receive your full identity or financial details.
• Fraud prevention and security services: Specialist third-party providers may receive device identifiers, IP addresses, and behavioral signals to assess transaction risk and detect account compromise.
• Legal and regulatory authorities: We may disclose Personal Data to law-enforcement agencies, regulatory bodies, or courts when required by applicable law, a valid legal order, or to protect the rights, property, or safety of ahha4d, its users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party service providers engaged by ahha4d are required to execute data-processing agreements that impose confidentiality obligations and restrict their use of your data to the specific purposes for which it was shared.

6. Data Retention

We retain Personal Data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Our standard retention schedules are as follows:

• Active account data: Retained for the duration of your account relationship with ahha4d plus a minimum of five years after account closure, to comply with AML and financial-record-keeping obligations.
• KYC documents: Retained for a minimum of five years following the completion of verification or account closure, whichever is later, in accordance with applicable AML regulations.
• Transaction records: Retained for a minimum of five years from the date of each transaction.
• Customer support communications: Retained for three years from the date of the last interaction, unless the subject matter relates to an ongoing dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your consent plus three years thereafter as evidence of compliance.
• Anonymised analytics data: May be retained indefinitely, as it cannot be used to identify any individual.

When Personal Data is no longer required, we securely delete or anonymise it in accordance with industry-standard data-destruction procedures.

7. Security Measures

ahha4d implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data exchanged between your browser or app and our servers is encrypted using TLS 1.3. Connections using older, insecure protocol versions are rejected.
• Encryption at rest: Personal Data and financial records stored on our servers are encrypted using AES-256.
• Access controls: Access to Personal Data is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited regularly.
• Two-factor authentication: We strongly encourage users to enable two-factor authentication (2FA) on their accounts. Internal system access by our staff requires 2FA without exception.
• Penetration testing: Our platform undergoes regular third-party penetration tests and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Incident response: We maintain a documented data-breach response plan. In the event of a breach that poses a risk to your rights, we will notify affected users and relevant authorities within 72 hours of becoming aware of the incident.

8. Cookies and Tracking Technologies

ahha4d uses cookies and similar client-side storage technologies to operate and improve the Platform. We do not use third-party advertising networks or behavioural profiling cookies.

8.1 Types of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function. These include session-management cookies that keep you logged in and security tokens that prevent cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without breaking core Platform functionality.
• Performance and analytics cookies: Used to understand how users interact with our Platform — which pages are most visited, where users encounter errors, and how long sessions last. This data is aggregated and anonymised before analysis.
• Functional cookies: Remember your preferences such as language settings, responsible-gaming limits display, and preferred deposit method to improve your experience across sessions.
• Fraud-prevention tokens: Device-fingerprinting tokens used exclusively for fraud detection and account security — for example, flagging logins from new or suspicious devices.

8.2 Managing Cookies

You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair or prevent access to core Platform features including login and payment processing. For full details on controlling cookies in your specific browser, refer to your browser's help documentation.

9. Your Privacy Rights

Regardless of your location, ahha4d recognises the following privacy rights for all users. To exercise any of these rights, contact our support team at [email protected] with your registered email address and a clear description of your request.

• Right of access: You may request a copy of the Personal Data we hold about you, including the purposes for which it is processed and the categories of recipients with whom it has been shared.
• Right to rectification: You may request correction of any inaccurate or incomplete Personal Data we hold about you.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we cannot delete data we are legally required to retain (e.g., AML records).
• Right to restriction: You may request that we restrict processing of your Personal Data in certain circumstances, such as while the accuracy of data is contested.
• Right to data portability: You may request a structured, machine-readable copy of the Personal Data you provided to us, where processing is based on consent or contract.
• Right to object: You may object to processing based on our legitimate interests at any time. You may also withdraw consent for marketing communications at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decisions: Where we make automated decisions that produce significant legal or similarly significant effects on you, you have the right to request human review of such decisions.

We will respond to all valid data-rights requests within 30 calendar days. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.

10. Children and Minors

ahha4d is strictly an adults-only platform. Our services are intended exclusively for individuals who are 21 years of age or older. We do not knowingly collect Personal Data from anyone under the age of 21. If you believe that a minor has created an account or provided us with Personal Data, please contact our support team immediately at [email protected]. Upon confirmation, we will promptly close the account, delete the associated Personal Data, and reverse any transactions where technically feasible.

We enforce age restrictions through mandatory KYC verification requiring government-issued photo identification for all accounts. Accounts that fail to complete age verification within the required timeframe will be suspended until verification is successfully completed.

11. International Data Transfers

ahha4d operates internationally and some of our service providers — including identity verification services, cloud infrastructure providers, and game studios — may process your Personal Data in countries other than Indonesia. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Contractual clauses that impose data-protection obligations equivalent to those in this Privacy Policy.
• Transfers only to countries or service providers that maintain adequate data-protection standards as assessed by our legal team.
• Regular audits of third-party data processors to verify ongoing compliance with contractual and legal obligations.

By using ahha4d and providing us with your Personal Data, you acknowledge that your data may be transferred to and processed in jurisdictions outside Indonesia in the manner described in this section.

12. Changes to This Privacy Policy

ahha4d reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Display a prominent notice on the Platform homepage for a minimum of 14 days following the change.
• Send an email notification to your registered email address for changes that materially affect your rights or our core data-processing activities.

Your continued use of the Platform following notification of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the Platform and may request account closure and data deletion by contacting our support team.

13. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data-processing practices, please contact our Data Privacy team. All privacy-related correspondence should be directed to:

Email: [email protected]
Support hours: 24 hours a day, 7 days a week (WIB, UTC+7)
Response time: We aim to acknowledge all privacy enquiries within 48 hours and resolve them within 30 calendar days.

For general account support, billing enquiries, or responsible-gaming assistance, please visit our FAQ page or use the live-chat feature available on the Platform homepage.