555kz Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below:

This Privacy Policy applies to all personal data collected and processed by 555kz in connection with the operation of the Platform, including data collected from members resident in Indonesia and from visitors who browse 555kz.net without registering an account.

555kz acts as the data controller for all personal data collected directly through the Platform. Where 555kz engages third-party processors to perform specific functions (such as payment processing via BCA, BRI, DANA, or GoPay infrastructure), those processors act as data processors under binding contractual terms and are not independent controllers of your data for 555kz's purposes.

This Policy does not apply to third-party websites or services that may be linked from the Platform for informational purposes. 555kz is not responsible for the privacy practices of any third-party site, and we encourage you to review the privacy policies of any external service you access.

555kz collects the following categories of personal data from members and Platform visitors:

555kz collects personal data through the following channels:

• Direct submission: When you complete the registration form, submit KYC documents, initiate a deposit or withdrawal transaction, contact our support team via live chat or email, or update your account profile settings.
• Automatic technical collection: When you visit 555kz.net, our servers automatically log your IP address, browser information, referring URL, and session timestamps. This technical data is collected regardless of whether you are a registered member.
• Cookies and similar tracking technologies: 555kz uses first-party cookies and, where applicable, third-party analytics scripts to understand how members navigate the Platform. See Clause 7 for full details of our cookie usage.
• Payment processor callbacks: When you complete a deposit or withdrawal via a local Indonesian payment channel (for example, a DANA e-wallet transfer or a BCA virtual account payment), the relevant payment processor returns a transaction confirmation payload to 555kz containing the transaction reference, amount in IDR, and the name registered to the originating account. This data is used solely to credit your playing balance and reconcile transactions.
• Identity verification providers: Where 555kz uses an automated KYC service to verify the authenticity of identity documents submitted by members, that provider may return a verification result and a risk score to 555kz. The underlying document images are stored by 555kz for the retention period defined in Clause 9.
• Publicly available sources: In limited circumstances relating to fraud prevention and AML compliance, 555kz may cross-reference member information against publicly available sanctions lists or court record databases.

555kz processes personal data only where a lawful basis exists for that processing. The table below sets out the primary processing purposes and the corresponding legal basis for each:

555kz does not sell personal data to any third party. We share personal data with third parties only in the following limited circumstances:

• Payment processors and banking partners: To facilitate deposits and withdrawals in IDR, 555kz shares the minimum necessary financial and identity data with relevant Indonesian payment processors and banking partners, including BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja. These entities are independent data controllers with respect to their own services and are subject to their own privacy policies and applicable Indonesian financial regulations.
• KYC and identity verification providers: 555kz may engage a third-party identity verification service to assist with KYC document authentication. Any such provider acts as a data processor under a binding data processing agreement and may not use member identity data for any purpose beyond the verification service it provides to 555kz.
• Cloud infrastructure and hosting providers: 555kz's Platform is hosted on cloud infrastructure operated by third-party providers. These providers have access to data stored on their infrastructure as part of service delivery but are contractually prohibited from accessing, using, or disclosing that data independently.
• Fraud prevention and AML compliance services: 555kz may share data with specialised fraud detection or sanctions screening services where required to meet its legal obligations or to protect the integrity of the Platform.
• Legal and regulatory authorities: 555kz will disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, by a valid court order, or where 555kz reasonably believes disclosure is necessary to prevent imminent harm or illegal activity.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of 555kz's business, personal data held by 555kz may be transferred to the acquiring entity as part of the transaction. Members will be notified of any such transfer and of any material changes to this Privacy Policy that result from the transaction, with a minimum of 30 days' notice before the transfer takes effect.

All third-party processors engaged by 555kz are required, by contract, to implement data security measures equivalent to those described in Clause 10 of this Policy and to process personal data only on 555kz's documented instructions.

555kz uses cookies and similar tracking technologies on 555kz.net to ensure the Platform functions correctly, to maintain your login session, and to analyse how members interact with the site. The following categories of cookies are used:

You may manage your cookie preferences at any time through the cookie settings panel accessible from the footer of 555kz.net, or by configuring your browser to block or delete cookies. Note that disabling strictly necessary cookies will prevent you from logging in and using core Platform features. Disabling functional cookies may result in a degraded browsing experience.

555kz does not use third-party advertising network cookies that track your activity across external websites for the purpose of serving behavioural advertising outside of 555kz.net.

555kz's primary operational infrastructure is hosted in data centres selected for their proximity to Southeast Asia in order to provide low-latency service to Indonesian members. Where personal data is transferred to, stored in, or processed in a country outside Indonesia, 555kz ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections described in this Privacy Policy.

Such safeguards may include, as applicable:

• Standard contractual clauses between 555kz and the relevant third-party processor, requiring the processor to maintain data security standards consistent with this Policy.
• Transfers to processors located in countries whose data protection frameworks have been assessed as providing adequate protection for personal data.
• Binding corporate rules or equivalent data governance frameworks where the processor is part of a multinational corporate group.

You may request further information about the specific safeguards in place for any given international transfer by contacting 555kz through the channels described in Clause 12.

555kz retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is subject to a legal hold (for example, as part of ongoing litigation or a regulatory investigation), retention is extended until the hold is lifted.

555kz implements a layered approach to data security, combining technical, organisational, and procedural controls to protect personal data against unauthorised access, loss, destruction, or disclosure. Key measures include:

• Transport security: All connections to 555kz.net, including the 555kz login page, deposit pages, and API endpoints, are secured with TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS. HSTS headers are enforced to prevent protocol downgrade attacks.
• Data-at-rest encryption: Member databases are encrypted using AES-256. Backup copies are stored in encrypted form in geographically separated data centres.
• Access controls: Access to production systems and member data is restricted to authorised personnel using role-based access control (RBAC). All privileged access is logged and subject to quarterly review. Remote access requires multi-factor authentication (MFA).
• Withdrawal PIN: A separate withdrawal PIN, distinct from your 555kz login password, is required to authorise all cashout requests. This provides an additional authentication layer for financial transactions.
• Intrusion detection: 555kz operates real-time intrusion detection and anomaly monitoring systems. Suspicious activity patterns — including unusual login locations, abnormal transaction velocities, and repeated failed authentication attempts — trigger automated alerts and, where warranted, temporary account suspension pending investigation.
• Penetration testing: 555kz commissions independent security assessments and penetration tests of its Platform on a regular basis. Critical findings are remediated within defined timelines as part of 555kz's vulnerability management programme.
• Staff training: All 555kz personnel with access to personal data complete mandatory data protection and security awareness training upon onboarding and annually thereafter.

As a 555kz member whose personal data is processed under this Privacy Policy, you hold the following rights with respect to that data:

• Right of Access: You may request a copy of the personal data 555kz holds about you, including information about the purposes for which it is processed, the categories of data held, any third parties with whom it has been shared, and the applicable retention period.
• Right to Rectification: If any personal data held by 555kz is inaccurate or incomplete, you may request that it be corrected or updated. For minor changes (such as a change of email address), you may update your details directly in the account dashboard. For changes to identity documents, please contact our support team.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, or where you object to processing and 555kz has no overriding legitimate grounds. This right is subject to exceptions where retention is required by applicable law (for example, AML retention obligations under Clause 9).
• Right to Restrict Processing: You may request that 555kz restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed, or where you have objected to processing and a decision is pending.
• Right to Data Portability: Where processing is based on consent or on performance of a contract and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format (such as JSON or CSV), or transmitted directly to another controller where technically feasible.
• Right to Object: You may object at any time to the processing of your personal data where 555kz relies on legitimate interests as the legal basis, including profiling for fraud detection and marketing analytics. 555kz will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right not to be Subject to Solely Automated Decisions: 555kz may use automated systems to flag accounts for fraud review or to assess responsible gaming risk. Where a fully automated decision produces a legal or similarly significant effect on you (for example, account suspension), you have the right to request human review of that decision.

To exercise any of the above rights, please contact the 555kz Data Privacy team using the details in Clause 12. We will respond to all verified requests within 30 calendar days. Complex or multi-part requests may require up to 60 days; you will be informed if an extension is necessary. There is no charge for submitting a data rights request unless the request is manifestly unfounded or excessive.

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data 555kz holds about you, please contact us through the following channels:

• Live Chat: Available 24/7 directly from 555kz.net. Indonesian-speaking agents are available at all hours. This is the fastest channel for urgent data security concerns, including suspected unauthorised account access.
• Support Email: [email protected] — please include "Privacy Request" in the subject line and provide your registered account username or email address to expedite verification. Responses within 5 business days for standard requests; within 24 hours for account security matters.

If you are not satisfied with 555kz's response to your privacy concern, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction applicable to 555kz's operations, or to seek legal redress through the courts.

555kz reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, Platform functionality, or our data processing practices. Material changes — including changes to the categories of data collected, the purposes for which data is processed, or the third parties with whom data is shared — will be communicated to registered members by email and by a prominent notice on the Platform no fewer than 14 calendar days before the changes take effect.

Non-material changes (such as corrections to typographical errors, clarifications of existing practices, or updates to contact details) may be made without advance notice and will be effective immediately upon publication on the Platform. The "Last Reviewed" date at the top of this Policy will be updated on every revision.

Your continued use of the Platform following the effective date of any amendment to this Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not accept the revised terms, you must cease using the Platform and may request account closure and withdrawal of your available IDR balance by contacting the support team.