Privacy Policy — diva4 Data Protection Commitment

In this Privacy Policy, the following terms carry the meanings set out below unless the context clearly requires otherwise:

This Privacy Policy applies to all Personal Data collected by diva4 in connection with your use of the Platform, regardless of how you access it — whether via desktop browser, mobile browser, or any other interface. It covers Personal Data collected during account registration, KYC verification, deposits and withdrawals in Indonesian Rupiah (IDR), gameplay, promotions, and customer support interactions.

diva4 acts as the Data Controller for the Personal Data described in this policy. Where diva4 engages third-party Processors — such as payment gateway providers, identity verification services, and game-content studios — it does so under binding data-processing agreements that restrict those Processors to acting solely on diva4's documented instructions.

This policy does not apply to third-party websites or services that may be linked from the Platform. diva4 has no control over the data practices of those third parties and accepts no responsibility for their privacy conduct.

diva4 collects Personal Data in three primary ways: data you provide directly, data generated automatically through your use of the Platform, and data received from third-party verification services. The categories and specific data points collected under each are set out in the table below.

diva4 does not collect special categories of sensitive Personal Data (such as health information, biometric data for identification purposes, racial or ethnic origin, religious beliefs, or political opinions) unless expressly required by applicable law and with appropriate safeguards in place.

diva4 processes Personal Data only where a legitimate legal basis exists. The primary legal bases and the corresponding processing purposes are as follows:

1. Performance of Contract: Processing your Identity Data, Contact Data, and Financial Data is necessary to create and maintain your Account, verify your eligibility (including age verification — you must be at least 21 years old), process deposits and withdrawals in IDR, and deliver the Services described in the diva4 Terms & Conditions.
2. Legal Obligation: Processing required to comply with applicable anti-money-laundering (AML) regulations, counter-terrorist-financing (CTF) requirements, and tax reporting obligations — including KYC verification and transaction monitoring — is carried out on the basis of legal obligation. diva4 cannot waive or negotiate these requirements on a Member's behalf.
3. Legitimate Interests: diva4 processes Technical Data and Gameplay Data on the basis of its legitimate interest in maintaining Platform security, detecting and preventing fraud and bonus abuse, improving service quality, and analysing aggregate usage patterns. Where diva4 relies on legitimate interests, it has conducted a balancing assessment and is satisfied that the processing does not override Members' fundamental privacy rights.
4. Consent: Where diva4 sends you direct marketing communications (promotional emails, bonus notifications, personalised offers), it does so only with your explicit, freely given, and withdrawable consent. You may withdraw marketing consent at any time by clicking the unsubscribe link in any marketing email or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before withdrawal.

diva4 does not sell, rent, or trade your Personal Data. Your data is shared with third parties only in the limited circumstances described below, and only to the extent strictly necessary for the specified purpose:

1. Payment Gateway Providers: To process deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and Bank Permata, and e-wallet transactions via OVO, DANA, GoPay, ShopeePay, and LinkAja, diva4 shares Financial Data with the relevant payment gateway or banking partner. These Processors are bound by bank-grade data protection standards and are not permitted to use your data for any purpose beyond executing the transaction.
2. KYC & AML Service Providers: Identity Data and Verification Data are shared with third-party identity verification and AML screening Processors to fulfil diva4's legal obligations. These Processors operate under binding data-processing agreements and are prohibited from using your data for any secondary purpose.
3. Game Content Studios: When you access casino games provided by Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, Pocket Games Soft, or Spribe, limited Technical Data (session token, game result, wager amount) is shared with the relevant studio's game server infrastructure for the purpose of rendering the game and recording its audited outcome. No Identity Data is passed to game studios.
4. Analytics Providers: diva4 uses first-party analytics tools. Where third-party analytics SDKs are used for performance diagnostics, data is anonymised or pseudonymised before transmission and is subject to a data-processing agreement prohibiting re-identification.
5. Law Enforcement & Regulatory Bodies: diva4 will disclose Personal Data to law enforcement authorities, courts, regulators, or other public bodies where required to do so by applicable law, court order, or where diva4 reasonably believes disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
6. Business Transfers: In the event of a merger, acquisition, or sale of assets involving diva4, Personal Data held by diva4 may be transferred to the successor entity, subject to that entity assuming the same data protection obligations described in this policy. Members will be notified of any such transfer before it takes effect.

diva4 uses cookies and similar technologies to maintain your session, remember your preferences, and analyse Platform performance. The cookies deployed by diva4 fall into the following categories:

diva4 does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts on the Platform.

You may manage your cookie preferences at any time through your Account settings. Withdrawing consent for functional or analytical cookies will not affect your ability to access core Platform features, though some personalisation features may be unavailable.

diva4 implements a multi-layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• Transport Security: All data transmitted between your device and the diva4 servers is encrypted using TLS 1.3. Connections using deprecated protocols (TLS 1.0, TLS 1.1, SSLv3) are rejected at the server level.
• At-Rest Encryption: Sensitive fields — including passwords (stored as salted bcrypt hashes), payment method details, and identity document data — are encrypted at rest using AES-256 with hardware-managed key storage.
• Access Controls: Access to Member Personal Data within diva4's internal systems is restricted on a need-to-know basis using role-based access control (RBAC). All internal access events are logged and subject to periodic audit review.
• Penetration Testing: diva4 commissions independent security penetration tests on the Platform on a regular basis. Identified vulnerabilities are remediated within defined severity-based SLA windows.
• Incident Response: diva4 maintains a documented data-breach response procedure. In the event of a breach that poses a material risk to Members' rights, affected Members will be notified within 72 hours of diva4 becoming aware of the incident, along with guidance on protective steps they can take.

While diva4 applies industry-standard security controls, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account login credentials and for notifying diva4 immediately at [email protected] if you suspect any unauthorised access to your Account.

As a diva4 Member, you hold the following data protection rights with respect to the Personal Data we process about you. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". diva4 will respond within 30 calendar days of receiving a valid, verified request.

diva4 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or audit obligations. The table below sets out the standard retention periods for the principal categories of data:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

diva4's primary data infrastructure is hosted in data centres with robust physical and logical security controls. Some third-party Processors engaged by diva4 — including certain game-content studio infrastructure providers and KYC verification services — may process Personal Data on servers located outside Indonesia.

Where Personal Data is transferred to a country that does not offer an equivalent level of data protection to that applicable in Indonesia, diva4 ensures that appropriate safeguards are in place before the transfer takes place. These safeguards include:

• Binding data-processing agreements incorporating standard contractual clauses;
• Certification under recognised international data security standards (such as ISO 27001 or SOC 2 Type II); and
• Supplementary technical measures, including end-to-end encryption, where the standard contractual clauses alone are not considered sufficient given the nature of the data and the destination country's legal framework.

You may request further information about the specific safeguards applicable to any international transfer by contacting diva4 at [email protected].

The diva4 Platform is strictly for adults aged 21 and above. diva4 does not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory step in the registration and KYC process; Accounts that cannot be verified as belonging to an individual of at least 21 years of age will be immediately suspended.

If diva4 becomes aware that it has inadvertently collected Personal Data from a person under the age of 21, it will take immediate steps to delete that data and close the associated Account. If you believe that diva4 may hold Personal Data relating to a minor, please contact [email protected] immediately.

diva4 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing activities, or the services we offer. The version number and "Last updated" date at the top of this page will be revised each time a change is made.

Where a change is material — meaning it meaningfully affects how your Personal Data is used or reduces your rights under this policy — diva4 will provide advance notice to Members via the email address registered to their Account, with a minimum of 14 calendar days before the amended policy takes effect.

Your continued use of the Platform after the effective date of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised policy, you should close your Account before the effective date and request deletion of your Personal Data in accordance with Clause 8.

Previous versions of this Privacy Policy are available on request from [email protected].

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way diva4 handles your Personal Data, please contact the diva4 privacy team using the details below. All privacy-related enquiries are handled by designated personnel with data protection responsibilities.

• General Support & Privacy Enquiries: [email protected] — use the subject line "Privacy Enquiry" to ensure your message is routed to the correct team.
• Data Rights Requests: [email protected] — use the subject line "Data Rights Request". Include your registered Account email address and the specific right you wish to exercise.
• Response Target: diva4 aims to acknowledge all privacy enquiries within 48 hours (Western Indonesia Time, WIB UTC+7) and to provide a substantive response within 30 calendar days. Complex requests may require additional time; you will be notified of any extension with an explanation.
• Support Availability: The diva4 customer support team operates 24 hours a day, 7 days a week, including Indonesian public holidays (Idul Fitri, Idul Adha, Independence Day 17 August, Nyepi, and other national observances), staffed by native Indonesian-speaking agents.