Privacy Policy

1 Overview

Glowin operates as a premium online gaming and sports betting platform serving players primarily across Indonesia — from Jakarta and Surabaya to Medan, Bandung, Bali, Yogyakarta, and beyond. As a platform that processes financial transactions and operates in an environment subject to international anti-money laundering (AML) and Know Your Customer (KYC) obligations, the collection and responsible handling of personal data is both a legal necessity and a fundamental component of our commitment to Member safety.

We approach data privacy with the same seriousness as we approach platform security. We collect only what is necessary, retain it only for as long as required, and never sell your personal information to third-party marketers. Our data practices are designed to meet the standards expected of an internationally operating gaming platform, including robust encryption, access controls, and audit trails.

This Policy is written in plain English to ensure that every Member — regardless of their technical or legal background — can understand exactly how their data is handled. If you have questions at any point, our support team is available 24/7 and can be reached at [email protected].

2 Definitions

The following terms carry specific meanings throughout this Privacy Policy:

• "Personal Data" means any information that directly or indirectly identifies a living natural person, including names, identification numbers, location data, online identifiers, financial account details, and any combination of information that could be used to identify an individual.
• "Processing" means any operation performed on Personal Data, whether or not by automated means — including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.
• "Data Controller" means glowin, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of glowin, under contractual obligations of confidentiality and data security.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the data subject's wishes — expressed by a clear affirmative act — that signifies agreement to the processing of their Personal Data for one or more specified purposes.
• "KYC" means Know Your Customer — the mandatory identity and document verification process required by glowin prior to a Member's first withdrawal and for ongoing compliance monitoring.
• "Cookie" means a small text file placed on a user's device by a web server for the purposes described in Clause 10 of this Policy.

3 Data We Collect

Glowin collects Personal Data across several categories, depending on your interaction with the Platform. The table below summarizes the types of data we collect and the context in which each category arises:

4 How We Collect Data

Glowin collects Personal Data through the following channels and mechanisms:

• Direct Submission: Data you actively provide when completing the Account registration form, submitting KYC documents, making a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated Technical Collection: Data gathered automatically by our servers and analytics infrastructure each time you access the Platform — including IP addresses, device fingerprints, session durations, and page interaction logs. This data is collected via server logs, cookies, and similar tracking technologies as described in Clause 10.
• Payment Processing Partners: When you initiate a deposit or withdrawal, our payment gateway partners confirm transaction status and may share limited transaction metadata — such as transaction reference numbers and timestamps — with glowin for reconciliation purposes.
• Identity Verification Providers: During KYC, glowin may engage third-party identity verification services to cross-check submitted document authenticity. These providers operate under contractual data processing agreements and are prohibited from using your data for their own purposes.
• Publicly Available Sources: In cases of fraud investigation or AML screening, glowin may supplement its records with information obtained from publicly available databases, credit reference agencies, or sanctions screening lists.

5 Purpose of Processing

Glowin processes your Personal Data only for defined, legitimate purposes. We do not use your data in ways incompatible with the purposes described below without first obtaining your additional consent:

1. Account Management: Creating, maintaining, and securing your Member Account, including authentication, password recovery, and account-level communications.
2. Identity Verification (KYC): Verifying that you are who you claim to be, that you meet the minimum age requirement of 21 years, and that you are not a prohibited person under applicable regulatory frameworks.
3. Payment Processing: Facilitating deposits and withdrawals via your chosen Indonesian banking or e-wallet channel, reconciling transactions, and maintaining accurate financial records.
4. Regulatory Compliance: Meeting anti-money laundering (AML) obligations, fraud prevention requirements, and international sanctions screening duties applicable to licensed gaming operators.
5. Customer Support: Responding to inquiries, resolving disputes, and maintaining a record of support interactions to ensure continuity of service and quality assurance.
6. Responsible Gaming: Monitoring gaming behavior to identify patterns consistent with problem gambling, applying player-protection tools, and fulfilling the Platform's duty of care toward vulnerable users.
7. Platform Improvement: Analyzing aggregated and anonymized usage data to improve the Platform's functionality, game offerings, and user experience.
8. Marketing Communications: Sending promotional offers, bonus notifications, and seasonal campaign messages to Members who have opted in to receive such communications. You may withdraw this consent at any time.
9. Legal Claims: Establishing, exercising, or defending legal claims in any dispute, arbitration, or regulatory inquiry involving glowin or a Member.

6 Legal Basis for Processing

Glowin relies on the following legal bases for processing your Personal Data, as applicable to each processing activity:

• Contractual Necessity: Processing required to perform our contract with you — specifically, to provide you with a functioning Member Account, process your financial transactions, and deliver the gaming services you have registered to use.
• Legal Obligation: Processing required to comply with AML regulations, KYC obligations, record-keeping requirements, and sanctions screening applicable to international gaming operators.
• Legitimate Interests: Processing conducted in pursuit of glowin's legitimate business interests — such as fraud detection, platform security, and responsible gaming monitoring — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookie usage, where you have given clear, informed, and freely withdrawable consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

7 Data Sharing & Third Parties

Glowin does not sell, rent, or trade your Personal Data to third-party advertisers or marketing agencies under any circumstances. Data sharing with third parties is limited strictly to the categories described below:

• Payment Processors: Local Indonesian bank transfer facilitators and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the minimum transaction data necessary to process your deposit or withdrawal instruction.
• Identity Verification Providers: Third-party KYC and document verification services receive copies of your submitted identification documents solely for the purpose of authenticating your identity.
• Game Content Providers: Software studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized session identifiers to facilitate game loading and fairness auditing. They do not receive your name, address, or financial details.
• Fraud Prevention & AML Services: Specialist third-party providers used to screen transactions and user profiles against sanctions lists, fraud databases, and politically exposed persons (PEP) registers.
• Regulatory Authorities: Where required by law, by court order, or by a competent regulatory authority, glowin will disclose Personal Data to the relevant body. We will notify affected Members of such disclosure where we are legally permitted to do so.
• Analytics & Infrastructure Providers: Cloud hosting, server management, and anonymized analytics service providers who assist in operating and improving the Platform under strict data processing agreements.

8 Data Retention

Glowin retains your Personal Data only for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be attributed to any identifiable individual. Anonymized and aggregated data may be retained indefinitely for statistical and analytical purposes.

9 Security Measures

Glowin implements a multi-layered security architecture to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure. Our security measures include, but are not limited to, the following:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This ensures that your login credentials, financial information, and personal details are protected in transit.
• Data Encryption at Rest: Sensitive Personal Data stored on glowin's servers — including identity documents and financial account references — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Internal staff members are granted access only to the data categories required for their specific role. All access events are logged and subject to periodic audit.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA on their accounts. glowin's internal administrative systems require mandatory 2FA for all staff accessing Member data.
• Penetration Testing & Vulnerability Management: The Platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, glowin will notify affected Members and relevant authorities within 72 hours of becoming aware of the breach, in accordance with applicable data protection standards.

10 Cookies & Tracking Technologies

Glowin uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences, and analyze usage patterns. The following cookie categories are in use:

• Strictly Necessary Cookies: Essential for the Platform to function — these manage your login session, maintain your Account authentication state, and ensure the security of your session. These cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, display options, and last-used payment method, improving your experience across sessions. These are enabled by default but can be disabled in your browser settings.
• Analytical Cookies: Used to collect anonymized data about how visitors interact with the Platform — which pages are visited most often, where users encounter errors, and how navigation flows are used. This data helps us improve the Platform experience. Analytical cookies require your consent.
• Security & Fraud Detection Cookies: Used to identify suspicious login patterns, detect bot activity, and flag potentially fraudulent sessions. These cookies are classified as strictly necessary for platform integrity purposes.

You may manage cookie preferences through your browser settings or through the cookie preference center available in your Account settings. Please note that disabling certain cookies may affect the functionality of the Platform or prevent you from accessing some features.

11 Your Rights Over Your Personal Data

As a data subject, you hold a number of rights regarding the Personal Data that glowin holds about you. These rights are summarized below. To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and respond fully within 30 calendar days.

12 Protection of Minors

Glowin operates an adults-only platform. Registration is strictly prohibited for any individual under 21 years of age. We do not knowingly collect, process, or retain Personal Data belonging to individuals under the age of 21.

During the Account registration process, all applicants are required to declare that they are 21 years of age or older. This declaration is supplemented by our KYC identity verification process, which cross-checks submitted government-issued identification documents to confirm the applicant's date of birth.

If glowin becomes aware — through the KYC process, a third-party report, or any other means — that a registered Member is under 21 years of age, the following actions will be taken immediately:

• The Member's Account will be suspended and subsequently closed.
• All deposits made by the underage Member will be returned in full.
• Any winnings accrued will be forfeited, as the Account was opened in breach of eligibility requirements.
• All Personal Data associated with the Account will be securely deleted, except where retention is required for fraud investigation or legal proceedings.

If you are a parent or guardian and believe that your child may have registered on the glowin platform, please contact us immediately at [email protected]. We will treat all such reports with the highest priority and act swiftly to investigate and resolve the matter.

13 International Data Transfers

Glowin's primary user base is located in Indonesia, and we process the majority of Member data using infrastructure hosted in data centers within or close to the Asia-Pacific region. However, some of our third-party Data Processors — including cloud infrastructure providers, identity verification services, and analytics platforms — may process data in jurisdictions outside Indonesia.

Where Personal Data is transferred internationally, glowin ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding the protections described in this Policy. These safeguards include:

• Contractual Protections: Standard contractual clauses incorporated into all data processing agreements with international third-party providers, obligating them to apply appropriate data protection standards.
• Adequacy Assessments: Prior to engaging any international Data Processor, glowin conducts a Transfer Impact Assessment to evaluate the legal environment of the destination country and the processor's data protection practices.
• Technical Safeguards: Data transferred internationally is encrypted in transit and at rest, regardless of the destination jurisdiction.

You may request details of specific international transfer arrangements by contacting us at [email protected] with the subject line "International Transfer Inquiry".

14 Policy Amendments

Glowin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will update the "Last Updated" date at the top of this page and, where reasonably practicable, notify active Members via email or an in-platform notification prior to the changes taking effect.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not agree to the updated Policy, you must cease using the Platform and may request Account closure in accordance with our Terms & Conditions. We recommend bookmarking this page and reviewing it periodically, particularly following receipt of a change notification.

Previous versions of this Privacy Policy are available upon written request to [email protected] with the subject line "Privacy Policy Version History".

15 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a concern about how glowin has handled your Personal Data, please contact our Data Protection team using the details below. Our support agents are available 24 hours a day, 7 days a week, in both English and Indonesian.

• Email: [email protected]
• Subject Line for Data Rights: "Data Rights Request"
• Subject Line for Complaints: "Privacy Complaint"
• Operating Hours: 24/7 — including public holidays
• Response Commitment: Acknowledgment within 3 business days; full response within 30 calendar days
• Languages: English and Indonesian