Privacy Policy for tripay

This Privacy Policy describes how tripay (the "Company", "we", "us", or "our") collects, uses, stores, shares, and protects the personal information of users ("you", "User", or "Player") who access or use our online betting platform at https://tripay.cam (the "Platform").

By registering an account on tripay, depositing funds, placing bets, or otherwise using our Services, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree with any part of this policy, you must not use the Platform.

This Privacy Policy is incorporated into and forms part of our Terms & Conditions. In the event of any conflict between this Privacy Policy and the Terms & Conditions, this Privacy Policy takes precedence on matters relating to personal data.

The data controller responsible for your personal information collected through the tripay Platform is the internationally licensed entity that operates tripay. For the purposes of this Privacy Policy, "data controller" means the organisation that determines the purposes for which and the manner in which any personal data is processed.

All questions, requests, or concerns about how your personal data is handled should be directed to our support team using the contact details provided in Section 15 of this Privacy Policy.

tripay collects and processes the following categories of personal data:

3.1 Account Registration Data

When you create an account, we collect:

• Your full legal name (as it appears on your government-issued identity document);
• Date of birth;
• Residential address in Indonesia (street, city, postal code);
• Email address;
• Mobile phone number;
• Chosen username and password (password is stored in hashed form and is never accessible in plain text);
• Preferred currency (IDR / Rupiah).

3.2 Identity Verification (KYC) Data

To comply with anti-money-laundering (AML) regulations and responsible gaming requirements, we collect:

• Scanned or photographed copies of government-issued identity documents: Indonesian national identity card (KTP), passport, or driver's licence (SIM);
• Proof of address documents: utility bills, bank statements, or government correspondence dated within the last three months;
• Proof of payment method ownership: screenshots or scans showing that the bank account or e-wallet (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) used for deposits is registered in your own name;
• Selfie photographs holding your ID document (in certain verification cases).

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method details;
• Bank account numbers and e-wallet account identifiers used for deposits and withdrawals;
• Transaction reference numbers and payment processor metadata;
• Account balance history and betting transaction logs.

3.4 Betting & Gaming Data

• Records of all bets placed, including bet type, stake amount, odds, and outcome;
• Game session data for slots, live casino, and togel (Indonesia's traditional numbers lottery);
• Bonus claims, wagering progress, and promotion participation history;
• Responsible gaming tool usage: deposit limits, session timers, cool-off periods, and self-exclusion requests.

3.5 Technical & Usage Data

• IP address, device type, operating system, browser type and version;
• Login timestamps, session duration, pages visited, and click patterns;
• Cookies and similar tracking technologies (see Section 11);
• Error logs and diagnostic data for troubleshooting technical issues.

3.6 Communications Data

• Records of all correspondence with our support team, including live chat transcripts, emails, and support tickets;
• Marketing preferences and consent records;
• Survey responses and feedback submissions.

We collect personal data through the following methods:

• Directly from you: When you register an account, submit KYC documents, make deposits or withdrawals, place bets, contact support, or update your account settings.
• Automatically: When you use the Platform, we automatically collect technical data such as IP address, device information, and browsing behaviour through cookies and server logs.
• From third-party payment processors: When you make a deposit or withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja, we receive transaction confirmation data from the relevant payment provider.
• From game providers: When you play slots, live casino, or other games, the game studios (such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, Microgaming, NetEnt) send us game session data including bet amounts, outcomes, and RTP metrics.

tripay collects and processes your personal data for the following purposes:

• Account Management: To create and maintain your account, authenticate your identity at login, and manage your user profile.
• Transaction Processing: To process deposits, withdrawals, and internal account transfers, and to maintain accurate financial records.
• KYC & Compliance: To verify your identity, confirm your age (21+ requirement), detect and prevent fraud, money laundering, and other illegal activities, and comply with international gaming regulations.
• Service Delivery: To provide access to sports betting, live casino, slot games, togel, and other gaming products; to calculate bet outcomes and payouts; and to manage bonuses and promotions.
• Responsible Gaming: To enforce deposit limits, loss limits, session timers, cool-off periods, and self-exclusion; to identify problem gambling patterns and offer support where appropriate.
• Customer Support: To respond to your inquiries, troubleshoot technical issues, and resolve disputes.
• Platform Improvement: To analyse usage patterns, identify bugs and performance issues, and improve the overall user experience.
• Marketing Communications: Where you have provided consent, to send you promotional offers, bonus announcements, and product updates via email or SMS.
• Legal Obligations: To comply with court orders, regulatory investigations, and other legally mandated disclosure requirements.

Under international data protection principles, tripay processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and tripay (i.e., the Terms & Conditions). This includes account creation, transaction processing, game delivery, and customer support.
• Legal Obligation: Processing is necessary to comply with legal requirements such as anti-money-laundering (AML) laws, Know Your Customer (KYC) regulations, age verification mandates, and tax reporting obligations.
• Legitimate Interests: Processing is necessary for tripay's legitimate business interests, such as fraud prevention, security monitoring, platform improvement, and internal analytics — provided these interests do not override your fundamental rights and freedoms.
• Consent: Where processing is based on your explicit consent, such as receiving marketing communications or participating in optional surveys. You may withdraw consent at any time by contacting our support team.

tripay does not sell your personal data to third parties. However, we may share your data with the following categories of recipients for the purposes described in Section 5:

• Payment Processors: Banks and e-wallet providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction data necessary to process your deposits and withdrawals.
• Game Providers: Studios such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, Microgaming, NetEnt, and Spribe receive your username and betting data to deliver game content and calculate outcomes. These providers are bound by contractual obligations to protect your data.
• KYC & Fraud Prevention Services: Third-party identity verification and fraud detection services may receive copies of your KYC documents and transaction patterns to assess risk and confirm identity.
• Cloud Infrastructure Providers: Secure data storage and server hosting providers receive encrypted data as part of our technical infrastructure. These providers are bound by strict data protection agreements.
• Regulatory Authorities: Where required by law, we may disclose your data to licensing authorities, law enforcement agencies, tax authorities, or courts in response to valid legal requests.
• Professional Advisors: Our legal counsel, auditors, and compliance consultants may access your data on a need-to-know basis to provide professional services to tripay.

tripay employs industry-standard technical and organisational measures to protect your personal data from unauthorised access, accidental loss, destruction, or damage. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using 256-bit Secure Socket Layer (SSL) or Transport Layer Security (TLS) protocols.
• Password Hashing: Your password is never stored in plain text. We use cryptographic hashing algorithms to store passwords securely.
• Access Controls: Personal data is stored on secure servers with restricted access. Only authorised personnel with a legitimate need-to-know can access sensitive data, and all access is logged.
• Firewalls & Intrusion Detection: Our servers are protected by firewalls, intrusion detection systems, and continuous security monitoring to detect and prevent unauthorised access attempts.
• Regular Security Audits: We conduct regular internal and external security audits, vulnerability assessments, and penetration testing to identify and remediate potential weaknesses.
• Data Segregation: Player funds are held in segregated accounts separate from operational funds, ensuring that your balance is always protected.

While we take every reasonable precaution to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your login credentials and for any activity that occurs under your account. If you suspect unauthorised access, contact our support team immediately.

tripay retains your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. Specific retention periods include:

• Account Data: Retained for the duration of your account's active status, plus seven (7) years after account closure to comply with financial record-keeping and tax reporting obligations.
• KYC Documents: Retained for seven (7) years after account closure to meet anti-money-laundering (AML) regulatory requirements.
• Transaction Records: Retained for seven (7) years to comply with financial auditing and tax reporting requirements.
• Betting History: Retained for seven (7) years for dispute resolution and regulatory compliance purposes.
• Support Communications: Retained for three (3) years for quality assurance and dispute resolution purposes.
• Marketing Preferences: Retained until you withdraw consent or request deletion, whichever comes first.
• Technical Logs: Retained for ninety (90) days for security monitoring and troubleshooting purposes.

After the applicable retention period expires, your personal data is securely deleted or anonymised such that it can no longer be linked to you as an individual.

Under international data protection principles, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of all personal data we hold about you. We will provide this information in a commonly used electronic format.
• Right of Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it.
• Right of Erasure ("Right to be Forgotten"): In certain circumstances, you have the right to request that we delete your personal data. This right is subject to our legal obligations to retain certain records (see Section 9).
• Right to Restrict Processing: You have the right to request that we temporarily suspend processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another service provider.
• Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis. You also have the right to object to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, please contact our support team using the details in Section 15. We will respond to all requests within thirty (30) days. In certain cases, we may require additional information to verify your identity before fulfilling your request.

tripay uses cookies and similar tracking technologies to enhance your experience on the Platform, analyse usage patterns, and deliver personalised content. A cookie is a small text file stored on your device that helps us recognise you on subsequent visits.

Types of Cookies We Use:

• Essential Cookies: Required for the Platform to function properly. These include session cookies that keep you logged in and enable secure navigation. You cannot opt out of essential cookies.
• Performance Cookies: Collect anonymous data on how visitors use the Platform, such as which pages are visited most often and how long sessions last. This helps us improve site performance.
• Functional Cookies: Remember your preferences (such as language selection, currency, and display settings) to provide a more personalised experience.
• Marketing Cookies: Track your browsing activity to deliver targeted advertising and promotional offers. These cookies may be set by third-party advertising partners. You can opt out of marketing cookies through your browser settings.

Most web browsers allow you to manage cookie preferences through the browser settings. You can choose to block or delete cookies, but doing so may affect the functionality of the Platform and your ability to use certain features.

tripay is strictly for adults aged 21 years and over. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that an account has been registered by someone under 21, we will immediately suspend the account, refund any deposited funds to the registered payment method, and delete all associated personal data.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact our support team immediately using the details in Section 15. We will take prompt action to investigate and remove the data.

tripay operates internationally and may transfer your personal data to servers located outside Indonesia for storage, processing, and backup purposes. When we transfer your data to another jurisdiction, we ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

These safeguards may include:

• Transferring data only to jurisdictions that provide an adequate level of data protection under international standards;
• Using standard contractual clauses approved by relevant data protection authorities;
• Ensuring that third-party service providers are bound by contractual obligations to protect your data.

By using the tripay Platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

tripay reserves the right to amend or update this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or business operations. Where a material change is made that significantly affects how we process your personal data, we will provide at least thirty (30) days' advance notice by:

• Posting a prominent notice on the Platform homepage;
• Sending an email notification to the address registered on your account;
• Displaying an in-platform banner when you next log in.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the revised policy, you must cease using the Platform and may request account closure and data deletion in accordance with Section 10.

The current version of this Privacy Policy is always available on this page, with the effective date displayed at the top of the document. We encourage you to review this policy periodically to stay informed of how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or how tripay handles your personal data, please contact our support team through any of the following channels:

• Live Chat: Available 24/7 directly on the Platform. Our Indonesian-speaking support agents are available around the clock across all Indonesian time zones (WIB, WITA, and WIT).
• Email Support: [email protected] (plain text — not a clickable link). Response time: within 24 hours on business days.

For formal data protection requests — including requests to access, rectify, or delete your personal data — please mark your communication clearly as "Data Protection Request" in the subject line and direct it to the same email address above. We will respond to all data protection requests within thirty (30) days of receipt.