Privacy Policy — al303

al303 ("we", "us", "our", or "the Platform") is committed to protecting and respecting the privacy of every individual who visits al303.vip or uses any of the services made available through it. This Privacy Policy sets out the basis on which any personal data we collect from you — or that you provide to us — will be processed by al303.

This policy applies to all members, visitors, and prospective users of the al303 platform, including individuals based in Jakarta, Surabaya, Bandung, Bali, Medan, Semarang, and all other regions across Indonesia. By accessing al303.vip, creating an account, making a deposit, or otherwise interacting with our Services, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy should be read alongside our Terms & Conditions, which govern your use of the Platform. Terms not defined in this policy carry the meaning ascribed to them in the Terms & Conditions.

al303 collects the following categories of personal data depending on how you interact with the Platform:

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data, or health information. If you voluntarily disclose such information in a support conversation, it will be used solely for the purpose of resolving that interaction and will not be stored as part of your permanent member profile.

al303 collects personal data through three primary mechanisms:

1. Directly from you. When you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team via live chat or email, participate in a promotion, or update your account settings, you provide data to us directly.
2. Automatically as you use the Platform. When you visit al303.vip, our servers, analytics systems, and cookies automatically collect Technical Data and Usage Data. This includes your IP address, device identifiers, the pages you navigate to, and the actions you take within your session. This data collection is necessary for the Platform to function and for us to maintain security.
3. From third parties. We may receive data about you from third-party identity verification providers used during KYC (e.g., document validation services), payment processors (e.g., when a bank or e-wallet confirms a transaction), fraud prevention services, and publicly available sources such as sanctions lists and politically exposed persons (PEP) databases that we are required to screen against for AML compliance purposes.

al303 processes your personal data for the following specific purposes:

• Account Management: To create, maintain, and administer your member account, including processing login authentication, managing your balance, and applying account-level settings such as deposit limits and self-exclusion preferences.
• Identity Verification (KYC): To verify your identity and age (21+ requirement) as required by our licensing obligations and to prevent underage gambling and fraud.
• Payment Processing: To process deposits and withdrawals via your selected payment method — including Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja) — and to maintain accurate financial records.
• Service Delivery: To provide access to all al303 products including the sportsbook (BRI Liga 1, EPL, La Liga, Champions League), live casino (Evolution Gaming, Pragmatic Play Live), slots (Pragmatic Play, PG Soft, NetEnt, Microgaming), and togel (Indonesia's traditional numbers lottery) markets.
• Security and Fraud Prevention: To monitor activity for signs of fraud, money laundering, multi-accounting, or use of automated bots, and to take appropriate action where such activity is detected.
• Responsible Gaming: To administer self-exclusion requests, deposit limits, loss limits, and reality-check tools in accordance with our Responsible Gaming commitments.
• Customer Support: To respond to your enquiries, resolve disputes, and improve the quality of our support interactions.
• Marketing Communications: To send promotional offers, bonus notifications, and event-related communications (e.g., promotions tied to Idul Fitri, Ramadhan, Piala AFF, or FIFA World Cup) to members who have opted in to receive them.
• Analytics and Platform Improvement: To understand how members use the Platform in aggregate, identify areas for improvement, and develop new features and products.
• Legal Compliance: To comply with applicable laws, regulations, court orders, and requests from competent authorities.

al303 relies on the following legal grounds to process your personal data:

al303 may share your personal data with the following categories of recipients:

1. Payment Service Providers. Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to authorise and process your transactions. These providers operate under their own privacy policies and applicable financial regulations.
2. Identity Verification Partners. Third-party KYC and document verification providers receive the identity documents you submit (e.g., KTP, passport) for the purpose of authenticating your identity. These partners are contractually bound to use your data solely for verification purposes and to maintain appropriate data security standards.
3. Game Studio Providers. When you play games delivered by third-party studios — including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Spribe, and Microgaming — minimal session data (such as a session token and game outcome records) is shared with those studios to deliver and settle the game. These studios are certified by independent testing agencies and operate under their own data processing agreements with al303.
4. Fraud Prevention and AML Services. We share data with fraud detection platforms and sanctions-screening services as required by our AML compliance obligations. This may involve cross-referencing your details against government-maintained sanctions lists, PEP databases, and industry-wide fraud registries.
5. Analytics Providers. Anonymised and aggregated usage data may be shared with analytics service providers to help us understand platform performance. No personally identifiable information is included in these data transfers.
6. Legal and Regulatory Authorities. al303 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, court order, or valid regulatory request. We will notify you of such disclosure where we are legally permitted to do so.
7. Corporate Transactions. In the event of a merger, acquisition, restructuring, or sale of all or a portion of al303's business assets, your personal data may be transferred to the acquiring entity as part of the transaction, provided the acquiring entity agrees to treat your data in accordance with this Privacy Policy.

al303 operates as an international platform and, as a result, your personal data may be processed on servers or by service providers located outside Indonesia. When data is transferred internationally, al303 takes the following measures to ensure that your data remains protected to a standard consistent with this Privacy Policy:

• All international transfers are conducted under data processing agreements that incorporate appropriate contractual protections.
• Where transfers involve processors in jurisdictions without a formal adequacy determination, we rely on standard contractual clauses or equivalent safeguards to ensure an adequate level of data protection.
• We assess all third-party processors prior to engagement and conduct periodic reviews to confirm their continued compliance with our data security requirements.

By using the al303 platform, you acknowledge and consent to your personal data being transferred to and processed in jurisdictions outside Indonesia, subject to the safeguards described above.

al303 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting obligations. The following retention principles apply:

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be associated with you as an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical analysis purposes.

al303 implements a multi-layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our key security measures include:

• Transport Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). Pages and API endpoints that handle personal or financial data enforce HTTPS exclusively.
• Data-at-Rest Encryption: Sensitive data stored in our databases — including KYC documents, financial account details, and hashed passwords — is encrypted using AES-256.
• Access Controls: Access to systems that hold personal data is restricted on a strict need-to-know basis. All al303 staff and contractors with data access are subject to background screening, confidentiality agreements, and role-based access limitations.
• Password Security: Member passwords are never stored in plain text. They are hashed using a computationally strong one-way hashing algorithm with a unique salt per account.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA on their accounts. al303 supports authenticator-app-based 2FA as an additional layer of login security.
• Fraud Monitoring: Our platform operates real-time fraud detection systems that monitor for anomalous login activity, unusual betting patterns, and signs of account compromise. Suspicious activity triggers automatic alerts and, where appropriate, temporary account restriction pending investigation.
• Security Testing: al303 conducts regular internal and third-party security assessments, including penetration testing and vulnerability scanning, to identify and remediate weaknesses in our infrastructure.

al303 uses cookies and similar tracking technologies on al303.vip to enable core functionality, remember your preferences, and gather anonymised analytics data. The table below describes the categories of cookies we use:

al303 does not use third-party advertising or retargeting cookies. You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform.

As a member of al303, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request".

1. Right to Access. You may request a copy of the personal data al303 holds about you. We will provide this in a structured, commonly used format within 10 business days of your verified request.
2. Right to Rectification. If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. Minor corrections (e.g., email address updates) can typically be made directly through your account settings.
3. Right to Erasure. You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (for consent-based processing). Note that we may be required to retain certain data for the periods specified in Clause 8 to comply with legal obligations — in such cases, we will inform you of the data we are required to retain and why.
4. Right to Restriction. You may request that we restrict processing of your data in certain circumstances — for example, while you contest the accuracy of data we hold, or while we investigate a complaint you have raised.
5. Right to Data Portability. For data you have provided to us directly and which is processed on a consent or contractual basis, you may request a machine-readable copy of that data for portability to another service.
6. Right to Object. You may object to our processing of your data where that processing is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
7. Right to Withdraw Consent. Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that took place prior to withdrawal.

We will respond to all verified data rights requests within 10 business days. In cases of complexity or high volume, we may extend this period by a further 20 business days and will notify you accordingly. We will not charge a fee for responding to data rights requests except where requests are manifestly unfounded or excessive.

al303 does not knowingly collect personal data from individuals under 21 years of age. Our registration flow requires users to confirm their date of birth, and all accounts are subject to age verification during KYC review. If al303 discovers or is notified that an account has been registered by a person under the age of 21, the following steps will be taken immediately:

• The account will be suspended and all access to the Platform revoked.
• Any balance held in the account will be reviewed — real-money deposits will be returned to the original payment method; bonus funds will be voided.
• All personal data associated with the account will be deleted as soon as it is no longer required for regulatory reporting purposes.

If you are a parent or guardian and believe that a minor in your household has registered an al303 account, please contact us immediately at [email protected]. We will act promptly to investigate and close the account. We also strongly recommend using parental control software to restrict access to online gambling platforms on devices used by minors.

The al303 platform may contain references to or integrations with third-party services, including game studios, payment processors, and sports data providers. While we take care to partner only with reputable providers, al303 does not control the privacy practices of third-party services and accepts no responsibility for their data handling.

When you interact with a third-party game (for example, a Pragmatic Play slot or an Evolution Gaming live table), that interaction is governed by both al303's privacy practices and the third-party studio's own terms and privacy policy. We recommend reviewing the privacy documentation of any third-party service you interact with through the Platform.

al303 reserves the right to update or amend this Privacy Policy at any time. When we make material changes — for example, changes to the categories of data we collect, the purposes for which we process it, or the rights available to you — we will notify you by:

• Displaying a prominent notice on the al303.vip homepage and your account dashboard for a minimum of 14 days prior to the change taking effect.
• Sending an email notification to the address registered on your account, where practicable.

Non-material changes (such as typographical corrections, clarifications that do not alter the substance of the policy, or updates to contact details) may be made without prior notice, and the "Last Updated" date at the top of this page will be revised accordingly.

Your continued use of al303.vip after the effective date of any revised Privacy Policy constitutes your acceptance of that revised policy. If you do not accept the changes, you should stop using the Platform and may request account closure in accordance with our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to al303's handling of your personal data, please contact us through the following channels:

We aim to acknowledge all privacy-related enquiries within 2 business days and provide a substantive response within 10 business days. For complex data rights requests that require additional processing time, we will inform you of the extended timeline before the initial 10-day period expires.