Privacy Policy

§1Introduction

gghoki ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who interact with the gghoki platform at https://gghoki.cam (the "Platform"). This Privacy Policy sets out the categories of personal data we collect, the purposes for which we process that data, the legal bases on which we rely, the third parties with whom we may share data, and the rights available to you as a data subject.

This policy applies to all Members — registered users of the Platform — as well as visitors who browse the Platform without creating an account. It applies to data collected through the website and all associated interfaces used to deliver gghoki's services. Where we process data on behalf of our payment and identity verification partners, those relationships are governed by separate data processing agreements that are consistent with the principles set out here.

Our primary audience is Indonesian players. While Indonesia has its own developing data protection framework, gghoki applies internationally recognized data protection standards — including principles derived from the General Data Protection Regulation (GDPR) and ISO/IEC 27001 — as a voluntary best-practice commitment to our users.

§2Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means gghoki, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of gghoki under a written data pr ocessing agreement.
• "Member" means a natural person who has registered an account on the Platform.
• "KYC" means Know Your Customer — the identity and age verification procedure applied to all Members prior to withdrawal activation.
• "Cookies" means small text files placed on your device by the Platform to store session and preference information.
• "IDR" means Indonesian Rupiah, the sole transaction currency on the Platform.

§3Data We Collect

The categories of personal data we collect vary depending on whether you are a visitor or a registered Member, and on the activities you undertake on the Platform. The following data types may be collected:

3.1 Identity Data

Full legal name, date of birth, nationality, and government-issued identity document details (such as KTP number, passport number, or driver's license number). This data is collected during account registration and KYC verification.

3.2 Contact Data

Email address, Indonesian mobile phone number, and residential address. These are required at registration and are used for account communication, transaction notifications, and support correspondence.

3.3 Financial Data

Bank account details (account holder name, bank name, and account number) associated with your registered payment methods — including accounts held at BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, and Bank Permata — as well as e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja. We do not store full card numbers or banking passwords.

3.4 Technical Data

IP address, browser type and version, operating system, device identifiers, time zone (WIB / WITA / WIT), and access timestamps. This data is collected automatically when you access the Platform and is used for security monitoring, fraud prevention, and platform optimization.

3.5 Behavioral Data

Betting history, game activity records, wagering patterns, deposit and withdrawal frequency, bonus usage, and session duration. This data is used to personalize your experience, identify problem gambling indicators, fulfill regulatory reporting obligations, and investigate disputes.

3.6 Communications Data

Records of your interactions with our customer support team, including live chat transcripts, email correspondence, and WhatsApp message logs. These are retained for quality assurance, dispute resolution, and training purposes.

§4How We Collect Data

We collect personal data through the following channels:

• Direct submission: Information you actively provide during account registration, KYC document upload, deposit or withdrawal requests, and support interactions;
• Automated collection: Technical and behavioral data gathered automatically as you navigate the Platform, via server logs, cookies, and analytics tools;
• Third-party verification partners: Identity and document verification data returned by our KYC service providers following document authentication;
• Payment processors: Transaction confirmation data from Indonesian banks (BCA, BRI, BNI, Mandiri, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) during deposit and withdrawal processing;
• Fraud prevention services: Risk scores and device fingerprint data returned by third-party fraud detection systems that operate as Data Processors under contract with gghoki.

§5Purpose & Legal Basis for Processing

We process your personal data only where we have a valid legal basis for doing so. The table below summarizes our primary processing activities:

§6Data Sharing & Disclosure

gghoki does not sell, rent, or trade your personal data. We may share your data with third parties only in the following strictly defined circumstances:

6.1 Service Providers (Data Processors)

We engage carefully selected third-party companies to assist in delivering our services. These include KYC and identity verification providers, payment gateway operators, fraud detection platforms, cloud hosting infrastructure providers, and analytics tools. All such providers operate under binding data processing agreements that prohibit them from using your data for any purpose other than delivering the contracted service to gghoki.

6.2 Financial Institutions

When you initiate a deposit or withdrawal, the minimum necessary data — including your name, account number, and transaction amount — is shared with the relevant Indonesian bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute the transaction.

6.3 Legal and Regulatory Disclosure

We may disclose your personal data to law enforcement agencies, regulators, or courts where we are legally compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of gghoki, our Members, or the public. We will notify you of any such disclosure where we are legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of gghoki's business, your personal data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and of any material changes to this Privacy Policy that result from it.

§7Data Retention

We retain your personal data only for as long as is necessary to fulfill the purpose for which it was collected, to comply with applicable legal and regulatory retention requirements, and to resolve disputes. Specific retention periods include:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with anti-money laundering (AML) record-keeping requirements;
• Transaction records: Retained for a minimum of 5 years from the date of each transaction;
• KYC documents: Retained for a minimum of 5 years following submission, or longer if required by applicable law;
• Communications records: Retained for 2 years from the date of the interaction, unless required for longer in connection with an active dispute;
• Technical / log data: Retained for 12 months from the date of collection, after which it is aggregated or deleted;
• Marketing preferences: Retained until you withdraw consent, after which your opt-out record is retained for 3 years to prevent inadvertent re-subscription.

Where retention is no longer legally required or operationally necessary, data is securely deleted or anonymized in accordance with our internal data lifecycle policy.

§8Security Measures

gghoki implements a multi-layered security framework to protect your personal data against unauthorized access, loss, alteration, or disclosure. Our technical and organizational measures include:

• Transport Layer Security (TLS 1.3): All data in transit between your browser or app and our servers is encrypted using TLS 1.3;
• AES-256 encryption at rest: Sensitive stored data — including identity documents and payment details — is encrypted at rest using AES-256 standard encryption;
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Staff with data access undergo background screening and are bound by confidentiality obligations;
• Two-factor authentication (2FA): Internal staff systems require 2FA. Members are also encouraged to enable 2FA on their own accounts;
• Penetration testing: We conduct regular third-party penetration tests and vulnerability assessments of our platform infrastructure;
• Incident response plan: A documented security incident response plan is maintained and tested annually, enabling rapid containment and notification in the event of a breach.

Despite these measures, no online platform can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect any unauthorized access to your account.

§9Cookies & Tracking Technologies

The Platform uses cookies and similar technologies (such as local storage and session tokens) to operate core functionality, maintain your login session, and gather anonymized performance data. We categorize our cookie use as follows:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens, CSRF protection tokens, and load-balancing cookies. No personal data collected via these cookies is used for marketing purposes.

9.2 Performance & Analytics Cookies

We use first-party analytics tools to understand how Members interact with the Platform — including page load times, navigation paths, and feature usage rates. This data is collected in aggregated, anonymized form and is used solely to improve platform performance. No third-party advertising analytics cookies (such as Google Ads remarketing tags or Meta Pixel) are deployed on the Platform.

9.3 Preference Cookies

These cookies remember your Platform settings, such as your preferred time zone display (WIB / WITA / WIT), language display preferences, and odds format selection. They do not collect sensitive personal data.

9.4 Cookie Management

You may manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. Disabling performance or preference cookies will not affect your ability to place bets or transact.

§10Exercising Your Data Rights

You may exercise any of the data rights summarized in Section 3 of the highlights above by submitting a request to our support team via live chat or email. To protect your privacy, we will verify your identity before processing any data rights request. We will respond within 30 calendar days of receiving a valid, verified request. In complex cases, this period may be extended by a further 30 days, with notice provided to you.

Where your request involves the erasure of data that we are legally required to retain (for example, AML transaction records), we will inform you of the specific retention obligation that prevents full erasure and will restrict processing of that data to the minimum necessary for compliance purposes only.

§11Minors

The gghoki Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect, store, or process personal data from individuals under the age of 21. If we become aware that personal data has been submitted by or on behalf of a minor, we will immediately suspend the associated account, delete the personal data, and — where appropriate — report the matter to the relevant authorities. If you believe a minor has registered on the Platform, please notify us immediately at [email protected].

§12International Data Transfers

gghoki operates globally, and your personal data may be transferred to and processed in countries outside Indonesia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Indonesia. These safeguards may include:

• Standard contractual clauses incorporated into data processing agreements with international service providers;
• Transfers to jurisdictions that have been recognized as providing an adequate level of data protection;
• Binding corporate rules where applicable to intra-group transfers.

By using the Platform, you acknowledge that your data may be transferred internationally in accordance with these safeguards.

§13Third-Party Links

The Platform may contain references to third-party services such as game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) and payment infrastructure partners. While these providers are carefully vetted, gghoki does not control their privacy practices. Interactions with third-party systems — such as launching a game hosted on a provider's server — are subject to that provider's own privacy policy. We encourage you to review the privacy policies of any third-party services you interact with through the Platform.

§14Policy Updates

gghoki reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. When we make material changes, we will notify registered Members via the Platform notification system or by email to the address associated with your account, at least 7 days before the changes take effect. The "Last Updated" date at the top of this document will always reflect the most recent revision. We encourage you to review this policy periodically. Continued use of the Platform after the effective date of any update constitutes your acceptance of the revised policy.

§15Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or gghoki's data practices, please contact us through any of the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly through the Platform interface
• WhatsApp Support: Available 24/7 — contact details provided after account registration
• Response Time: We aim to acknowledge all privacy-related inquiries within 48 hours (WIB) and resolve them within 30 calendar days