Privacy Policy

Definitions

The following defined terms are used throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — including but not limited to name, date of birth, national identity number, email address, mobile number, IP address, payment account details, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organization, storage, retrieval, use, disclosure, transfer, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, the Company operating the buah4f platform.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller under a binding data processing agreement.
• "Player" / "You" means any individual who accesses, registers on, or uses the buah4f platform.
• "Platform" means the buah4f website at buah4f.cam, all subdomains, and all associated services.
• "KYC" means Know Your Customer — the identity and address verification process applied to all account holders.

Data Controller

buah4f acts as the Data Controller for all Personal Data collected through the Platform. The Company is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently, and that appropriate technical and organizational measures are in place to protect it.

All data protection inquiries, access requests, and complaints should be directed to the buah4f Data Protection team via the contact details provided in Clause 15. We aim to respond to all formal data protection requests within 30 calendar days of receipt.

Data We Collect

buah4f collects Personal Data across several categories. The specific data collected depends on how you interact with the Platform:

buah4f does not collect or process special category data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation) and has no legitimate basis for doing so in the context of its services.

How Data Is Collected

We collect Personal Data through the following channels:

• Directly from you: When you register an account, complete KYC, make a deposit or withdrawal, contact our support team, or update your account settings.
• Automatically: When you visit the Platform, our servers and analytics tools automatically record Technical Data and Usage Data. This includes data collected via cookies and similar tracking technologies (see Clause 10).
• From third parties: When we use third-party identity verification providers to authenticate your KTP or passport; when payment processors confirm transaction details; and when fraud-prevention partners flag unusual activity associated with your IP address or device fingerprint.
• From public sources: In limited circumstances, we may cross-reference publicly available information to verify the accuracy of the data you provide (for example, checking that a listed address matches publicly available postal records).

Purposes of Processing

buah4f processes your Personal Data only for specific, clearly defined purposes. We do not use your data for any purpose incompatible with those stated below:

• Account management: Creating and maintaining your buah4f account, authenticating your identity at login, and managing your account settings and preferences.
• Transaction processing: Facilitating deposits and withdrawals in IDR via your linked local bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity verification (KYC): Confirming that you meet the eligibility requirements set out in our Terms & Conditions, including age verification (21+) and residency verification.
• Fraud prevention and security: Detecting and preventing unauthorized access, money laundering, bonus abuse, and other forms of fraudulent activity that could harm the platform or other players.
• Regulatory compliance: Meeting the Company's obligations under applicable anti-money laundering (AML) and counter-terrorist financing (CTF) regulations, and responding to lawful requests from competent authorities.
• Customer support: Responding to your inquiries, resolving disputes, and providing Indonesian-speaking support agents who can communicate with players across Jakarta, Surabaya, Medan, Bandung, Bali, and beyond.
• Platform improvement: Analyzing aggregated, anonymized usage data to improve the platform's functionality, user experience, game selection, and performance.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling indicators and administer the self-management tools available in your account.
• Targeted communications: Sending you promotional offers, bonus announcements, and product updates that are relevant to your account — only where you have not opted out of marketing communications.

Legal Basis for Processing

buah4f processes Personal Data on the following legal bases, as recognized under international data protection standards:

• Contractual necessity: Processing required to perform the contract between buah4f and the Player — including account creation, transaction processing, and KYC verification. Without this processing, we cannot provide the service.
• Legal obligation: Processing required for compliance with applicable AML, CTF, and gaming regulatory obligations — including retention of transaction records for mandated periods.
• Legitimate interests: Processing necessary for fraud prevention, platform security, abuse detection, and service analytics — where our legitimate interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential cookie deployment, where we have obtained your prior, informed, and freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

buah4f does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. We share your data only in the following limited circumstances:

• Service providers (Data Processors): We engage trusted third-party vendors — including KYC/identity verification providers, payment processors, fraud detection services, cloud hosting providers, and customer support platform operators — to help deliver our services. These vendors process data solely on our instructions under binding data processing agreements and are prohibited from using your data for any other purpose.
• Payment partners: Your financial data is shared with the relevant bank or e-wallet operator (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, LinkAja) strictly to the extent necessary to complete your requested transaction.
• Regulatory authorities: We may disclose Personal Data to law enforcement agencies, financial intelligence units, or other competent authorities where required by a lawful court order, subpoena, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of the Company's assets, your Personal Data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify you of any such transfer via email or platform notification.
• With your consent: In any other circumstance not covered above, we will seek your explicit consent before sharing your Personal Data with a third party.

Data Retention

buah4f retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years after account closure, in accordance with AML regulatory requirements.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• KYC documentation: Retained for a minimum of 5 years from the date of verification or from account closure, whichever is later.
• Support communications: Retained for 3 years from the date of the last interaction, to enable dispute resolution and service improvement.
• Technical logs and session data: Retained for 90 days, after which they are automatically purged unless required for an ongoing security investigation or legal proceeding.
• Marketing consent records: Retained for as long as the consent remains valid, and for 3 years following withdrawal of consent to evidence compliance.

Following the expiry of the applicable retention period, Personal Data is securely deleted or anonymized such that it can no longer be associated with an individual. Anonymized data may be retained indefinitely for statistical and business intelligence purposes.

Data Security

buah4f employs industry-standard technical and organizational measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or damage. Our security framework includes:

• Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption. Sensitive data at rest — including KYC documents, financial records, and password hashes — is encrypted using AES-256 encryption algorithms.
• Access controls: Access to Personal Data is restricted to authorized personnel on a need-to-know basis and is governed by role-based access control policies. All access is logged and audited regularly.
• Secure infrastructure: Personal Data is stored on secured cloud infrastructure operated by Tier 1 providers with ISO 27001 certification. Servers are located in secure data centers with physical access controls and 24/7 monitoring.
• Intrusion detection: Real-time monitoring systems detect and alert on suspicious activity, including unauthorized login attempts, unusual data access patterns, and potential DDoS attacks.
• Regular audits: We conduct regular internal security reviews and engage third-party cybersecurity firms to perform annual penetration testing and vulnerability assessments.
• Incident response: In the event of a confirmed data breach that poses a risk to your rights and freedoms, we will notify you without undue delay (and in no event later than 72 hours after discovery) via email and platform notification, including details of the nature of the breach, the data affected, and remedial actions taken.

While buah4f takes every reasonable precaution to secure your data, no method of transmission over the internet or electronic storage is 100% secure. Players are responsible for maintaining the confidentiality of their account credentials and for notifying us immediately if they suspect unauthorized access to their account.

Cookies & Tracking Technologies

buah4f uses cookies and similar tracking technologies to enhance your experience on the Platform. A cookie is a small text file stored on your device that allows the Platform to recognize you on subsequent visits.

We deploy the following types of cookies:

• Essential cookies: Necessary for the operation of the Platform, including session management, authentication, and fraud prevention. These cannot be disabled without rendering the Platform unusable.
• Performance cookies: Collect anonymized data on how you use the Platform (pages visited, time spent, navigation paths) to help us identify performance issues and improve user experience.
• Functional cookies: Remember your preferences — such as language selection, currency display (IDR), and timezone (WIB/WITA/WIT) — to provide a personalized experience.
• Marketing cookies: Track your activity across sessions to deliver targeted promotional content and measure the effectiveness of marketing campaigns. These cookies are deployed only with your consent.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing the core Platform functionality, but certain features may not work as intended.

Your Privacy Rights

As a buah4f account holder, you hold the following data protection rights. To exercise any of these rights, contact our Data Protection team via the details in Clause 15:

We aim to respond to all rights requests within 30 calendar days. For complex requests, we may extend this period by up to 60 additional days and will notify you of the extension within the initial 30-day window.

Minors & Age Verification

buah4f services are available exclusively to individuals aged 21 or older. We do not knowingly collect, process, or retain Personal Data from any individual under the age of 21.

Age verification is a mandatory component of our KYC process. All account holders must provide a valid government-issued identity document (Indonesian KTP, passport, or SIM) showing their date of birth. Where an account is found to belong to a person under 21 years of age, the account will be immediately closed, all balances forfeited, and the associated Personal Data deleted in accordance with our retention policy.

Parents and guardians concerned that a minor may have registered on the Platform should contact our Data Protection team immediately at the email address listed in Clause 15.

International Data Transfers

Your Personal Data may be transferred to and processed in countries outside Indonesia where buah4f, its service providers, or its payment partners operate data centers or maintain servers. These transfers are governed by one or more of the following safeguards:

• Adequacy decisions: Transfers to jurisdictions recognized as offering an adequate level of data protection by relevant international standards.
• Standard contractual clauses: Binding data transfer agreements approved by recognized data protection authorities, which obligate the receiving party to protect data to an equivalent standard as in Indonesia.
• Processor guarantees: All third-party Data Processors engaged by buah4f are contractually required to implement appropriate technical and organizational security measures regardless of their geographic location.

By using the buah4f Platform, you acknowledge and consent to these international data transfers on the basis set out in this Privacy Policy.

Policy Changes

buah4f reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or service offerings. Material changes will be communicated via email to the address registered on your account and via a prominent notice on the Platform homepage.

The "Last Updated" date at the top of this document indicates the most recent revision. Continued use of the Platform following a Privacy Policy update constitutes acceptance of the revised terms. If you do not agree with the updated Privacy Policy, you must discontinue use of the Platform and may request account closure and data deletion in accordance with Clause 11.

Contact & Complaints

For all data protection inquiries, privacy rights requests, or complaints regarding the handling of your Personal Data, please contact the buah4f Data Protection team:

• Email (plain text — not a clickable link): [email protected]
• Subject line: Please use "Data Protection Request" or "Privacy Rights Request" in your subject line to ensure prompt routing to the Data Protection team.
• Response time: We aim to acknowledge all data protection inquiries within 3 business days and provide a substantive response within 30 calendar days.
• Language: Our Data Protection team operates in both English and Indonesian, ensuring Players across Jakarta, Surabaya, Medan, Bandung, Bali, and all regions of Indonesia can exercise their rights comfortably in their preferred language.

If you are dissatisfied with our response to a data protection request or complaint, you have the right to lodge a complaint with a supervisory data protection authority in your jurisdiction.