Privacy Policy — nato21

This Privacy Policy applies to all personal data collected by nato21 through our website at nato21.cam, mobile applications, and any related services (collectively, the "Platform"). This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights regarding your data.

nato21 operates as an online betting and casino platform serving Indonesian players who prefer to engage with international brands in English. We process personal data in accordance with applicable data protection laws and regulations, including principles of fairness, transparency, and accountability.

Scope: This Privacy Policy covers only data collected directly by nato21. It does not apply to third-party websites, applications, or services that may be linked from our Platform. We encourage you to review the privacy policies of any third-party sites you visit.

Acceptance: By creating an account on nato21, accessing the Platform, or using any of our services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with this policy, you must not use the Platform.

For the purposes of data protection law, nato21 is the data controller responsible for the processing of personal data collected through the Platform. This means nato21 determines the purposes and means of processing your personal data and is accountable for ensuring that processing complies with applicable data protection requirements.

Where nato21 engages third-party service providers to process data on our behalf (for example, payment processors, identity verification services, or game studios), those providers act as data processors under our instruction and are contractually bound to protect your data in accordance with this Privacy Policy.

nato21 collects several categories of personal data to provide, secure, and improve our services. The types of data we collect include:

3.1 Registration Data: When you create an account on nato21, we collect:

• Full legal name (as it appears on your government-issued identification)
• Date of birth (to verify you are at least 21 years of age)
• Residential address (street address, city, postal code, country)
• Email address
• Mobile phone number (optional, for account recovery and two-factor authentication)
• Username and password (password is stored in encrypted hash form only)
• Currency preference (Indonesian Rupiah / IDR by default for Indonesian players)

3.2 Identity Verification (KYC) Data: To comply with anti-money laundering regulations and age verification requirements, we collect:

• Copies of government-issued identification documents (Indonesian National Identity Card / KTP, passport, or driving licence / SIM)
• Proof of address documents (utility bills, bank statements, or official correspondence dated within the past three months)
• Photographs or scans of the documents above
• Selfie photographs for biometric facial comparison (in cases where enhanced verification is required)

3.3 Financial Data: When you deposit or withdraw funds, we collect:

• Bank account information (bank name, account holder name, account number) — for Indonesian banks such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, or BSI
• E-wallet account information (OVO, DANA, GoPay, ShopeePay, LinkAja — account holder name and registered phone number)
• Transaction history (deposit amounts, withdrawal amounts, timestamps, transaction IDs)
• Payment method verification documents (screenshots or statements confirming ownership of the payment method)

Note: nato21 does not directly store credit card numbers or full bank account credentials. Payment processing is handled by secure third-party payment gateways that are PCI-DSS compliant.

3.4 Usage Data: We automatically collect information about how you interact with the Platform, including:

• IP address and geolocation data (city/region level, not precise GPS coordinates)
• Device information (device type, operating system, browser type and version, screen resolution)
• Session data (login times, logout times, session duration)
• Pages visited, features used, and navigation paths through the Platform
• Bet history (markets wagered on, bet amounts, outcomes, timestamps)
• Game activity (games played, time spent in games, results)
• Bonus claims and wagering progress

3.5 Communications Data: If you contact nato21 support or communicate with us via email, live chat, or other channels, we collect:

• The content of your messages
• Timestamps and communication metadata
• Any attachments you provide (screenshots, documents, etc.)
• Support ticket history and resolution notes

3.6 Marketing Preferences: We record your preferences regarding promotional communications, including whether you wish to receive:

• Email newsletters and promotional offers
• SMS notifications (where you have opted in)
• Push notifications (for mobile app users who have granted permission)

We collect personal data through the following methods:

• Direct Collection: Information you provide directly when registering an account, completing your profile, uploading KYC documents, making deposits or withdrawals, or contacting customer support.
• Automatic Collection: Usage data, device information, and IP addresses are collected automatically through cookies, web beacons, server logs, and analytics tools when you access the Platform.
• Third-Party Sources: We may receive data from payment processors (transaction confirmation), identity verification services (KYC validation results), or fraud detection providers (risk scoring) to verify your identity and protect against fraudulent activity.
• Public Sources: In rare cases, we may obtain publicly available information (such as sanctions lists or politically exposed persons databases) to fulfill our legal and regulatory obligations.

nato21 processes your personal data for the following purposes:

5.1 Account Management:

• Creating and maintaining your nato21 account
• Authenticating your identity when you log in
• Processing account updates and changes
• Managing account closures and self-exclusion requests

5.2 Service Provision:

• Processing bets, wagers, and game transactions
• Crediting winnings and calculating account balances
• Applying bonuses, promotions, and loyalty rewards
• Displaying personalized content and recommendations
• Providing customer support and responding to inquiries

5.3 Payment Processing:

• Processing deposits via Indonesian banks (BCA, BRI, BNI, Mandiri, etc.) and e-wallets (OVO, DANA, GoPay, etc.)
• Processing withdrawal requests to verified bank accounts and e-wallets
• Verifying ownership of payment methods
• Maintaining transaction records for financial auditing

5.4 Identity Verification & Compliance:

• Verifying you are at least 21 years of age and a resident of an eligible jurisdiction
• Conducting Know Your Customer (KYC) checks to prevent fraud and identity theft
• Complying with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations
• Detecting and preventing duplicate accounts
• Investigating suspected breaches of our Terms & Conditions

5.5 Security & Fraud Prevention:

• Monitoring account activity for suspicious or fraudulent behavior
• Detecting collusion, bonus abuse, and exploitation of software vulnerabilities
• Protecting against unauthorized account access
• Maintaining audit logs for security investigation purposes

5.6 Marketing & Communications (with your consent):

• Sending promotional offers, bonuses, and newsletters
• Notifying you of new games, features, and platform updates
• Conducting customer satisfaction surveys
• Sending important service announcements (account-related, not promotional)

5.7 Platform Improvement:

• Analyzing usage patterns to improve user experience and interface design
• Testing new features and optimizing platform performance
• Generating aggregated, anonymized statistics for business intelligence

5.8 Legal Obligations:

• Responding to lawful requests from courts, regulatory authorities, or law enforcement
• Retaining records as required by applicable gambling and financial regulations
• Reporting suspicious transactions or activities to relevant authorities

nato21 processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and nato21 (i.e., to provide the betting and gaming services you have requested). This includes account creation, transaction processing, and service delivery.
• Legal Obligation: Processing is necessary to comply with legal obligations imposed on nato21, such as age verification, KYC requirements, AML/CTF regulations, and record-keeping obligations under gambling law.
• Legitimate Interests: Processing is necessary for nato21's legitimate business interests, including fraud prevention, security monitoring, platform optimization, and business analytics — provided these interests do not override your fundamental rights and freedoms.
• Consent: Where required by law, we process data on the basis of your explicit consent. This includes processing for marketing communications, cookies (where consent is required), and certain types of profiling. You may withdraw consent at any time via your account settings.

nato21 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. However, we may share your data with the following categories of third parties under strict data processing agreements:

7.1 Payment Processors: We share transaction data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These providers receive only the data necessary to complete the transaction.

7.2 Identity Verification Providers: KYC documents and identity data are shared with specialized verification services to confirm your identity, age, and address. These providers operate under strict confidentiality obligations and are contractually prohibited from using your data for any purpose other than verification.

7.3 Game Studios & Software Providers: Gameplay data may be shared with game studios (Pragmatic Play, Evolution Gaming, NetENet, Microgaming, Spribe, Pocket Games Soft, etc.) to operate live casino games, slots, and crash games. Studios receive only the data necessary to deliver game results and do not receive your full personal profile.

7.4 Fraud Detection & Security Providers: IP address, device fingerprints, and behavioral data may be shared with fraud prevention services to identify suspicious activity, prevent bonus abuse, and protect against unauthorized access.

7.5 Customer Support Tools: If you contact nato21 support via live chat or email, your communications may be processed through third-party customer service platforms. These platforms are configured to ensure data security and confidentiality.

7.6 Legal & Regulatory Authorities: We may disclose personal data to courts, regulators, law enforcement agencies, or other public authorities where required by law or where necessary to:

• Comply with a legal obligation or respond to a lawful request
• Enforce our Terms & Conditions or investigate potential breaches
• Protect the rights, property, or safety of nato21, our users, or the public
• Report suspicious transactions under AML/CTF regulations

7.7 Business Transfers: In the event of a merger, acquisition, sale of assets, or bankruptcy, personal data may be transferred to the acquiring entity. In such cases, we will ensure the new data controller continues to honor this Privacy Policy.

7.8 Aggregated & Anonymized Data: We may share aggregated, anonymized statistics (such as overall user demographics, total betting volumes, or popular game categories) with business partners or for research purposes. This data cannot be used to identify individual users.

nato21 uses cookies, web beacons, and similar tracking technologies to enhance your experience on the Platform and for analytical purposes.

What Are Cookies? Cookies are small text files placed on your device by websites you visit. They help the website remember information about your visit, such as login status, language preferences, and session data.

Types of Cookies We Use:

• Essential Cookies: Necessary for the Platform to function. These enable core features such as secure login, account authentication, and session management. You cannot opt out of essential cookies as the Platform would not work without them.
• Performance Cookies: Collect information about how visitors use the Platform (pages visited, time spent, error messages encountered). This data is aggregated and used to improve Platform performance and user experience.
• Functional Cookies: Remember your preferences and settings (language, currency, display options) to provide a personalized experience.
• Analytics Cookies: Help us understand user behavior, traffic sources, and conversion rates. We may use third-party analytics services (such as Google Analytics) for this purpose.

Managing Cookies: You can control cookie settings through your browser. Most browsers allow you to refuse cookies or delete existing cookies. However, disabling essential cookies will impair your ability to use the Platform. To manage cookies, consult your browser's help documentation.

nato21 does not use third-party advertising cookies or retargeting pixels. We do not track your browsing activity on other websites.

nato21 takes data security seriously and has implemented comprehensive technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure:

9.1 Encryption:

• All data transmitted between your device and nato21 servers is encrypted using 256-bit SSL/TLS protocols (visible as "https" and the padlock icon in your browser).
• Sensitive data (passwords, payment information, KYC documents) is encrypted at rest using industry-standard encryption algorithms.

9.2 Access Controls:

• Access to personal data is restricted to authorized nato21 personnel who require access for legitimate business purposes (account management, KYC review, customer support, fraud investigation).
• All staff members with data access are bound by strict confidentiality obligations.
• Access is logged and monitored. Unauthorized access attempts trigger security alerts.

9.3 Infrastructure Security:

• Servers are hosted in secure data centers with physical access controls, fire suppression systems, and redundant power supplies.
• Firewalls, intrusion detection systems, and regular security audits protect against cyber attacks.
• Automated backups ensure data can be recovered in case of system failure.

9.4 Payment Security:

• Payment processing is handled by PCI-DSS compliant third-party providers. nato21 does not store full credit card numbers or bank account credentials.
• Withdrawal requests are subject to additional identity verification to prevent unauthorized fund transfers.

9.5 Incident Response:

• In the unlikely event of a data breach, nato21 will notify affected users and relevant authorities in accordance with applicable data breach notification laws.
• We maintain an incident response plan to quickly contain and remediate security incidents.

Your Responsibility: You are responsible for maintaining the confidentiality of your account credentials. Do not share your username or password with anyone. If you suspect unauthorized access to your account, contact nato21 support immediately.

nato21 retains personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law:

• Active Accounts: While your account remains active, we retain all account data, transaction history, and communications to provide ongoing service.
• Closed Accounts: If you close your account, we will retain certain data for a period of up to seven (7) years to comply with legal obligations (tax, anti-money laundering, gambling regulations) and to resolve any disputes or outstanding issues. After this period, data is securely deleted or anonymized.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years after account closure as required by AML/CTF regulations.
• Transaction Records: Financial transaction records are retained for up to seven (7) years for tax, audit, and regulatory purposes.
• Marketing Data: If you unsubscribe from marketing communications, your email address will be retained on a suppression list to ensure we do not accidentally contact you again. This list is retained indefinitely unless you request complete deletion.
• Security Logs: System logs and audit trails are retained for up to two (2) years for security monitoring and incident investigation purposes.

After the applicable retention period, personal data is securely deleted using industry-standard data destruction methods or irreversibly anonymized such that it can no longer be linked to an identifiable individual.

Under applicable data protection laws, you have the following rights regarding your personal data:

11.1 Right of Access: You have the right to request a copy of the personal data nato21 holds about you. This is commonly known as a "data subject access request." We will provide the data in a structured, commonly used, machine-readable format.

11.2 Right to Rectification: If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most account information directly through your account settings. For other data, contact support.

11.3 Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data in certain circumstances, such as when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent (where processing was based on consent)
• You object to processing and there are no overriding legitimate grounds for continued processing
• The data was unlawfully processed

Note: This right is not absolute. We may be legally required to retain certain data (for example, transaction records for tax purposes or KYC documents under AML regulations) even after you request deletion.

11.4 Right to Restrict Processing: You may request that we restrict processing of your data in certain circumstances, such as when you contest the accuracy of the data or when you have objected to processing.

11.5 Right to Data Portability: You have the right to receive the personal data you provided to nato21 in a structured, machine-readable format and to transmit that data to another data controller where technically feasible.

11.6 Right to Object: You have the right to object to processing of your data where we rely on legitimate interests as the legal basis. This includes objecting to direct marketing (you can unsubscribe at any time via the link in marketing emails or through your account settings).

11.7 Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

11.8 Right to Lodge a Complaint: If you believe nato21 has violated your data protection rights, you have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.

Exercising Your Rights: To exercise any of the above rights, contact nato21 at [email protected] with "Data Protection Request" in the subject line. We will respond to your request within 30 days. We may request additional information to verify your identity before processing your request.

nato21 is strictly a 21+ platform. We do not knowingly collect, process, or retain personal data from individuals under the age of 21.

Age verification is conducted through mandatory KYC checks before any withdrawal is permitted. If we become aware that we have inadvertently collected data from a person under 21 years of age, we will:

• Immediately suspend the account
• Delete all personal data associated with the account
• Refund any deposited funds (minus any winnings, which will be forfeited)
• Implement additional measures to prevent future underage access

Parents or guardians who believe their child has provided personal data to nato21 should contact [email protected] immediately with details of the account and proof of guardianship.

nato21 operates internationally and may transfer personal data to countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Where we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
• Data processing agreements requiring third-party processors to maintain equivalent data protection standards
• Transfers to jurisdictions recognized as providing adequate data protection

For Indonesian players, certain data (such as transaction data processed by Indonesian banks BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, or e-wallets OVO, DANA, GoPay) remains within Indonesia and is subject to Indonesian data protection regulations.

nato21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or business operations. The "Last Updated" date at the top of this document indicates when the policy was most recently revised.

Material changes (such as changes to the purposes for which we process data, new categories of third-party recipients, or changes to your rights) will be communicated to registered users via email to the address on file. You will also see a notification banner on the Platform when you next log in.

Continued use of the Platform following any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated terms, you must cease using the Platform and may request account closure and data deletion (subject to legal retention obligations).

For questions, concerns, or requests related to this Privacy Policy or your personal data, please contact nato21:

• Email: [email protected] (use subject line "Privacy Inquiry" or "Data Protection Request")
• Live Chat: Available 24/7 on the nato21 platform (accessible when logged into your account)
• Response Time: We aim to respond to all privacy-related inquiries within 48 business hours. Data subject access requests and other formal rights requests will be completed within 30 days as required by law.

For formal data protection complaints or escalations, you may also contact the relevant data protection supervisory authority in your jurisdiction.