Privacy Policy — jos65

Jos65 ("the Company", "we", "us", "our") operates the online betting and casino platform accessible at https://jos65.bet (the "Platform"). This Privacy Policy applies to all Members and visitors of the Platform, regardless of the device or browser used to access it.

We understand that trust is the foundation of the relationship between jos65 and the Indonesian players who choose our Platform. Protecting your personal data is not merely a legal obligation for us — it is a core operational commitment. Every process and system at jos65 is designed with data minimisation and security as primary considerations.

This Privacy Policy should be read together with our Terms & Conditions and our Responsible Gaming page, both of which contain additional provisions relevant to the processing of your data. By registering an account on the Platform, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of applicable data protection legislation, the data controller responsible for your personal information is the jos65 operating entity, which holds the international licence under which the Platform is operated.

All data subject requests, privacy complaints, and formal correspondence relating to this Privacy Policy should be directed to our Data Protection contact. The preferred method of contact is via email at [email protected] with the subject line "Data Privacy Request". Alternatively, you may raise any privacy concern via our 24/7 live chat service, and an agent will escalate your query to the appropriate team within one business day.

Jos65 collects personal data in the following categories. We collect only the minimum data required for each purpose, consistent with the principle of data minimisation.

Jos65 collects personal data through the following mechanisms:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or update your account preferences.
• Automatically: When you use the Platform, our servers automatically log technical and usage data including your IP address, device identifiers, session activity, and game interaction data. This data is collected through server logs, cookies, and similar tracking technologies described in Clause 9.
• From payment providers: When you deposit or withdraw funds via a local Indonesian bank or e-wallet, the payment provider shares transaction confirmation data with us — including transaction reference numbers, amounts, and the masked account identifier used for the transfer.
• From identity verification partners: Where we use a third-party KYC service provider to verify your identity documents, that provider shares the verification result and relevant data extracts with us.
• From fraud prevention services: We may receive risk-scoring data from third-party fraud detection partners in relation to specific transactions or account activities that trigger our automated monitoring systems.

We process your personal data only where we have a lawful basis for doing so. The following table sets out the purposes for which we process your data and the corresponding legal basis in each case:

Jos65 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share your data only with the categories of recipients listed below, and only to the extent strictly necessary for the stated purpose:

• Payment processors and banking partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data needed to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party identity verification services receive copies of the documents you submit during the KYC process. These providers operate under strict data processing agreements and may not use the data for any purpose other than verification.
• Fraud prevention and AML service providers: Specialist third-party providers assist us in identifying suspicious transactions and account activity. Data shared with these providers is subject to confidentiality obligations.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised session and game-play data to facilitate game delivery and resolve technical disputes. These providers do not receive personally identifiable information beyond what is technically necessary for game delivery.
• IT infrastructure and cloud service providers: Our Platform is hosted on secure cloud infrastructure. Service providers operating these systems access data solely for infrastructure management purposes and are bound by strict data processing agreements.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, financial regulators, or other government bodies where we are legally required to do so, or where disclosure is necessary to protect the rights and safety of jos65, its Members, or the public.
• Professional advisers: Our legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis when providing professional services to the Company. All such advisers are bound by professional confidentiality obligations.

Jos65 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in compliance with anti-money-laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with financial regulatory requirements.
• KYC and verification documents: Retained for a minimum of five (5) years following account closure or the completion of the last transaction, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the last interaction, unless related to an ongoing legal dispute or regulatory investigation.
• Technical and usage logs: Typically retained for thirteen (13) months from the date of collection, after which they are anonymised or deleted.
• Marketing preference records: Retained until you withdraw consent or close your account, plus six (6) months to ensure suppression lists are properly maintained.

When personal data is no longer required for its original purpose and no legal obligation requires its continued retention, it is securely deleted or anonymised using industry-standard data destruction procedures.

Jos65 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security framework includes:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser and the jos65 Platform is encrypted using 256-bit SSL/TLS encryption. You can verify this by the padlock icon in your browser's address bar when visiting https://jos65.bet.
• Encryption at rest: Sensitive personal data stored in our databases — including identity documents and financial records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to systems containing personal data is restricted to authorised personnel only, on a strict need-to-know basis. All staff with access to personal data undergo regular data protection training.
• Multi-factor authentication: Administrative access to internal systems requires multi-factor authentication (MFA). We also strongly encourage Members to enable two-factor authentication (2FA) on their own accounts.
• Regular security audits: Our Platform and infrastructure undergo regular third-party security penetration testing and vulnerability assessments. Critical vulnerabilities are addressed within defined remediation windows.
• Incident response: Jos65 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities within the timeframe required by applicable law.

Jos65 uses cookies and similar tracking technologies to operate the Platform effectively, remember your session state, and analyse how Members interact with our services. The following categories of cookies are in use:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing identifiers. They cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Used to remember your preferences — such as your language display settings, preferred deposit method, and responsible gaming tool configurations — so that you do not need to re-enter them on every visit.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Members navigate the Platform. This helps us identify technical issues, improve user experience, and optimise page load performance. Analytics data is not linked to individually identifiable Members.
• Security and Fraud Prevention Cookies: Used to identify unusual or suspicious account activity, such as logins from unrecognised devices or locations. These cookies form part of our fraud detection system and serve a legitimate interest in protecting your account.

Jos65 does not use third-party advertising cookies or share cookie data with social media advertising networks. You may adjust cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to use the Platform.

As an internationally operated Platform serving Indonesian players, some of your personal data may be transferred to, and processed in, countries other than Indonesia. This occurs primarily in the context of our cloud infrastructure providers and certain third-party service providers who operate data centres outside of Indonesia.

Where such international transfers take place, jos65 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection law. These safeguards include contractual data processing agreements incorporating appropriate data transfer clauses, and transfers only to service providers located in jurisdictions with recognised data protection standards.

By registering an account on the jos65 Platform, you acknowledge and consent to the transfer of your personal data as described in this clause.

As a Member of the jos65 Platform, you have the following rights in relation to the personal data we hold about you. You may exercise any of these rights by contacting us via live chat or at [email protected]. We will respond to all verified requests within 30 days.

Please note that certain rights are subject to exemptions — in particular, we may be unable to delete data that we are legally required to retain for AML or regulatory purposes. Where an exemption applies, we will explain the reason in our response to your request.

The jos65 Platform is strictly for adults aged 21 years and over. We do not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the account registration and KYC processes.

If we discover that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account. Any funds deposited by an underage user will be returned to the originating payment method where technically possible. If you have reason to believe that a person under 21 has registered an account on the jos65 Platform, please contact us immediately via live chat or at [email protected].

The jos65 Platform does not contain links to external third-party websites beyond those necessary for the core operation of our payment and game delivery infrastructure. However, if you do navigate from the Platform to a third-party website or service, please be aware that those third-party sites have their own privacy policies, for which jos65 accepts no responsibility or liability. We encourage you to review the privacy policy of any third-party service you access.

Jos65 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform functionality. When we make material changes to this Policy, we will notify active Members by posting a prominent notice on the Platform homepage and, where practicable, by sending an email notification to the address registered to your account.

The updated Privacy Policy will take effect 7 days after the date of publication unless the changes are required for legal compliance purposes, in which case they take effect immediately. The "Effective Date" shown at the top of this page will be updated each time a new version is published. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or complaints about this Privacy Policy or about how jos65 handles your personal data, please contact our Data Protection team using any of the following channels:

• Live Chat: Available 24/7 directly on the Platform — the fastest channel for all privacy queries.
• Email: [email protected] — please use the subject line "Data Privacy Request" so your message is routed to the correct team promptly. Typical response time is within 4 hours during WIB business hours.

Indonesian-speaking support agents are on duty around the clock. We are committed to resolving all data-related queries promptly, fairly, and transparently.