Privacy Policy

Definitions

The following definitions apply throughout this Privacy Policy:

Scope & Applicability

This Privacy Policy applies to all Personal Data collected, processed, or stored by calo33 in connection with:

• The registration and ongoing maintenance of a calo33 member account.
• Any deposit, withdrawal, or financial transaction conducted through the calo33 platform.
• All gaming and wagering activity undertaken by a Member on calo33, including slot play, live casino sessions, sports betting, and keno.
• All communications between a Member and the calo33 customer support team, whether via email, live chat, or any other channel.
• Visits to the calo33 website at https://calo33.bio, regardless of whether the visitor holds an active member account.

This policy applies to Members and visitors located in Indonesia, which is the primary market served by calo33. Members from Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and all other regions of Indonesia are equally covered by this policy. calo33 is committed to applying responsible data handling standards consistent with internationally recognized privacy best practices, including the principles underlying Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022, commonly referred to as "UU PDP").

Data We Collect

calo33 collects Personal Data across several categories, described in the table below. We collect only the minimum data necessary for the stated purposes and do not collect sensitive categories of data (such as health or biometric data) unless expressly required for regulatory compliance.

3.1 Registration Data

When you create a calo33 account, we collect:

• Full legal name (as it appears on your government-issued identity document).
• Date of birth (to verify that you are at least 21 years of age, as required for eligibility).
• Email address (primary contact and account recovery channel).
• Mobile phone number (for two-factor authentication and security alerts).
• Residential address in Indonesia (city, province, and postal code).
• Username and encrypted password credentials.

3.2 Identity Verification (KYC) Data

Before processing your first withdrawal request, and at any other time deemed necessary by our compliance team, we may request:

• A copy or photograph of a valid government-issued identity document — such as an Indonesian national identity card (KTP), passport, or driver's license.
• A recent proof-of-address document (utility bill, bank statement, or official correspondence dated within the past three months).
• Evidence that your registered payment method is in your own name — for example, a screenshot of your BCA, BRI, BNI, or Mandiri mobile banking profile, or an OVO, DANA, or GoPay account confirmation.

3.3 Financial & Transaction Data

For every deposit and withdrawal transaction, we record:

• Payment method type (bank transfer, e-wallet) and the associated account identifier (account number or e-wallet phone number), sufficient to route transactions and verify ownership — we do not store full bank account credentials.
• Transaction amount in Indonesian Rupiah (IDR/Rp), transaction date and time (WIB, UTC+7), and transaction reference number.
• Account balance history, including bonus credits, wagering activity, and withdrawal records.

3.4 Technical & Usage Data

When you visit or use the calo33 platform, we automatically collect certain technical data:

• IP address and approximate geographic location (city and region level, not precise GPS).
• Device type, operating system, browser type and version.
• Pages visited, session duration, click-stream data, and game activity logs.
• Cookie identifiers and similar tracking technologies (see Clause 9).

3.5 Communications Data

When you contact calo33 support, we retain records of the communication, including the content of your messages and the date and time of each interaction. This data is used to resolve queries efficiently and to improve service quality.

How We Collect Data

calo33 collects Personal Data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in a promotion.
• Automatically via your use of the platform — through cookies, web beacons, server logs, and similar technologies that record technical and usage data as described in Clause 3.4.
• From third-party service providers — such as payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) who may confirm transaction status or account ownership details, and KYC verification partners who assist in identity document validation.
• From publicly available sources — where necessary for fraud prevention or regulatory compliance purposes, such as publicly listed sanctions or politically exposed persons (PEP) registers.

Purpose of Processing

calo33 processes your Personal Data for the following specific and legitimate purposes:

Legal Basis for Processing

calo33 processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing required to fulfill our obligations to you under the calo33 Terms & Conditions — including account registration, payment processing, and customer support.
• Legal obligation: Processing necessary to comply with applicable law, including AML requirements, age verification obligations, and cooperation with authorized regulatory or law enforcement inquiries.
• Legitimate interests: Processing carried out for calo33's legitimate business interests, including fraud prevention, platform security, and service improvement — where these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for marketing communications and optional analytics cookies, where you have given freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time by contacting support or adjusting your account preferences.

Data Sharing & Disclosure

calo33 does not sell, rent, or trade your Personal Data to any third party for commercial marketing purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

7.1 Payment Processors

To process deposits and withdrawals in Indonesian Rupiah, calo33 shares the necessary transaction data with relevant payment service providers, including local bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers are bound by strict data protection obligations and are permitted to use your data only to process the relevant transaction.

7.2 KYC & Identity Verification Partners

To fulfill our identity verification obligations, calo33 may share KYC documentation (identity card copies, proof-of-address documents) with licensed third-party KYC verification service providers. These partners operate under contractual data protection agreements with calo33 and may not use your data for any purpose beyond verification.

7.3 Technology & Infrastructure Providers

calo33 uses reputable third-party providers for hosting, database management, analytics, and cybersecurity services. These providers process data on calo33's behalf as data processors under binding data processing agreements and are prohibited from using your data for their own purposes.

7.4 Game Content Providers

Game studios whose content is available on calo33 — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive anonymized or pseudonymized gameplay data for the purposes of game performance monitoring and regulatory compliance. No personally identifiable information is shared with game studios beyond what is strictly necessary.

7.5 Regulatory & Law Enforcement Authorities

calo33 may be required by law, court order, or regulatory directive to disclose Personal Data to competent government or law enforcement authorities. In such cases, calo33 will disclose only the minimum data required and, where legally permitted, will notify the affected Member of the disclosure.

International Transfers

calo33 operates as an internationally licensed platform. Some of the third-party service providers described in Clause 7 may be located outside of Indonesia, which means your Personal Data may be transferred to and processed in jurisdictions outside your country of residence. Where such transfers occur, calo33 takes the following measures to ensure your data receives an adequate level of protection:

• We enter into binding data processing agreements with all third-party processors that impose data protection standards consistent with internationally recognized privacy principles.
• We conduct due diligence on all international service providers before engaging them to handle Personal Data.
• We apply technical safeguards — including encryption in transit and at rest — to all data transferred internationally.

By using the calo33 platform, you acknowledge and consent to the transfer of your Personal Data to calo33's international service providers, subject to the protections described above.

Cookies & Tracking Technologies

calo33 uses cookies and similar tracking technologies to ensure the platform functions correctly, to remember your preferences, and to analyze how Members interact with the site. The categories of cookies we use are described below:

9.1 Strictly Necessary Cookies

These cookies are essential for the calo33 platform to operate. They enable core functions such as logging into your account, maintaining your session, and processing transactions. They cannot be disabled without breaking core platform functionality and do not require your consent to be set.

9.2 Performance & Analytics Cookies

These cookies collect anonymized or pseudonymized data about how visitors use the calo33 website — such as which pages are visited most frequently, how long sessions last, and where errors occur. This information helps us improve platform performance. These cookies are set only where you have provided consent.

9.3 Functional Cookies

These cookies remember your preferences — such as your preferred language setting, display preferences, and recently played games — to provide a more personalized experience. They are set only where you have provided consent.

9.4 Managing Cookies

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the calo33 platform. Most modern browsers (Chrome, Firefox, Safari, Edge) provide straightforward cookie management options in their settings menus.

Data Security

calo33 takes the security of your Personal Data seriously and implements a comprehensive set of technical and organizational measures to protect it against unauthorized access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and calo33 servers is encrypted using industry-standard SSL/TLS protocols. The calo33 website enforces HTTPS across all pages and redirects any HTTP requests automatically.
• Encryption at Rest: Sensitive data stored in calo33 databases — including password hashes, identity document references, and financial identifiers — is encrypted using strong symmetric encryption algorithms.
• Access Controls: Access to systems containing Personal Data is restricted to authorized calo33 personnel who require it to perform their specific job functions. All internal access is logged and subject to periodic audit.
• Two-Factor Authentication: calo33 supports and encourages Members to enable two-factor authentication (2FA) on their accounts to provide an additional layer of protection against unauthorized access.
• Penetration Testing & Security Audits: calo33 conducts regular security assessments, including third-party penetration testing, to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed data security incident that may affect Member data, calo33 will notify affected Members and relevant authorities within the timeframe required by applicable law.

Data Retention

calo33 retains your Personal Data for as long as necessary to fulfill the purposes described in this Privacy Policy, subject to the following minimum retention periods:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized in accordance with calo33's internal data disposal procedures.

Your Rights

As a calo33 Member, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please submit a written request to our support team at the contact details in Clause 16. calo33 will respond to all valid requests within thirty (30) calendar days.

• Right of Access: You have the right to request confirmation of whether calo33 holds Personal Data about you, and if so, to receive a copy of that data together with information about how it is processed.
• Right of Rectification: You have the right to request the correction of any inaccurate or incomplete Personal Data held about you. For certain data categories (such as your registered name), we may require supporting documentation before making corrections.
• Right of Erasure: You have the right to request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where the data has been unlawfully processed. Note that calo33 may be required to retain certain data under applicable AML and regulatory obligations regardless of a deletion request.
• Right to Restrict Processing: You have the right to request a temporary restriction on the processing of your Personal Data in certain circumstances — for example, while a dispute regarding the accuracy of your data is being resolved.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where calo33 processes your data based on your consent (e.g., for marketing emails), you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Object: You have the right to object to processing carried out on the basis of calo33's legitimate interests. calo33 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Children & Minors

calo33 is strictly an adults-only platform. Access to real-money gaming and wagering is restricted to individuals who are at least 21 years of age. calo33 does not knowingly collect Personal Data from any individual under the age of 21. If we become aware that a member account has been registered by or on behalf of a person under 21, we will:

• Immediately suspend and permanently close the relevant account.
• Void all pending bets and bonus credits associated with the account.
• Return any real-money deposits to the originating payment method, net of any amounts already wagered, at calo33's reasonable determination.
• Delete or anonymize all Personal Data associated with the underage account as soon as legally permissible.

If you are a parent or legal guardian and believe that your child has registered a calo33 account, please contact us immediately at the email address in Clause 16 so that we can take prompt action.

Third-Party Links

The calo33 website may contain references to, or contextual information about, third-party services such as payment providers, game studios, and sports leagues. Where such references include hyperlinks to external websites, please be aware that calo33 has no control over the content or privacy practices of those external sites. This Privacy Policy applies exclusively to data collected and processed by calo33 at https://calo33.bio. calo33 is not responsible for the privacy practices of any third-party website and recommends that you review the privacy policy of any external site you visit.

Policy Updates

calo33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, calo33 will notify Members via the email address registered on their account and will post a prominent notice on the calo33 platform for a minimum of fourteen (14) days before the revised policy takes effect. The effective date at the top of this policy will be updated to reflect any revision. Your continued use of the calo33 platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree to the updated terms, you must cease using the platform and contact our support team to request account closure.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a privacy-related complaint, please contact our dedicated privacy support team using the details below:

• Email: support@calo33.bio (plain text — not a clickable link)
• Response Time: We aim to acknowledge all privacy-related requests within 3 business days (WIB, UTC+7) and to fully resolve them within 30 calendar days.
• Language: Our support team includes Indonesian-speaking agents available 24/7 who can assist you in either English or Bahasa Indonesia when handling privacy inquiries.

When submitting a privacy request, please include your registered calo33 username and email address so that we can verify your identity before acting on your request. calo33 will not action data rights requests from unverified individuals, as this protects Members against unauthorized third-party attempts to access or delete their data.