Privacy Policy

pedro4 takes the protection of your personal data seriously. This Policy applies to all personal data processed in connection with your use of the Platform, including data collected when you register an account, make deposits or withdrawals through Indonesian payment channels such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja, participate in Games, contact our support team, or browse the Platform as a visitor.

This Policy is intended to provide you with clear, honest information about our data practices. We have drafted it in plain English to make it as accessible as possible. Where legal terminology is unavoidable, we have provided explanations within the text. If you have any questions about this Policy or how pedro4 handles your data, please contact us using the details provided in Clause 16.

This Policy should be read in conjunction with pedro4's Terms and Conditions, which govern the overall contractual relationship between you and pedro4. In the event of any conflict between this Policy and the Terms and Conditions on a data-privacy matter, this Policy shall prevail.

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including names, identity document numbers, email addresses, phone numbers, IP addresses, device identifiers, and financial account details.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" — pedro4, in its capacity as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on pedro4's behalf and under pedro4's documented instructions.
• "KYC" — Know Your Customer, the mandatory identity verification procedures pedro4 is required to conduct under applicable anti-money laundering and responsible gaming standards.
• "KTP" — Kartu Tanda Penduduk, the Indonesian National Identity Card, the primary government-issued identification document accepted for KYC verification.
• "Cookies" — small text files placed on your device by the Platform to enable certain functionality, remember preferences, and collect analytical data about Platform usage.
• "Sensitive Personal Data" — a subset of personal data that warrants enhanced protection, including identity document numbers, financial account details, and biometric data.

pedro4 collects personal data across several categories, depending on how you interact with the Platform. The table below provides a structured overview of the categories of data collected and the primary purpose for which each category is used:

pedro4 does not intentionally collect Special Categories of Personal Data as defined under international data protection standards (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes beyond KYC, data concerning health, or data concerning sex life or sexual orientation). If any such data is inadvertently collected — for example, through free-text fields in support communications — it is deleted or anonymised as soon as it is identified.

pedro4 collects personal data through the following principal methods:

• Direct provision by you: When you register an account, you provide identity and contact data directly via the registration form. During KYC verification, you upload your KTP and selfie photograph. When you initiate deposits or withdrawals, you provide financial data.
• Automated collection during Platform use: Our servers automatically log technical data (IP address, device information, browser type) and usage data (pages visited, games played, bet activity) each time you access the Platform. This data is collected via server logs, cookies, and similar tracking technologies.
• Third-party data sources: We receive transaction confirmation data from payment processors (banks and e-wallet providers) confirming the success or failure of deposits and withdrawals. We may also receive fraud risk scores from third-party verification services during the KYC process.
• Communications with support: When you contact pedro4's customer support team via live chat, email, or WhatsApp, we collect the content of your communications and any additional data you voluntarily provide to resolve your inquiry.

pedro4 does not collect personal data from social media platforms, data brokers, or public records beyond what is strictly necessary for KYC verification of identity documents issued by the Indonesian government.

pedro4 processes your personal data on the following legal bases, in accordance with applicable data protection principles:

• Contract performance: Processing is necessary to fulfil our obligations under the Terms and Conditions you accepted when creating your account, including identity verification, deposit and withdrawal processing, game operation, bonus delivery, and customer support.
• Legal obligation: Processing is required to comply with applicable laws and regulations, including anti-money laundering (AML) statutes, counter-terrorism financing rules, responsible gaming obligations, tax reporting requirements, and regulatory record-keeping mandates.
• Legitimate interests: Processing is necessary for pedro4's legitimate business interests, provided those interests are not overridden by your fundamental rights. Legitimate interests include fraud prevention, platform security, technical diagnostics, business analytics, and the detection of Terms and Conditions violations.
• Consent: Where required by law, and in all cases for optional marketing communications, processing is based on your explicit, freely given, specific, informed, and unambiguous consent, which you may withdraw at any time via your account settings or by contacting support.

Where pedro4 relies on consent as the legal basis for processing, withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. If you withdraw consent for a processing activity that is essential to the operation of your account, pedro4 may be unable to continue providing services, in which case your account may need to be closed in accordance with the account closure provisions in our Terms and Conditions.

pedro4 processes your personal data for the following purposes, all of which fall within the scope of the legal bases described in Clause 5:

1. Account creation and management: To create and maintain your player account, authenticate your identity, and enable access to the Platform.
2. Identity verification (KYC/AML): To verify that you are at least 21 years of age, that you are a resident of Indonesia, that the identity documents you provide are genuine and belong to you, and that you are not subject to sanctions or self-exclusion lists.
3. Transaction processing: To process deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, LinkAja, and other payment methods, and to maintain accurate financial records.
4. Game operation: To deliver sports betting (covering BRI Liga 1, EPL, La Liga, Champions League, and more), live casino, togel, bandar bola, mix parlay, slot games, crash games, and sabung ayam markets, ensuring fair outcomes and detecting manipulation or cheating.
5. Bonus and promotion management: To deliver welcome bonuses, reload bonuses, cashback offers, and other promotions, track wagering progress, and enforce bonus terms.
6. Customer support: To respond to inquiries, resolve disputes, investigate complaints, and provide 24/7 assistance in Indonesian-speaking and English-language support channels.
7. Responsible gaming: To monitor play patterns for signs of problem gambling, enforce deposit limits and session time limits, process self-exclusion requests, and comply with our 21+ age restriction policy.
8. Fraud prevention and security: To detect and prevent fraudulent transactions, multiple account abuse, bonus exploitation, identity theft, account takeovers, and other forms of Platform misuse.
9. Legal compliance: To comply with tax reporting obligations, regulatory audits, law enforcement requests, and court orders.
10. Platform improvement: To analyse usage patterns, identify technical issues, optimize user experience, and develop new features.
11. Marketing communications (with consent): To send promotional emails, SMS messages, and push notifications about bonuses, new games, and special events, only if you have opted in to receive such communications.

pedro4 does not use automated decision-making (including profiling) that produces legal effects or similarly significantly affects you without human oversight. While automated systems flag accounts for review based on risk scores or unusual activity patterns, all material decisions — including KYC approval, withdrawal approval, account suspension, and bonus forfeiture — are made by a human operator after reviewing the relevant data.

pedro4 does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only with recipients who are contractually obligated to protect your data and use it solely for the purposes for which it was shared:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to process your deposits and withdrawals. These entities operate under the supervision of Bank Indonesia and are subject to strict data protection and financial confidentiality obligations.
• KYC verification partners: Third-party identity verification services receive copies of your KTP and selfie photograph to authenticate the documents and confirm they have not been forged or tampered with. These partners are bound by strict confidentiality agreements and delete or return all data upon completion of verification.
• Fraud detection and prevention services: Specialized security providers receive transaction data, device fingerprints, and behavioral data to generate fraud risk scores and detect patterns indicative of money laundering, bonus abuse, or account compromise.
• Game providers: When you play games supplied by third-party studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others), your account identifier, bet data, and game outcomes are shared with those providers to enable game operation. Game providers process this data as independent controllers under their own privacy policies.
• Cloud infrastructure providers: pedro4 uses secure cloud hosting services to store data and operate the Platform. These providers have access to encrypted data solely for the purpose of providing infrastructure services and are prohibited from accessing or using the data for any other purpose.
• Legal and regulatory authorities: pedro4 discloses personal data to law enforcement, tax authorities, gaming regulators, and courts when required by law, court order, or valid regulatory request. Such disclosures are made only to the extent legally required and under appropriate confidentiality protections.
• Professional advisors: pedro4 may share data with lawyers, auditors, accountants, and consultants who require access to provide professional services to pedro4. Such advisors are bound by professional confidentiality obligations.
• Business transaction parties: In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal data may be transferred to the acquiring entity, which will be required to continue protecting your data in accordance with this Policy.

All third parties with whom pedro4 shares data are carefully vetted and contractually required to implement appropriate technical and organizational security measures. pedro4 conducts periodic reviews of data processor compliance and security practices.

pedro4 uses cookies and similar tracking technologies to enable Platform functionality, remember your preferences, and collect analytics data. Cookies are small text files placed on your device when you visit the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These cookies enable core features such as login sessions, secure access to your account, transaction processing, and navigation. These cookies cannot be disabled without breaking the Platform.
• Functional cookies: Enable enhanced functionality and personalization, such as remembering your language preference, your last-visited game, and your display settings. You can disable these cookies, though some features may not work optimally.
• Analytics cookies: Collect aggregated, anonymized data about how visitors use the Platform, including page views, session duration, and navigation paths. pedro4 uses this data to identify technical issues and improve user experience. You can opt out of analytics cookies via your browser settings.
• Marketing cookies (if you consent): Track your interaction with promotional content and measure the effectiveness of marketing campaigns. These cookies are only set if you have explicitly consented to receive marketing communications.

You can control cookie settings through your browser. Most browsers allow you to view, delete, and block cookies. However, if you block strictly necessary cookies, you will be unable to access your account or use the Platform. For more information on managing cookies, consult your browser's help documentation.

pedro4 does not use third-party advertising networks or behavioral tracking technologies beyond the cookies and analytics tools described above.

pedro4 implements a comprehensive information security program designed to protect your personal data against unauthorized access, accidental loss, destruction, or damage. Our security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and pedro4's servers is encrypted using industry-standard 256-bit SSL/TLS protocols, the same level of encryption used by major banks.
• Encrypted data storage: Sensitive personal data, including KTP numbers, financial account details, and passwords, is stored in encrypted form using AES-256 encryption or equivalent standards.
• Password security: Player passwords are hashed using bcrypt or a similarly robust one-way cryptographic algorithm. pedro4 staff cannot access or recover your original password.
• Access controls: Access to personal data is restricted to authorized pedro4 employees and contractors on a strict need-to-know basis. All personnel with data access are subject to confidentiality obligations.
• Network security: pedro4's infrastructure is protected by firewalls, intrusion detection systems, DDoS mitigation, and 24/7 security monitoring.
• Regular security testing: pedro4 conducts periodic vulnerability assessments, penetration testing, and code reviews to identify and remediate security weaknesses.
• Incident response plan: pedro4 maintains a documented data breach response plan. In the event of a security incident affecting your personal data, you will be notified within 72 hours as required by applicable law.

pedro4 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active accounts: Data is retained for the duration of your account's active status and for six (6) months following your last login or transaction, whichever is later.
• Closed accounts (voluntary closure): After you voluntarily close your account, most personal data is anonymized or deleted within 90 days. However, identity verification records (KTP, selfie), financial transaction records, and communications are retained for seven (7) years to comply with Indonesian tax, AML, and record-keeping regulations.
• Suspended or excluded accounts: For accounts closed due to Terms violations, fraud, or self-exclusion, personal data is retained for the duration of the exclusion period plus seven (7) years to prevent circumvention of exclusions and for regulatory compliance.
• Marketing data: If you opt out of marketing communications, your email address and phone number are retained on a suppression list to ensure you do not receive further marketing, but all other marketing data is deleted within 30 days.
• Technical and analytics data: Aggregated, anonymized analytics data may be retained indefinitely for statistical and research purposes. This data cannot be linked back to you as an individual.

At the end of the applicable retention period, personal data is either permanently deleted or irreversibly anonymized such that it can no longer be associated with you. Deletion is carried out using secure data destruction methods that render the data unrecoverable.

Under applicable data protection principles, you hold the following rights with respect to your personal data processed by pedro4:

• Right of access: You have the right to request confirmation of whether pedro4 is processing your personal data, and if so, to receive a copy of that data along with information about how it is being used.
• Right to rectification: You have the right to request correction of inaccurate personal data and completion of incomplete data. You can update most contact and profile information directly via your account settings.
• Right to erasure (right to be forgotten): You have the right to request deletion of your personal data where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you object to processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed. Note that this right is not absolute and may be limited by legal record-keeping obligations.
• Right to restriction of processing: You have the right to request that pedro4 restrict processing of your data (i.e., store it but not actively use it) while a dispute about accuracy or lawfulness is being resolved.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
• Right to object: You have the right to object to processing of your data where pedro4 relies on legitimate interests as the legal basis, unless pedro4 can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right not to be subject to automated decision-making: You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects, unless such processing is necessary for contract performance or you have given explicit consent.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Subject Rights Request" and include your full name, account username, and a description of the right you wish to exercise. pedro4 will acknowledge your request within two (2) business days and provide a substantive response within thirty (30) days. If we require additional time, we will notify you of the extension and the reasons for it.

pedro4 may request additional information to verify your identity before fulfilling a rights request, particularly for access and deletion requests. This is a security measure to ensure personal data is not disclosed to unauthorized parties.

pedro4 operates a strict 21+ age restriction policy. The Platform is not intended for use by individuals under 21 years of age, and pedro4 does not knowingly collect personal data from anyone under this age.

If pedro4 becomes aware that personal data has been collected from an individual under 21 years of age, whether through a registration attempt or otherwise, the data will be deleted immediately, the associated account (if any) will be permanently closed, and any Funds will be handled in accordance with applicable regulatory guidance on underage gambling.

Parents or guardians who become aware that a minor has provided personal data to pedro4 should contact us immediately at [email protected] so that appropriate action can be taken.

pedro4 operates as an international online gaming platform. Your personal data may be transferred to, stored in, and processed in jurisdictions outside of Indonesia where pedro4's servers, data processors, or service providers are located. These jurisdictions may have data protection laws that differ from Indonesian law.

Where personal data is transferred internationally, pedro4 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual data protection clauses based on internationally recognized standard contractual clauses
• Verification that the recipient jurisdiction provides an adequate level of data protection
• Implementation of additional technical and organizational security measures where necessary

By using the Platform, you acknowledge and consent to the international transfer of your personal data as described in this Policy. If you have concerns about international transfers, please contact us for more specific information about the safeguards in place.

The Platform may contain links to third-party websites, including game provider sites, payment processor sites, and responsible gaming resources. pedro4 is not responsible for the privacy practices or content of these external sites.

When you click a link to a third-party website, you leave the pedro4 Platform and become subject to that third party's privacy policy and terms of service. We encourage you to read the privacy policy of any website you visit before providing personal data.

This Policy applies solely to personal data collected by pedro4 through the Platform at https://pedro4.cam. It does not apply to data collected by third parties, even if accessed through links on our Platform.

pedro4 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or business operations. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.

Where amendments are material — meaning they significantly change how we collect, use, or share your personal data, or affect your rights — pedro4 will notify you by email to your registered address and via a prominent notice on the Platform at least fourteen (14) days before the amended Policy takes effect.

Minor amendments, such as corrections to typographical errors, clarifications that do not alter the substance of the Policy, or updates to contact details, may be made without prior notice.

Your continued use of the Platform after the effective date of an amended Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept the amendments, you must cease using the Platform and contact support to close your account.

If you have any questions, concerns, or complaints about this Privacy Policy or about how pedro4 handles your personal data, please contact our Data Protection team:

• Email: [email protected] (please use subject line "Privacy Inquiry" or "Data Subject Rights Request" as appropriate)
• Response time: Initial acknowledgment within two (2) business days; substantive response within five (5) business days for general inquiries and within thirty (30) days for formal data subject rights requests

pedro4 takes all privacy complaints seriously. If you submit a complaint, we will:

1. Acknowledge receipt of your complaint within two (2) business days
2. Investigate the matter thoroughly and impartially
3. Provide you with a written response outlining our findings and any remedial action taken within thirty (30) days
4. If your complaint cannot be resolved within thirty (30) days, explain the reasons for the delay and provide a revised timeline

If you are not satisfied with pedro4's response to your privacy complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For Indonesian residents, this may include reporting the matter to the Ministry of Communication and Information Technology (Kementerian Komunikasi dan Informatika) or other applicable regulatory body with jurisdiction over data protection matters.