Privacy Policy —
How gul91 Protects Your Data

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Controller" means gul91, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means a third party that processes Personal Data on behalf of gul91 under a data-processing agreement.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their Personal Data.
• "Player" / "You" means any individual who has registered an account on, or otherwise interacts with, the gul91 Platform.
• "KYC Data" means identity and age verification documents provided by you during the Know Your Customer process, including but not limited to government-issued identification and proof of address.

2.1 gul91 collects the following categories of Personal Data, depending on how you interact with the Platform:

2.2 You are not required to provide all categories of Personal Data listed above. However, failure to provide mandatory data (such as Identity Data and Financial Data) will prevent gul91 from opening or maintaining your account, or from processing withdrawals.

3.1 gul91 collects Personal Data through the following channels:

• Direct Interactions: Data you provide when registering an account, completing KYC, making deposits or withdrawal requests, contacting support, or submitting feedback.
• Automated Technologies: Technical and Usage Data collected automatically when you access the Platform, via cookies, web beacons, server logs, and similar tracking technologies. See Section 7 (Cookies & Tracking) for full details.
• Third-Party Sources: Identity verification data from KYC service providers; fraud-screening data from payment processors; publicly available information used to enhance fraud detection.
• Payment Processors: Confirmation data from local bank transfer services and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) necessary to verify and reconcile transactions.

4.1 gul91 processes your Personal Data on one or more of the following legal grounds:

• Contractual Necessity: Processing required to perform our contract with you — specifically, to operate your account, process deposits and withdrawals, and provide access to the Platform's betting and gaming services.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including anti-money-laundering (AML) obligations, age-verification requirements, and cooperation with law-enforcement authorities.
• Legitimate Interests: Processing necessary for gul91's legitimate interests, including fraud detection and prevention, platform security, network and information security, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Where gul91 relies on your consent as the legal basis (for example, for certain optional marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Contact support at [email protected] to withdraw consent.

5.1 gul91 uses your Personal Data for the following purposes:

• To register and maintain your player account on the Platform.
• To verify your identity and age (21+) through our KYC process.
• To process deposits and withdrawals via your chosen Indonesian bank or e-wallet.
• To detect, prevent, and investigate fraud, money laundering, and other illegal activities.
• To personalise your experience on the Platform, including game recommendations and promotional offers relevant to your activity.
• To monitor your gaming behaviour for responsible gaming purposes, including identifying patterns that may indicate problem gambling.
• To send you transactional communications — such as deposit confirmations, withdrawal updates, and security alerts — which are a necessary part of the service and cannot be opted out of while your account is active.
• To send you promotional communications, where you have consented to receive them. You may opt out at any time.
• To improve the Platform's features, performance, and user experience based on aggregated usage data.
• To comply with our legal and regulatory obligations, including maintaining records required under applicable AML legislation.

6.1 gul91 does not sell your Personal Data. We may share your data with the following categories of third parties, strictly for the purposes set out in this Policy:

• Payment Processors and Banking Partners: Indonesian bank transfer networks and e-wallet providers (including OVO, DANA, GoPay, ShopeePay, LinkAja) that facilitate deposits and withdrawals. These parties receive only the data necessary to execute the transaction.
• Identity Verification Providers: Third-party KYC service providers who assist in verifying the authenticity of identity documents submitted by Players. These providers operate under strict data-processing agreements with gul91.
• IT and Platform Infrastructure Providers: Cloud hosting, server management, and cybersecurity vendors that support the operation of the gul91 Platform. These providers act as data Processors under contractual obligations.
• Fraud Prevention and AML Services: Third-party screening services used to identify high-risk transactions and comply with anti-money-laundering obligations.
• Game Content Providers: Providers such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, and Spribe may receive minimal technical session data required to deliver game content. They do not receive your full identity or financial data.
• Regulatory and Law-Enforcement Authorities: Where gul91 is legally required to disclose data — for example, in response to a lawful court order, regulatory investigation, or law-enforcement request — we will comply. Where permitted, we will notify you of such a request.
• Professional Advisers: Legal counsel, auditors, and insurers, where necessary and subject to professional confidentiality obligations.

6.2 All third-party data sharing is governed by data-processing agreements that require recipients to maintain appropriate technical and organisational security measures and to use the data only for the specified purpose.

7.1 gul91 uses cookies and similar tracking technologies to operate the Platform effectively and to provide a secure, personalised experience. The following types of cookies are used:

7.2 gul91 does not use third-party advertising cookies or cross-site tracking pixels. Your browsing behaviour on gul91 is not shared with advertising networks.

7.3 You may control cookie settings through your browser preferences. Disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions.

8.1 gul91 retains your Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your active account relationship with gul91.
• Transaction and Financial Records: Retained for a minimum of five (5) years following the date of the transaction, in compliance with applicable anti-money-laundering legislation.
• KYC Documents: Retained for a minimum of five (5) years following account closure or the end of the business relationship.
• Support Communications: Retained for two (2) years from the date of the last interaction, unless required longer for dispute resolution.
• Technical and Usage Logs: Retained for up to twelve (12) months in identifiable form, after which they are anonymised or deleted.

8.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9.1 gul91 implements a range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS/SSL encryption for all data in transit between your browser and our servers.
• Encryption of sensitive data at rest, including financial information and KYC documents.
• Role-based access controls limiting staff access to Personal Data to those with a legitimate need.
• Multi-factor authentication (MFA) for internal systems that handle Personal Data.
• Regular penetration testing and vulnerability assessments by independent security specialists.
• 24/7 security monitoring and automated anomaly detection on the Platform's infrastructure.

9.2 In the event of a Personal Data breach that is likely to result in a high risk to your rights and freedoms, gul91 will notify you without undue delay, providing details of the nature of the breach, the categories of data affected, and the steps we are taking to mitigate the impact.

10.1 Subject to applicable law, you have the following rights in relation to your Personal Data held by gul91:

10.2 To exercise any of the rights listed above, please contact our support team at [email protected]. We will respond to all verifiable requests within thirty (30) calendar days. In complex cases, we may extend this period by a further sixty (60) days, with notification provided to you within the initial thirty-day period.

10.3 gul91 will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

11.1 The gul91 Platform is strictly intended for adults aged 21 years and above. gul91 does not knowingly collect or process Personal Data from individuals under the age of 21.

11.2 Where gul91 discovers that Personal Data has been collected from an individual under the age of 21, it will take immediate steps to delete that data and close the associated account. Any funds deposited by an underage player will be handled in accordance with Section 2.2 of the Terms & Conditions.

11.3 If you believe that a minor may have registered an account on the Platform, please notify us immediately at [email protected].

12.1 The gul91 Platform integrates third-party services to deliver game content, process payments, and maintain platform security. These third-party providers — including game studios such as Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, NetEnt, and Microgaming — operate under their own privacy policies with respect to data they independently collect through their services.

12.2 gul91 is not responsible for the privacy practices of third-party game studios or payment providers beyond the scope of data shared by gul91 under data-processing agreements. We recommend reviewing the privacy policies of any third-party providers whose services you access through the Platform.

12.3 The gul91 Platform does not contain links to external websites. Any content appearing to link externally should be reported to our support team.

13.1 gul91 primarily stores and processes your Personal Data within secure data centres. In certain circumstances, your data may be transferred to or processed by service providers located outside Indonesia — for example, cloud infrastructure providers or international KYC vendors.

13.2 Where such transfers occur, gul91 ensures that appropriate safeguards are in place to protect your Personal Data to the same standard as required under applicable data protection law. Safeguards may include standard contractual clauses, adequacy decisions, or other recognised transfer mechanisms.

13.3 By using the gul91 Platform, you acknowledge and consent to the transfer of your Personal Data as described in this section, where such transfers are necessary to deliver the services you have requested.

14.1 gul91 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform services. The "Last Updated" date at the top of this page will be revised accordingly.

14.2 Where changes are material — meaning they significantly affect how we process your Personal Data or your rights in relation to that data — we will notify registered Players via email or an on-Platform notice at least seven (7) days before the change takes effect.

14.3 Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not accept the updated Policy, you must close your account and cease using the Platform.

15.1 For any questions, requests, or concerns regarding this Privacy Policy or gul91's handling of your Personal Data, please contact us using the details below:

15.2 If you are not satisfied with gul91's response to a data privacy concern, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.

15.3 gul91 takes all privacy complaints seriously. Every complaint is logged, investigated by a designated team member, and responded to in writing. We are committed to resolving data privacy concerns promptly and fairly.