Privacy Policy

1 Introduction

cafeqq is committed to protecting the privacy and personal data of every player on our platform. This Privacy Policy applies to all personal data collected through the cafeqq website at https://cafeqq.cam, our customer support channels, and any communications between you and cafeqq.

cafeqq primarily serves players based in Indonesia. Our platform operates in English and processes player data in compliance with internationally recognized data protection standards. Where Indonesian data protection law — including the Personal Data Protection Law (UU PDP) — imposes obligations on data controllers, cafeqq makes reasonable efforts to align with those requirements as they apply to our operating context.

This policy is written in plain, accessible English so that players across Jakarta, Surabaya, Bandung, Medan, Bali, and every other city in Indonesia can clearly understand how their data is handled. If you have any questions after reading this policy in full, please contact us at the details provided in Section 15.

2 Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, payment details, device identifiers, and IP address.
• "Processing" — any operation performed on personal data, including collection, storage, use, transmission, alteration, retrieval, and deletion.
• "Data Controller" — cafeqq, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of cafeqq, under our instruction and subject to a data processing agreement.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Cookie" — a small text file placed on your device by a website to store session information, preferences, or analytics data.
• "KYC" — Know Your Customer; the identity and age-verification process required of all players before withdrawals are processed.
• "Platform" — the cafeqq website at https://cafeqq.cam and all services delivered through it.

3 Data We Collect

cafeqq collects personal data across the following categories. We collect only what is necessary for the stated purpose; we do not engage in speculative or excessive data collection.

4 How Data Is Collected

cafeqq collects personal data through the following channels and mechanisms:

• Account registration form: When you create an account, you directly provide your name, date of birth, email address, mobile number, and chosen username and password.
• KYC document submission: When you submit identity and payment-method documents via our secure upload portal to satisfy verification requirements prior to withdrawal.
• Deposit and withdrawal transactions: When you initiate a transaction via BCA, BRI, BNI, Bank Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, or LinkAja, relevant payment reference data is captured by our system.
• Platform usage: Automatically, as you browse and use the Platform. This includes technical data such as IP address, device identifiers, and session logs, collected via server logs and analytics tools.
• Cookies and similar tracking technologies: Via cookies, pixel tags, and local storage objects placed on your device when you visit the Platform. See Section 8 for full details.
• Customer support interactions: When you contact us via live chat, email, or any other support channel, the content and metadata of those communications are retained for quality assurance and dispute resolution purposes.
• Third-party data providers: In limited circumstances, we may receive data about you from identity verification agencies, fraud detection services, or payment processors — for example, to cross-check KYC information or flag suspicious transaction patterns.

5 Legal Basis for Processing

cafeqq processes your personal data only where a valid legal basis exists. The primary bases on which we rely are as follows:

• Contractual necessity: Processing is required to fulfill our contractual obligations to you as a registered player — specifically, to operate your account, process deposits and withdrawals in IDR, and deliver the gaming services you have requested.
• Legal obligation: Processing is required to comply with applicable law, including anti-money laundering (AML) regulations, age-verification obligations, and responses to lawful requests from regulatory or law-enforcement authorities.
• Legitimate interests: Processing is necessary for cafeqq's legitimate business interests, including fraud prevention, platform security, product analytics, and customer service improvement, provided those interests are not overridden by your fundamental privacy rights.
• Consent: Where we send you promotional communications (email newsletters, bonus offers, seasonal promotions), we do so only where you have provided an explicit opt-in consent at registration or subsequently. You may withdraw marketing consent at any time by contacting support or updating your account preferences.

6 How We Use Your Data

cafeqq uses the personal data we collect for the following specific purposes:

1. Account management: Creating, maintaining, and securing your cafeqq account, including password resets and account-preference updates.
2. Transaction processing: Verifying, authorizing, and recording all deposits and withdrawals made via supported Indonesian banking and e-wallet channels.
3. Identity and age verification (KYC): Confirming that you are at least 21 years of age and are who you claim to be, in accordance with our Terms & Conditions and our responsible gaming obligations.
4. Fraud and AML detection: Monitoring account activity for suspicious patterns, unauthorized access attempts, bonus abuse, and potential money-laundering activity. Flagged activity may be reported to relevant authorities.
5. Customer support: Responding to your inquiries, resolving disputes, and maintaining a record of support interactions for quality assurance purposes.
6. Platform improvement: Analyzing aggregated usage data to understand how players interact with our site, identify technical issues, and inform decisions about new features and game offerings.
7. Personalization: Using your game history and preferences to surface relevant content, such as recommended games or sports markets, within your account dashboard.
8. Promotional communications: Sending you information about bonuses, seasonal promotions (e.g., Idul Fitri cashback offers, Ramadhan reload bonuses), and new game launches — only where you have opted in. You may opt out at any time.
9. Legal compliance: Fulfilling our obligations under applicable laws and responding to legally valid requests from courts, regulators, or law-enforcement bodies.

7 Data Sharing & Disclosure

cafeqq does not sell your personal data. We share data with third parties only in the following circumstances, and only to the minimum extent necessary:

• Payment processors and banking partners: We share transactional data with the payment institutions involved in processing your deposits and withdrawals (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay). These institutions operate under their own privacy policies and regulatory obligations.
• Game providers: When you play a game powered by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), certain session data (e.g., player ID, game session ID, wager amounts) is transmitted to that provider to facilitate gameplay and RNG certification. No personally identifiable information beyond a pseudonymous player ID is shared with game providers.
• Identity verification services: We engage third-party KYC and fraud-screening providers to assist in verifying player identities and detecting fraudulent documents. These providers act as Data Processors under our instruction and are contractually prohibited from using your data for any other purpose.
• Analytics providers: Aggregated, anonymized usage data may be shared with analytics platforms to help us understand player behavior and improve the Platform. No personal identifiers are included in these data sets.
• Legal and regulatory authorities: We will disclose personal data to courts, regulators, law-enforcement agencies, or other competent authorities when required by law, court order, or to protect the rights and safety of cafeqq or other parties.
• Corporate transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of cafeqq's business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party Data Processors engaged by cafeqq are subject to written data processing agreements that prohibit unauthorized use, require appropriate security measures, and mandate prompt notification in the event of a data breach.

8 Cookies & Tracking Technologies

cafeqq uses cookies and similar technologies to ensure the Platform functions correctly, to remember your preferences, and to understand how players use our site. The following categories of cookies are deployed:

Strictly necessary cookies are deployed without requiring your consent, as they are essential to Platform operation. Functional and analytics cookies are deployed only where you have provided consent via our cookie preference tool. You may withdraw consent and clear cookies at any time through your browser settings, though doing so may affect certain Platform functions.

9 Data Retention

cafeqq retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active account data (identity, contact, financial data): Retained for the duration of your account registration plus a minimum of 5 years following account closure, to satisfy AML record-keeping requirements.
• Transaction records (deposits, withdrawals, bet history): Retained for a minimum of 5 years from the date of each transaction.
• KYC documents: Retained for a minimum of 5 years from the date of verification or the date of account closure, whichever is later.
• Customer support communications: Retained for 3 years from the date of the last interaction, for dispute resolution and quality-assurance purposes.
• Technical and usage data (logs, session data): Retained for 12 months, after which they are aggregated and anonymized or deleted.
• Marketing consent records: Retained for the duration of your account and for 2 years after you withdraw consent, as evidence of your original opt-in.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where data cannot be immediately deleted due to backup rotation schedules, it is isolated from active processing systems and deleted at the next scheduled purge cycle.

10 Data Security

cafeqq employs a layered security architecture to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. Key security measures include:

• Transport Layer Security (TLS 1.2/1.3): All data transmitted between your device and our servers is encrypted in transit. Our SSL certificate is maintained and renewed continuously.
• Data-at-rest encryption: Personal data stored in our databases is encrypted using AES-256 encryption. Database access is restricted to authenticated system accounts operating under the principle of least privilege.
• Access control: Logical access to systems containing personal data is restricted to authorized personnel whose roles require it. Access rights are reviewed quarterly and revoked immediately upon role change or termination of employment.
• Two-factor authentication (2FA): All internal administrative accounts require 2FA. Players are strongly encouraged to enable 2FA on their cafeqq accounts for additional login security.
• Penetration testing and vulnerability scanning: Our security team conducts regular assessments of our infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed data breach that poses a risk to players, cafeqq will notify affected players within 72 hours of becoming aware of the incident, describing the nature of the breach, the data affected, and the steps we are taking to address it.

11 Your Rights

As a player whose personal data is processed by cafeqq, you are entitled to exercise the following rights at any time by contacting our support team. We will respond to all valid requests within 30 calendar days.

To exercise any of the rights listed above, contact our Data Protection team at [email protected] with the subject line "Data Rights Request" and include your registered account username and the specific right you wish to exercise. We may request a copy of your identity document to confirm your identity before processing the request, in order to protect against unauthorized access to your data.

12 Minors

cafeqq strictly prohibits the registration and participation of individuals under the age of 21. Our platform is not directed at, and does not knowingly collect personal data from, persons under 21 years of age.

During account registration and KYC verification, we take active steps to confirm that each player meets the 21+ age requirement. If we discover that personal data has been collected from a person under 21, we will immediately close the associated account, delete the personal data in question (subject to any legal obligations to retain evidence of the breach), and return any deposits made, less any amounts already withdrawn.

If you are a parent or guardian and believe that a person under your care has registered on cafeqq, please contact us immediately at [email protected]. We take underage gambling extremely seriously and will act on all such reports without delay. For further guidance, please review our Responsible Gaming page.

13 International Data Transfers

cafeqq operates internationally and may transfer your personal data to servers or service providers located outside Indonesia. Where such transfers occur, cafeqq takes the following steps to ensure your data remains protected to an equivalent standard:

• Transfers are made only to countries or entities that provide an adequate level of data protection, or where appropriate safeguards (such as standard contractual clauses) are in place.
• All third-party Data Processors receiving personal data are bound by contractual obligations to maintain security standards consistent with this Privacy Policy.
• Where transfers involve game provider platforms (e.g., Evolution Gaming's live studios, Pragmatic Play servers), those providers operate under their own regulatory licenses and security frameworks, and data sharing is limited to pseudonymous session identifiers.

By using the Platform, you acknowledge and consent to the transfer of your personal data outside Indonesia where necessary for the delivery of our services, subject always to the safeguards described in this section.

14 Changes to This Privacy Policy

cafeqq may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. When we make material changes — such as introducing a new category of data collection, a new sharing arrangement, or a new retention period — we will notify registered players by email at least 14 days before the changes take effect.

For minor amendments (typographical corrections, clarifications that do not alter the substance of the policy), the updated policy will be published on this page with a revised "Last Updated" date without individual player notification. We encourage you to review this page periodically to stay informed about how we protect your data.

Continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any material change, you may request account closure before the effective date by contacting our support team.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data cafeqq holds about you, please reach out using the contact details below. All privacy-related inquiries are handled by our designated Data Protection team.

• Email: [email protected] — use subject line "Privacy Inquiry" or "Data Rights Request" for priority routing
• Live Chat: Available 24/7 via the in-platform chat widget
• Response Time: We acknowledge all privacy-related requests within 48 hours and provide a substantive response within 30 calendar days
• Support Hours: 24 hours a day, 7 days a week (WIB, UTC+7)