Privacy Policy
nas4d Platform

nas4d ("we", "our", "the Platform") operates the online gaming website at nas4d.org, serving registered adult Members across Indonesia with sports betting, live casino, slot games, and togel (Indonesia's traditional numbers lottery) products. As a data controller, nas4d determines the purposes and means by which your personal data is processed.

This Privacy Policy applies to all personal data collected through the nas4d website, account registration process, customer support interactions, financial transactions, and any other touchpoint between you and nas4d. It does not apply to third-party websites linked from our platform, including game studios such as Pragmatic Play or Evolution Gaming, which operate under their own privacy frameworks.

The following terms carry the meanings defined below throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or can reasonably identify a natural person, directly or indirectly, including name, identification number, location data, email address, IP address, or one or more factors specific to the physical, economic, or social identity of that person.
• "Processing" — Any operation performed on personal data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" — nas4d, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — A third party that processes personal data on behalf of nas4d under a written data processing agreement, such as a payment gateway or cloud infrastructure provider.
• "Member" / "You" — A natural person who has registered an account on the nas4d platform and whose personal data is subject to this Policy.
• "KYC" — Know Your Customer, the identity verification process nas4d undertakes to confirm a Member's identity and satisfy anti-money laundering (AML) obligations.
• "Cookies" — Small text files stored on your device by your browser at the instruction of the nas4d website, used to maintain session state, remember preferences, and gather analytics data.
• "Sensitive Data" — A subset of personal data that warrants heightened protection, including financial account details, government-issued identification numbers, and health-related information provided in the context of responsible gaming self-assessments.

nas4d collects personal data across several categories depending on how you interact with the platform. The table below summarises the data types we process:

nas4d collects personal data through three primary channels:

• Direct Collection: Data you voluntarily provide during account registration, KYC document upload, deposit and withdrawal requests, contact form submissions, live chat sessions, and responsible gaming tool configuration.
• Automated Collection: Data gathered automatically when you access the nas4d website, including your IP address, device fingerprint, browser metadata, session timestamps, and in-platform behavioural interactions. This data is collected via server logs, first-party cookies, and proprietary analytics tools.
• Third-Party Sources: Data received from identity verification partners (who confirm the authenticity of KTP, SIM, or passport documents), payment processors (who relay transaction confirmation data), fraud detection providers, and publicly accessible databases used for AML screening against international sanctions lists.

nas4d does not purchase personal data lists from commercial data brokers. Any third-party data received is limited to what is strictly necessary for the purposes described in Section 4 and is subject to contractual data protection obligations.

nas4d processes your personal data only for defined, legitimate, and documented purposes. The table below maps each processing purpose to the data categories involved:

nas4d relies on the following legal bases to process personal data, in accordance with internationally recognised data protection standards:

• Contractual Necessity: Processing required to perform the contract between you and nas4d — namely, to operate your account, process bets, and manage financial transactions. Without this processing, nas4d cannot deliver its services.
• Legal Obligation: Processing necessary to comply with applicable anti-money laundering regulations, KYC requirements, tax reporting obligations, and any order from a competent authority.
• Legitimate Interests: Processing for fraud prevention, platform security, network integrity, and responsible gaming monitoring, where nas4d's interests do not override your fundamental privacy rights. A legitimate interests assessment (LIA) is maintained on file for each such processing activity.
• Consent: Processing for optional purposes such as personalised marketing communications and the use of non-essential analytics cookies. Consent is collected at point-of-capture, is freely given, specific, informed, and unambiguous, and may be withdrawn at any time via account settings or by contacting support.

nas4d does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared only in the following circumstances and only to the extent necessary:

• Payment Processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja receive transaction-level financial data to execute deposits and withdrawals. These providers are independent controllers for the data they process under their own privacy policies.
• Identity Verification Partners: Third-party KYC providers receive document images and identity data to perform liveness checks and document authenticity verification. All such partners are bound by strict data processing agreements and are prohibited from using your data for any purpose other than the verification requested.
• Game Studio Providers: Studios including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, and Spribe receive a pseudonymised player token and session data necessary to run game rounds. No directly identifiable data (name, ID number, financial details) is shared with game studios.
• Fraud & AML Screening Services: Specialist providers that cross-reference identity data against international sanctions lists, Politically Exposed Persons (PEP) databases, and fraud intelligence networks. Such sharing is required by law or legitimate regulatory obligation.
• Cloud Infrastructure Providers: nas4d's platform is hosted on enterprise-grade cloud infrastructure. The hosting provider processes data as a data processor under a binding data processing agreement and has no independent right to access Member data.
• Law Enforcement & Regulators: nas4d will disclose personal data to competent government authorities, courts, or regulators where required to do so by law, court order, or where disclosure is necessary to protect the rights, property, or safety of nas4d, its Members, or the public.

nas4d operates with infrastructure and service partners that may be located outside Indonesia. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, nas4d implements the following safeguards:

• Standard Contractual Clauses (SCCs): Contracts with overseas data processors incorporate internationally recognised standard contractual clauses that impose binding data protection obligations equivalent to those applicable in the originating jurisdiction.
• Adequacy Assessments: Before any new international transfer is initiated, nas4d conducts a transfer impact assessment to evaluate the destination country's legal framework and determine whether supplementary safeguards are required.
• Data Minimisation: Only the minimum data necessary for the specific processing purpose is transferred internationally. Sensitive data such as KTP document images is processed in-region wherever technically feasible.

By registering on nas4d, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia as described above, subject to the safeguards set out in this section.

nas4d retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligation. The following retention periods apply:

Upon expiry of the applicable retention period, nas4d securely destroys or anonymises the relevant data using industry-standard methods so that it can no longer be associated with any identifiable individual.

nas4d uses cookies and similar tracking technologies to operate the platform, maintain your session, and understand how Members use the site. The categories of cookies we use are:

• Strictly Necessary Cookies: Essential for the platform to function. These cookies maintain your login session, remember your language and currency preferences, and protect against cross-site request forgery (CSRF). They cannot be disabled without rendering the platform inoperable.
• Analytics Cookies: Used to measure aggregate traffic patterns, identify popular game categories, and evaluate the performance of site features. Data collected is pseudonymised and reported in aggregate. These cookies require your consent and can be disabled via account settings.
• Functional Cookies: Remember your preferences such as notification settings, responsible gaming reminders, and display configurations to improve your experience on return visits.
• Fraud Prevention Cookies: Short-lived session tokens that help nas4d's security systems detect and prevent account takeover, credential stuffing attacks, and automated bot activity. These are classified as strictly necessary.

nas4d does not use third-party advertising cookies or cross-site tracking technologies. You will not be tracked across the wider internet based on your nas4d activity. You may manage cookie preferences at any time through your browser settings; however, disabling strictly necessary cookies will impair platform functionality.

nas4d implements a layered security architecture designed to protect Member data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Transport Encryption: All data transmitted between your device and nas4d's servers is protected by TLS 1.3 with 256-bit AES encryption. The platform enforces HTTPS-only access and uses HTTP Strict Transport Security (HSTS).
• Data-at-Rest Encryption: Sensitive data fields, including identity document references and financial account identifiers, are encrypted at rest using AES-256. Database-level encryption is applied to all production data stores.
• Access Controls: Internal access to Member personal data is restricted on a strict need-to-know basis. All staff with data access undergo background checks and are bound by confidentiality agreements. Access is authenticated via multi-factor authentication (MFA) and is fully audited.
• Penetration Testing: The nas4d platform undergoes regular independent penetration testing by certified security professionals. Critical vulnerabilities are remediated within 24 hours of discovery; high-severity issues within 72 hours.
• Data Breach Response: nas4d maintains a documented incident response plan. In the event of a data breach that is likely to result in a risk to Member rights, affected Members will be notified promptly with details of the incident, the data involved, and the steps taken to contain and remediate it.
• Password Security: Member passwords are stored using a modern adaptive hashing algorithm (bcrypt with a work factor calibrated to current hardware). Plaintext passwords are never stored or logged under any circumstance.

As a Member of nas4d, you hold a comprehensive set of rights over your personal data. nas4d is committed to honouring these rights promptly and without undue friction. The following rights are available to all Members:

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Privacy Rights Request — [Your Username]". nas4d will acknowledge your request within 72 hours and respond in full within 30 calendar days. In complex cases, this period may be extended by a further 60 days, in which case nas4d will notify you of the extension and the reason for it.

nas4d's gaming services are strictly restricted to adults aged 21 and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. The nas4d registration process requires date-of-birth entry, and all KYC verification includes age confirmation against government-issued identification.

If nas4d discovers that personal data belonging to a person under 21 has been collected — whether as a result of misrepresentation during registration or any other cause — that data will be permanently deleted within 48 hours of discovery, the associated account will be closed, and any Balance will be returned to the originating payment method after identity confirmation.

nas4d reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the structure of the platform. The "Last Updated" date at the top of this page will be revised whenever material changes are made.

When changes are material — meaning they affect how we use your personal data in a way that could meaningfully impact your privacy interests — nas4d will notify registered Members by email to the address associated with their account at least 14 days before the updated Policy takes effect. For non-material changes (such as clarifications of existing language), the updated Policy will be published without prior individual notice.

Continued use of the nas4d platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the platform and submit an account closure request to our support team.

nas4d has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection obligations. If you have any questions, concerns, or complaints regarding the handling of your personal data, you may contact the DPO directly:

• Email (DPO): [email protected] — Use subject line "DPO Enquiry — [Your Username]" to ensure routing to the Data Protection team.
• General Support: Available 24/7 via live chat on the nas4d platform. Indonesian-speaking agents are available at all hours for Members who prefer to discuss privacy matters in their native language.
• Response Commitment: nas4d acknowledges all privacy-related enquiries within 72 hours and provides a substantive response within 30 calendar days, in line with the timelines described in Section 11.
• Complaints: If you are dissatisfied with nas4d's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to you.