Privacy Policy

1 Introduction

boca4d ("we", "us", "our", "the Platform") operates the online betting and casino platform accessible at boca4d.cam, providing sports betting — including markets on BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, and international tournaments — live casino games, togel (Indonesia's traditional numbers lottery), and a wide range of slot and table games to Members resident in Indonesia.

In the course of providing these services, boca4d collects and processes personal data about you as a Member or prospective Member. We are committed to handling that data responsibly, transparently, and in accordance with internationally recognized data protection principles.

This Privacy Policy applies to all personal data collected through the boca4d website, its mobile interface, customer support communications (including email, WhatsApp, and live chat), and any other interaction you have with boca4d as a Member or user.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform as a whole. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a matter relating specifically to personal data, this Privacy Policy shall take precedence.

2 Definitions

The following defined terms are used throughout this Privacy Policy:

Term	Meaning
Personal Data	Any information that identifies or can reasonably be used to identify a living individual, including name, email address, device identifiers, and financial account details.
Processing	Any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
Data Controller	boca4d, in its capacity as the entity that determines the purposes and means of processing your Personal Data.
Data Processor	A third-party service provider that processes Personal Data on behalf of and under instruction from boca4d.
Member / You	Any individual who has registered an account on boca4d or is otherwise interacting with the Platform.
KYC Data	Identity and address verification documents submitted by a Member as part of the Know Your Customer process, including government-issued identification and proof of payment method ownership.
Cookies	Small text files placed on your device by the Platform to collect usage and preference data as described in Clause 7.

3 Data We Collect

boca4d collects personal data from you directly (when you register, deposit, or contact support), automatically (through cookies and server logs), and from third parties (such as payment processors and identity verification service providers). The categories of personal data we collect include:

Data Category	Specific Data Points
Registration Data	Full legal name, date of birth, email address, residential address in Indonesia, username, and hashed password.
KYC / Identity Data	Copies of government-issued Indonesian identity documents (KTP, passport, SIM); proof-of-address documents; selfie verification images where required.
Financial Data	Bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP); e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja); deposit and withdrawal transaction records; account balance history.
Transactional / Betting Data	Wager history, game session logs, bet amounts, outcomes, bonus usage records, and responsible gaming limit settings.
Technical Data	IP address, device type and operating system, browser type and version, session timestamps (recorded in WIB, UTC+7), and geolocation data (country/city level).
Communications Data	Content of emails, live chat transcripts, and WhatsApp messages sent to boca4d's support team; records of support ticket interactions.
Marketing Preferences	Your stated preferences regarding receiving promotional communications from boca4d, and your opt-in or opt-out status for specific promotional categories.

We do not intentionally collect special categories of sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs, or health data — unless you voluntarily disclose such information in a support communication, in which case it will be used solely to resolve your inquiry.

4 How We Use Your Data

boca4d uses the personal data we collect for the following purposes:

• Account creation and authentication: To register your account, verify your identity at login, and prevent unauthorized access.
• Identity verification (KYC): To fulfill our anti-money laundering (AML) and responsible gaming obligations, including confirming that you are at least 21 years of age and resident in Indonesia.
• Transaction processing: To process deposits and withdrawals via your chosen Indonesian bank or e-wallet, and to maintain an accurate record of your account balance and transaction history.
• Service delivery: To provide you with access to betting markets, live casino games, togel draws, and all other platform features.
• Customer support: To respond to your inquiries submitted via email, live chat, or WhatsApp, and to maintain a record of your support history for quality and training purposes.
• Responsible gaming: To monitor for signs of problem gambling behavior, enforce self-exclusion orders and deposit limits, and provide appropriate responsible gaming interventions. See our Responsible Gaming page for full details.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory compliance: To fulfill our obligations under applicable AML regulations and to respond to lawful requests from competent authorities.
• Platform improvement: To analyze aggregated, anonymized usage data to improve the performance, design, and features of boca4d. Individual behavioral data used for this purpose is always anonymized before analysis.
• Marketing communications: To send you promotional offers, bonus notifications, and platform news — but only if you have opted in to receive such communications. You may opt out at any time by contacting support at [email protected].

5 Legal Basis for Processing

boca4d processes your personal data on one or more of the following legal grounds:

• Contractual necessity: Processing is required to perform our obligations under the agreement between you and boca4d — specifically, to operate your account, process transactions, and deliver the platform's services.
• Legal obligation: Processing is required to comply with applicable AML, counter-terrorism financing (CTF), and responsible gaming regulations — including mandatory KYC verification and transaction monitoring.
• Legitimate interests: Processing is necessary for boca4d's legitimate business interests, including fraud prevention, platform security, and analytics — provided those interests are not overridden by your data protection rights.
• Consent: Where processing is based on your freely given, specific, and informed consent — such as for marketing communications — you retain the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

boca4d does not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

• Payment processors and banking partners: Your financial data is shared with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing your deposit and withdrawal transactions.
• Identity verification providers: KYC documents are processed by our contracted identity verification partner(s) under a strict data processing agreement that prohibits any use of your data outside the scope of identity verification for boca4d.
• Game content providers: Anonymized session data (not personally identifiable information) is shared with game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft to facilitate game delivery and session continuity.
• Regulatory and law enforcement authorities: We will disclose personal data to competent authorities if legally required to do so by a valid court order, regulatory instruction, or applicable law. We will notify you of such a disclosure where we are legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of boca4d's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third-party Data Processors engaged by boca4d are contractually bound to process your data only on boca4d's documented instructions, to implement appropriate technical and organizational security measures, and to delete or return all personal data upon termination of their engagement with us.

7 Cookies & Tracking

boca4d uses cookies and similar tracking technologies to provide a functional, personalized, and secure platform experience. When you access boca4d, the following categories of cookies may be placed on your device:

Cookie Type	Purpose
Strictly Necessary	Essential for the Platform to function. These cookies maintain your login session, remember your language and currency preferences, and protect against cross-site request forgery (CSRF). They cannot be disabled without breaking core platform functionality.
Performance & Analytics	Collect anonymized data about how Members navigate the Platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data helps us improve platform performance and user experience.
Functional	Remember your preferences — such as your preferred deposit method, game lobby view, and notification settings — so the Platform behaves consistently across sessions without requiring you to re-enter preferences each time.
Security	Support our fraud detection systems by identifying anomalous session behavior, such as logins from unusual IP addresses or device changes that may indicate unauthorized account access.

boca4d does not use third-party behavioral advertising cookies, retargeting pixels, or social media tracking scripts. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to use the Platform.

8 Data Retention

boca4d retains your personal data for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

Data Category	Retention Period
Account & Registration Data	5 years from the date of account closure, in line with AML compliance requirements.
KYC / Identity Documents	5 years minimum from submission date, or longer if required by a specific regulatory obligation or ongoing investigation.
Financial Transaction Records	5 years from the date of each transaction, in accordance with standard financial record-keeping requirements.
Betting & Gaming History	3 years from the date of each wager, unless the records are required in connection with a dispute, investigation, or legal proceeding.
Support Communications	2 years from the date of the support interaction, for quality assurance and dispute resolution purposes.
Technical / Log Data	12 months from the date of collection, after which it is anonymized or deleted.
Marketing Preference Records	Retained for the duration of your membership and for 1 year after account closure, to maintain an auditable record of your consent and opt-out history.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. If you have requested account closure, we will initiate the deletion process for non-legally-required data within 90 calendar days of your account being formally closed.

9 Data Security

boca4d implements a comprehensive, layered security framework to protect your personal and financial data against unauthorized access, loss, alteration, or disclosure. Our key security measures include:

• Transport encryption: All data transmitted between your device and boca4d's servers is encrypted using TLS 1.2 or higher (256-bit SSL). HTTPS is enforced across all pages and API endpoints.
• At-rest encryption: Sensitive data — including KYC documents and financial account identifiers — is encrypted at rest using AES-256 encryption on our server infrastructure.
• Access controls: Internal access to Member personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and undergo regular data protection training.
• Two-factor authentication (2FA): Available to all Members on their boca4d accounts, and mandatory for all boca4d staff accessing internal systems containing personal data.
• Penetration testing and vulnerability assessments: boca4d's platform and infrastructure undergo regular third-party security testing to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed data breach that poses a risk to your rights and freedoms, boca4d will notify affected Members within 72 hours of becoming aware of the breach, including details of the data affected and the steps we are taking in response.

While boca4d takes all reasonable technical and organizational steps to protect your data, no digital system can be guaranteed as completely impervious to all threats. We strongly encourage you to use a strong, unique password for your boca4d account and to enable two-factor authentication to maximize your account's security.

10 Your Rights

As a Member of boca4d, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us using the details in Clause 15. We will respond to all verified requests within 30 calendar days.

• Right of Access: You have the right to request a copy of the personal data boca4d holds about you, along with information about how it is being used and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account information directly within your boca4d account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. This right is subject to our legal retention obligations under AML and financial regulations; data that we are legally required to retain cannot be erased on request.
• Right to Restriction of Processing: In certain circumstances, you may request that we restrict the processing of your personal data — for example, while a dispute about the accuracy of the data is being resolved.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format for the purpose of transferring it to another service provider.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on legitimate interests. You may also withdraw consent for marketing communications at any time without affecting the lawfulness of prior processing based on consent.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time by contacting support. Withdrawal of consent does not affect any processing that took place prior to the withdrawal.

boca4d will not discriminate against any Member for exercising their data rights. Exercising these rights will not affect your ability to use the Platform, except where the deletion or restriction of certain data makes it technically impossible for us to provide a specific service.

11 Children's Privacy

boca4d is strictly an adults-only platform. Our services are not directed at, and are not intended for, individuals under the age of 21. We do not knowingly collect personal data from anyone under 21 years of age.

If we become aware that we have inadvertently collected personal data from an individual under 21, we will take immediate steps to delete that data and close the associated account. All balances associated with an underage account will be forfeited. If you believe a minor may have registered an account on boca4d, please notify us immediately at [email protected] so that we can investigate and act promptly.

12 International Data Transfers

boca4d's primary server infrastructure is located in a jurisdiction with robust data protection frameworks. In certain operational contexts — for example, when using internationally contracted game providers such as Pragmatic Play, Evolution Gaming, or Microgaming — your anonymized session data may be processed on servers located outside Indonesia.

Where personal data (as distinct from anonymized session data) is transferred outside Indonesia, boca4d ensures that appropriate safeguards are in place. These safeguards include contractual data protection clauses that impose obligations on the recipient that are equivalent to the protections described in this Privacy Policy, and that restrict the recipient's use of your data to the specific purpose for which the transfer was made.

boca4d does not transfer KYC documents, financial account identifiers, or other sensitive personal data to jurisdictions that do not provide an adequate level of data protection without first obtaining your explicit consent or putting in place appropriate contractual safeguards.

13 Third-Party Links

The boca4d Platform may contain references to third-party brands, game studios, or sporting organizations — such as BRI Liga 1, EPL, FIFA, or game providers including Pragmatic Play and Evolution Gaming. These references do not constitute links to external websites and boca4d does not embed third-party tracking scripts or widgets from social media platforms.

In the unlikely event that the Platform contains a link to an external website for informational purposes, boca4d is not responsible for the privacy practices or content of that external site. We encourage you to review the privacy policy of any external website you choose to visit. This Privacy Policy applies solely to data collected through boca4d's own Platform and support channels.

14 Changes to This Policy

boca4d reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable regulations, or platform operations. When we make material changes to this Policy, we will notify you by sending a notification to the email address registered to your account and by updating the "Last Updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of boca4d following the publication of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to this Policy, you must discontinue use of the Platform and request account closure as described in our Terms & Conditions.

15 Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data boca4d holds about you, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — use the subject line "Data Privacy Request" for fastest routing to our data protection team. (Plain text — not a clickable link.)
• WhatsApp: +62 811 0000 4444 — available 07:00–24:00 WIB daily. (Plain text — not a clickable link.)
• Live Chat: Available 24/7 within the boca4d platform. Average response time under 30 seconds. Indonesian-speaking agents are always on duty.

All data access and erasure requests must be submitted by the registered account holder and will require identity verification before we can action them. This step is in place to protect your data from unauthorized access or deletion requests made by third parties. We aim to acknowledge all privacy-related requests within 3 business days and to fully resolve them within 30 calendar days of receipt.