Privacy Policy – pphoki

pphoki is committed to protecting the privacy of every individual who visits, registers on, or interacts with our platform at https://pphoki.world. This Privacy Policy has been prepared in accordance with internationally recognised data protection principles and is intended to give you clear, honest, and complete information about how your personal data is handled.

By accessing the pphoki platform, creating an Account, or submitting any personal information to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, please do not use the Platform or submit your personal data to us.

This Policy should be read together with our Terms & Conditions, which govern your overall use of the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Platform" — the pphoki website at https://pphoki.world, including all associated subdomains, mobile interfaces, and in-app environments.
• "We", "Us", "Our", "pphoki" — the operating entity that owns, operates, and is responsible for the Platform.
• "You", "User", "Member" — any individual who accesses, browses, registers on, or interacts with the Platform.
• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, email address, phone number, bank account details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For this Platform, pphoki is the Data Controller.
• "Third Party" — any individual or organisation other than you or pphoki that may receive or process Personal Data.
• "Cookies" — small text files placed on your device by the Platform for the purposes described in Section 7.
• "KYC" — Know Your Customer identity verification procedures required to confirm eligibility to use the Platform.

pphoki is the Data Controller in respect of all Personal Data collected from Members and visitors through the Platform. As Data Controller, pphoki determines the purposes for which your Personal Data is processed and the means by which that processing takes place.

All data protection enquiries, access requests, and complaints may be directed to our dedicated privacy contact as set out in Section 15 of this Policy.

pphoki collects Personal Data across several categories depending on how you interact with the Platform. The table below summarises the main data categories, specific data points, and the context in which each is collected:

We do not collect or process any Special Categories of Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where strictly required by law or regulation and with your explicit prior consent.

pphoki collects your Personal Data through the following channels:

4.1 Direct Interactions

You provide Personal Data directly to us when you register an Account, complete KYC verification, make a deposit or withdrawal, participate in a promotion, submit a support request, or respond to a survey or feedback invitation. This category represents the most significant source of Personal Data we hold about you.

4.2 Automated Technologies

When you access the Platform, our servers automatically record Technical Data and Usage Data through cookies, web beacons, pixel tags, and server log files. This data is collected to ensure the Platform functions correctly, to detect fraud and abuse, and to improve the overall user experience. See Section 7 for full details on how we use cookies.

4.3 Third-Party Sources

We may receive Personal Data about you from third-party identity verification providers, fraud prevention agencies, payment processors, and analytics partners. Any data received from these sources is handled in accordance with this Privacy Policy and the applicable data-sharing agreements we maintain with those third parties.

pphoki processes your Personal Data only where a legitimate legal basis exists. The following table summarises each primary processing purpose and its corresponding legal basis:

Where we rely on your consent as the legal basis for processing — for example, to send you marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To opt out of marketing communications, contact us at the address in Section 15.

pphoki does not sell, rent, or trade your Personal Data to any third party for their own marketing purposes. We may share your Personal Data with the following categories of recipient, strictly on a need-to-know basis and subject to binding data-processing agreements:

6.1 Payment Service Providers

To process your deposits and withdrawals, we share relevant financial data with our partner payment processors, which include local Indonesian bank transfer networks and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers process your data solely for the purpose of completing the requested transaction.

6.2 Identity Verification Partners

To fulfil our KYC obligations, we share identity documentation with accredited third-party verification services. These services are contractually prohibited from using your data for any purpose other than identity verification on our behalf.

6.3 Fraud Prevention & Security Agencies

We may share Technical Data, Usage Data, and Identity Data with fraud prevention agencies and cybersecurity partners to detect and prevent fraudulent activity, money laundering, and account abuse.

6.4 Regulatory & Law Enforcement Authorities

Where required by applicable law, court order, or regulatory direction, pphoki may disclose Personal Data to the relevant governmental or law enforcement authority. We will, where legally permissible, notify you of any such disclosure.

6.5 Analytics & Technology Providers

We work with analytics and infrastructure providers to operate, maintain, and improve the Platform. These providers act as data processors under our instruction and may not use your Personal Data for their own independent purposes.

The Platform uses cookies and similar tracking technologies to deliver core functionality, maintain your session, and understand how Members interact with our content. The following categories of cookies may be placed on your device when you visit the Platform:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in during a visit and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Remember your preferences such as language settings, preferred currency display (IDR), and responsible gaming limit configurations.
• Performance & Analytics Cookies: Collect aggregated, anonymised data about how pages are used and how visitors navigate the Platform. This information helps us identify areas for improvement.
• Marketing & Targeting Cookies: Used to deliver promotions and content that are relevant to your interests, and to measure the effectiveness of marketing campaigns. These cookies are only placed with your consent.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will affect Platform functionality. Detailed instructions for managing cookies in the most common browsers (Chrome, Firefox, Safari, Edge) are available on those browsers' respective support pages.

pphoki retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of your active membership plus a minimum of five (5) years after Account closure, in compliance with anti-money laundering (AML) record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in line with financial regulatory standards.
• KYC Documents: Retained for the duration of your membership plus five (5) years after Account closure, or such longer period as required by applicable law.
• Customer Support Communications: Retained for two (2) years from the date of each interaction, to enable dispute resolution and service quality review.
• Marketing Consent Records: Retained for as long as the consent is active, plus three (3) years after consent is withdrawn, as evidence of your consent status.
• Technical & Usage Logs: Retained for up to twelve (12) months for security and platform performance purposes, then aggregated or deleted.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised, unless a longer retention period is required or permitted by law.

pphoki implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes but is not limited to:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to all pages, login sessions, and financial transactions.
• Data Encryption at Rest: Sensitive Personal Data stored on our servers — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data within pphoki is restricted to authorised personnel on a strict need-to-know basis. All staff with access to Member data undergo regular data protection training.
• Two-Factor Authentication (2FA): Available to all Members and mandatory for internal administrative access to systems holding Personal Data.
• Penetration Testing & Security Audits: Our Platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities proactively.
• Incident Response Plan: In the event of a confirmed data breach that poses a risk to your rights and freedoms, pphoki will notify affected Members and the relevant authorities within 72 hours of becoming aware of the breach, where required by applicable law.

While we take every reasonable precaution to protect your data, no internet transmission or electronic storage system can be guaranteed to be 100% secure. You also bear responsibility for maintaining the confidentiality of your Account login credentials. Please refer to Section 3.2 of our Terms & Conditions for guidance on Account security best practices.

As a data subject, you have a range of rights in relation to the Personal Data pphoki holds about you. These rights are described below. To exercise any of these rights, please contact us using the details in Section 15. We aim to respond to all valid requests within 30 days of receipt.

Please note that some rights are subject to conditions and exceptions. For example, we may be unable to delete data that we are legally required to retain. We will always explain our reasoning if we are unable to fully honour a request.

As an internationally operating platform serving Members primarily in Indonesia, pphoki may transfer your Personal Data to servers and service providers located outside Indonesia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy, including:

• Standard contractual clauses or data transfer agreements with the receiving entity.
• Transfers only to jurisdictions that maintain an adequate level of data protection as recognised by applicable law.
• Binding corporate rules where applicable within our group of affiliated companies.

If you would like further information about the specific safeguards applied to any particular international transfer of your Personal Data, please contact us using the details in Section 15.

If you believe that a person under 21 has provided Personal Data to pphoki or has registered an Account on the Platform, please notify us immediately at [email protected]. Upon receiving and verifying such a report, we will promptly delete all associated Personal Data and close the Account in question. Any funds held in such an Account will be handled in accordance with applicable law.

Our KYC procedures — which require submission of a government-issued photo ID confirming date of birth — are the primary mechanism by which we enforce the 21+ age requirement. We take this obligation seriously and continuously review our verification processes to maintain their effectiveness.

The Platform does not contain links to external third-party websites for the purpose of outbound navigation. However, certain embedded content or functionality provided by third-party partners (such as game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may operate under their own privacy policies in respect of data collected within their game interfaces.

pphoki is not responsible for the privacy practices or content of any third-party game provider or technology partner. Where a third-party provider's technology is integrated into the Platform, we require those providers to handle any data in compliance with applicable privacy standards and in accordance with the data-processing agreements we maintain with them.

pphoki reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, we will notify active Members via email and/or a prominent notice on the Platform at least seven (7) days before the revised Policy takes effect.

The "Last Updated" date at the top of this document indicates when the most recent revision was made. We encourage you to review this Policy periodically to stay informed about how we protect your Personal Data. Archived versions of previous Privacy Policy iterations are available upon request by contacting our support team.

Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a complaint about how pphoki has handled your Personal Data, please contact us through the following channel:

• Privacy Enquiries Email: [email protected]
• Subject Line: Please use "Privacy Request – [Your Registered Email]" to ensure prompt routing to our data protection team.
• Response Time: We aim to acknowledge all privacy-related requests within 48 hours (WIB) and to resolve them fully within 30 calendar days.
• Live Support: Our 24/7 live support team — available in both English and Indonesian — can assist with general privacy questions and direct you to the appropriate escalation path for formal data subject requests.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction in which you reside.