Please Read Carefully: This Privacy Policy forms part of the ndu21 Terms & Conditions. By creating an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
Introduction
ndu21 ("we", "us", "our") operates the online betting and casino platform accessible at https://ndu21.cam (the "Platform"). We are committed to protecting the personal data of every User who interacts with our Platform, whether as a registered account holder or a visitor browsing our public pages.
This Privacy Policy describes our practices regarding the collection, use, storage, sharing, and protection of personal information. It applies to all Users of the ndu21 Platform, including residents of Indonesia accessing the Platform from Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Makassar, and all other locations across the archipelago.
We handle personal data with the care and discretion you would expect from a financially regulated institution. Our data practices are aligned with internationally recognized privacy principles, and we continuously review our procedures to maintain the highest standards of data security and user trust.
Definitions
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably identify a living individual, directly or indirectly (e.g., name, email address, IP address, bank account number). |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction. |
| "Data Controller" | ndu21, which determines the purposes and means of processing personal data collected through the Platform. |
| "Data Processor" | A third party that processes personal data on behalf of ndu21, such as a payment gateway or KYC verification provider. |
| "User" / "You" | Any individual who accesses, registers on, or uses the ndu21 Platform. |
| "Sensitive Data" | A subset of personal data requiring heightened protection, including national identity numbers (KTP), financial account details, and biometric data where applicable. |
| "Cookies" | Small text files placed on your device by the Platform to store session information, preferences, and analytics data. |
Data We Collect
ndu21 collects the minimum data necessary to operate the Platform, fulfill legal obligations, and deliver a high-quality user experience. The categories of personal data we process are as follows:
3.1 Registration and Identity Data
- Full legal name as stated on your national identity document
- Date of birth (to verify the 21+ age requirement)
- Residential address in Indonesia
- Email address and mobile phone number
- Username and encrypted password
- National identity card (KTP) number and scan, submitted during KYC verification
3.2 Financial and Transaction Data
- Bank account details (account number and bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP, Bank Danamon)
- E-wallet identifiers associated with OVO, DANA, GoPay, ShopeePay, or LinkAja accounts
- Deposit and withdrawal amounts, dates, and transaction reference numbers
- Payment card details (for Visa/Mastercard transactions, card data is tokenized and processed by our PCI-DSS-compliant payment processor — ndu21 does not store full card numbers)
- Bet history, game session records, wager amounts, and associated outcomes
3.3 Technical and Usage Data
- IP address and approximate geolocation derived from IP
- Device type, operating system, and browser type and version
- Session timestamps, login history, and session duration
- Pages visited, features used, and in-session navigation patterns
- Referral source (how you arrived at the Platform)
3.4 Communications Data
- Content of messages sent to our customer support team via live chat or email
- Records of promotional communications you have accepted or opted out of
- Feedback, survey responses, and complaint submissions
3.5 Responsible Gaming Data
- Self-exclusion requests and their effective dates
- Deposit limit settings and modifications
- Problem gambling indicators flagged by our monitoring systems (used internally for player protection purposes only)
How We Collect Data
ndu21 collects personal data through the following channels:
- Directly from You: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to surveys and promotions.
- Automatically: Through cookies, web beacons, and server logs as you browse and interact with the Platform. This includes technical data such as IP addresses, session tokens, and clickstream data.
- From Third Parties: From identity verification providers (KYC/AML partners), payment processors and financial institutions (for transaction verification), fraud detection services, and analytics providers — all operating under strict data processing agreements with ndu21.
- From Public Sources: Publicly available information relevant to fraud prevention or compliance purposes, such as sanctions lists and politically exposed persons (PEP) databases.
Purposes of Processing
We process your personal data for the following clearly defined purposes:
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining, and securing your ndu21 account; processing deposits, withdrawals, and bets. |
| KYC & Compliance | Verifying your identity and age (21+), meeting anti-money laundering (AML) obligations, and satisfying international licensing requirements. |
| Fraud Prevention | Detecting and preventing unauthorized access, fraudulent transactions, bonus abuse, and collusion. |
| Customer Support | Responding to inquiries, resolving disputes, and improving service quality through interaction records. |
| Platform Improvement | Analyzing usage patterns to enhance the Platform's functionality, performance, and user experience. |
| Responsible Gaming | Monitoring for signs of problematic gambling behavior and applying protective measures where appropriate. |
| Marketing | Sending promotional offers, bonus alerts, and event notifications to Users who have consented to receive them. You may opt out at any time. |
| Legal Obligations | Complying with applicable laws, responding to lawful requests from regulatory or law enforcement authorities. |
Legal Basis for Processing
ndu21 processes your personal data on one or more of the following legal grounds:
- Contractual Necessity: Processing required to fulfill our obligations to you under the Terms & Conditions — principally, operating your account, executing transactions, and settling bets.
- Legal Obligation: Processing required by applicable law, including KYC/AML verification, record-keeping obligations under our international gaming license, and responding to lawful regulatory inquiries.
- Legitimate Interests: Processing for fraud prevention, security monitoring, Platform analytics, and responsible gaming compliance, where our legitimate interests are not overridden by your fundamental rights and freedoms.
- Consent: Processing for direct marketing communications, non-essential cookies, and certain profiling activities, where you have given your informed and freely withdrawable consent.
Withdrawing Consent: Where processing is based on your consent, you may withdraw that consent at any time by contacting us at [email protected] or updating your account preferences. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
Data Sharing & Disclosure
ndu21 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your data only in the following circumstances and only to the extent necessary:
- Payment Processors: Financial institutions and payment service providers (including those facilitating BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, Visa, and Mastercard transactions) receive the data required to execute and verify your transactions.
- KYC/AML Providers: Identity verification and fraud screening partners receive your identity documents and relevant personal data to complete verification checks in compliance with our licensing obligations.
- Game Studios: Third-party game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized or pseudonymized session data necessary to deliver their games through the Platform.
- IT and Infrastructure Providers: Cloud hosting, database, and cybersecurity service providers who process data on our behalf under binding data processing agreements.
- Legal and Regulatory Authorities: Where required by law or valid legal process, we may disclose personal data to law enforcement agencies, courts, or regulatory bodies. We will notify you of such disclosures where legally permitted to do so.
- Business Transfers: In the event of a merger, acquisition, or sale of all or part of ndu21's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.
No Sale of Data: ndu21 will never sell your personal data to advertisers, data brokers, or any other third party for commercial gain. Your data is an asset we protect, not a product we trade.
International Data Transfers
ndu21 operates on a globally distributed infrastructure. As a result, your personal data may be processed and stored on servers located outside Indonesia. Where data is transferred internationally, ndu21 ensures that appropriate safeguards are in place, including:
- Data processing agreements incorporating standard contractual clauses aligned with internationally recognized data protection frameworks.
- Transfer only to jurisdictions that maintain an adequate level of data protection, or to recipients who have implemented equivalent technical and organizational safeguards.
- Encryption of data in transit (TLS/SSL) and at rest (AES-256) regardless of the processing location.
By using the ndu21 Platform, you acknowledge and consent to the transfer of your personal data to our international processing infrastructure under the protections described above.
Cookies & Tracking Technologies
ndu21 uses cookies and similar tracking technologies to operate the Platform efficiently and improve your experience. The following table describes the categories of cookies we use:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Essential for Platform operation — session authentication, security tokens, and load balancing. Cannot be disabled without impairing Platform functionality. | Session |
| Functional | Remembers your preferences such as language settings, preferred payment method, and display options to personalize your experience. | Up to 12 months |
| Analytics | Collects anonymized usage data (pages visited, feature interactions, session duration) to help us understand how the Platform is used and identify areas for improvement. | Up to 24 months |
| Marketing | Tracks referral sources and campaign performance to measure the effectiveness of our promotional activities. Only activated with your consent. | Up to 30 days |
| Fraud Prevention | Fingerprints device characteristics to detect suspicious access patterns, multiple account creation, and unauthorized login attempts. | Up to 6 months |
You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use core Platform features. For marketing and analytics cookies, you may withdraw consent at any time by contacting [email protected].
Data Retention
ndu21 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and our international licensing obligations. Our standard retention periods are as follows:
- Active Account Data: Retained for the lifetime of your account plus a minimum of 5 years following account closure, in accordance with AML record-keeping requirements.
- KYC and Identity Documents: Retained for a minimum of 5 years from the date of submission or account closure, whichever is later.
- Transaction Records: Retained for a minimum of 5 years from the date of each transaction to satisfy financial compliance obligations.
- Customer Support Communications: Retained for 3 years from the date of the interaction, unless the communication relates to a formal dispute or legal proceeding, in which case it is retained until that matter is fully resolved.
- Marketing Consent Records: Retained for 2 years from the date consent was given or withdrawn, whichever is later.
- Technical Logs and Analytics Data: Anonymized after 90 days and retained in aggregate form for up to 24 months for Platform improvement purposes.
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized so that it can no longer be associated with any individual.
Your Privacy Rights
As a User of the ndu21 Platform, you are entitled to exercise the following rights in relation to your personal data. To submit a request, contact us at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 days of receiving a valid request.
Right of Access
Request a copy of all personal data we hold about you, including the categories processed and the purposes for which they are used.
Right to Rectification
Request correction of any inaccurate or incomplete personal data held in your account. You may also update basic details directly through your account settings.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purpose collected, subject to our legal retention obligations.
Right to Restrict Processing
Request that we limit the processing of your data in certain circumstances, such as while a dispute regarding accuracy is being resolved.
Right to Portability
Request a structured, machine-readable copy of the personal data you have provided to us, where processing is based on consent or contract.
Right to Object
Object to processing based on legitimate interests, including direct marketing profiling. We will cease processing unless we demonstrate compelling grounds that override your interests.
Identity Verification: To protect your privacy, we will verify your identity before processing any rights request. We may ask you to provide a copy of your KTP or answer security questions associated with your account.
Security Measures
ndu21 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security framework includes:
- TLS/SSL Encryption: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS 1.2 or higher), the same standard used by international banking institutions.
- At-Rest Encryption: Sensitive data stored in our databases — including identity documents and financial records — is encrypted using AES-256.
- Two-Factor Authentication (2FA): ndu21 supports optional 2FA for account login to provide an additional layer of protection against unauthorized access.
- Access Controls: Access to personal data within ndu21's internal systems is restricted on a strict need-to-know basis and governed by role-based access control (RBAC) policies. All internal access is logged and audited.
- Penetration Testing: Our Platform and infrastructure undergo regular security assessments and penetration testing by qualified third-party security professionals.
- Incident Response: ndu21 maintains a documented data breach response plan. In the event of a breach affecting your rights and freedoms, we will notify you within 72 hours of becoming aware of the incident, where technically feasible.
- Staff Training: All ndu21 personnel with access to personal data receive mandatory data protection training upon onboarding and at least annually thereafter.
Your Role in Security: While we take every reasonable measure to protect your data, you also play a role. Use a strong, unique password for your ndu21 account, enable 2FA, and never share your login credentials with anyone. ndu21 will never ask for your password via email or live chat.
Minors
The ndu21 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes mandatory age verification, and KYC procedures are in place to confirm that all account holders meet the minimum age requirement.
If we become aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the collected data without undue delay, and refund any deposits made, provided no fraudulent intent is established. If you believe a minor has registered on our Platform, please contact us immediately at [email protected] so that we can take prompt action.
Policy Changes
ndu21 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. When we make material changes, we will notify you by sending an email to the address registered on your account and by updating the "Last Updated" date at the top of this page.
We encourage you to review this Policy periodically. Your continued use of the Platform following the publication of an updated Policy constitutes acceptance of the revised terms. If you do not agree with any change, you should discontinue use of the Platform and may request account closure by contacting our support team.
The current version of this Privacy Policy is always available at https://ndu21.cam/privacy-policy. Previous versions are available upon written request.
Contact & Complaints
If you have questions, concerns, or complaints about how ndu21 handles your personal data, or if you wish to exercise any of the rights described in Section 11, please reach out to our Data Protection team using the details below:
- Email: [email protected] (plain text — not a clickable link)
- Subject Line: "Privacy Policy Inquiry" or "Privacy Rights Request" for faster routing
- Response Time: General privacy inquiries within 48 hours; formal rights requests within 30 calendar days
- Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays such as Idul Fitri, Idul Adha, and Indonesian Independence Day (17 August)
- Languages: English and Bahasa Indonesia both accepted for privacy correspondence
If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection or supervisory authority in the jurisdiction applicable to you. ndu21 is committed to resolving all privacy concerns fairly and transparently, and we welcome the opportunity to address your concerns directly before escalation.