Privacy Policy

The following terms carry the meanings defined below throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, including by reference to a name, identification number, location data, online identifier, or one or more factors specific to that person's identity.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means naga22, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of naga22, subject to naga22's documented instructions and a binding data processing agreement.
• "Member" / "you" means any registered user of the naga22 Platform.
• "KYC Data" means the identity verification documents and associated data submitted by a Member during the Know Your Customer verification process.
• "Cookies" means small text files placed on your device by the naga22 Platform to enable core functionality, session management, analytics, and personalization.

naga22 operates as the Data Controller in respect of all Personal Data collected through the naga22 Platform at naga22.cam. As Data Controller, naga22 determines the purposes for which Personal Data is collected and the means by which it is processed.

For all data protection enquiries, access requests, and complaints relating to this Privacy Policy, please contact our Data Protection team using the contact details provided in Clause 15 of this Policy. All such communications should be marked clearly as "Data Protection Enquiry" to ensure prompt routing to the appropriate team.

Where naga22 engages third-party Data Processors to carry out specific functions (such as payment processing, identity verification, or hosting services), those processors act strictly on naga22's instructions and are contractually bound to maintain data security standards consistent with this Policy.

naga22 collects Personal Data through three primary channels: data you provide directly, data generated automatically by your use of the Platform, and data obtained from third-party sources where applicable. The categories of Personal Data we collect are described below.

3.1 Data You Provide Directly

3.2 Data Generated Automatically

3.3 Data from Third Parties

naga22 may receive limited Personal Data from third-party sources in the following circumstances:

• KYC verification partners: Identity verification service providers may return a verified/unverified status and flag data (e.g., sanctions screening result) based on the documents you submit.
• Payment processors: Transaction confirmation data (amount, reference number, status) is returned by your bank or e-wallet provider to confirm deposit or withdrawal completion.
• Fraud prevention services: Third-party risk-scoring tools may provide a risk signal associated with an IP address, devic e fingerprint, or payment method. naga22 uses this signal to supplement — not replace — its own fraud detection logic.

naga22 processes your Personal Data only where a valid legal basis exists. The primary legal bases on which naga22 relies are set out below:

• Contractual necessity: Processing required to perform the contract between you and naga22 — including account registration, deposit and withdrawal processing, bet settlement, and KYC verification — is carried out on the basis that it is necessary to deliver the services you have requested.
• Legitimate interests: naga22 processes certain data (such as usage analytics, fraud detection signals, and security logging) on the basis of its legitimate interests in operating a secure, commercially viable platform, provided those interests are not overridden by your rights and interests.
• Legal obligation: Where naga22 is required by applicable law, court order, or regulatory authority to process or disclose Personal Data, we do so on the basis of legal obligation.
• Consent: Where naga22 relies on your consent as the legal basis for processing — for example, to send you promotional communications — you may withdraw that consent at any time by updating your communication preferences in Account Settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

naga22 uses the Personal Data it collects for the following purposes. Where a purpose relies on a specific legal basis, that basis is indicated in parentheses:

• Account creation and management — registering your account, authenticating your identity, and maintaining your account settings. (Contractual necessity)
• Financial transaction processing — crediting deposits in IDR from BCA, BRI, BNI, Mandiri, CIMB Niaga, and supported e-wallets; processing withdrawal requests to your verified payment method. (Contractual necessity)
• KYC and age verification — confirming that you are at least 21 years of age and verifying your identity before processing withdrawals or acting on high-value account changes. (Legal obligation / Contractual necessity)
• Platform security and fraud prevention — detecting and investigating unauthorized access, multi-accounting, bonus abuse, money laundering, and other Prohibited Conduct as defined in our Terms & Conditions. (Legitimate interests)
• Customer support — managing your support queries submitted via live chat or email, maintaining correspondence records, and resolving disputes. (Contractual necessity)
• Responsible gaming monitoring — monitoring betting patterns to identify potential problem gambling indicators and proactively offering responsible gaming tools where appropriate. (Legitimate interests / Legal obligation)
• Platform improvement and analytics — analysing aggregate usage data to improve the performance, design, and functionality of the naga22 Platform. (Legitimate interests)
• Promotional communications — sending you information about naga22 promotions, bonuses, and platform updates, where you have opted in to receive such communications. (Consent)
• Legal and regulatory compliance — responding to lawful requests from regulatory authorities, law enforcement bodies, or courts. (Legal obligation)

naga22 does not sell your Personal Data. We share Personal Data only in the limited circumstances described below, and only to the minimum extent required for the stated purpose:

6.1 Service Providers (Data Processors)

naga22 engages carefully selected third-party service providers who process Personal Data on our behalf, strictly under written data processing agreements that prohibit them from using your data for any purpose other than delivering services to naga22. These providers include:

• Identity verification providers: Process your KTP/passport and selfie data to return a KYC verification result.
• Payment processors: Facilitate deposit and withdrawal transactions via local Indonesian banks and e-wallet networks.
• Cloud infrastructure providers: Host naga22 Platform infrastructure with contractually mandated security and confidentiality standards.
• Game studio APIs: Providers such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, Microgaming, and Spribe receive a session token and game-result data to deliver game content. They do not receive your full identity data.
• Fraud detection services: Receive technical identifiers (IP address, device fingerprint) to return a risk score used in fraud prevention workflows.
• Customer support platform: Hosts live chat transcripts and email ticket data to facilitate support case management.

6.2 Legal and Regulatory Disclosures

naga22 may disclose Personal Data to government authorities, regulatory bodies, or law enforcement agencies where required by a valid legal obligation, court order, or regulatory direction. naga22 will, where legally permissible, notify the affected member of any such disclosure request before complying.

6.3 Business Transfers

In the event that naga22 undergoes a merger, acquisition, or sale of all or substantially all of its assets, Personal Data held by naga22 may be transferred to the successor entity as part of that transaction. In such circumstances, naga22 will provide notice to affected members and ensure that the successor entity is bound by data protection commitments no less protective than those set out in this Policy.

naga22 uses cookies and similar tracking technologies to operate the Platform, maintain session state, and gather aggregate analytics. The following categories of cookies are in use:

You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary or security cookies will impair Platform functionality and may prevent you from logging in or transacting. naga22 does not use third-party advertising cookies or cross-site tracking cookies.

naga22 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulatory obligation. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active membership and for a minimum of 5 years following account closure, in compliance with anti-money-laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, consistent with financial record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years following account closure or the completion of the relevant verification process.
• Customer support records: Retained for 3 years from the date of the last interaction in the relevant support case.
• Marketing consent records: Retained for 3 years from the date of consent or its withdrawal, as evidence of the consent decision.
• Analytics and usage data: Retained in aggregate, anonymized form indefinitely for Platform improvement purposes. Individual session logs are deleted after 12 months.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in accordance with naga22's data destruction procedures. Anonymized data that can no longer be linked to an identifiable individual is not subject to this Policy and may be retained and used without restriction.

naga22 implements a multi-layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our technical and organizational security measures include:

• Encryption at rest: All databases containing Personal Data are encrypted using AES-256. KYC documents are stored in an isolated, access-controlled storage environment with independent encryption keys.
• Encryption in transit: All communications between your browser and the naga22 Platform are protected by TLS 1.2 or higher (256-bit SSL). Our SSL certificate is renewed and monitored continuously.
• Access controls: Internal access to Personal Data is restricted via role-based access control (RBAC). Privileged access requires multi-factor authentication (MFA) and is subject to regular access reviews.
• Intrusion detection: naga22 operates continuous network monitoring and intrusion detection systems. Anomalous access patterns trigger automated alerts and manual review.
• Penetration testing: The Platform undergoes regular third-party penetration testing. Critical findings are remediated within defined SLA timelines.
• Staff training: All naga22 personnel with access to Personal Data receive regular data protection and security awareness training.
• Incident response: naga22 maintains a documented data breach incident response plan. In the event of a breach that poses a risk to members' rights, we will notify affected individuals within 72 hours of becoming aware of the incident.

naga22 operates internationally and may process or store Personal Data on servers located outside of Indonesia. Where Personal Data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that which applies in Indonesia, naga22 implements appropriate safeguards to ensure your data remains protected to the standard described in this Policy.

Such safeguards may include:

• Standard contractual clauses requiring the recipient to process Personal Data in accordance with naga22's privacy standards.
• Binding corporate rules or equivalent internal data transfer frameworks where data is transferred to affiliates.
• Transfer to jurisdictions that maintain adequate data protection frameworks as assessed by naga22's data protection team.

By using the naga22 Platform, you acknowledge that your Personal Data may be transferred to and processed in countries other than Indonesia, subject to the safeguards described above. If you have questions about specific international data transfers, please contact naga22 using the details in Clause 15.

As a naga22 member, you hold the following rights in respect of your Personal Data. naga22 will respond to all verified data subject requests within 14 calendar days of receipt, free of charge unless the request is manifestly unfounded or excessive.

To exercise any of these rights, please contact the naga22 data protection team using the details in Clause 15. To protect your data from unauthorized disclosure, we will verify your identity before processing any data subject request. We may ask you to provide a copy of your registered ID as part of this verification step.

The naga22 Platform is strictly restricted to adults aged 21 years and older. naga22 does not knowingly collect Personal Data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC processes.

If naga22 becomes aware that Personal Data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the relevant Personal Data, and reverse any financial transactions associated with that account to the extent technically possible.

If you believe that a minor has registered a naga22 account, please contact our support team immediately at [email protected] so that we can take prompt action.

The naga22 Platform does not contain links to external third-party websites or services for commercial or affiliate purposes. In the limited event that any reference to an external resource is made (for example, a responsible gaming helpline), naga22 is not responsible for the privacy practices or content of that third-party resource. This Privacy Policy applies exclusively to data processed by naga22 through the naga22.cam Platform and its associated services.

naga22 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, naga22 will notify active members via the registered email address on their account and display a prominent notice on the Platform for a minimum of 14 days following the update.

The "Last Reviewed" date at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the naga22 Platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you do not accept the revised terms, please discontinue use of the Platform and contact support to close your account.

For all data protection enquiries, data subject access requests, or complaints regarding naga22's handling of your Personal Data, please contact our Data Protection team through the following channels:

If you are not satisfied with naga22's response to a data protection complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. naga22 will cooperate fully with any such regulatory investigation.

For responsible gaming concerns, self-exclusion requests, or account restriction queries, please visit our dedicated Responsible Gaming page or contact support directly via live chat. Responsible gaming requests are treated as high priority and actioned within 24 hours.