Privacy Policy — roma43

This Privacy Policy ("Policy") describes how roma43 ("Platform", "we", "us", "our") collects, processes, stores, and protects personal data submitted by or collected about individuals ("Members", "Users", "you") who access and use the roma43 platform at roma43.cam. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. This Policy should be read together with our Terms & Conditions.

01 Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including name, national ID number, date of birth, email address, phone number, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For this Platform, the Data Controller is the licensed international gaming entity operating roma43.
• "Data Processor" — any third party engaged by roma43 to process Personal Data on its behalf, under documented instructions and appropriate contractual safeguards.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "Cookie" — a small text file placed on your device by the Platform to store session information, preferences, and analytics data.
• "KYC" — Know Your Customer, the identity and age verification process required before processing withdrawals above specified thresholds.

02 Data Controller

roma43 is operated by a licensed international gaming entity (the "Company"). The Company acts as the Data Controller for all Personal Data collected through the Platform. All data processing activities are conducted in accordance with the applicable data protection framework of the Company's jurisdiction of incorporation and with internationally recognized privacy standards.

Members who are residents of Indonesia acknowledge that Indonesia's Personal Data Protection Law (UU PDP) and related regulations may apply to certain aspects of data processing involving their personal information. roma43 is committed to upholding standards consistent with those requirements to the fullest extent operationally practicable.

For all data-related enquiries, requests, and complaints, please contact our Data Protection point of contact at the email address provided in Section 13 of this Policy.

03 Data We Collect

roma43 collects Personal Data through multiple channels, including direct submission by the Member during registration and ongoing account use, automatic collection through technical systems, and — in limited circumstances — from verified third-party sources. The categories of data collected are as follows:

roma43 does not collect sensitive personal data categories (such as health data, racial or ethnic origin, or political opinions) and does not use facial recognition or biometric processing beyond standard document-photo matching for KYC purposes.

04 Purpose & Legal Basis for Processing

roma43 processes Personal Data only for specified, explicit, and legitimate purposes. The primary purposes and their corresponding legal bases are:

• Account Registration and Management: Processing is necessary to perform the contract between you and roma43 (i.e., the Terms & Conditions you accepted at registration). This includes creating your account, verifying your identity, and managing your balance and transaction history.
• Identity Verification (KYC): Processing is required by our legal and regulatory obligations to prevent underage gambling, fraud, and money laundering. We are required to verify that all Members are at least 21 years of age before processing withdrawals above specified thresholds.
• Payment Processing: Processing is necessary to fulfill our contractual obligation to credit your deposits and execute your withdrawal requests via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and other accepted payment channels in IDR.
• Fraud Prevention and Platform Security: Processing is necessary for the legitimate interests of roma43 in detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, and unauthorized access.
• Responsible Gaming Compliance: Processing is required by regulatory obligation and legitimate interest to monitor for signs of problem gambling behavior and to give effect to self-exclusion requests, deposit limits, and cooling-off periods.
• Customer Support: Processing is necessary to respond to your support requests, resolve disputes, and maintain records of support interactions, as required by our contractual obligations to you.
• Marketing Communications: With your explicit consent, roma43 may send you promotional offers, seasonal campaigns (such as Idul Fitri or Ramadhan special bonuses), and platform updates by email or SMS. You may withdraw this consent at any time by contacting support.
• Analytics and Platform Improvement: Processing is in roma43's legitimate interest to analyze aggregate usage patterns, optimize the platform experience, and develop new features. Analytics data is used in de-identified or aggregated form wherever possible.
• Legal Compliance: Processing may be required to comply with applicable laws, respond to lawful requests from regulatory or law enforcement bodies, and fulfill record-keeping obligations.

05 Data Sharing & Disclosure

roma43 does not sell, rent, or trade your Personal Data to unaffiliated third parties for their own marketing purposes. Your data may be shared in the following circumstances only:

• Payment Processors: Financial Data is shared with your chosen bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process deposit and withdrawal transactions.
• Identity Verification Providers: Identity Data and KYC documentation are shared with third-party identity verification services for document authentication and age confirmation purposes, under strict data processing agreements.
• Fraud Prevention Services: Technical Data and usage patterns may be shared with specialist fraud detection and prevention service providers to protect the integrity of the Platform.
• Game Software Providers: Usage Data relating to specific games may be shared with licensed game studios (such as Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, and Microgaming) for technical support, dispute resolution, and game audit purposes. These providers access only the minimum data necessary for their function.
• Regulatory and Law Enforcement Bodies: roma43 will disclose Personal Data to competent authorities where required by a valid legal order, court judgment, or regulatory directive. roma43 will notify the affected Member where legally permitted to do so.
• Group Companies: Personal Data may be shared within the roma43 corporate group for internal administrative purposes, subject to the same data protection standards as this Policy.

All third-party Data Processors engaged by roma43 are bound by written data processing agreements that restrict their use of your data to the specific purpose for which it was shared and require them to implement appropriate technical and organizational security measures.

06 Data Retention

roma43 retains Personal Data for no longer than is necessary to fulfill the purpose for which it was collected, subject to any applicable legal retention obligations. Our standard retention periods are as follows:

• Active Account Data (Identity, Contact, Financial, Usage): retained for the duration of your active membership plus a minimum of 5 years following account closure, to comply with anti-money laundering record-keeping requirements.
• Transaction Records: retained for a minimum of 5 years from the date of each transaction, in accordance with financial regulatory requirements.
• KYC Documentation: retained for a minimum of 5 years post-account closure, or longer where required by applicable law.
• Support Communications: retained for 3 years from the date of each interaction, for dispute resolution and quality-assurance purposes.
• Marketing Consent Records: retained for the duration of your consent plus 2 years following withdrawal of consent, as evidence of lawful processing.
• Technical / Log Data: retained for up to 12 months in identifiable form, then anonymized or deleted, unless required for ongoing security investigations.

If you request deletion of your Personal Data (see Section 9), roma43 will delete or anonymize data where it is not subject to a legal retention obligation. Data that must be retained by law will be archived with restricted access and flagged for deletion once the retention period expires.

07 Security Measures

roma43 implements technical and organizational security measures designed to protect Personal Data against accidental loss, unauthorized access, misuse, alteration, or disclosure. Our security framework includes:

• 256-Bit SSL Encryption: All data transmitted between your device and roma43 servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to all pages — login, registration, deposits, withdrawals, and game sessions.
• Secure Data Storage: Personal Data is stored on secure servers with access restricted to authorized personnel only. Database encryption at rest is applied to all sensitive data fields, including Identity Data and Financial Data.
• Access Controls: Internal access to Member data is granted on a strict need-to-know basis, with role-based permissions enforced through multi-factor authentication for all administrative accounts.
• Regular Security Audits: roma43 conducts internal and third-party security audits at least annually to identify and remediate vulnerabilities. Penetration testing is performed on critical systems twice yearly.
• Firewall and Intrusion Detection: Network perimeter defenses, including firewalls, intrusion detection systems, and DDoS mitigation, are actively monitored 24/7.
• Employee Training: All roma43 staff with access to Personal Data receive mandatory data protection and information security training at onboarding and annually thereafter.

In the event of a data breach that poses a high risk to your rights and freedoms, roma43 will notify affected Members and, where required, the relevant supervisory authority within 72 hours of discovery.

08 Cookies & Tracking Technologies

roma43 uses cookies and similar tracking technologies to enhance platform functionality, remember your preferences, maintain your login session, and analyze usage patterns. By continuing to use the Platform, you consent to the use of cookies as described in this section.

The types of cookies we use are:

• Essential Cookies: Required for core platform functionality, including maintaining your login session, remembering your language preference, and processing transactions. These cookies cannot be disabled without severely impairing your ability to use the Platform.
• Performance Cookies: Collect anonymized information about how you use the Platform, such as which pages are visited most frequently and whether error messages are encountered. This data is used solely for platform optimization and troubleshooting.
• Functionality Cookies: Remember your settings and preferences (such as timezone display — WIB, WITA, or WIT — and preferred bet-slip format) to provide a more personalized experience on return visits.
• Analytics Cookies: Used to measure traffic patterns, understand user behavior, and assess the effectiveness of marketing campaigns. Analytics data is processed in aggregated, de-identified form.

Most browsers allow you to control cookies through settings. If you disable cookies, some features of the Platform may not function correctly, and you may not be able to log in or place wagers. For more information on managing cookies, consult your browser's help documentation.

roma43 does not use third-party advertising cookies or permit external ad networks to track Members across the Platform.

09 Your Data Protection Rights

As a Member of roma43, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact our support team at the email address provided in Section 13:

• Right of Access: You may request a copy of all Personal Data that roma43 holds about you, including Identity Data, Transaction History, and Usage Data. We will provide this in a structured, commonly used, machine-readable format (CSV or JSON) within 30 days of your verified request.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to have it corrected. You can update most data directly through your account settings; for changes to Identity Data (name, date of birth), please contact support with supporting documentation.
• Right to Erasure (Right to be Forgotten): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent for processing that was based on consent. Note that roma43 is required by law to retain certain data (KYC records, transaction history) for a minimum of 5 years; such data will be archived with restricted access until the retention period expires.
• Right to Restriction of Processing: You may request that roma43 suspend processing of your Personal Data (other than storage) where you contest the accuracy of the data, where processing is unlawful but you do not wish erasure, or where roma43 no longer needs the data but you require it for legal claims.
• Right to Data Portability: You may request that roma43 transmit your Personal Data directly to another data controller (where technically feasible) in a structured, machine-readable format.
• Right to Object: You may object to processing of your Personal Data based on roma43's legitimate interests, unless roma43 can demonstrate compelling legitimate grounds that override your interests. You may object to marketing communications at any time by clicking the unsubscribe link in any email or contacting support.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
• Right to Lodge a Complaint: If you believe roma43 has processed your Personal Data in violation of applicable data protection law, you have the right to lodge a complaint with the supervisory authority in the jurisdiction where roma43 is incorporated, or in your country of residence if you are covered by an applicable data protection regime.

roma43 will respond to all data subject requests within 30 days. Where a request is complex or numerous requests have been received, we may extend this period by up to 60 additional days, in which case we will inform you of the extension and the reasons for it.

10 Protection of Minors

roma43 strictly prohibits the use of the Platform by any individual under the age of 21 years. We do not knowingly collect, process, or retain Personal Data from minors. All Members are required to confirm their age at registration, and comprehensive age verification (KYC) is conducted before processing any withdrawal.

If roma43 becomes aware that an account has been registered by an individual under 21, that account will be suspended immediately, all wagers will be voided, and any deposited funds will be refunded to the payment method used (minus any winnings, which will be forfeited). The minor's Personal Data will be securely deleted, except where retention is required by law to document the violation and prevent re-registration.

Parents or guardians who believe a minor has accessed roma43 and provided Personal Data should contact our support team immediately. roma43 cooperates fully with parents and guardians to investigate and resolve such incidents.

11 International Data Transfers

roma43 is operated by an international gaming entity, and Personal Data may be transferred to, stored in, or accessed from countries outside Indonesia, including jurisdictions that may not provide the same level of data protection as Indonesian law. Where such transfers occur, roma43 ensures that appropriate safeguards are in place, including:

• Transfer to countries recognized by international standards bodies as providing adequate data protection;
• Use of Standard Contractual Clauses (SCCs) approved by recognized data protection authorities; or
• Reliance on the recipient's binding corporate rules or certification under recognized data protection frameworks.

All third-party Data Processors handling Member data outside Indonesia are contractually bound to apply data protection standards equivalent to those set out in this Policy. By using the Platform, you acknowledge and consent to these international transfers under the safeguards described above.

12 Policy Amendments

roma43 reserves the right to update or amend this Privacy Policy at any time to reflect changes in data processing practices, legal requirements, or platform features. Where changes are material — meaning they significantly affect how your Personal Data is processed or your rights under this Policy — roma43 will provide advance notice via email to the address registered on your account and via prominent notice on the Platform homepage.

Continued use of the Platform following publication of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree with any changes, you must cease using the Platform and contact support to request account closure and, where applicable, data deletion.

The "Last updated" date at the top of this page indicates the effective date of the most recent version. Members are encouraged to review this page periodically to remain informed of current data practices.

13 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or roma43's data processing practices, please contact our Data Protection team at the following address:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy Enquiry" or "Data Subject Request"
• Response Time: All privacy-related enquiries are acknowledged within 48 hours; full resolution or substantive response is provided within 30 days

When submitting a data subject request (such as a request for access, rectification, or erasure), please include sufficient information for roma43 to verify your identity (your registered email address and account username). We may request additional verification where necessary to protect your data from unauthorized access.

If you believe your privacy rights have been violated and roma43 has not resolved your complaint to your satisfaction, you have the right to lodge a complaint with the supervisory authority responsible for data protection in the jurisdiction where roma43 is incorporated, or in Indonesia if you are covered by Indonesian data protection law.

For general customer support (non-privacy matters), please visit our FAQ page or review our Terms & Conditions.