h5loby Privacy Policy

1Definitions

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "h5loby," "we," "us," or "our" — the operator of the online casino and sportsbook platform accessible at https://h5loby.app.
• "Platform" — the h5loby website, all associated subdomains, mobile browser interfaces, and any related digital services.
• "Member" or "you" — any individual who has registered an account on h5loby, or who browses the Platform without registration.
• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, directly or indirectly. This includes names, email addresses, phone numbers, bank account details, device identifiers, and IP addresses.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof.
• "Controller" — the entity that determines the purposes and means of processing Personal Data. h5loby acts as the Controller for all data collected through the Platform.
• "Processor" — a third party that processes Personal Data on behalf of h5loby and under h5loby's documented instructions.
• "KYC" — Know Your Customer; the identity and age verification procedures required for regulatory compliance and account security.
• "Cookie" — a small text file placed on your device by the Platform to store session information, preferences, and behavioural data for analytics and functionality purposes.

2Scope & Application

This Privacy Policy applies to all Personal Data collected by h5loby in connection with the operation of the Platform, including data collected from registered Members, prospective Members who have initiated but not completed registration, and unregistered visitors who browse the Platform.

This Policy applies regardless of the device or browser used to access h5loby. It covers data collected through the website interface, through customer support interactions (including live chat and email correspondence), through payment processing, and through any promotional communications sent by h5loby.

This Policy does not apply to third-party websites, payment processors, or game studios whose services are accessible from or integrated into the h5loby Platform. Those third parties maintain their own independent privacy policies, and h5loby is not responsible for their data practices.

3Data We Collect

h5loby collects Personal Data across the following categories, depending on how you interact with the Platform:

3.1 Registration and Account Data

When you create a h5loby account, we collect: your chosen username, email address, date of birth, and any other fields completed during the registration process. This is the minimum data required to create and maintain a functional account.

3.2 Identity Verification (KYC) Data

To comply with our anti-money-laundering (AML) and age verification obligations, we may collect copies of government-issued identity documents (such as a KTP, SIM, or passport), proof of address, and evidence of the payment method used. KYC data is processed with heightened security controls and is never used for marketing purposes.

3.3 Financial and Transaction Data

We collect records of all deposit and withdrawal transactions conducted through your h5loby account, including the payment method used (such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja), transaction amounts in Indonesian Rupiah (IDR), timestamps, and transaction reference numbers. Full bank account numbers and e-wallet credentials are not stored on h5loby's servers; payment processing is handled by certified third-party payment processors.

3.4 Gaming and Betting Activity Data

We maintain records of all bets placed, games played, outcomes, session durations, and wagering history associated with your account. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance.

3.5 Technical and Device Data

When you access the Platform, we automatically collect: your IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, time spent on each page, and click-path data. This data is collected through server logs and tracking technologies including cookies.

3.6 Communication Data

We retain records of all communications between you and h5loby, including live chat transcripts, email correspondence, and any documentation you submit in connection with a query, complaint, or support request.

3.7 Marketing Preference Data

Where you have opted in to receive promotional communications from h5loby, we store your contact details and marketing preference settings. You may update or withdraw your marketing consent at any time through your account settings.

4How We Collect Data

h5loby collects Personal Data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or opt in to marketing communications.
• Automatically through the Platform — via server logs, cookies, web beacons, and similar tracking technologies that operate when you browse or interact with any page on the h5loby Platform.
• From payment service providers — transaction confirmation data is received from our certified payment partners (including local Indonesian bank transfer gateways and e-wallet operators) when you deposit or withdraw funds.
• From identity verification services — where h5loby uses a third-party KYC service provider to validate the authenticity of identity documents submitted by Members.
• From fraud prevention and analytics partners — aggregated or pseudonymised data from third-party fraud detection tools that help h5loby identify suspicious account activity and protect the integrity of the Platform.

5Purposes of Processing

h5loby processes Personal Data only for defined, documented purposes. The principal purposes for which we process your data are as follows:

• Account management: creating, maintaining, and securing your h5loby account throughout your membership.
• Service delivery: enabling access to all games, betting markets, promotions, and features available on the Platform.
• Payment processing: facilitating deposits and withdrawals in Indonesian Rupiah via supported local payment channels including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Identity and age verification: confirming that all Members are at least 21 years of age and that account details are genuine, in compliance with our anti-fraud and AML obligations.
• Responsible gaming: monitoring gaming patterns to identify Members who may be at risk of problem gambling and to enforce self-imposed limits, cooling-off periods, or self-exclusion requests.
• Legal and regulatory compliance: meeting all applicable obligations under international gaming regulations, anti-money-laundering legislation, and data protection law.
• Fraud prevention and platform security: detecting and preventing unauthorised access, account takeover, multi-accounting, bonus abuse, and other forms of prohibited conduct.
• Customer support: responding to queries, resolving disputes, and providing assistance through live chat and email channels.
• Marketing communications: sending promotional offers, bonus notifications, and platform updates to Members who have opted in to receive such communications.
• Platform analytics and improvement: analysing aggregated usage data to improve the design, performance, and content of the h5loby Platform.

6Legal Bases for Processing

h5loby processes Personal Data on the following legal bases:

• Contractual necessity: processing is necessary to perform the contract between h5loby and the Member — including account creation, game access, and payment processing.
• Legal obligation: processing is required to comply with applicable law, including AML regulations, identity verification requirements, and gaming licence conditions.
• Legitimate interests: processing is necessary for h5loby's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and improving our Services — provided those interests are not overridden by your fundamental rights.
• Consent: where processing is based on consent (primarily marketing communications), you may withdraw consent at any time through your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

7Data Sharing & Disclosure

h5loby does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We may share Personal Data with third parties only in the following limited circumstances:

7.1 Service Providers and Processors

h5loby engages third-party service providers who process Personal Data on our behalf and under our instructions. These include payment processing partners (such as local Indonesian bank gateway providers and e-wallet operators), KYC verification services, cloud hosting and infrastructure providers, customer support platform vendors, fraud detection and analytics tools, and marketing communication platforms. All Processors are subject to contractual data protection obligations and are prohibited from using your data for any purpose outside the scope of their engagement with h5loby.

7.2 Game Content Providers

Game studios and content providers integrated into the h5loby Platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive session-level data (such as a pseudonymous player ID, bet amounts, and game outcomes) required to operate their games. These providers are not provided with your full account profile, KYC documents, or financial account details.

7.3 Regulatory and Law Enforcement Authorities

h5loby may be required by applicable law, court order, or regulatory authority to disclose Personal Data to competent government bodies, financial intelligence units, or law enforcement agencies. Where permitted by law, h5loby will notify affected Members of any such disclosure request. Where notification is legally prohibited, h5loby will comply with the applicable legal process without prior Member notice.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of h5loby's business, Personal Data held by h5loby may be transferred to the acquiring or successor entity. Members will be notified of any such transfer and the applicable privacy terms of the acquiring entity prior to any change in the processing of their data.

8International Data Transfers

h5loby's platform infrastructure and some of its third-party service providers operate outside of Indonesia. Where Personal Data is transferred to a country that does not provide a level of data protection equivalent to that applicable in Indonesia, h5loby implements appropriate safeguards, which may include standard contractual clauses, data processing agreements with binding data protection obligations, or transfers to jurisdictions with recognised adequacy frameworks.

By using the h5loby Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside your country of residence, including countries in Southeast Asia, Europe, and other international locations where h5loby's infrastructure partners operate.

9Data Retention

h5loby retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. Our general retention approach is as follows:

• Account and transaction data: retained for a minimum of 5 years following account closure, in compliance with AML and gaming regulatory record-keeping requirements.
• KYC documents: retained for a minimum of 5 years following the completion of the KYC process or account closure, whichever is later.
• Gaming and betting history: retained for the duration of active membership and for 5 years following account closure for dispute resolution and regulatory purposes.
• Customer support communications: retained for 3 years from the date of the most recent interaction, or longer if the communication relates to an unresolved dispute or regulatory matter.
• Marketing data: retained until you withdraw consent or request erasure, subject to any overriding legal retention obligations.
• Technical and device data (logs): typically retained for 12 months, unless a longer retention period is required for security or fraud investigation purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to an individual. Anonymised or aggregated data may be retained indefinitely for analytics and platform improvement purposes.

10Cookies & Tracking Technologies

10.1 Types of Cookies Used

h5loby uses the following categories of cookies and similar tracking technologies on the Platform:

• Strictly necessary cookies: required for core Platform functionality, including session authentication, load balancing, and security token management. These cannot be disabled.
• Functional cookies: remember your preferences (such as language settings and display options) to personalise your experience.
• Analytics cookies: collect aggregated, pseudonymised data on how Members use the Platform, including pages visited and navigation paths, to help h5loby improve performance and content.
• Security and fraud prevention cookies: assist in identifying unusual browsing patterns, device fingerprinting anomalies, and potential bot activity.

10.2 Managing Cookies

You may control cookie settings through your browser's privacy settings. Disabling non-essential cookies will not prevent you from accessing the Platform, but may limit certain personalisation features. Strictly necessary cookies cannot be disabled without impairing core Platform functionality. Please note that h5loby does not use third-party advertising or retargeting cookies.

11Security Measures

h5loby applies a layered approach to data security, combining technical, organisational, and procedural controls to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and h5loby's servers.
• Encrypted storage for sensitive data at rest, including KYC documents and financial records, using AES-256 encryption.
• Bcrypt password hashing — passwords are never stored in plain text and are salted and hashed using a one-way cryptographic function.
• Two-factor authentication (2FA) available to all Members as an additional layer of login security.
• Role-based access controls ensuring that h5loby staff can only access the data categories necessary for their specific role.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Automated anomaly detection systems that flag unusual login patterns, rapid successive transactions, and other indicators of account compromise.
• Incident response procedures — in the event of a data breach that poses a risk to your rights and freedoms, h5loby will notify affected Members and relevant authorities within the timeframes required by applicable law.

Despite our extensive security measures, no online platform can guarantee absolute security against all possible threats. You are encouraged to use a strong, unique password for your h5loby account and to enable 2FA to further protect your account.

12Your Privacy Rights

As a Member of h5loby, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact our support team via live chat or at the email address provided in Section 16.

• Right of Access: you may request a copy of all Personal Data held by h5loby about you, along with information about how it is used and with whom it has been shared.
• Right to Rectification: if any Personal Data held by h5loby is inaccurate or incomplete, you have the right to request that it be corrected.
• Right to Erasure ("Right to be Forgotten"): you may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Please note that h5loby may be required to retain certain data under applicable AML and gaming regulatory obligations even following a deletion request.
• Right to Restrict Processing: you may request that h5loby limit the processing of your Personal Data while a query regarding its accuracy or lawfulness is being resolved.
• Right to Data Portability: you may request that Personal Data provided by you to h5loby be delivered to you in a structured, machine-readable format.
• Right to Object: you may object to the processing of your Personal Data where h5loby relies on legitimate interests as the legal basis, particularly in relation to marketing communications and analytics profiling.
• Right to Withdraw Consent: where processing is based on your consent (primarily marketing), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

h5loby will respond to all data rights requests within 30 days of receipt. Where a request is complex or numerous, the response period may be extended by a further 60 days, with written notification of the extension provided within the initial 30-day period.

13Children's Privacy

h5loby is strictly an adult platform. We do not knowingly collect Personal Data from any person under the age of 21. Our registration process includes an age declaration, and identity verification procedures are applied to confirm that all Members meet the minimum age requirement before withdrawal privileges are activated.

If h5loby becomes aware that Personal Data has been collected from an individual under the age of 21 — whether through registration misrepresentation or any other means — the relevant account will be immediately suspended, all associated balances will be voided, and any collected data will be deleted in accordance with applicable law. If you believe a minor has registered on h5loby, please report this to our support team immediately.

14Third-Party Links & Integrations

The h5loby Platform integrates with third-party game studios, payment processors, and analytics tools. While h5loby carefully vets its third-party partners and imposes contractual data protection obligations on all Processors, h5loby is not responsible for the privacy practices or the content of any third-party service.

Game studios such as Pragmatic Play, Evolution Gaming, and NetEnt operate under their own privacy frameworks in connection with the data they receive from game sessions. Payment processors such as local bank gateway operators and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) are independently regulated and maintain their own privacy and security standards. h5loby encourages Members to review the privacy policies of any third-party service they interact with.

15Policy Amendments

h5loby reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the scope of our Services. When material changes are made, h5loby will publish the revised Policy on this page with an updated effective date and, where appropriate, notify registered Members via email or in-platform notification.

Your continued use of the h5loby Platform following the publication of a revised Privacy Policy constitutes your acknowledgment of the updated terms. We encourage you to review this page periodically. If you object to any change in this Policy, you should cease using the Platform and contact our support team to request account closure.

16Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about h5loby's data practices, please contact our Data Protection team through the following channels:

• Support Email: [email protected] — plain text, not a clickable link.
• Live Chat: available 24 hours a day, 7 days a week directly on the h5loby Platform. Our support team includes native Indonesian-speaking agents who can assist in both English and Indonesian.
• Response Time: h5loby aims to acknowledge all privacy-related requests within 3 business days and to respond substantively within 30 calendar days.

If you are not satisfied with h5loby's response to a privacy concern, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For Members located in Indonesia, this may include reporting to the Ministry of Communication and Information Technology (Kementerian Komunikasi dan Informatika) or any successor body with data protection oversight responsibilities under applicable Indonesian law.