Privacy Policy

This Privacy Policy applies to all personal data processed by diva55 in connection with the operation of the online gaming platform accessible at https://diva55.pro (the "Platform"). It governs data collected from Members, prospective Members, visitors who browse the Platform without registering, and any individual who contacts diva55 through any support channel.

For the purposes of applicable data protection law, diva55 acts as the data controller in respect of all personal data processed under this policy. If you have questions about how diva55 handles your data, or if you wish to exercise any of your data subject rights, please contact us at the address set out in Section 15 of this document.

This Privacy Policy should be read alongside the Terms & Conditions and the Responsible Gaming Policy, which together form the complete legal framework governing your relationship with diva55. By registering an account or using any aspect of the Platform, you confirm that you have read and understood this Privacy Policy.

diva55 collects personal data that is necessary to operate a safe, compliant, and high-quality gaming platform. The categories of personal data we process are described in the table below.

diva55 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data (other than identity document photos used for KYC), or health data, except where a Member voluntarily discloses a health-related context in connection with a responsible gaming request — in which case the data is processed solely to facilitate the appropriate support.

diva55 collects personal data through the following channels:

• Direct submission: Information you provide when completing the account registration form, submitting KYC documents, making a deposit or withdrawal request, contacting our support team, or responding to a promotional survey.
• Automated collection: Technical and gaming data collected automatically as you interact with the Platform, including IP address logging, session tracking, and game-engine event recording. This data is collected whether or not you are a registered Member.
• Third-party sources: Identity verification data returned by our KYC service providers; fraud-risk scores from fraud-prevention partners; payment confirmation data from our payment processing partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja).
• Cookies and similar technologies: Data collected via cookies, web beacons, and local storage as described in Section 10 of this policy.

diva55 processes your personal data on the following legal grounds, as applicable to each processing activity:

• Contractual necessity: Processing required to fulfill our obligations under the Terms & Conditions, including account management, payment processing, KYC verification, and game outcome recording.
• Legal obligation: Processing required to comply with applicable gaming regulations, anti-money-laundering (AML) obligations, and fraud-prevention requirements imposed by our licensing jurisdiction.
• Legitimate interests: Processing carried out for purposes that are in diva55's legitimate business interests and are not overridden by your rights — including platform security, fraud detection, responsible gaming monitoring, and service improvement analytics.
• Consent: Processing activities for which diva55 relies on your freely given, specific, informed consent — principally, the sending of marketing communications and the use of non-essential cookies. You may withdraw consent for these activities at any time without affecting the lawfulness of prior processing.

diva55 uses the personal data it collects strictly for the following defined purposes:

1. Account creation and management: Setting up and maintaining your diva55 Member Account, authenticating your identity at login, and managing account preferences and security settings.
2. Payment processing: Facilitating deposits and withdrawals via Indonesian local banks and e-wallets including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja. All transaction amounts are recorded in IDR.
3. KYC and age verification: Verifying that you are at least 21 years of age and that you are the legitimate owner of the payment methods registered to your account, in line with our responsible gaming commitments and compliance obligations.
4. Gaming services: Delivering casino games, live dealer tables, sports betting markets, online poker, and slot titles; recording game outcomes; administering bonuses; and resolving disputes.
5. Fraud prevention and security: Detecting and investigating suspicious activity, unauthorized account access, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
6. Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behavior; enforcing deposit limits, cool-off periods, and self-exclusion requests; and flagging accounts for welfare review where indicators of harm are present.
7. Customer support: Responding to queries, complaints, and responsible gaming requests through our 24/7 live chat and email channels.
8. Marketing and promotions: Sending promotional emails, platform notifications, and personalized bonus offers to Members who have opted in to receive marketing communications. You can unsubscribe at any time via the link in any marketing email or by contacting support.
9. Platform improvement: Analyzing aggregated, anonymized usage data to improve the user experience, optimize game loading performance, and refine our responsible gaming tools.
10. Legal and regulatory compliance: Retaining records as required by our licensing obligations, responding to lawful requests from regulatory authorities, and enforcing our contractual rights.

diva55 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. Data sharing is limited to the following categories of recipients, each of whom is bound by contractual data processing obligations and applicable data protection standards:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja receive transaction-level data necessary to process your deposits and withdrawals. These parties operate under their own privacy policies and banking-sector regulations.
• Identity verification providers: Our KYC partner receives your identity documents and returns a verification result. KYC data is not retained by the provider beyond the verification process.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe receive pseudonymous session identifiers to deliver game content and record round outcomes. They do not receive your full identity data.
• Fraud prevention and AML partners: Fraud-risk scoring services receive IP addresses, device fingerprints, and transaction metadata in pseudonymized form to assess risk signals.
• Cloud infrastructure and hosting providers: diva55's platform infrastructure is hosted on enterprise-grade cloud services. These providers process data solely on diva55's instructions and are contractually prohibited from accessing or using Member data for their own purposes.
• Regulatory and law enforcement authorities: diva55 will disclose personal data to competent authorities when required to do so by a lawful order, court order, or statutory obligation. Where permitted, diva55 will notify the affected Member of such disclosure.

Because diva55 operates as an internationally licensed gaming platform, some of the third-party service providers described in Section 6 may be located outside Indonesia. Where personal data is transferred to a country that does not offer a level of data protection equivalent to Indonesian standards, diva55 implements appropriate safeguards, including:

• Contractual clauses that impose data protection obligations on the receiving party equivalent to those that apply within Indonesia;
• Data processing agreements that restrict the recipient's use of the transferred data to the specific, defined purpose for which it was disclosed;
• Technical controls, including encryption in transit and at rest, to protect data integrity during international transfer.

diva55 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable regulatory and licensing obligations. The following retention schedule applies:

When data reaches the end of its retention period, it is securely deleted or anonymized in accordance with diva55's internal data destruction procedures. Anonymized, aggregated data (from which no individual can be identified) may be retained indefinitely for platform analytics purposes.

diva55 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our core security controls include:

• Encryption in transit: All data exchanged between your device and the diva55 platform is protected by TLS 1.2 or higher (SSL encryption). The padlock indicator in your browser confirms an active encrypted connection.
• Encryption at rest: Sensitive data stored in diva55 databases — including passwords (stored only as salted hashes), financial records, and KYC documents — is encrypted using AES-256 or equivalent standards.
• Access controls: Access to production systems containing Member data is restricted to authorized personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
• Penetration testing: diva55 conducts periodic security assessments and penetration tests conducted by independent third-party security firms to identify and remediate vulnerabilities.
• Incident response: diva55 maintains a documented data breach response procedure. In the event of a confirmed personal data breach that poses a risk to Members, affected individuals will be notified promptly and remediation steps communicated transparently.

diva55 uses cookies and similar technologies (web beacons, local storage, session tokens) to operate the Platform securely, remember your preferences, and analyze usage patterns. Cookies are small data files placed on your device when you visit the Platform.

You can manage cookie preferences at any time through your account settings panel or by adjusting your browser settings to block or delete cookies. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform.

As a data subject, you hold meaningful rights over your personal data held by diva55. The following rights are available to all Members and platform visitors:

To exercise any of the above rights, contact our support team via email at [email protected] with the subject line "Data Subject Request". We will acknowledge your request within 72 hours and respond substantively within 30 calendar days. In cases of complexity or high volume, we may extend this period by a further 30 days, in which case we will notify you of the extension in advance.

We may need to verify your identity before actioning a data subject request. This is a security measure to ensure that personal data is not disclosed to an unauthorized party, and is not a means to delay or obstruct your request.

diva55 is strictly an adult gaming platform. You must be at least 21 years of age to register an account or use any of the Services. diva55 does not knowingly collect personal data from individuals under the age of 21.

If diva55 determines — through KYC review, age verification checks, or any other means — that an account has been registered by a person under 21, the account will be immediately suspended, all activity will cease, the collected personal data will be securely deleted in accordance with our data destruction procedures, and any deposited funds will be returned to the source payment method after completion of a mandatory compliance review.

The diva55 Platform does not contain links to external third-party websites as a matter of policy. However, game content delivered by third-party studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe, and others) is embedded within the Platform via iframes or API integrations. These studios operate under their own data privacy frameworks.

The personal data shared with game studios is limited to pseudonymous session identifiers sufficient to load the game and record the round result. Full identity data is never passed to game studios. For details of how individual game studios handle session data, please refer to their respective published privacy documentation.

diva55 is not responsible for the privacy practices of any third-party studio or payment provider. We recommend reviewing their privacy policies where relevant to your use of those services.

diva55 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, diva55 will notify Members via a prominent notice on the Platform homepage, an in-account notification, or an email to the registered email address — whichever is most appropriate given the nature of the change.

The "Last Updated" date at the top of this document reflects the date on which the most recent material revision was made. Your continued use of the diva55 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not agree with any change to this policy, you should cease using the Platform and contact our support team to arrange account closure and a data subject erasure request if applicable.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or want to raise a data-related complaint, please contact our Data Protection team using the details below:

If you are dissatisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant supervisory authority in your jurisdiction or to the data protection authority in diva55's licensing jurisdiction. Contact details for these authorities are available upon request from our support team.