ns221 Privacy Policy

ns221 operates an internationally licensed online gaming platform that serves English-preference players across Indonesia. As a platform that handles real-money transactions, identity verification, and gaming activity data, we recognise that responsible data stewardship is inseparable from the trust our players place in us.

This Privacy Policy sets out in clear, plain English how ns221 collects, uses, stores, shares, and protects the personal data of every individual who accesses or registers on the Platform — whether you are browsing from Jakarta, Surabaya, Bandung, Bali, Medan, or anywhere else across the Indonesian archipelago.

ns221 acts as the data controller in respect of personal data collected directly through the Platform. Where we engage third-party service providers to process data on our behalf, those parties act as data processors and are bound by contractual obligations that reflect the standards set out in this Policy.

If you have questions about any aspect of this Policy before registering an Account, please contact us at the details provided in Section 14. We are committed to transparency and will respond to all privacy inquiries within five business days.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to a name, identification number, location data, online identifier, or factors specific to the physical, economic, or social identity of that person.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" means ns221, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of ns221 in accordance with documented instructions.
• "Account" means the registered user profile created by a Player on the ns221 Platform.
• "Player" means any individual who has registered an Account on the Platform and is at least 21 years of age.
• "KYC" means Know Your Customer — the identity and age verification procedures applied by ns221 in compliance with its international gaming licensing obligations.
• "Cookies" means small text files placed on a user's device by a website to store session information, preferences, and analytical data.
• "Platform" means the ns221 website at https://ns221.vip, including all sub-pages, gaming interfaces, and customer support systems.

ns221 collects only the Personal Data that is necessary to provide, secure, and improve the Platform and its services. The categories of data we collect are described below:

3.1 Registration & Identity Data

This data is collected when you create an Account on the Platform. It is used to establish your identity, verify your age (21+), and enable us to communicate with you about your Account. You are required to provide accurate and current information at all times; inaccurate registration data may result in Account suspension.

3.2 KYC Verification Documents

KYC documents are requested prior to processing your first withdrawal or where our compliance obligations require enhanced due diligence. These documents are processed solely for identity verification and anti-money-laundering (AML) compliance purposes and are stored in encrypted form.

3.3 Financial Transaction Data

All transactions are denominated in Indonesian Rupiah (IDR). ns221 records the details of every deposit and withdrawal processed through approved Indonesian payment channels including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja. Transaction data is retained for the period required by our licensing obligations.

3.4 Gaming Activity Data

We record your gaming activity on the Platform — including bets placed across sportsbook markets (such as BRI Liga 1, EPL, Champions League, and MotoGP Mandalika), slot and RNG game sessions, live casino rounds, poker tournament participation, and bonus redemption history. This data is used to operate the Platform, detect fraud, and fulfil our responsible gaming obligations.

3.5 Technical & Device Data

Technical data is collected automatically when you access the Platform and is used for security monitoring, fraud prevention, and platform performance analysis. IP addresses are used to detect access from jurisdictions where the Platform may not be available and to identify suspicious login patterns.

3.6 Communications Data

When you contact ns221 customer support — via live chat, email, or any other channel — we record the content of those communications, including your Account details, the nature of your inquiry, and the resolution provided. This data is retained for quality assurance, dispute resolution, and regulatory audit purposes.

ns221 collects Personal Data through the following channels and mechanisms:

• Directly from you — when you register an Account, complete the KYC process, make a deposit or withdrawal, contact customer support, or participate in a promotion.
• Automatically via the Platform — through cookies, session tokens, server logs, and analytics tools that record your interaction with the Platform's pages, game interfaces, and navigation elements.
• From payment processors — Indonesian bank transfer confirmations and e-wallet transaction confirmations (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) may return transaction status and reference data to ns221's payment gateway.
• From identity verification partners — third-party KYC service providers may return a verification status (pass / fail / refer) and risk signals to ns221. ns221 does not receive raw document data directly from these providers beyond what you submitted.
• From fraud detection systems — automated risk-scoring tools may flag device fingerprints, IP velocity patterns, or unusual betting sequences for manual review by the ns221 compliance team.

ns221 uses the Personal Data it collects for the following purposes:

ns221 processes Personal Data only where a valid legal basis exists. The four legal bases on which we rely are described below:

• Contractual necessity: Processing is required to perform the contract between ns221 and the Player — for example, to operate an Account, execute a deposit, or deliver a gaming session. Without this processing, ns221 cannot provide its services.
• Legal obligation: Processing is required to comply with ns221's obligations under its international gaming license — including KYC verification, AML transaction monitoring, responsible gaming interventions, and regulatory reporting.
• Legitimate interest: Processing is necessary for ns221's legitimate business interests, such as preventing fraud, securing the Platform, improving service quality, and detecting multi-accounting — provided those interests are not overridden by the Player's fundamental rights and freedoms.
• Consent: Where processing is not covered by the above three bases — principally for optional marketing communications and certain non-essential cookies — ns221 will seek your explicit consent before processing. You may withdraw consent at any time without affecting previously lawful processing.

ns221 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share data only in the circumstances described below, and only to the minimum extent necessary for each purpose:

7.1 Payment Processors

To process deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), ns221 shares the transaction amount, Account reference, and beneficiary bank details with the relevant payment gateway. These processors are contractually prohibited from using your data for any purpose other than completing the transaction.

7.2 KYC & Identity Verification Providers

KYC documents submitted by Players are processed by ns221's contracted identity verification partners. These partners operate under strict data processing agreements and are not permitted to retain your documents beyond the verification window or to use them for any unrelated purpose.

7.3 Game Studios & Platform Providers

Third-party game studios — including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft — receive session tokens and game-round identifiers to deliver their game content. These studios do not receive your full Personal Data profile; only the minimum data required to authenticate and operate a game session is transmitted.

7.4 Regulatory & Law Enforcement Authorities

ns221 may disclose Personal Data to regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or the terms of its international gaming license. ns221 will notify you of such disclosures where legally permitted to do so.

7.5 Professional Advisors

ns221's legal counsel, auditors, and compliance consultants may access Personal Data on a strictly need-to-know basis for the purpose of providing professional advice. All such advisors are bound by professional confidentiality obligations.

The ns221 Platform uses cookies and similar tracking technologies to operate core Platform functionality, maintain session state, and — where you have consented — to analyse Platform performance. The cookies used by ns221 fall into the following categories:

You may manage your cookie preferences at any time via your browser settings. Disabling strictly necessary cookies will prevent core Platform functionality from operating correctly and may result in your session being terminated. Disabling analytical cookies has no effect on your ability to use the Platform.

ns221 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and licensing obligations, and to resolve disputes. The following retention periods apply as a general framework:

• Account and registration data: Retained for the duration of the Account and for a minimum of five years following Account closure, in accordance with AML record-keeping requirements under ns221's international gaming license.
• KYC documents: Retained for a minimum of five years from the date of verification or Account closure, whichever is later. Documents are stored in encrypted form and access is restricted to authorised compliance personnel.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction in compliance with financial record-keeping standards.
• Gaming activity logs: Retained for a minimum of three years following Account closure for regulatory audit and responsible gaming review purposes.
• Communications data (support tickets, chat logs): Retained for a minimum of two years from the date of the communication for quality assurance and dispute resolution purposes.
• Technical and device data: Retained for up to 12 months from collection for security monitoring purposes, after which it is aggregated or deleted.
• Marketing consent records: Retained for the lifetime of the Account plus two years to evidence the consent basis for any marketing communications sent.

Where a legal hold is in place — for example, where data is relevant to ongoing litigation or a regulatory investigation — the standard retention periods above are suspended until the hold is lifted.

ns221 implements a multi-layered technical and organisational security programme to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption across all data transmissions between your browser and the ns221 Platform. All pages are served exclusively over HTTPS.
• Encryption at rest for all KYC documents, financial records, and Account credentials stored in ns221's data infrastructure.
• Segregated player funds — your IDR balance is held in accounts that are operationally separated from ns221's own business funds, ensuring that Platform financial difficulties do not affect player balances.
• Access controls — internal access to Personal Data is restricted on a strict need-to-know basis. All staff with access to Player data undergo background screening and receive regular data security training.
• Intrusion detection and monitoring — ns221's infrastructure is subject to 24/7 automated security monitoring. Anomalous access patterns trigger immediate alerts to the security team.
• Regular penetration testing — ns221 commissions independent security assessments of its Platform infrastructure on a periodic basis.
• Incident response — in the event of a confirmed personal data breach that is likely to result in a risk to Player rights, ns221 will notify affected Players and the relevant regulatory authority within the timeframes prescribed by applicable law.

As a Player whose Personal Data is processed by ns221, you hold the following rights in relation to your data. To exercise any of these rights, contact ns221 at [email protected] with the subject line "Privacy Rights Request" and include your Account username and a description of your request. ns221 will acknowledge your request within 5 business days and provide a substantive response within 30 days.

• Right of Access: You may request a copy of the Personal Data ns221 holds about you, together with information about how it is used and with whom it is shared. ns221 will provide this in a structured, commonly used format.
• Right to Rectification: If any Personal Data ns221 holds about you is inaccurate or incomplete, you have the right to request its correction. You may update most registration data directly via your Account settings panel.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no other legal basis applies. Note that ns221 is required to retain certain data (KYC records, transaction logs) for minimum statutory periods, which may limit the scope of erasure.
• Right to Restrict Processing: You may request that ns221 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested or while an objection to processing is being considered.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that ns221 provide your Personal Data in a machine-readable format suitable for transfer to another service provider.
• Right to Object: You may object to processing based on ns221's legitimate interests at any time. ns221 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing emails), you may withdraw that consent at any time via your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

ns221 will not charge a fee for processing a privacy rights request in the vast majority of cases. Where a request is manifestly unfounded or excessive (e.g., identical repeated requests within a short period), ns221 reserves the right to charge a reasonable administrative fee or to decline to act on the request, with written reasons provided.

The ns221 Platform is strictly for adults aged 21 and over. ns221 does not knowingly collect Personal Data from any individual under the age of 21. Registration on the Platform requires confirmation that you are at least 21 years of age, and ns221's KYC verification process is designed to detect and prevent access by minors.

If ns221 becomes aware that Personal Data has been collected from a person under 21 years of age without verified parental consent, it will take immediate steps to delete that data and close the associated Account. Any funds deposited by a minor will be returned to the originating payment method following identity verification.

If you are a parent or guardian and believe that your child has registered on the ns221 Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action within 24 hours of receiving your report.

ns221 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our licensing obligations, or the way in which we operate the Platform. Where changes are material — for example, a change to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — ns221 will provide at least 14 days' advance notice via the Platform and/or registered email before the amended Policy takes effect.

The "Last updated" date displayed at the top of this page always reflects the most recently published version. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should cease using the Platform and may request Account closure in accordance with the ns221 Terms & Conditions.

We encourage all Players to review this Privacy Policy periodically to stay informed about how ns221 is protecting their data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ns221 handles your Personal Data, please contact the ns221 Data Privacy team through any of the following channels:

• Email: [email protected] — use the subject line "Privacy Rights Request" for formal data subject requests
• Live Chat: Available 24/7 via the live chat widget within the Platform for registered Players, staffed by native Indonesian-speaking agents
• Response Time: ns221 acknowledges all privacy inquiries within 5 business days and provides a substantive response within 30 calendar days
• Operating Hours: Customer support is available around the clock across WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones