bar01 Privacy Policy

1 Definitions

The following definitions apply throughout this Privacy Policy:

• "bar01", "we", "us", or "our" refers to the operator of the bar01 Platform, accessible at https://bar01.net and any associated mobile applications or APIs.
• "Platform" refers to the bar01 website, its subdomains, mobile applications, and all gaming, wagering, and account-management services accessible through those channels.
• "Player", "you", or "your" refers to any individual who accesses, registers on, or uses the bar01 Platform in any capacity.
• "Personal Data" means any information relating to an identified or identifiable natural person — including name, date of birth, email address, phone number, payment details, device identifiers, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "KYC" (Know Your Customer) refers to the identity and age verification process required to confirm that a Player meets bar01's eligibility requirements.
• "Cookies" means small text files or similar tracking technologies placed on your device when you visit the Platform.
• "IDR" means Indonesian Rupiah, the currency in which all bar01 balances and transactions are denominated.

2 Data Controller

bar01 is the data controller for all Personal Data collected through the Platform. As data controller, bar01 determines the purposes and means of Processing your Personal Data and is responsible for ensuring that such Processing complies with applicable data protection principles.

If you have any questions or concerns about how bar01 handles your Personal Data, or if you wish to exercise any of your data subject rights, you may contact our dedicated data protection point of contact at [email protected]. Please include "Privacy Request" in the subject line of your message so that our team can route your query promptly.

3 Data We Collect

bar01 collects the following categories of Personal Data, grouped by the context in which they are gathered:

bar01 does not intentionally collect Special Category Data (such as health information, racial or ethnic origin, religious beliefs, or political opinions). If you voluntarily disclose such information in communications with our support team, we will handle it with heightened confidentiality and will not use it for any purpose beyond responding to your query.

4 How We Collect Your Data

bar01 collects Personal Data through the following channels:

• Direct Interactions. You provide Identity Data, Contact Data, and Financial Data when you register an account, complete KYC verification, make a deposit or withdrawal, use live chat, or email our support team.
• Automated Technologies. Technical Data and Usage Data are collected automatically as you browse the Platform. This is done through server logs, session cookies, analytics pixels, and similar tracking technologies described in Section 8.
• Third-Party Payment Providers. When you initiate a deposit or withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja, those providers may share transaction confirmation data with bar01 to reconcile your account balance.
• KYC Verification Partners. bar01 may engage third-party identity verification services to assist in validating government-issued identity documents. These services confirm verification outcomes to bar01; bar01 does not receive or store your raw document scans beyond the period necessary to complete verification.
• Game Content Providers. Third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may share game session data with bar01 to enable accurate wagering records and bonus calculation.
• Fraud Prevention Services. bar01 uses third-party fraud detection and anti-money-laundering screening tools that may cross-reference your data against publicly available watchlists and sanction databases.

5 How We Use Your Data

bar01 uses your Personal Data for the following purposes. Where multiple categories of data are used for a single purpose, the relevant categories are indicated in parentheses:

1. Account Registration and Management. To create and maintain your bar01 Account, authenticate your identity at login, and communicate important account notifications. (Identity, Contact, Technical Data)
2. KYC and Age Verification. To confirm that you are at least 21 years of age and to comply with our anti-money-laundering obligations. (Identity Data)
3. Payment Processing. To process IDR deposits and withdrawals via your chosen Indonesian bank or e-wallet, reconcile your account balance, and maintain accurate financial records. (Financial Data)
4. Gaming Services Delivery. To operate sports betting (including BRI Liga 1, Champions League, EPL, and other markets), live casino, slot games, and all other bar01 products — and to calculate and award winnings and bonuses accurately. (Gaming Activity, Financial Data)
5. Fraud Prevention and Security. To detect, investigate, and prevent unauthorised access, fraud, money laundering, duplicate accounts, and other prohibited conduct. (Identity, Technical, Financial, Gaming Activity Data)
6. Customer Support. To respond to your queries, resolve disputes, and process complaints through our 24/7 support service. (Identity, Contact, Communications Data)
7. Responsible Gaming. To implement and monitor self-exclusion, deposit limits, and cooling-off periods you request, and to identify patterns of gaming behaviour that may indicate harm. (Gaming Activity, Responsible Gaming Data)
8. Regulatory Compliance. To comply with applicable international gaming regulations, data retention obligations, and financial crime prevention requirements. (All categories, as required)
9. Platform Improvement. To analyse aggregate usage patterns, optimise Platform performance, and enhance the overall player experience. (Technical, Usage Data — in anonymised or aggregated form where possible)
10. Marketing Communications. To send you promotional offers, bonus notifications, and seasonal campaign messages (e.g., Idul Fitri, Ramadhan, and Nyepi promotions) where you have given explicit consent or where a legitimate interest applies. You may opt out of marketing communications at any time. (Contact Data)

6 Legal Basis for Processing

bar01 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity. Processing is necessary to perform the contract between you and bar01 — principally the Terms & Conditions you accept at registration — including operating your account, processing payments, and delivering gaming services.
• Legal Obligation. Processing is required for bar01 to comply with applicable laws and regulations, including anti-money-laundering obligations, age verification requirements, and financial record-keeping duties.
• Legitimate Interests. Processing is necessary for bar01's legitimate business interests, including fraud prevention, network security, responsible gaming monitoring, and general platform improvement — provided those interests are not overridden by your fundamental privacy rights.
• Consent. For marketing communications and for certain non-essential cookies, bar01 relies on your freely given, informed, specific consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Data Sharing & Disclosure

bar01 does not sell your Personal Data. We share your data only in the following limited circumstances:

• Payment Service Providers. We share Financial Data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to the extent strictly necessary to process your deposits and withdrawals.
• KYC and Identity Verification Partners. We engage third-party identity verification services that process your Identity Data on bar01's behalf under strict data processing agreements, solely to fulfil our age and identity verification obligations.
• Game Content Providers. Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive game session data necessary to operate their games within the bar01 Platform. These studios are contractually prohibited from using your data for any purpose beyond game delivery.
• Fraud and AML Service Providers. bar01 uses third-party fraud detection and anti-money-laundering screening tools that process limited Personal Data — such as name, transaction patterns, and IP address — to identify and prevent financial crime.
• Regulatory and Law Enforcement Authorities. bar01 will disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to protect bar01's legal rights or the safety of any person.
• Corporate Transactions. In the event of a merger, acquisition, or sale of all or part of bar01's business, your Personal Data may be transferred to the acquiring entity as part of the transaction. You will be notified in advance of any such transfer and of any material change in how your data is processed.

All third parties with whom bar01 shares Personal Data are required to process that data only in accordance with bar01's instructions and applicable data protection standards, and are prohibited from using it for their own independent commercial purposes.

8 Cookies & Tracking Technologies

bar01 uses cookies and similar tracking technologies to operate the Platform securely, remember your preferences, and analyse usage patterns. The following types of cookies are used:

You may manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies will affect Platform functionality. For most modern browsers, cookie management instructions are available in the browser's Help section.

9 Data Retention

bar01 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account and Identity Data. Retained for the duration of your active account, plus a minimum of five years following account closure. This period is required to satisfy anti-money-laundering record-keeping obligations.
• Financial Transaction Records. Retained for a minimum of five years from the date of each transaction, in line with standard financial compliance requirements.
• Gaming Activity Logs. Retained for a minimum of three years from the date of each gaming session, to support dispute resolution and regulatory audit requirements.
• KYC Documents. Retained for the duration of your account and for five years following account closure, or longer where required by the applicable regulatory framework.
• Customer Support Communications. Retained for three years from the date of the last correspondence, to maintain an accurate record of dispute resolution history.
• Technical and Usage Logs. Retained for up to 13 months in identifiable form, after which they may be anonymised and retained indefinitely for aggregate analytics.
• Marketing Consent Records. Retained for the duration of your consent, plus three years thereafter as evidence of the consent given.

When Personal Data is no longer required, bar01 will securely delete it using industry-standard data destruction methods, or anonymise it so that it can no longer be linked to any individual.

10 Your Data Rights

Subject to applicable law, you have the following rights with respect to the Personal Data bar01 holds about you. To exercise any of these rights, please email [email protected] with the subject line "Data Rights Request". bar01 will respond within 30 calendar days of receiving a valid request.

• Right of Access. You have the right to request a copy of the Personal Data bar01 holds about you and to receive information about how it is being processed.
• Right to Rectification. You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. For straightforward corrections (e.g., updating your contact details), you may also do this directly within your Account settings.
• Right to Erasure ("Right to Be Forgotten"). You may request that bar01 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and there are no overriding legitimate grounds. This right is subject to bar01's legal data-retention obligations — we cannot delete data that we are legally required to keep.
• Right to Restrict Processing. You have the right to request that bar01 restrict the processing of your Personal Data in certain circumstances, for example while a rectification request is being resolved.
• Right to Data Portability. Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to request that it be transmitted to another data controller where technically feasible.
• Right to Object. You have the right to object at any time to the processing of your Personal Data where that processing is based on bar01's legitimate interests, including profiling for fraud prevention purposes. bar01 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent. Where bar01 relies on your consent as the legal basis for processing (e.g., for marketing emails), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11 Security Measures

bar01 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure:

• Encryption in Transit. All data transmitted between your device and the bar01 Platform is encrypted using 256-bit TLS (Transport Layer Security). This applies to every page of the Platform, not just payment pages.
• Encryption at Rest. Personal Data stored on bar01's servers — including Identity Data, KYC documents, and Financial Data — is encrypted at rest using AES-256 encryption.
• Payment Tokenisation. Financial credentials processed through BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja are tokenised. bar01 stores only a secure token reference, not your raw account or card number.
• Access Controls. Access to Personal Data within bar01's systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and subject to regular review.
• Two-Factor Authentication. bar01 encourages all Players to enable two-factor authentication on their accounts. Customer-facing 2FA options are available within your Account security settings.
• Penetration Testing. bar01 conducts regular third-party security assessments, including penetration testing of the Platform's infrastructure, to identify and remediate vulnerabilities proactively.
• Data Breach Response. In the unlikely event of a personal data breach that poses a risk to your rights, bar01 will notify you without undue delay and will implement its incident response protocol to contain and remediate the breach.

While bar01 takes every reasonable precaution to secure your data, no online platform can guarantee absolute security. You are responsible for keeping your account credentials confidential. If you believe your account has been compromised, contact us immediately at [email protected].

12 Minors

The bar01 Platform is strictly for adults aged 21 and over. bar01 does not knowingly collect, process, or retain Personal Data belonging to individuals under the age of 21. Age verification is a mandatory step in the registration and KYC process.

If bar01 becomes aware that Personal Data has been collected from an individual under 21, we will promptly close the associated account, delete the data, and return any deposited funds to the payment source from which they originated.

If you are a parent or guardian and you believe that a minor in your care has accessed the bar01 Platform and provided Personal Data, please contact us immediately at [email protected]. We will investigate and take appropriate action within two business days.

13 International Data Transfers

bar01 is an internationally operated platform. Your Personal Data may be transferred to, and processed in, countries other than Indonesia — including the country in which bar01's servers and operational systems are hosted. These countries may have data protection laws that differ from those in Indonesia.

Whenever bar01 transfers Personal Data internationally, we ensure that appropriate safeguards are in place to protect your data. These safeguards may include:

• Contractual clauses that impose data protection obligations on the recipient of the data equivalent to those bar01 itself adheres to.
• Transfers to recipients in jurisdictions that have been assessed as providing an adequate level of data protection for the purposes of bar01's operations.
• Transfer impact assessments conducted for specific high-risk transfer scenarios, with additional technical safeguards applied where necessary.

By using the bar01 Platform and submitting your Personal Data, you acknowledge that your data may be processed in jurisdictions outside Indonesia as described in this section.

14 Amendments to This Policy

bar01 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to the Platform. When material changes are made, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, by sending a notification to your registered email address or displaying an in-Platform alert.

Your continued use of the bar01 Platform after any updated Privacy Policy is published constitutes your acknowledgment of the changes. If you do not accept the revised Privacy Policy, you must cease using the Platform and may request account closure in accordance with the Terms & Conditions.

We encourage you to review this page periodically to remain informed about how bar01 protects your Personal Data.

15 Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact bar01 through the following channels:

• Email: [email protected] — please use "Privacy Request" or "Data Rights Request" in the subject line.
• Live Chat: Available 24/7 inside your bar01 Account dashboard. Indonesian-speaking agents are available during peak WIB evening hours (18:00–24:00 WIB).
• Response Time: bar01 aims to acknowledge all privacy-related queries within 24 hours and to provide a substantive response within 30 calendar days of receiving a valid, complete request.

If you are not satisfied with bar01's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority in the jurisdiction governing bar01's operations.