Privacy Policy

1 Overview & Scope

This Privacy Policy describes how dana54 ("we", "us", "our") collects, processes, stores, and discloses personal data in connection with the operation of the dana54 online gaming Platform, accessible at dana54.app. It applies to all registered Members, prospective Members who interact with the Platform without completing registration, and any visitor who accesses the dana54 website.

dana54 operates under an international gaming license and serves players principally located in Indonesia. Our data handling practices are designed to meet the standards of internationally recognised data protection frameworks, and to respect the privacy expectations of Indonesian players and consumers.

This Policy applies to personal data collected through all channels by which Members interact with dana54, including:

• The dana54.app website and any associated mobile-optimised URLs.
• Email, live chat, and WhatsApp communications with dana54 support staff.
• Payment processing interactions with dana54's integrated local bank and e-wallet partners.
• Promotional and marketing communications sent by dana54 to opted-in Members.

This Policy does not cover third-party websites, game studios, or payment providers whose own privacy policies govern the data they independently collect. Where dana54 embeds third-party content — such as live dealer game streams from Evolution Gaming or Pragmatic Play Live — the relevant third party's privacy notice also applies to data processed within that embedded environment.

2 Definitions

The following defined terms are used consistently throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, date of birth, national identity number, contact details, financial account details, IP address, device identifiers, and betting activity records.
• "Processing" — any operation performed on Personal Data, including collection, recording, organisation, storage, retrieval, use, disclosure, erasure, or destruction, whether or not by automated means.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. For the purposes of this Policy, dana54 acts as Data Controller in respect of all Member Personal Data collected through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of and under the instruction of the Data Controller (e.g., dana54's payment processing partners, cloud infrastructure providers).
• "Member" — any registered user of the dana54 Platform who has completed the Account registration process and whose Account has been approved.
• "KYC" (Know Your Customer) — the identity and age-verification process conducted by dana54 in accordance with its licensing and responsible gaming obligations.
• "Sensitive Data" — a subset of Personal Data requiring enhanced protection, including data revealing political opinions, religious beliefs, health information, biometric data, or data specifically relating to a person's financial circumstances beyond standard account balance information.

3 Data We Collect

dana54 collects Personal Data in two principal ways: data you provide directly, and data collected automatically through your use of the Platform.

Data you provide directly:

Data collected automatically:

4 How We Use Your Data

dana54 uses Personal Data collected from Members strictly for the purposes listed below. We do not use your data for any purpose that is incompatible with these stated purposes without obtaining your prior consent:

• Account management: Creating, maintaining, and administering your dana54 Account, including processing login authentication, password resets, and account preference changes.
• Service delivery: Processing deposits and withdrawals via supported Indonesian bank transfer and e-wallet channels; crediting winnings; applying bonus promotions; resolving bet disputes and game queries.
• Identity & age verification (KYC): Confirming that you meet the 21+ age requirement and that your identity matches the details provided at registration, as required by dana54's licensing obligations.
• Fraud prevention and security: Detecting and investigating suspicious account activity, payment fraud, bonus abuse, multi-accounting, and any other activity inconsistent with fair use of the Platform.
• Anti-money-laundering (AML) compliance: Monitoring transactions for patterns consistent with money laundering, terrorist financing, or proceeds of crime in accordance with dana54's international licensing obligations.
• Responsible gaming: Monitoring betting patterns and account behaviour for indicators of problem gambling; enforcing voluntary deposit limits, loss limits, cooling-off periods, and self-exclusion requests; providing timely intervention where required.
• Customer support: Responding to enquiries, complaints, and disputes submitted via live chat, email, or WhatsApp; maintaining records of support interactions for quality assurance.
• Marketing communications: Sending promotional offers, bonus notifications, and event-based messages (e.g., Idul Fitri and Ramadhan special promotions) to Members who have opted in to such communications. Members may withdraw consent at any time via the Account preference centre.
• Platform improvement: Analysing aggregated usage data to improve game selection, interface design, and feature performance; conducting A/B testing of new features in anonymised environments.
• Legal and regulatory obligations: Complying with requests from competent regulatory, law-enforcement, or judicial authorities under applicable law; retaining records as required by dana54's operating license.

5 Legal Basis for Processing

Every Processing activity conducted by dana54 rests on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between dana54 and a Member — including Account administration, payment processing, KYC verification, and service delivery — is carried out on the basis that it is necessary for the performance of that contract.
• Legal obligation: Processing necessary for dana54 to comply with its licensing conditions, AML regulations, and any applicable data retention requirements is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming intervention, and Platform analytics is carried out on the basis of dana54's legitimate interest in operating a safe, fair, and commercially sustainable Platform — provided that such processing does not override the fundamental rights and freedoms of Members.
• Consent: Processing for direct marketing communications and non-essential cookie use is carried out on the basis of your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

dana54 does not sell, rent, or trade Member Personal Data to third-party marketing organisations. Data sharing is limited to the following categories of recipient, each of whom is bound by contractual data protection obligations consistent with this Policy:

• Payment processors and banking partners: Personal Data necessary to execute deposit and withdrawal transactions is shared with the relevant Indonesian bank (e.g., BCA, BRI, BNI, Mandiri) or e-wallet provider (e.g., OVO, DANA, GoPay) on a minimum-necessary basis. Financial institutions receiving this data are subject to their own regulatory obligations under Indonesian banking law.
• KYC and identity verification providers: Document images and identity data collected during KYC are shared with dana54's certified identity verification partner(s) solely for the purpose of confirming Member identity and age.
• Game content and technology providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive pseudonymised player identifiers necessary to facilitate game session tracking, RTP auditing, and jackpot computation. These providers do not receive your full identity or financial details.
• Cloud infrastructure and hosting providers: dana54 uses enterprise-grade cloud infrastructure providers to host Platform data. These providers act as Data Processors under binding contractual agreements and process Personal Data solely on dana54's instructions.
• Fraud detection and AML service providers: Specialised third-party tools assist dana54 in detecting fraudulent activity and monitoring for AML risk indicators. Data shared with these providers is used exclusively for those purposes.
• Regulatory, legal, and law-enforcement authorities: dana54 will disclose Personal Data to competent governmental, regulatory, judicial, or law-enforcement authorities where required to do so by a valid legal obligation, court order, or the terms of dana54's operating license. dana54 will notify affected Members of such disclosures to the extent permitted by law.

No data is transferred to recipients outside the categories listed above without your prior explicit consent, except where required by an overriding legal obligation.

7 Cookies & Tracking Technologies

dana54 uses cookies and similar tracking technologies to ensure the proper functioning of the Platform, to remember your preferences, and to gather analytics data that helps us improve the Member experience. The following categories of cookie are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without breaking core Platform functionality.
• Functional / preference cookies: Store your Platform preferences such as language selection, preferred deposit method, and notification settings. Disabling these cookies will reset your preferences on each visit.
• Analytics cookies: Collect aggregated, anonymised data about how Members navigate the Platform — pages visited, games launched, time spent in each section, and click paths. This data is used internally to improve product design and is not sold to third parties.
• Marketing / attribution cookies: Where dana54 runs referral or affiliate programmes, attribution cookies record which channel introduced a Member to the Platform. These cookies are only active for opted-in affiliate traffic and do not track non-Member visitors beyond the initial attribution event.

You may manage cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in to the Platform. dana54 does not use fingerprinting techniques or device-level tracking methods that persist beyond standard browser cookie lifespan.

8 Data Retention

dana54 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law or licensing conditions. The following retention periods apply as a general guide:

• Active Account data: Retained throughout the period during which your Account remains open and active.
• Transaction records (deposits, withdrawals, bet history): Retained for a minimum of five (5) years following the date of the transaction, as required by AML regulations applicable under dana54's operating license.
• KYC documents: Retained for a minimum of five (5) years following Account closure or the date of the last transaction, whichever is later.
• Support communications: Retained for three (3) years from the date of the interaction unless the communication is directly connected to an unresolved dispute, in which case it is retained until the dispute is fully resolved plus one (1) additional year.
• Marketing preference records: Retained for the duration of your Account plus two (2) years following Account closure, to maintain an auditable record of your consent and opt-out history.
• Analytics and usage data: Aggregated analytics data is retained indefinitely in anonymised form. Raw session-level usage logs are purged after 90 days.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised using industry-standard data destruction procedures. Where deletion is technically impractical in the short term (for example, data held in encrypted backup archives), the data is quarantined and excluded from further processing until destruction is completed at the next scheduled backup rotation.

9 Security Measures

dana54 implements a layered security architecture designed to protect Member Personal Data against unauthorised access, disclosure, alteration, and destruction. Our current security measures include:

• 256-bit TLS 1.3 encryption: All data transmitted between your device and the dana54 Platform is encrypted in transit using TLS 1.3. Unencrypted HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Personal Data stored in dana54's databases — including KYC document images and financial records — is encrypted at rest using AES-256 encryption.
• Access control: Access to systems containing Personal Data is granted on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication (MFA), and access logs are reviewed regularly by our security team.
• Penetration testing: dana54 commissions independent security assessments of its Platform infrastructure at least annually. Critical and high-severity findings are remediated within defined SLA windows.
• Fraud monitoring: Automated and manual monitoring systems operate 24/7 to detect anomalous account activity, suspicious login attempts, and unusual transaction patterns.
• Data breach response: In the event of a confirmed data breach affecting Member Personal Data, dana54 will notify affected Members and relevant regulatory authorities within the timeframes required by applicable law, and will publish a security notice on the Platform.

10 Your Rights

As a data subject, you hold the following rights in relation to the Personal Data dana54 holds about you. To exercise any of these rights, submit a written request to our Data Protection Officer using the contact details in Section 14. We will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days.

11 Minors

The dana54 Platform is strictly intended for adults aged 21 years or older. dana54 does not knowingly collect Personal Data from individuals under the age of 21. If you are under 21, you must not register an Account or use any real-money feature of the Platform.

If dana54 discovers or has reasonable grounds to believe that Personal Data has been collected from a person under the age of 21, that Account will be immediately suspended, the data will be deleted as soon as technically practicable, and any associated transactions will be reversed where permissible. Parents or guardians who believe that their child has registered a dana54 Account should contact us immediately at [email protected].

For guidance on parental control tools that can restrict access to online gaming platforms on shared or family devices, please refer to dana54's Responsible Gaming page.

12 International Data Transfers

dana54's Platform infrastructure is hosted on cloud servers located in data centres that may be situated outside Indonesia. As a result, Personal Data collected from Indonesian Members may be transferred to and stored in jurisdictions other than Indonesia.

Where such transfers occur, dana54 ensures that appropriate safeguards are in place to protect Personal Data to a standard equivalent to that described in this Policy. Safeguards employed by dana54 include:

• Contractual data protection clauses included in all Data Processor agreements, requiring processors to implement security measures consistent with dana54's standards.
• Preference for cloud infrastructure providers that maintain certified data centres in Southeast Asia or Asia-Pacific regions, reducing cross-border transfer exposure for Indonesian player data.
• Regular review of the data protection standards of all international Data Processors as part of dana54's annual vendor assessment process.

By registering an Account with dana54, you acknowledge that your Personal Data may be transferred internationally in accordance with the safeguards described above.

13 Policy Amendments

dana54 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, data processing practices, or Platform features. Material changes to this Policy will be communicated to registered Members via email to their registered address, with a minimum of fourteen (14) calendar days' notice prior to the revised Policy taking effect.

Non-material clarifications and corrections — such as fixing typographical errors, updating contact details, or improving the clarity of existing descriptions without changing their substantive meaning — may be made without prior notice. The "Last updated" date at the top of this page will be revised on every update, whether material or non-material.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the Platform and may request voluntary Account closure in accordance with the Terms & Conditions.

14 Contact & Data Protection Officer

dana54 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and with applicable data protection obligations. If you wish to exercise any of your data rights (Section 10), submit a privacy complaint, or raise any question about how dana54 handles your Personal Data, you may contact the DPO using the following details:

• Email: [email protected] — subject line: "Privacy Request – [Your Account Username]"
• WhatsApp: +62 812-3456-7890
• Live Chat: Available 24/7 at dana54.app — select "Account & Privacy" from the support topic menu
• Response time: Acknowledgement within 5 business days; substantive response within 30 calendar days

If you are not satisfied with dana54's response to a privacy complaint, you may escalate the matter to the supervisory authority responsible for data protection in the jurisdiction applicable to your complaint. For Indonesian residents, the relevant national authority is the Ministry of Communication and Information Technology of the Republic of Indonesia (Kominfo).