Privacy Policy

1. Introduction

1.1   marbol is committed to protecting the privacy and security of all Members' personal information. We recognize that trust is fundamental to our relationship with you, and we take our data protection responsibilities seriously.

1.2   This Policy applies to all personal data collected through the marbol website, mobile site, customer support interactions (email, live chat), and any other touchpoint where you interact with our services.

1.3   This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform and form part of the overall agreement between you and marbol.

1.4   If you have questions about this Policy or wish to exercise your privacy rights, please contact us at the details provided in Section 14 below.

2. Data Controller

2.1   For the purposes of applicable data protection laws, marbol is the data controller responsible for the personal information collected through the Platform.

2.2   marbol operates under an international gaming licence and complies with the data protection requirements imposed by its licensing jurisdiction, as well as with international best practices for cross-border data processing.

2.3   While marbol primarily serves Indonesian players, the Platform is operated internationally. Personal data may be processed in jurisdictions outside Indonesia where our servers, service providers, or business partners are located. All such processing is subject to appropriate safeguards as described in Section 7 below.

3. Information We Collect

3.1   Personal Identification Information. When you register an account on marbol, we collect:

• Full legal name (as it appears on your government-issued ID)
• Date of birth
• Gender
• Residential address (street address, city, province, postal code)
• Email address
• Mobile phone number
• Preferred username and password (password is stored in hashed format only)

3.2   KYC Verification Documents. To comply with regulatory requirements and prevent underage gambling, fraud, and money laundering, we collect:

• Government-issued identity document: KTP (Kartu Tanda Penduduk), SIM (Surat Izin Mengemudi), or Indonesian Passport
• Proof of address: utility bill, bank statement, or official government correspondence dated within 90 days
• Proof of payment method: photograph or screenshot of bank card (front/back, with middle digits obscured) or e-wallet account
• Selfie photograph holding the submitted ID document (for enhanced verification)

3.3   Financial Information. When you make deposits or request withdrawals, we collect:

• Bank account details: bank name, account holder name, account number (for Indonesian banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI)
• E-wallet details: OVO, DANA, GoPay, ShopeePay, LinkAja account identifiers
• Transaction history: deposit amounts, withdrawal amounts, timestamps, payment methods used

3.4   Account Activity Data. We automatically collect information about your use of the Platform, including:

• Login and logout timestamps
• Bets placed: sport/league/event, market type, stake amount, odds, potential payout, result
• Casino game sessions: game title, provider, session duration, bet amounts, wins/losses, RTP
• Bonus activations and wagering progress
• Customer support interactions: live chat transcripts, email correspondence, support ticket history

3.5   Technical and Device Information. When you access the Platform, we automatically collect:

• IP address and geolocation data (country, region, city-level approximation)
• Device identifiers: device type (desktop, mobile, tablet), operating system, browser type and version
• Clickstream data: pages visited, time spent on each page, referral source, exit page
• Performance data: page load times, error messages, site crashes or technical issues

3.6   Communications Data. If you contact us via email, live chat, or other channels, we retain records of all correspondence for quality assurance, training purposes, and compliance with our regulatory obligations.

4. Purpose of Collection

4.1   We collect and process personal data for the following purposes:

4.2   We will not use your personal data for purposes other than those listed above without obtaining your explicit consent, unless required by law.

5. Legal Basis for Processing

5.1   Under applicable data protection law, we rely on the following legal bases for processing your personal information:

• Contractual Necessity: Processing is necessary to perform our contract with you (the Terms & Conditions) and to provide the services you have requested, including account creation, payment processing, and access to games.
• Legal Obligation: Processing is required to comply with legal and regulatory obligations, including KYC/AML requirements, age verification, responsible gaming monitoring, tax reporting, and responses to lawful authority requests.
• Legitimate Interests: Processing is necessary for our legitimate business interests, including fraud prevention, platform security, technical optimization, customer support quality assurance, and internal record-keeping, provided such interests do not override your fundamental rights.
• Consent: Where we send marketing communications or use non-essential cookies, we rely on your freely given, specific, informed, and unambiguous consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

6.1   Service Providers. We share personal data with trusted third-party service providers who perform functions on our behalf, including:

• Payment processors and banks (for deposit/withdrawal processing)
• KYC verification providers (for identity document validation)
• Game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, etc. — receive pseudonymised betting data only)
• Cloud hosting providers (for secure data storage and server infrastructure)
• Customer support software vendors (for live chat and ticketing systems)
• Email service providers (for transactional and promotional communications)

All service providers are bound by strict confidentiality obligations and are contractually prohibited from using your data for any purpose other than providing services to marbol.

6.2   Legal and Regulatory Authorities. We may disclose personal data to government authorities, regulators, or law enforcement agencies where required by law, including:

• Responses to valid court orders, subpoenas, or other legal processes
• Compliance with anti-money laundering (AML) and counter-terrorism financing (CTF) reporting obligations
• Cooperation with investigations into suspected criminal activity, fraud, or match-fixing
• Disclosure to our licensing authority as required under the terms of our operating licence

6.3   Business Transfers. In the event of a merger, acquisition, reorganization, or sale of all or part of marbol's assets, personal data may be transferred to the acquiring entity, provided that the new controller agrees to continue protecting your data in accordance with this Policy.

6.4   No Third-Party Marketing. marbol does not sell, rent, or share your personal data with third-party marketers, advertisers, or data brokers. Your information is never used for purposes unrelated to the operation of the Platform or our legal obligations.

7. International Data Transfers

7.1   marbol operates internationally and may transfer personal data to servers and service providers located outside Indonesia, including in jurisdictions that may not provide the same level of data protection as Indonesian law.

7.2   Where personal data is transferred internationally, we implement appropriate safeguards to protect your information, including:

• Use of data processing agreements incorporating Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
• Verification that recipient jurisdictions provide adequate data protection under applicable law
• Technical measures such as encryption in transit and at rest
• Contractual obligations requiring service providers to implement equivalent security standards

7.3   By using the Platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

8. Data Security Measures

8.1   marbol employs industry-leading technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or damage, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• AES-256 encryption at rest for sensitive data stored in databases
• Secure password hashing using bcrypt or equivalent algorithms (passwords are never stored in plain text)
• Firewalls and intrusion detection/prevention systems protecting all network perimeters
• Multi-factor authentication (MFA) for administrative access to backend systems
• Regular security audits and penetration testing conducted by independent third-party experts
• Staff training on data protection, confidentiality, and secure handling procedures
• Access controls ensuring that personal data is accessible only to authorized personnel on a need-to-know basis
• 24/7 monitoring of server infrastructure for suspicious activity or security incidents
• Automated backup systems with encrypted off-site storage for disaster recovery

8.2   While we implement robust security measures, no system is entirely impervious to attack. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities in accordance with applicable data breach notification requirements.

8.3   Your Responsibility. You are responsible for maintaining the confidentiality of your account credentials. Never share your password with others, and always log out after using a shared or public device. If you suspect unauthorized access to your account, contact us immediately at [email protected].

9. Data Retention

9.1   We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

9.2   Active Accounts. For accounts in good standing with regular activity, personal data is retained for the duration of the account's active status plus any applicable regulatory retention period.

9.3   Closed Accounts. When you voluntarily close your account or when marbol terminates an account for breach of Terms, we retain certain personal data for the following periods:

• Identity and KYC documents: 7 years from account closure (AML/CTF legal requirement)
• Financial transaction records: 7 years from transaction date (tax and audit requirements)
• Betting history and account activity logs: 5 years from account closure (regulatory requirement)
• Marketing communication preferences: Deleted immediately upon account closure
• Customer support correspondence: 3 years from final interaction (quality assurance and complaint resolution)

9.4   After the applicable retention period expires, personal data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

9.5   We may retain data for longer periods where required by law, for the establishment, exercise, or defense of legal claims, or where you have provided explicit consent for extended retention.

10. Your Privacy Rights

10.1   Subject to applicable law, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you, including details of how it is used and with whom it is shared.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. You can update most information directly via your Account Settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (subject to legal retention obligations).
• Right to Restriction: You may request that we limit the processing of your personal data in certain circumstances, such as while a dispute about accuracy or lawfulness is being resolved.
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing emails, non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory data protection authority if you believe your rights have been violated.

10.2   To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 days of receiving a valid request. We may require additional identification to verify your identity before processing certain requests.

10.3   There is no charge for exercising your privacy rights, except where requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or refuse the request.

11. Cookies & Tracking Technologies

11.1   marbol uses cookies and similar tracking technologies (web beacons, pixels, local storage) to enhance your experience, maintain session state, and analyze site usage.

11.2   Types of Cookies We Use:

• Essential Cookies: Strictly necessary for the operation of the Platform (login authentication, session management, security). These cannot be disabled without breaking core functionality.
• Performance Cookies: Collect anonymous data about how visitors use the site (pages visited, time on site, error messages) to help us improve performance. These use aggregated, non-identifiable data.
• Functional Cookies: Remember your preferences (language, currency, timezone) to provide a personalized experience.
• Marketing Cookies: Track your browsing activity to deliver relevant promotional content. These require your explicit consent and can be disabled via browser settings.

11.3   Managing Cookies. Most browsers allow you to refuse cookies or delete existing cookies through your browser settings. Note that disabling essential cookies will prevent you from using core Platform features. Instructions for managing cookies in common browsers:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies

11.4   We do not respond to Do Not Track (DNT) signals because there is no industry consensus on how to interpret them. However, you can control tracking through the browser settings mentioned above.

12. Protection of Minors

12.1   marbol is an adults-only platform. We do not knowingly collect personal data from individuals under 21 years of age. Our registration process requires date-of-birth entry, and all accounts are subject to mandatory age verification through KYC document review.

12.2   If we discover that personal data has been collected from a person under 21, we will immediately and permanently close the account, delete all personal data (except where retention is legally required for regulatory reporting), and return any deposited funds to the payment source after appropriate verification.

12.3   Parents and guardians are encouraged to monitor their children's internet usage. If you believe a minor has registered on marbol or provided us with personal information, please contact us immediately at [email protected] so we can take appropriate action.

13. Policy Updates

13.1   marbol reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational needs.

13.2   Material changes to this Policy will be communicated to you via email to your registered address and/or by a prominent notice on the Platform. The "Last Updated" date at the top of this document will always reflect the effective date of the most recent revision.

13.3   We encourage you to review this Policy periodically. Your continued use of the Platform after any changes constitutes acceptance of the updated Policy.

13.4   If you do not agree with a revised Policy, you may request account closure in accordance with our Terms & Conditions. Any personal data collected prior to the policy change will continue to be processed under the terms you originally agreed to, unless you provide explicit consent to the new terms.

14. Contact & Complaints

14.1   If you have any questions, concerns, or complaints about this Privacy Policy or our data handling practices, please contact our Data Protection team:

• Email (plain text — not a clickable link): [email protected]
• Subject Line: "Privacy Policy Inquiry" or "Data Protection Request"
• Live Chat: Available 24/7 on the Platform (select "Privacy & Data Protection" from the topic menu)

14.2   We will acknowledge receipt of your inquiry within 2 business days and provide a substantive response within 30 days. For complex requests (e.g., data portability involving large volumes of records), we may extend this period by an additional 60 days with prior notice and explanation.

14.3   Complaint Escalation. If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with your local data protection supervisory authority. For Indonesian residents, this may include the Ministry of Communication and Information Technology (Kominfo) or other relevant regulatory bodies with jurisdiction over data protection matters.