pen4d Privacy Policy

This Privacy Policy applies to all personal data collected and processed by pen4d in connection with the operation of the pen4d platform accessible at https://pen4d.bio, including all sub-pages, game interfaces, customer support channels, and promotional communications. It applies to all individuals who visit, register on, or interact with the pen4d platform, regardless of the device or method of access used.

For the purposes of this Privacy Policy, "personal data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including but not limited to a name, Indonesian National Identity Card (KTP) number, mobile phone number, email address, IP address, bank account details, and device identifiers.

pen4d operates as an internationally licensed offshore gaming platform. While this Privacy Policy has been designed with Indonesian players in mind — reflecting the practices of local banks such as BCA, BRI, BNI, and Mandiri, as well as Indonesian e-wallets including OVO, DANA, GoPay, ShopeePay, and LinkAja — it is also consistent with recognised international data protection standards.

pen4d collects the following categories of personal data in the course of operating its platform and serving its players:

pen4d does not knowingly collect sensitive personal data beyond what is required for identity verification and AML compliance. Specifically, pen4d does not collect racial or ethnic origin data, political opinions, religious beliefs, trade union membership, genetic or biometric data, or criminal record information except where a player is flagged through a mandatory AML screening process.

pen4d collects personal data through the following channels:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact the support team, or respond to a promotional survey.
• Automatically via the platform: When you visit pen4d.bio, our servers and analytics tools automatically record technical data including your IP address, device identifiers, browser configuration, and session activity. This data collection is passive and does not require any action on your part.
• From payment processors: When you initiate a deposit or withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja, we receive transaction confirmation data from the relevant payment provider. We do not have access to your full banking credentials — only to the transaction reference, amount, timestamp, and account name/number needed to credit or debit your pen4d balance.
• From third-party identity verification providers: pen4d works with licensed identity verification and AML screening partners to cross-reference KYC data. These partners may provide pen4d with a verification status and risk score but do not provide raw third-party data profiles to pen4d beyond what is necessary for the verification decision.
• From cookies and similar tracking technologies: As described in Section 9 (Cookies & Tracking) of this policy.

pen4d processes your personal data for the following specific, legitimate purposes:

• Account Administration: Creating, maintaining, and managing your pen4d player account, including processing login authentication, resetting credentials, and updating account preferences.
• Transaction Processing: Crediting deposits and processing withdrawal requests in Indonesian Rupiah (IDR) via your chosen local bank or e-wallet, and maintaining an accurate record of all financial activity on your account.
• KYC and AML Compliance: Verifying your identity and age (minimum 21 years) in accordance with pen4d's licensing obligations and internationally recognised anti-money laundering standards.
• Responsible Gaming: Monitoring gameplay patterns to identify indicators of problem gambling behaviour, enforcing deposit limits and self-exclusion requests, and providing targeted responsible gaming communications where appropriate.
• Customer Support: Responding to your queries, resolving disputes, and providing technical assistance via live chat and email.
• Platform Security and Fraud Prevention: Detecting and investigating unauthorised account access, collusion, bonus abuse, money laundering attempts, and other prohibited conduct as defined in pen4d's Terms & Conditions.
• Platform Improvement: Analysing aggregate, anonymised usage data to improve game performance, platform usability, and the overall player experience.
• Marketing Communications: Sending promotional offers, seasonal bonuses (including Ramadhan, Idul Fitri, and Indonesian Independence Day promotions), and product updates to players who have opted in to receive such communications.
• Legal and Regulatory Obligations: Retaining records as required by applicable laws and responding to lawful requests from regulatory or law enforcement authorities.

pen4d will not process your personal data for any purpose that is incompatible with the purposes listed above without obtaining your prior consent or establishing a separate lawful basis for the new processing activity.

pen4d relies on the following legal bases when processing your personal data:

• Contractual Necessity: The majority of processing activities — account management, transaction processing, KYC verification, and customer support — are necessary for the performance of the contract between you and pen4d (as governed by the Terms & Conditions). Without this processing, pen4d cannot provide its services to you.
• Legitimate Interests: pen4d processes technical data, gameplay data, and security-related data on the basis of its legitimate interests in preventing fraud, maintaining platform integrity, and improving its services. Where we rely on legitimate interests, we conduct a balancing test to ensure that our interests do not override your fundamental rights and freedoms.
• Legal Obligation: KYC, AML screening, and transaction record-keeping are carried out to comply with applicable legal and licensing requirements. pen4d cannot waive these obligations at a player's request.
• Consent: Marketing communications are sent only to players who have explicitly opted in to receive them. Consent is freely given, specific, and may be withdrawn at any time without affecting the operation of your account.

pen4d does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below:

• Payment Processing Partners: We share the minimum transaction data necessary with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals. These providers act as independent data controllers in respect of their own services and are subject to their own privacy policies.
• Identity Verification and AML Screening Providers: We engage third-party KYC and compliance partners to assist with identity verification and sanctions screening. These providers process your data on pen4d's behalf under strict data processing agreements and may not use your data for their own commercial purposes.
• Technology and Infrastructure Providers: pen4d uses cloud hosting, platform security, and analytics service providers. These partners process data only as instructed by pen4d and are bound by confidentiality obligations.
• Game Content Providers: Third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive anonymised session identifiers to serve game content. These providers do not receive your full personal profile.
• Regulatory and Law Enforcement Authorities: pen4d will disclose personal data to competent authorities where required to do so by law, court order, or the terms of its gaming licence. pen4d will, where legally permitted, notify affected players of such disclosures.
• Business Transfers: In the event of a merger, acquisition, or sale of the pen4d business or its assets, player data may be transferred to the acquiring entity. Affected players will be notified via their registered email address prior to any such transfer.

pen4d retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law and licensing obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, pen4d will securely delete or anonymise your personal data in a manner that prevents reconstruction. Anonymised, aggregate data may be retained indefinitely for analytical and reporting purposes.

pen4d implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, and disclosure. Key measures include:

• Transport Encryption: All data transmitted between your device and pen4d.bio is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon displayed in your browser confirms that your session is encrypted.
• Data Encryption at Rest: Sensitive data stored in pen4d's databases — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to player data is restricted on a strict need-to-know basis. All staff with access to personal data undergo background checks and are subject to confidentiality obligations. Access rights are reviewed periodically and revoked immediately upon termination of employment or contract.
• Multi-Factor Authentication: Internal pen4d systems that process player data require multi-factor authentication for all staff logins. Players are strongly encouraged to enable SMS OTP two-factor authentication on their own accounts.
• Vulnerability Management: pen4d conducts regular penetration testing and vulnerability scans of its platform. Identified vulnerabilities are remediated in accordance with a risk-based patching schedule.
• Incident Response: pen4d maintains a documented security incident response plan. In the event of a data breach that is likely to result in material risk to affected players, pen4d will notify affected individuals without undue delay.

pen4d uses cookies and similar tracking technologies on pen4d.bio to provide core platform functionality, analyse usage patterns, and deliver a personalised experience. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They manage your login session, maintain your account state across pages, and ensure that the platform displays correctly on your device. These cookies cannot be disabled without rendering the platform inoperable.
• Performance and Analytics Cookies: These cookies collect anonymised data about how players navigate and use pen4d.bio — including which pages are visited most frequently, how long sessions last, and where errors occur. This data helps pen4d improve platform performance and user experience. No personally identifiable information is collected by analytics cookies.
• Functional Cookies: These cookies remember your preferences — such as your chosen display settings and the last game category you browsed — to provide a more personalised experience on return visits.
• Security Cookies: These cookies support fraud detection and account security functions, helping pen4d identify unusual login patterns and potentially malicious activity.

pen4d does not currently use third-party advertising cookies or behavioural targeting cookies that track your activity across other websites. Cookies set by payment providers (OVO, DANA, GoPay, etc.) when you are redirected to their payment interface are governed by the respective provider's own cookie policy.

Most browsers allow you to manage cookie preferences through the browser settings menu. Blocking strictly necessary cookies will impair platform functionality. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

pen4d recognises and respects your rights in relation to your personal data. You may exercise any of the following rights by submitting a written request to the pen4d support team at the email address provided in Section 14 of this policy:

pen4d's platform is strictly intended for adults aged 21 years and over. pen4d does not knowingly collect personal data from individuals under the age of 21. If pen4d becomes aware that it has collected personal data from a person under the age of 21, all such data will be deleted immediately and the associated account will be permanently closed in accordance with pen4d's Terms & Conditions.

Parents and guardians who believe that a minor may have registered a pen4d account using false age information should contact pen4d immediately at the support email address listed in Section 14. pen4d will investigate such reports with priority and take appropriate action within 24 hours of receiving a verified report.

pen4d employs mandatory age verification as part of its KYC process, requiring all players to confirm their date of birth at registration and to submit a valid Indonesian KTP or passport demonstrating that they are 21 years of age or older before withdrawal functionality is enabled. pen4d also operates responsible gaming tools including deposit limits, session reminders, and self-exclusion — further details are available on pen4d's dedicated Responsible Gaming page.

As an internationally licensed platform, pen4d may process and store personal data on servers located outside of Indonesia. When personal data is transferred to a jurisdiction that does not have data protection laws equivalent to those applicable in Indonesia, pen4d takes steps to ensure that an adequate level of protection is maintained through one or more of the following mechanisms:

• Standard contractual clauses or equivalent data transfer agreements with the receiving party.
• Ensuring that the receiving party is subject to a recognised certification scheme or binding corporate rules that provide adequate data protection.
• Transferring data only to jurisdictions that offer an adequate level of protection as recognised by applicable international standards.

By registering a pen4d account, you acknowledge that your personal data may be transferred to and stored in jurisdictions outside Indonesia for the purposes described in this Privacy Policy. pen4d will always ensure that any such transfer is subject to appropriate safeguards consistent with this policy.

pen4d reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the services we offer. When material changes are made to this policy, pen4d will notify registered players via the email address on their account at least 7 calendar days before the revised policy takes effect.

The "Last Updated" date displayed at the top of this document will always reflect the most recent revision. We encourage players to review this Privacy Policy periodically to stay informed about how pen4d protects their personal data. Continued use of the pen4d platform following the effective date of any revision constitutes your acceptance of the updated policy.

If you do not accept the revised Privacy Policy, you should cease using the pen4d platform and contact the support team to request account closure and data erasure in accordance with Section 10 of this policy.

For questions, concerns, or requests relating to this Privacy Policy or the personal data pen4d holds about you, please contact the pen4d Data Privacy team using the details below. All privacy-related correspondence is handled confidentially by designated privacy staff.

When submitting a data rights request, please include your full registered name, account username, the email address registered on your pen4d account, and a clear description of your request. pen4d will ask you to verify your identity before acting on any request that involves accessing, modifying, or deleting personal data.

If you are not satisfied with pen4d's response to a privacy complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction or to the dispute resolution body specified under pen4d's gaming licence. pen4d is committed to resolving privacy complaints fairly and promptly.