lok21 Privacy Policy

This Privacy Policy ("Policy") describes how lok21 ("we", "us", "the Platform") collects, processes, stores, and protects the personal data of individuals ("you", "Member", "User") who register an account with, or otherwise interact with, the lok21 online gaming platform at https://lok21.net and all associated sub-domains and mobile interfaces.

lok21 is committed to handling your personal data responsibly, transparently, and in accordance with internationally recognised data protection principles — including those reflected in the General Data Protection Regulation (GDPR) framework, which lok21 applies as a baseline standard of data governance regardless of a Member's specific jurisdiction.

By registering a lok21 account or continuing to use the platform after this Policy has been published or updated, you acknowledge that you have read this Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you should cease using the lok21 platform and contact support to close your account.

This Policy is incorporated by reference into the lok21 Terms & Conditions and forms part of the agreement between you and lok21. In the event of any conflict between this Policy and the Terms & Conditions on a data-related matter, this Policy shall prevail.

lok21 collects personal data through multiple touchpoints — account registration, identity verification, payment processing, platform usage, and customer support interactions. The categories of personal data we collect are set out in the table below:

lok21 does not intentionally collect sensitive personal data beyond what is strictly necessary for KYC compliance — specifically, we do not collect data concerning health conditions, religious beliefs, political opinions, or biometric data beyond what is visible in a standard government-issued ID photograph.

lok21 uses Member personal data exclusively for the purposes described in this Policy. We do not use personal data for purposes that are incompatible with those described without first obtaining your explicit consent. The primary purposes for which lok21 processes personal data are:

1. Account Management: To create, maintain, and administer your lok21 account — including verifying your identity at registration, processing login requests, managing account security settings, and handling account closure requests.
2. Payment Processing: To process deposits and withdrawals in IDR via your nominated Indonesian bank accounts and e-wallets, to maintain accurate transaction records, and to resolve payment disputes or discrepancies.
3. KYC and AML Compliance: To verify your age (21+), identity, and source of funds in compliance with know-your-customer (KYC) and anti-money-laundering (AML) obligations. This may involve cross-referencing your data against sanctions lists and fraud-prevention databases.
4. Platform Delivery: To provide the core gaming services — sportsbook markets, live casino tables, slot titles, togel (Indonesia's traditional numbers lottery) draw results, mahjong, and esports betting markets — and to personalise your platform experience based on your gaming preferences and usage patterns.
5. Customer Support: To respond to your enquiries, complaints, and support requests via live chat (available 24/7, 00:00–24:00 WIB), email, and WhatsApp (08:00–24:00 WIB), and to maintain records of support interactions for quality assurance.
6. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and any other conduct that violates the lok21 Terms & Conditions. This includes automated risk scoring and, where flagged, manual review by our compliance team.
7. Responsible Gaming: To monitor for indicators of problem gambling, to administer self-exclusion periods and deposit limits set by Members, and to contact Members where responsible gaming concerns are identified. Full details are available on the Responsible Gaming page.
8. Direct Marketing (with consent): Where you have explicitly opted in, to send you promotional emails, SMS messages, and in-platform notifications about bonuses, seasonal promotions (including Idul Fitri, Ramadhan, Nyepi, and Indonesian Independence Day offers), new game releases, and sportsbook specials. You may withdraw marketing consent at any time via your account settings.
9. Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from regulatory or law enforcement authorities, and enforce our contractual rights.
10. Platform Improvement: To analyse aggregated, anonymised usage data to improve platform performance, fix technical issues, develop new features, and optimise user experience.

Every instance of personal data processing by lok21 is grounded in one or more of the following recognised legal bases:

lok21 does not sell, rent, or trade your personal data to unaffiliated third parties for commercial purposes. Your data is shared only in the limited circumstances described below, and only to the extent necessary to fulfil each specified purpose:

• Payment Service Providers: Your financial data is shared with the relevant Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These providers act as independent data controllers in respect of their own payment processing obligations.
• KYC and Identity Verification Partners: Identity documents submitted for KYC verification may be processed by third-party identity verification service providers acting as data processors on lok21's behalf, under strict contractual data protection obligations.
• Game Content Providers: Certain usage data (e.g., session identifiers and bet results) is shared with certified game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — to the extent necessary to deliver and settle game outcomes. These studios do not receive your identity or financial data.
• Fraud Prevention and AML Databases: Where a transaction or account triggers a fraud or AML alert, relevant data may be shared with third-party fraud prevention databases and financial intelligence services. This is done pursuant to our legal obligations and legitimate interests in preventing financial crime.
• Regulatory and Law Enforcement Authorities: lok21 will disclose personal data to governmental, regulatory, or law enforcement bodies when required to do so by a lawful order, subpoena, court order, or equivalent legal instrument. Where permitted by law, lok21 will notify the affected Member of such a disclosure.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of lok21's business, Member personal data may be transferred to the acquiring entity as part of the transaction, subject to that entity assuming obligations materially equivalent to those set out in this Policy.

lok21 uses cookies and similar tracking technologies to operate and optimise the platform. A cookie is a small text file placed on your device by a web server; it does not execute code and cannot access files stored on your device beyond the scope of the cookie itself.

The following categories of cookies are used on the lok21 platform:

• Strictly Necessary Cookies: These cookies are essential to the operation of the lok21 platform and cannot be disabled. They enable core functions such as session authentication, account security, fraud prevention token management, and load balancing. No consent is required for these cookies.
• Functional Cookies: These cookies remember your preferences — such as language settings, preferred game category, and responsible gaming limit configurations — to personalise your experience across sessions. They are set only with your consent.
• Analytics Cookies: These cookies collect anonymised or pseudonymised data about how Members interact with the lok21 platform — including pages visited, session duration, click paths, and error events — to help us understand usage patterns and improve platform performance. Third-party analytics providers acting as data processors may set these cookies on lok21's behalf.
• Marketing Cookies: Where you have consented to marketing communications, these cookies help lok21 measure the effectiveness of promotional campaigns and deliver relevant promotional content within the platform. No retargeting across third-party websites is conducted.

You can manage your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies will impair or prevent your access to the lok21 platform. Disabling other categories of cookies will reduce the personalisation of your experience but will not affect your ability to place bets, deposit, or withdraw funds.

lok21 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, the resulting dataset can no longer be linked to you and is no longer treated as personal data under this Policy.

lok21 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, destruction, or accidental loss. These measures include:

• Encryption in Transit: All data transmitted between your device and the lok21 platform is protected using TLS 1.2 or higher, implemented via a 256-bit SSL certificate. This applies to all page requests, API calls, and payment transactions.
• Encryption at Rest: Personal data stored in lok21's databases — including KYC documentation and financial records — is encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the encrypted data using a dedicated key management system.
• Password Security: Member passwords are stored exclusively as one-way cryptographic hashes using an industry-standard adaptive hashing algorithm (e.g., bcrypt). Plain-text passwords are never stored, logged, or transmitted in any form.
• Access Controls: Access to production systems and Member personal data is restricted on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication, logged, and subject to regular access review. Privileged access is time-limited and audited.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable SMS OTP-based 2FA on their lok21 accounts. 2FA is available in account security settings and is applied as a mandatory step for all withdrawal requests above a defined threshold.
• Vulnerability Management: lok21's technical infrastructure is subject to regular penetration testing, automated vulnerability scanning, and patching in accordance with a defined security maintenance schedule.
• Incident Response: lok21 maintains a documented personal data breach response procedure. In the event of a breach that is likely to result in a high risk to your rights and freedoms, lok21 will notify affected Members without undue delay and in accordance with applicable data breach notification requirements.

As a lok21 Member, you hold a number of rights with respect to your personal data. lok21 is committed to facilitating the exercise of these rights promptly and without undue bureaucracy. Your rights are set out below — click each right to expand the details:

To exercise any of the rights listed above, contact the lok21 Data Protection team at support [at] lok21.net with the subject line "Data Rights Request" and your registered account username. lok21 will verify your identity before processing any data rights request and will respond within 30 calendar days. Where a request is complex or involves a large volume of data, lok21 may extend this period by a further 30 days and will notify you accordingly.

lok21 operates a strict 21+ only policy. The platform is not directed at, and does not knowingly collect personal data from, any individual under the age of 21. Age verification is a mandatory step in the account registration process, and KYC documentation confirming date of birth is required before a Member can make a first withdrawal.

If lok21 becomes aware that personal data has been collected from a person under the age of 21, that account will be suspended immediately, all funds will be returned to the original payment source in accordance with the lok21 Terms & Conditions, and all personal data associated with the underage account will be securely deleted as soon as legally permissible.

Parents and guardians concerned about underage access to online gaming platforms are encouraged to use parental control software to restrict access to gambling websites. If you believe a minor has registered an account on lok21, please contact support [at] lok21.net immediately.

lok21 operates an internationally distributed technical infrastructure. As a result, your personal data may be stored on or accessed from servers located outside Indonesia. Where such international transfers occur, lok21 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

Safeguards used for international data transfers include:

• Standard Contractual Clauses: Where data is transferred to third-party data processors in jurisdictions without an equivalent level of data protection, lok21 uses Standard Contractual Clauses (SCCs) or equivalent contractual mechanisms to establish binding data protection obligations on the receiving party.
• Adequacy Assessments: Before engaging any data processor in a new jurisdiction, lok21's compliance team conducts a data transfer impact assessment to identify risks and implement additional safeguards where necessary.
• Data Minimisation in Transit: Only the minimum personal data necessary to fulfil the relevant processing purpose is transmitted across jurisdictional boundaries. Identity and financial data is not transmitted internationally beyond what is required for payment processing and KYC verification.

lok21 reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. The "Last Updated" date at the top of this Policy will be revised whenever material changes are made.

Where a change to this Policy is material — meaning it significantly affects your rights or the way lok21 processes your personal data — lok21 will provide advance notice through one or more of the following channels:

• A prominent notice displayed on the lok21 platform upon your next login, requiring acknowledgement before continued access;
• A direct email notification to the address registered on your lok21 account, sent at least 14 days before the revised Policy takes effect;
• An in-platform notification in your account messages inbox.

Continued use of the lok21 platform following the effective date of any revised Policy constitutes acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the platform and contact support [at] lok21.net to close your account before the effective date.

Non-material changes — such as typographical corrections, clarifications that do not alter the substance of the Policy, or updates to contact information — may be made without advance notice, and the "Last Updated" date will be revised accordingly.

If you have any questions, concerns, or requests relating to this Privacy Policy or to lok21's handling of your personal data, please contact the lok21 Data Protection team using the details below. All data-related correspondence is handled in both English and Indonesian.

If you are not satisfied with lok21's response to a data rights request or privacy complaint, you have the right to escalate the matter to your relevant data protection authority or seek resolution through the dispute resolution procedure set out in the lok21 Terms & Conditions.