Privacy Policy

This Privacy Policy applies to all personal data processed by 11boa in connection with the online betting and casino platform available at https://11boa.net (the "Platform"). It governs data collected through the website, mobile-optimised browser interfaces, live-chat support sessions, email correspondence, and any other touchpoint through which you interact with 11boa.

11boa operates as an internationally licensed online gaming operator serving players in Indonesia and other jurisdictions where online betting is accessible. This Policy is written to meet the standards of internationally recognised data protection frameworks, including the principles set out in the EU General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (UU PDP No. 27 Tahun 2022), which we adopt as best-practice standards regardless of strict legal applicability.

By registering an account, logging in, or otherwise using the Platform, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy. If you do not agree, you must discontinue use of the Platform immediately.

This Policy should be read alongside 11boa's Terms & Conditions and Responsible Gaming page, which together form the full framework governing your use of the Platform.

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including name, identification number, location data, online identifiers, or factors specific to the physical, economic, cultural, or social identity of that person.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means 11boa, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of 11boa, subject to a binding data-processing agreement.
• "User" / "you" means any natural person who accesses or uses the Platform, whether as a registered account holder or as an anonymous visitor.
• "KYC" (Know Your Customer) means the identity and age verification process required before a User may process financial transactions on the Platform.
• "Sensitive Data" means Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, health status, financial account details, or biometric data — all of which receive enhanced protection under this Policy.

11boa collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:

11boa collects Personal Data through the following channels and mechanisms:

1. Direct Submissions: Information you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, or contacting our support team via live chat or email.
2. Automated Technical Collection: When you access the Platform, our servers automatically record technical data including your IP address, browser type, device identifiers, and session activity logs. This collection is necessary for platform security, fraud detection, and performance monitoring.
3. Cookies and Similar Technologies: The Platform uses first-party cookies and local storage to maintain session state, remember user preferences, and track aggregate usage patterns. See Section 10 for full details.
4. Third-Party Payment Processors: When you initiate a deposit or withdrawal, the payment processor may share transaction confirmation data with 11boa to allow us to update your wallet balance and maintain an accurate transaction record.
5. KYC Verification Providers: Where 11boa employs a third-party KYC verification service to validate government-issued identity documents, that provider may return a verification result (pass/fail) and summary metadata to 11boa. The document image itself may be stored by the KYC provider under their own privacy policy, subject to a data-processing agreement with 11boa.
6. Responsible Gaming Tool Activations: When you set a deposit limit, activate a cool-off period, or request self-exclusion, the Platform records that event as part of your account's responsible gaming history.

11boa processes your Personal Data exclusively for the following defined purposes:

1. Account Management: To register, authenticate, and maintain your 11boa account, including processing your login credentials and maintaining your account preferences and history.
2. Identity and Age Verification (KYC): To verify that you are at least 21 years of age and to confirm your identity as required by our licensing obligations and responsible gaming commitments. Indonesian players will have their KTP data verified against submitted documents.
3. Transaction Processing: To process deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, and Indonesian e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and to process withdrawal requests to your verified payment account.
4. Platform Security and Fraud Prevention: To detect, investigate, and prevent unauthorised access, multi-accounting, bonus abuse, money laundering, match-fixing involvement, and any other activity that threatens the integrity of the Platform or the interests of other users.
5. Regulatory and Legal Compliance: To maintain records required by our international gaming licence, to respond to lawful requests from competent authorities, and to fulfil obligations under applicable data protection law.
6. Customer Support: To respond to your support enquiries, resolve disputes, and provide 24/7 Indonesian-speaking assistance via live chat and email.
7. Responsible Gaming: To administer the deposit limits, cool-off periods, and self-exclusion tools that you activate on your account, and to monitor for patterns of play that may indicate problem gambling behaviour.
8. Promotions and Bonus Administration: Where you have opted in to marketing communications, to send you information about relevant promotions, bonuses, and seasonal offers tailored to your activity on the Platform.
9. Platform Improvement: To analyse aggregated, anonymised usage patterns to improve game performance, navigation, and the overall user experience on the Platform.

For each category of processing activity, 11boa relies on one or more of the following legal bases:

Where 11boa relies on legitimate interests as the legal basis for processing, we have conducted a balancing assessment to confirm that our interests are not overridden by your fundamental rights and freedoms. You may request a summary of any such assessment by contacting our Data Protection Officer (see Section 15).

11boa shares your Personal Data with third parties only in the specific circumstances described below. In all cases, data sharing is subject to contractual data-protection obligations that require the recipient to protect your Personal Data to a standard at least equivalent to this Policy.

1. Payment Processors: To process deposits and withdrawals via local Indonesian banking and e-wallet channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja), 11boa shares the minimum transaction data required by the relevant payment processor — typically your account identifier, transaction amount, and designated payment destination. Full financial credentials are never shared with 11boa by these processors.
2. KYC Verification Providers: To fulfil age and identity verification obligations, 11boa may transmit your submitted identity documents and personal details to a certified KYC verification partner. These partners operate under strict data-processing agreements and are prohibited from using your data for any purpose other than the verification task.
3. Game Content Providers: Live casino and slot game sessions involve a real-time data connection between your browser and the game studio's servers (e.g., Evolution Gaming, Pragmatic Play, Microgaming). Game studios receive a pseudonymous session token and game result data; they do not receive your full identity or financial data unless this is required by a specific studio's licensing terms, in which case it will be disclosed to you prior to playing.
4. Customer Support Platforms: Our live-chat support system is operated via a third-party customer service platform. Support conversation content may be stored on that platform's servers under a data-processing agreement with 11boa.
5. Legal and Regulatory Authorities: 11boa will disclose Personal Data to competent governmental, regulatory, or law enforcement authorities where required to do so by applicable law, court order, or valid legal process. Where legally permitted, 11boa will notify you of such a request before complying.
6. Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of 11boa's assets, your Personal Data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any material changes to data processing that result from it, with a minimum of 30 days' advance notice.

11boa retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and licensing obligations. The following retention periods apply:

At the end of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with 11boa's data destruction procedures. Anonymised data (from which you can no longer be identified) may be retained indefinitely for aggregate analytics purposes.

11boa implements a layered security architecture designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our key technical and organisational security measures include:

1. Encryption in Transit: All data exchanged between your browser and the 11boa Platform is encrypted using TLS 1.2 or higher (256-bit SSL). The Platform enforces HTTPS exclusively — unencrypted HTTP connections are automatically redirected.
2. Encryption at Rest: Sensitive Personal Data, including identity documents and financial records, is encrypted at rest using AES-256 encryption. Encryption keys are managed under a dedicated key management system with access restricted to authorised personnel only.
3. Access Controls: Access to systems containing Personal Data is governed by role-based access control (RBAC). Staff members access only the minimum Personal Data necessary for their specific role. All administrative access is logged and periodically audited.
4. Two-Factor Authentication: 11boa supports two-factor authentication (2FA) for all registered accounts. We strongly encourage all users to enable 2FA via the account security settings. Internal staff access to production systems mandates 2FA.
5. Intrusion Detection and Rate Limiting: The Platform operates automated intrusion detection systems, IP-based rate limiting on login and API endpoints, and 24/7 security monitoring to detect and respond to suspicious activity in real time.
6. Vulnerability Management: 11boa conducts regular penetration testing and vulnerability scanning. Critical vulnerabilities are patched within 24 hours of discovery; high-severity vulnerabilities within 72 hours.
7. Staff Training: All 11boa personnel who handle Personal Data receive regular data protection and information security training. Confidentiality agreements are in place for all staff with access to user data.
8. Data Breach Response: In the event of a Personal Data breach that poses a risk to your rights and freedoms, 11boa will notify affected users within 72 hours of becoming aware of the breach, and will report to the relevant supervisory authority where required by law.

The 11boa Platform uses cookies and similar client-side storage technologies to deliver core functionality and to understand how users interact with the Platform. The following cookie categories are in use:

11boa does not use third-party advertising cookies or tracking pixels that report your behaviour to external advertising networks. All analytics data collected on the Platform is processed by 11boa or its contracted analytics providers under data-processing agreements, and is not shared with advertising platforms.

You can control functional and analytics cookies through the Privacy Settings section of your account dashboard. Note that disabling strictly necessary and fraud-detection cookies via your browser settings may prevent the Platform from functioning correctly.

Subject to applicable law and the limitations described below, you hold the following rights in respect of your Personal Data processed by 11boa:

To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "Data Rights Request". 11boa will respond within 30 days of receiving a valid request. Where requests are complex or numerous, we may extend this period by a further 60 days with notice.

The 11boa Platform is strictly intended for adults aged 21 years and over. 11boa does not knowingly collect Personal Data from any person under the age of 21. Age verification (KYC) is a mandatory step prior to any financial transaction on the Platform.

If 11boa becomes aware that it has inadvertently collected Personal Data from an individual under 21, it will immediately suspend the relevant account, delete the associated Personal Data within 72 hours of discovery, and return any deposited funds to the originating payment account.

If you are a parent or guardian and believe that a person under 21 has registered or attempted to use the 11boa Platform, please contact [email protected] immediately with the subject line "Underage Account Report". We will investigate and act promptly.

11boa's Platform infrastructure and third-party service providers may be located in countries outside Indonesia. Where Personal Data is transferred to a country that does not provide a level of data protection equivalent to Indonesian or internationally recognised standards, 11boa implements appropriate safeguards to protect your data, including:

• Standard Contractual Clauses (SCCs) or equivalent contractual protections between 11boa and the recipient;
• Adequacy assessments to confirm that the recipient jurisdiction provides comparable protections;
• Technical safeguards including end-to-end encryption of data in transit.

You may request details of the specific safeguards applied to any cross-border data transfer involving your Personal Data by contacting our Data Protection Officer.

11boa reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, new legal requirements, or Platform developments. The date of the most recent revision is displayed at the top of this page.

For material changes — defined as changes that broaden the categories of data we collect, introduce new processing purposes, alter the legal basis for processing, or materially affect your rights — 11boa will provide at least 14 days' advance notice by posting a prominent notice on the Platform and, where practicable, by sending a notification to the email address registered on your account.

Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and may request account closure in accordance with the Terms & Conditions.

Archived versions of previous Privacy Policies are available upon request from our Data Protection Officer.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data, please contact the 11boa Data Protection Officer (DPO) using the details below. Our support team is available 24 hours a day, 7 days a week, with Indonesian-speaking agents available at all hours.