Privacy Policy

1. Introduction

babyjp operates as an internationally licensed online gaming platform serving players across Indonesia, including in Jakarta, Surabaya, Medan, Bandung, Yogyakarta, Bali, and beyond. As a platform that handles financial transactions and identity-sensitive data, we recognise that responsible data stewardship is both a legal obligation and a fundamental expression of the trust our players place in us.

This Policy applies to all personal data processed in connection with your use of the babyjp website, mobile-optimised interface, customer support channels, and any associated services. It should be read alongside our Terms & Conditions, which govern the broader contractual relationship between you and babyjp.

babyjp is the data controller for the purposes of this Policy. We are committed to handling your data with integrity, limiting collection to what is genuinely necessary, and giving you meaningful control over how your information is used.

2. Data We Collect

babyjp collects the following categories of personal data:

Category	Examples	Collected At
Identity Data	Full legal name, date of birth, nationality, government ID number (KTP, SIM, or passport)	Registration & KYC verification
Contact Data	Email address, phone number, residential address (including city and province in Indonesia)	Registration & account updates
Financial Data	Bank account name and number (BCA, BRI, BNI, Mandiri), e-wallet account (OVO, DANA, GoPay), transaction history in IDR / Rp	Deposit and withdrawal processing
Verification Data	Copies of identity documents, proof of address, selfie photographs submitted during KYC	KYC verification process
Technical Data	IP address, browser type and version, device type and operating system, session timestamps, login history	Automatically, on every platform visit
Usage Data	Pages visited, games played, bet history, session duration, feature interactions	Automatically, during platform use
Communications Data	Content of emails, live chat transcripts, and support tickets submitted to babyjp	When you contact customer support

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data (except where voluntarily disclosed in a responsible gaming context), or biometric identifiers beyond those explicitly required for identity verification.

3. How We Collect Your Data

3.1 Directly from You. The majority of the data babyjp holds about you is provided directly by you during account registration, KYC submission, payment processing, or when you contact our support team. You are in control of what you provide.

3.2 Automatically. When you access the babyjp platform, certain technical and usage data is collected automatically through standard web technologies including server logs, session cookies, and analytics tools. This data helps us maintain platform security, detect fraud, and improve the user experience.

3.3 From Third Parties. In limited circumstances, babyjp may receive data about you from third parties, including:

• Identity verification partners (for enhanced KYC checks).
• Payment processors, including Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay), to confirm the status of financial transactions.
• Fraud prevention and anti-money-laundering (AML) screening services.

In each case, we only request and receive the minimum data necessary for the specific purpose and we ensure that any third-party data provider is subject to appropriate data-protection standards.

4. Purpose & Legal Basis for Processing

babyjp processes personal data for the following purposes and on the following legal bases:

• Account creation and management — necessary for the performance of our contract with you.
• Identity verification (KYC) and age confirmation (21+) — necessary to comply with our international licensing obligations and to protect minors.
• Processing deposits and withdrawals — necessary for the performance of our contract with you; involves sharing relevant transaction data with BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay as payment intermediaries.
• Fraud detection and platform security — necessary for our legitimate interest in protecting the platform and all of its users from financial crime, collusion, and unauthorised access.
• Anti-money-laundering (AML) compliance — necessary to comply with legal obligations imposed by our licensing authority.
• Customer support — necessary for the performance of our contract with you and for our legitimate interest in resolving disputes fairly.
• Platform analytics and improvement — necessary for our legitimate interest in maintaining and improving the quality and security of the platform.
• Responsible gaming monitoring — necessary for our legal obligation and our legitimate interest in protecting vulnerable players.
• Direct marketing communications — based on your explicit consent, which you may withdraw at any time by contacting support or updating your account notification preferences.

5. Data Sharing & Disclosure

5.1 Internal Access. Access to your personal data within babyjp is restricted to staff whose job functions require it — specifically, customer support agents, compliance officers, and financial operations teams. All staff with data access are bound by confidentiality obligations.

5.2 Service Providers (Processors). babyjp shares data with the following categories of trusted third-party service providers who process data on our behalf and under our instructions:

• Payment processors: BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay — to process your deposits and withdrawals in Indonesian Rupiah.
• Identity verification services: KYC technology partners who verify the authenticity of identity documents.
• Cloud infrastructure providers: Server and database hosting services operating under enterprise-grade data security agreements.
• Fraud and AML screening providers: Automated risk assessment tools used to detect suspicious activity patterns.
• Analytics providers: Anonymised, aggregated platform usage analytics — no personally identifiable data is shared with analytics partners.

5.3 Legal Disclosures. babyjp may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by law, court order, or to defend against legal claims. We will notify you of any such disclosure where permitted by law to do so.

5.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of babyjp's assets, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and before a different privacy policy applies to it.

5.5 No Sale of Data. babyjp does not sell, rent, trade, or otherwise transfer your personal data to third parties for their own commercial purposes. This commitment is unconditional and does not have exceptions for anonymised or aggregated data that could reasonably re-identify you.

6. Data Retention

6.1 Active Accounts. While your account remains active, babyjp retains all personal data collected during the course of your use of the platform. This data is necessary to operate your account, comply with our licensing obligations, and resolve any disputes that may arise.

6.2 Closed Accounts. Following account closure, babyjp retains personal data for a minimum of five (5) years from the date of closure. This retention period reflects the requirements of our international gaming licence and standard financial record-keeping obligations. Financial transaction records may be retained for longer if required by applicable law.

6.3 KYC Documents. Identity documents submitted as part of the KYC process are retained for the duration of the account relationship plus five years post-closure, in line with anti-money-laundering regulatory requirements.

6.4 Marketing Data. Where you have consented to receive marketing communications, your marketing preferences and contact data are retained until you withdraw consent. Following withdrawal, your details are suppressed (not deleted) to ensure we do not inadvertently contact you again.

6.5 Support Records. Customer support communications (emails, chat logs) are retained for 24 months from the date of the interaction to support quality assurance, dispute resolution, and staff training purposes.

7. Cookies & Tracking Technologies

babyjp uses a limited set of cookies and similar tracking technologies on our platform. We categorise our cookie use as follows:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They include session management cookies that keep you logged in, security tokens that protect against cross-site request forgery (CSRF), and load-balancing cookies. These cannot be disabled without impairing core platform functionality.
• Functional Cookies: These remember your preferences such as language settings and display preferences. They improve your experience but are not strictly necessary to use the platform.
• Analytics Cookies: babyjp uses anonymised, first-party analytics cookies to understand how players interact with our platform in aggregate — for example, which pages are most visited and where users exit. No personally identifiable information is passed to analytics systems.

babyjp does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. We do not participate in cross-site behavioural advertising networks.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the platform. Disabling functional or analytics cookies will not prevent you from using babyjp's core features.

8. Data Security

8.1 Technical Safeguards. babyjp implements a comprehensive set of technical security measures to protect your personal data against unauthorised access, loss, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial records.
• Multi-factor authentication (MFA) options for player accounts and mandatory MFA for all internal staff systems.
• Regular third-party penetration testing and vulnerability assessments of our platform infrastructure.
• Intrusion detection and prevention systems (IDS/IPS) monitoring network traffic in real time.
• Segregated database architecture ensuring that personal data, financial data, and game data are stored in separate, access-controlled environments.

8.2 Organisational Safeguards. Beyond technical controls, babyjp enforces strict organisational measures to protect your data:

• All staff with access to personal data undergo mandatory data protection training and are bound by confidentiality agreements.
• Access to personal data follows the principle of least privilege — staff can only access the data necessary for their specific job function.
• All data access events are logged and audited on a regular basis by our internal compliance team.
• A documented incident response plan is maintained and tested periodically to ensure a swift and effective response in the event of a data breach.

8.3 Data Breach Notification. In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, babyjp will notify affected players without undue delay and, where required, will report the breach to the relevant regulatory authority within the timeframe stipulated by applicable law. Notifications will be sent to your registered email address and will include a description of the breach, the data affected, and the steps babyjp is taking in response.

9. Your Data Rights

As a player on the babyjp platform, you are entitled to exercise the following rights in relation to your personal data. To submit a request, contact us at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and respond in full within 30 days (WIB business days).

10. Children's Privacy

babyjp's platform is strictly for adults aged 21 and over. We do not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory step during account registration, and our KYC process is specifically designed to confirm that all players meet this requirement before they can deposit funds or access any real-money games, including togel (Indonesia's traditional numbers lottery), sports betting, and live casino products.

If babyjp becomes aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the data collected, and return any deposits made to the original payment method. If you believe a minor has registered an account on the babyjp platform, please contact us immediately at [email protected].

Parents and guardians are encouraged to use parental control software and to speak openly with young people about online gambling risks. Further guidance is available on our Responsible Gaming page.

11. International Data Transfers

11.1 Cross-Border Processing. babyjp's infrastructure involves data processing in multiple jurisdictions, as our servers, payment processors, and KYC partners may be located in countries other than Indonesia. When your personal data is transferred outside of Indonesia, babyjp ensures that appropriate safeguards are in place to maintain the same level of protection that you would expect if your data remained in Indonesia.

11.2 Safeguards in Place. For transfers to countries that do not have an adequacy decision or equivalent data protection framework, babyjp relies on one or more of the following mechanisms:

• Standard contractual clauses (SCCs) incorporated into contracts with third-party processors and sub-processors.
• Data processing agreements (DPAs) that impose data protection obligations equivalent to those in this Policy.
• Binding corporate rules where transfers occur within a group of companies under a unified privacy framework.

11.3 Payment Data Localisation. Financial transaction data involving Indonesian bank accounts (BCA, BRI, BNI, Mandiri) and local e-wallets (OVO, DANA, GoPay) is processed through the respective institution's domestic infrastructure and is subject to Indonesian banking and payment system regulations. babyjp does not route Indonesian payment data through unnecessary third countries.

12. Amendments to This Policy

12.1 Right to Update. babyjp reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. The "Last Updated" date at the top of this page will be revised whenever a change is made.

12.2 Notification of Material Changes. Where a proposed change is material — meaning it significantly affects how we collect, use, or share your personal data — babyjp will provide at least 14 days' advance notice via email to your registered address and through a prominent notice on the platform, before the change takes effect.

12.3 Continued Use. Your continued use of the babyjp platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with any change, you may request account closure in accordance with Section 10.3 of our Terms & Conditions.

13. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a privacy-related complaint, please contact babyjp's data protection team using the details below:

• Support Email: [email protected]
• Subject Line: "Privacy Policy Enquiry" or "Data Rights Request" as applicable
• Response Time: Acknowledgement within 48 hours; full response within 30 calendar days (WIB)
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays
• Languages: English and Bahasa Indonesia

If you are not satisfied with babyjp's response to a privacy complaint, you have the right to escalate the matter to the supervisory authority responsible for data protection in the jurisdiction where babyjp holds its international gaming licence. Details of the applicable authority will be provided upon request.