Privacy Policy

For the purposes of this Privacy Policy, the following terms have the meanings assigned below:

bolago operates as the Data Controller for all Personal Data collected and processed through the Platform. As Data Controller, bolago is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently in accordance with this Privacy Policy and applicable data protection principles.

bolago's designated Data Protection contact can be reached at [email protected] with the subject line "Data Protection Inquiry". We aim to acknowledge all data-related inquiries within five (5) business days (WIB business hours, Monday to Friday, 09:00–17:00 WIB).

bolago collects the following categories of Personal Data, depending on how you interact with the Platform:

bolago collects Personal Data through the following channels:

• Direct Submission: Data you voluntarily provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting our support team.
• Automated Collection: Technical and usage data collected automatically when you access the Platform, via server logs, session tracking, and first-party analytics tools embedded in the Platform.
• Cookies and Similar Technologies: Data gathered via cookies, web beacons, and local storage objects placed on your device during Platform sessions, as described in Section 7.
• Payment Processors: Confirmation data returned by local payment gateways (such as BCA virtual account services, BRI transfer confirmations, OVO and DANA transaction receipts) to verify that a deposit or withdrawal has been successfully processed.
• Third-Party Identity Verification Providers: Where bolago uses a licensed third-party KYC service provider to assist in verifying identity documents, that provider may return verification results and risk scores to bolago as part of the KYC process.
• Anti-Fraud and AML Screening: Data from commercially licensed screening databases used to verify that Members are not subject to sanctions, politically exposed person (PEP) designations, or known fraud watchlists.

bolago processes your Personal Data only where a lawful basis exists for doing so. The following table sets out the primary purposes for which we process Personal Data and the corresponding legal basis for each:

bolago does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We may share your Personal Data only in the following limited and controlled circumstances:

• Payment Service Providers: We share the financial data necessary to process your transactions with licensed payment processors and the banks or e-wallets you have selected (for example, BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja). These providers act as Data Processors under formal data processing agreements.
• Identity Verification Services: Third-party KYC and AML screening providers receive identity document data and return verification results to bolago. These providers are contractually prohibited from using your data for any purpose other than completing the verification task assigned by bolago.
• Game Content Providers: Studio providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized session data for game performance analytics. These providers do not receive identifiable personal information.
• IT Infrastructure and Hosting Providers: bolago's hosting, cloud storage, and cybersecurity service providers may have technical access to data stored on infrastructure they manage. All such providers operate under strict data processing agreements.
• Legal and Regulatory Authorities: bolago may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or in good-faith belief that disclosure is necessary to prevent imminent harm.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of bolago's assets, your Personal Data may be transferred to the successor entity, subject to equivalent privacy protections. You will be notified of any such transfer that materially affects this Policy.

bolago uses cookies and similar tracking technologies to operate and improve the Platform. The following cookie categories are in use:

Most web browsers allow you to manage cookie preferences through their settings panels. Blocking strictly necessary cookies will impair your ability to log in and use the Platform. bolago does not currently respond to "Do Not Track" browser signals, as no universal industry standard for these signals has been adopted.

bolago retains Personal Data for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your membership and for a period of five (5) years following permanent account closure, to comply with anti-money laundering record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years following account closure, as required by applicable financial compliance regulations.
• Transaction Records: Financial transaction logs are retained for a minimum of five (5) years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• Support Communications: Customer support chat logs and email correspondence are retained for three (3) years from the date of the last interaction, after which they are permanently deleted unless required for ongoing legal proceedings.
• Analytics Data: Aggregated, anonymized usage analytics data may be retained indefinitely as it cannot be used to identify individual Members.
• Marketing Preferences: Records of your consent or opt-out status for marketing communications are retained for the full duration of your membership and for two (2) years after account closure.

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymized using industry-standard data destruction methods. bolago does not archive Personal Data beyond its retention period without a documented legal justification.

bolago implements a multi-layered technical and organizational security framework designed to protect Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Key security measures include:

• TLS 1.3 Encryption: All data transmitted between your device and bolago's servers is encrypted using Transport Layer Security (TLS) 1.3, the current industry gold standard for in-transit data protection.
• AES-256 Data Encryption at Rest: Personal Data stored in bolago's databases is encrypted using AES-256, the same encryption standard used by international financial institutions.
• Access Controls: Access to systems containing Personal Data is restricted on a strict need-to-know basis, enforced through role-based access controls, multi-factor authentication for administrative accounts, and comprehensive access logging.
• Regular Penetration Testing: bolago commissions independent third-party security assessments and penetration tests on a regular cycle to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: bolago maintains a documented data breach incident response plan. In the event of a confirmed breach affecting Member data, bolago will notify affected Members and relevant authorities in accordance with Section 9 of this Policy and applicable law.
• Staff Training: All bolago personnel with access to Member data complete mandatory data protection and information security training as a condition of their access privileges being granted and renewed.

As a bolago Member and a data subject, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and include your registered username and a description of your request.

• Right of Access: You have the right to request a copy of the Personal Data bolago holds about you, along with information about how it is being processed. We will fulfill verified access requests within thirty (30) calendar days.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update certain data fields directly within your Account Settings panel.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected and where no legal retention obligation overrides the deletion request. Note that regulatory obligations may require us to retain certain data (such as KYC documents and transaction records) for a minimum statutory period even after account closure.
• Right to Restriction of Processing: You may request that bolago suspend the processing of your Personal Data in specific circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive your Personal Data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You have the right to object to processing carried out on the basis of bolago's legitimate interests, including profiling for responsible gaming monitoring. Where you object, bolago will cease processing unless compelling legitimate grounds override your objection.
• Right to Withdraw Consent: Where processing is based on your consent (for example, for marketing communications), you may withdraw that consent at any time via your Account Settings. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

The bolago Platform is strictly intended for adults aged 21 and over. bolago does not knowingly collect or process Personal Data from any individual under the age of 21. Age verification is a mandatory component of the KYC process for all Members prior to withdrawal eligibility being granted.

If bolago becomes aware — through any means, including parental notification or KYC review — that a Member account has been registered by or used by an individual under the age of 21, bolago will immediately suspend the account, void all associated wagers and bonus balances, return any verified deposited funds to the original payment source, and permanently delete all Personal Data associated with the underage account from active systems, subject to any mandatory regulatory retention obligations.

bolago's primary Member base is located in Indonesia, and our platform is designed to serve Indonesian players. However, certain technical operations — including cloud hosting infrastructure, third-party KYC verification services, and game content delivery from studio providers such as Pragmatic Play and Evolution Gaming — may involve Personal Data being processed on servers located outside Indonesia.

Where Personal Data is transferred internationally, bolago ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. Such safeguards may include contractual data transfer clauses, data processing agreements requiring the receiving entity to apply equivalent security and privacy standards, and technical measures such as end-to-end encryption.

bolago does not transfer Personal Data to jurisdictions that bolago has assessed as providing materially inadequate data protection standards without first implementing the additional safeguards described above.

bolago reviews this Privacy Policy regularly and reserves the right to update it at any time to reflect changes in our data processing practices, applicable law, or Platform operations. The "Last Updated" date at the top of this page will be revised whenever a material change is made.

Where changes are material — meaning they substantively alter how we collect, use, or share your Personal Data — bolago will notify active Members by email to the address registered on their Account at least fourteen (14) days before the updated Policy takes effect. For non-material updates (such as clarifications of existing language or correction of typographical errors), the revised Policy will take effect immediately upon publication.

We encourage you to review this Privacy Policy periodically. Your continued use of the bolago Platform following the effective date of any update constitutes your acknowledgment of the revised Policy. If you do not accept the revised terms, you should cease using the Platform and submit an account closure request to [email protected].

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how bolago has handled your Personal Data, please contact us using the details below:

If you are not satisfied with bolago's response to a data-related complaint, you have the right to escalate the matter to the relevant data protection authority or seek independent legal advice. bolago will cooperate fully with any legitimate regulatory investigation into our data processing practices.

For responsible gaming concerns, including requests to apply deposit limits, session restrictions, or self-exclusion, please visit our dedicated Responsible Gaming page or contact support at the email address above with the subject line "Responsible Gaming Request".