Privacy Policy — ex606

In this Privacy Policy the following terms carry the meanings set out below:

• "ex606" (also "we", "us", "our", "the Platform") means the online casino and sportsbook operated at https://ex606.app and all associated sub-domains.
• "Member" / "you" means any individual who has registered an account on ex606 or who visits the Platform as an unauthenticated user.
• "Personal Data" means any information that identifies or could reasonably identify a natural person, including name, date of birth, contact details, financial account details, and device identifiers.
• "Processing" means any operation performed on Personal Data — including collection, storage, retrieval, use, disclosure, and deletion.
• "KYC" means Know Your Customer — the identity verification process required of all Members prior to their first withdrawal.
• "Payment Data" means bank account numbers, e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), or card numbers associated with deposit and withdrawal transactions.
• "Cookies" means small text files placed on your device by the Platform to maintain session state, support analytics, and remember preferences.
• "Third-Party Processor" means any external vendor engaged by ex606 to process Personal Data on ex606's behalf under a binding data processing agreement.
• "WIB" means Western Indonesia Time (UTC+7), the default operating time zone referenced in support and processing SLAs throughout this Policy.

This Privacy Policy applies to all Personal Data collected by ex606 through any channel, including the ex606 website (https://ex606.app), mobile-optimised web interfaces, customer support communications (email and live chat), and any promotional or referral programmes operated by ex606.

This Policy applies to all current and former Members, as well as to visitors who browse the Platform without registering. Where a specific product or service operates under supplementary privacy terms, those supplementary terms apply in addition to — and, in the event of conflict, are subordinate to — this Policy.

ex606's Platform is intended exclusively for adults aged 21 and above who are accessing the Platform for lawful personal entertainment purposes. By using the Platform you confirm that you are at least 21 years of age and that the processing of your Personal Data as described in this Policy is lawful in your jurisdiction.

ex606 collects Personal Data across the following categories:

ex606 collects Personal Data through the following channels:

• Directly from you: When you complete the registration form, submit KYC documents, add a bank account or e-wallet for deposits and withdrawals, contact our support team via live chat or email, or update your account preferences.
• Automatically: When you visit or interact with the Platform, our servers and analytics tools automatically record Technical Data and Behavioural Data such as your IP address, session duration, and the game categories you navigate.
• From KYC and payment partners: Where an authorised Third-Party Processor (such as a KYC verification bureau or payment gateway) confirms or supplements identity and payment information provided by you, ex606 may receive that confirmation data in order to complete your verification or transaction.
• From cookies and similar technologies: As described in Clause 7 below, certain cookies automatically capture Technical Data and session-state information each time you access the Platform.

ex606 processes your Personal Data only for specified, explicit, and legitimate purposes. The table below maps each processing purpose to its legal basis:

Where we rely on legitimate interest as a legal basis, we have conducted a balancing test to confirm that our legitimate interest is not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interest — see Clause 10 for details.

ex606 does not sell, rent, or exchange your Personal Data with any third party for commercial gain. We share Personal Data only in the following circumstances and only to the minimum extent required:

• Payment processors: To execute deposits and withdrawals, we share necessary Payment Data with authorised banking and e-wallet partners, including networks connected to BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja. These partners are bound by their own regulatory obligations and by contractual data protection terms with ex606.
• KYC and identity verification providers: To fulfil our age (21+) and identity verification obligations, we share Identity Data and document images with accredited KYC verification bureaus. These providers act as Third-Party Processors under binding data processing agreements and may not use your data for any purpose other than KYC verification.
• Game studios and RNG certification bodies: Aggregated, non-identifiable transaction data may be shared with game providers (including Evolution Gaming, Pragmatic Play, PG Soft, Spribe, NetEnt, and Microgaming) for game settlement, dispute resolution, and regulatory reporting purposes. No directly identifiable Personal Data is shared with game studios beyond what is required for settling a specific disputed game round.
• Technology infrastructure providers: Cloud hosting, server management, and cybersecurity vendors who process Personal Data solely on ex606's instructions under confidentiality and data processing agreements.
• Legal and regulatory authorities: Where required by applicable law, court order, or a lawful request from a competent regulatory or law enforcement authority, ex606 will disclose Personal Data to the extent legally mandated. ex606 will, where permitted by law, notify the affected Member before making such a disclosure.

ex606 uses cookies and similar lightweight tracking technologies to operate the Platform effectively. The cookies deployed by ex606 fall into the following categories:

ex606 does not deploy third-party advertising cookies, cross-site tracking pixels, or social media widgets that report your browsing activity to external advertising networks. You can manage or delete cookies at any time through your browser's privacy settings. Note that disabling Strictly Necessary cookies will impair your ability to log in and use the Platform.

ex606 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption on all data in transit between your browser and ex606's servers.
• Encryption at rest for all sensitive Personal Data and Payment Data stored in our database systems.
• Role-based access control (RBAC) ensuring that Personal Data is accessible only to ex606 staff members with a demonstrated operational need.
• Multi-factor authentication (MFA) enforced for all internal administrative access to systems holding Member Personal Data.
• Regular penetration testing and independent security audits conducted by qualified third-party cybersecurity professionals.
• Intrusion detection systems (IDS) and anomaly monitoring that flag unusual access patterns in real time, operating 24/7 across WIB, WITA, and WIT time zones.
• Incident response procedures that require us to notify affected Members within 72 hours of becoming aware of a personal data breach that is likely to result in a high risk to your rights and freedoms.

ex606 retains your Personal Data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following default retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked back to you. Where anonymisation is used in lieu of deletion, the resulting data is used only for aggregate statistical analysis and carries no personal identifiers.

As an ex606 Member you hold the following rights in relation to your Personal Data. To exercise any of these rights, submit a written request to [email protected] with your registered account username and a clear description of the right you wish to exercise. ex606 will respond within 30 days of receipt.

• Right of Access: You may request a copy of all Personal Data ex606 holds about you, including the categories of data, the purposes for which it is processed, and any third parties to whom it has been disclosed.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request its correction or completion without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and there is no overriding legitimate interest. This right is subject to our legal retention obligations.
• Right to Restriction: You may request that we restrict processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object at any time to processing of your Personal Data for direct marketing purposes. You also have the right to object to processing based on legitimate interest, in which case ex606 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests and rights.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

ex606 strictly prohibits the use of its Platform by any person under the age of 21. We do not knowingly collect Personal Data from individuals under 21. Our registration process includes age verification steps, and our KYC programme requires all Members to confirm their age with government-issued photo identification.

If ex606 becomes aware or has reasonable grounds to believe that a Member is under the age of 21, the account will be immediately suspended, all balances will be frozen pending investigation, and all Personal Data associated with the underage account will be securely deleted in accordance with the procedures set out in Clause 9 above — with the exception of records required to be retained for AML compliance purposes.

ex606 operates infrastructure across multiple geographic regions to ensure service availability, redundancy, and performance for Members across Indonesia — including Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, Semarang, Palembang, and Makassar. As a result, your Personal Data may be stored on or transferred to servers located outside Indonesia.

Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to Indonesia, ex606 employs appropriate safeguards to ensure that your data remains protected to a standard at least equivalent to that applied within Indonesia. These safeguards include:

• Binding contractual clauses (data processing agreements) incorporating standard data protection obligations between ex606 and the receiving entity.
• Technical safeguards including end-to-end encryption of data in transit and at rest.
• Restricting transfers to jurisdictions that ex606 has independently assessed as providing an adequate level of protection for the categories of data being transferred.

By registering an account on ex606 and accepting these terms, you acknowledge that your Personal Data may be transferred, stored, and processed outside Indonesia under the safeguards described in this clause.

ex606 may update this Privacy Policy from time to time to reflect changes in our data processing practices, new regulatory requirements, or improvements to our Platform and services. The "Last updated" date shown at the top of this page will be revised each time a material change is made.

Where a proposed amendment materially affects how we use your Personal Data or reduces your rights, ex606 will provide at least 14 days' advance notice by posting a prominent notice on the Platform and, where appropriate, by sending a notification to your registered email address. Non-material amendments (such as clarifications, corrections of typographic errors, or structural reorganisation that does not change the substance) take effect immediately upon publication.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with an amendment, you must stop using the Platform and contact [email protected] to request account closure before the amendment takes effect.

Previous versions of this Privacy Policy are available upon written request submitted to [email protected]. We retain prior versions for a minimum of three (3) years from the date of supersession.

If you have any questions about this Privacy Policy, wish to exercise a data right under Clause 10, or want to raise a concern about how ex606 handles your Personal Data, please contact us through the following channel:

• Email: [email protected] — please include "Privacy Request" in the subject line along with your registered account username.
• Live Chat: Available 24/7 directly within the Platform after logging in to your account. Indonesian-speaking support agents are available around the clock.
• Response SLA: Privacy-related requests are acknowledged within 48 hours (WIB business hours) and substantively resolved within 30 days of receipt of a complete request.