Privacy Policy

1. Definitions

Throughout this Privacy Policy, the following terms carry the meanings defined below:

2. Scope & Application

This Privacy Policy applies to all personal data collected and processed by hwg500 in connection with the operation of the platform and the provision of online gaming services to members located in Indonesia and other permitted jurisdictions. It governs data collected through all channels, including account registration, gaming activity, payment transactions, customer support interactions, and website browsing sessions.

This policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with hwg500. In the event of any inconsistency between this policy and a more specific data-related clause in another document, the more specific clause shall prevail for that specific matter.

3. Personal Data We Collect

hwg500 collects the minimum personal data necessary to deliver our services securely and in compliance with applicable regulations. The categories of personal data we collect include the following:

3.1 Registration & Identity Data

When you create an account, we collect your full legal name, date of birth, Indonesian residential address, email address, mobile phone number, and the password you set for your account. This information is required to establish your identity and validate your eligibility to use the platform.

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and age verification requirements, we collect copies of government-issued identification documents (such as your KTP, Passport, or SIM), proof of residential address documents, and, where required, a selfie photograph with your identity document. We may also collect bank account ownership evidence.

3.3 Financial & Transaction Data

We record all deposit and withdrawal transactions, including transaction amounts in Indonesian Rupiah (IDR), payment method details (bank account numbers associated with BCA, BRI, BNI, Mandiri, and other supported Indonesian banks, or e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja), transaction timestamps, and transaction reference numbers. We do not store full card numbers or online banking credentials on our platform.

3.4 Gaming Activity Data

We maintain records of your gaming history on the platform, including games played, bet amounts, game outcomes, bonus activations, wagering requirement progress, and session durations. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance purposes.

3.5 Technical & Device Data

When you access the platform, we automatically collect technical information including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, time spent on pages, and click-path data. This information is used for platform security, fraud prevention, and improving the user experience.

3.6 Customer Support Communications

When you contact our support team via live chat, WhatsApp, Telegram, or email, we retain records of those communications, including the content of messages, timestamps, and any documents shared during the interaction. These records support quality assurance, dispute resolution, and continuity of service.

4. How We Collect Your Data

hwg500 collects personal data through the following channels and mechanisms:

• Directly from you: Information you provide during account registration, KYC document submission, deposit and withdrawal requests, and customer support interactions.
• Automatically via the platform: Technical and behavioral data collected through server logs, cookies, pixel tags, and similar tracking technologies when you browse or use the platform.
• From payment service providers: Transaction confirmation data and payment status updates received from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• From identity verification services: Verification status and risk signals from third-party KYC service providers engaged by hwg500 to assist in identity document authentication.
• From fraud prevention and security services: Risk scores, device fingerprint data, and flagged behavior patterns from third-party fraud detection services that help us protect the platform and our members.

5. Purposes & Legal Basis for Processing

hwg500 processes your personal data only for specified, lawful purposes. The table below summarizes the primary processing activities, their purposes, and the legal basis for each:

6. Cookies & Tracking Technologies

The hwg500 platform uses cookies and similar tracking technologies to deliver core functionality, maintain session security, and gather anonymized analytics data. By continuing to use the platform after reviewing this policy, you consent to our use of cookies as described below.

6.1 Types of Cookies We Use

6.2 Managing Cookies

Most modern browsers allow you to view, manage, and delete cookies through their settings menu. Disabling strictly necessary cookies will impair your ability to use the platform, including logging in and placing bets. Disabling functional or analytics cookies will not prevent you from using core platform features, though your experience may be less personalized. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

7. Sharing & Disclosure of Personal Data

hwg500 does not sell, rent, or trade your personal data to any third party for their independent commercial use. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

7.1 Service Providers (Processors)

We engage carefully selected third-party service providers to assist in delivering platform services. These include payment processors and Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, and e-wallet providers), identity verification and KYC solution providers, fraud detection and cybersecurity vendors, cloud infrastructure and hosting providers, and customer support technology platforms. All processors are bound by contractual data processing agreements requiring them to handle your data strictly in accordance with our instructions and applicable data protection standards.

7.2 Game Content Providers

Certain game outcome and session data may be shared with our licensed game studio partners — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — for the purpose of game integrity verification, technical auditing, and RNG certification compliance. These studios receive only the minimum data necessary for these purposes and are prohibited from using it for any other purpose.

7.3 Legal & Regulatory Disclosure

hwg500 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of law where we are legally required to do so, or where disclosure is necessary to protect the legal rights, property, or safety of hwg500, its members, or the public. We will inform you of any such disclosure where we are legally permitted to do so.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of hwg500's business assets, personal data held by hwg500 may be transferred to the acquiring entity as part of the transaction. Members will be notified of any such transfer and any material change in data controller identity prior to the transfer taking effect, with reasonable advance notice provided.

8. International Data Transfers

hwg500 operates internationally and may store or process your personal data on servers located outside Indonesia. Where personal data is transferred to a jurisdiction that may not provide the same level of data protection as Indonesia's applicable laws, hwg500 implements appropriate safeguards to ensure your data remains protected to an equivalent standard.

These safeguards include contractual clauses requiring overseas recipients to maintain data protection standards consistent with internationally recognized principles, technical security measures including encryption at rest and in transit, and access control restrictions limiting data access to authorized personnel only. By using the platform, you acknowledge and consent to the transfer of your personal data to our international server infrastructure under these protective measures.

9. Data Retention

hwg500 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active account data: Retained throughout the duration of your membership and account activity on the platform.
• KYC and identity documents: Retained for a minimum of 5 years following account closure to meet AML regulatory requirements.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction, consistent with financial record-keeping obligations.
• Customer support communications: Retained for 3 years from the date of the last interaction, or longer if the communication relates to an unresolved dispute or legal matter.
• Technical and device logs: Retained for up to 12 months for security monitoring and fraud investigation purposes, then deleted or anonymized.
• Marketing consent records: Retained for the duration of your consent status plus 3 years to demonstrate compliance with consent-based marketing obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized so that it can no longer be associated with an identified individual.

10. Data Security

hwg500 takes the security of your personal data seriously and implements a layered set of technical and organizational measures designed to protect your data against unauthorized access, accidental loss, alteration, or disclosure. Our security framework includes the following controls:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the hwg500 platform is encrypted using industry-standard transport layer security protocols.
• Encryption at Rest: Sensitive personal data stored on our servers, including KYC documents and financial records, is encrypted at rest using AES-256 encryption.
• Access Control: Access to personal data is restricted to hwg500 employees and contractors who have a genuine operational need to access it. All access is governed by role-based permissions and logged for audit purposes.
• Two-Factor Authentication (2FA): hwg500 staff accessing internal systems containing personal data are required to authenticate using two-factor methods. We also offer 2FA to members for their own account security.
• Regular Security Audits: We conduct periodic internal security reviews and engage independent third-party penetration testers to assess the resilience of our platform against known attack vectors.
• Incident Response Plan: In the event of a confirmed personal data breach that poses a risk to members, hwg500 will notify affected individuals and relevant authorities within the timeframes required by applicable regulations.

11. Your Privacy Rights

As a member of the hwg500 platform, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team with your account details and a clear description of your request. We will respond within 30 days of receiving a verifiable request.

11.1 Right of Access

You have the right to request a copy of the personal data that hwg500 holds about you, along with information about the purposes for which it is processed, the categories of data held, the recipients with whom it has been shared, and the retention periods that apply.

11.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay. For certain data fields (such as your registered name or date of birth), we may require supporting documentation before making corrections to ensure ongoing KYC compliance.

11.3 Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. Please note that certain data must be retained for legal and regulatory compliance purposes (see Section 9) and cannot be deleted on request during the mandatory retention period.

11.4 Right to Restriction of Processing

You have the right to request that hwg500 restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or while an objection to processing is being evaluated.

11.5 Right to Data Portability

Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.

11.6 Right to Object

You have the right to object to the processing of your personal data where hwg500 relies on legitimate interests as the legal basis for processing. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defense of legal claims.

11.7 Right to Withdraw Consent

Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

12. Minors & Age Restriction

The hwg500 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21, and we do not permit minors to register accounts or participate in any gaming activity on the platform.

As part of our KYC process, hwg500 verifies the age of all members prior to enabling withdrawal functionality. If we become aware that personal data has been collected from an individual under 21, we will promptly suspend the associated account, delete the personal data in question, and return any deposits made to the original payment source where feasible.

If you are a parent or guardian and believe that a minor under your care has registered an account with hwg500, please contact our support team immediately so that we can take appropriate action.

13. Third-Party Links & Services

The hwg500 platform may reference or display content from third-party game providers such as Pragmatic Play, Evolution Gaming, NetEnt, and others. While these studios are contractually bound to our data sharing requirements (as described in Section 7.2), they operate their own independent privacy practices for data collected directly through their own platforms or products outside of hwg500.

hwg500 is not responsible for the privacy practices of any third-party service whose content may be accessible via or in connection with the platform. We encourage you to review the privacy policies of any third-party services you interact with independently. This Privacy Policy applies solely to personal data collected and processed by hwg500 in its capacity as data controller.

14. Amendments to This Policy

hwg500 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or the services we offer. Material changes to this policy will be communicated to registered members via email notification and/or a prominent notice on the platform at least 7 days before the revised policy takes effect, except where immediate amendment is required by law or regulatory instruction.

The "Last Updated" date at the top of this policy indicates when the most recent revision was made. We encourage you to review this policy periodically to stay informed about how hwg500 protects your personal data. Your continued use of the platform following the effective date of any revision constitutes your acceptance of the updated policy.

15. Contact & Data Enquiries

If you have questions, concerns, or requests relating to this Privacy Policy or the personal data hwg500 holds about you, please contact our Data Protection team through any of the following channels. All privacy-related enquiries are handled by trained staff and will receive a substantive response within 30 calendar days.

• Email: [email protected] — mark your subject line as "Privacy Enquiry" for priority routing to our data protection team.
• Live Chat: Available directly on the hwg500 platform, 24 hours a day, 7 days a week, with average first-response times under 2 minutes.
• WhatsApp & Telegram: Contact details are available within your account dashboard after logging in.

For formal data subject rights requests (access, erasure, portability, rectification), please contact us via email with the subject line "Data Subject Rights Request" and include your full registered name, email address on file, and a clear description of the right you wish to exercise. We may request additional verification before processing your request to ensure the security of your account.

For concerns about responsible gaming or self-exclusion, please visit our dedicated Responsible Gaming page, where additional guidance and support resources are available.