lego36 Privacy Policy

lego36 is committed to protecting the privacy and personal data of every player who interacts with our Platform. We recognize that trust is the foundation of any lasting relationship between a gaming platform and its players, and we take our data protection responsibilities seriously.

This Privacy Policy sets out, in clear and plain English, the categories of personal data we collect, the purposes for which that data is processed, the parties with whom we may share data, the measures we take to protect your information, and the rights you hold as a data subject.

lego36 primarily serves players based in Indonesia. In doing so, we handle personal data within the context of Indonesian legal and regulatory expectations, while also applying internationally recognized data protection principles to ensure the highest standard of privacy for our players across Jakarta, Surabaya, Bandung, Medan, Bali, and throughout the country.

If you have questions about any aspect of this Privacy Policy, or wish to exercise any of the rights described herein, please contact our Data Protection team using the details set out in Section 15.

The following terms carry the meanings assigned below throughout this Privacy Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person. This includes information that, alone or in combination with other data, can identify a specific individual.
• "Processing" — Any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, or deletion.
• "Data Controller" — lego36, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — A third party that processes Personal Data on behalf of lego36, including payment processors, KYC verification providers, and analytics partners.
• "Player" / "User" / "you" — Any individual who registers an account on, or otherwise accesses or uses, the lego36 Platform.
• "Sensitive Personal Data" — A subset of Personal Data that warrants heightened protection, including government-issued identification numbers, financial account details, and biometric data collected for KYC purposes.
• "Cookie" — A small data file stored on your device by the Platform to enable core functionality, remember your preferences, and support analytics.
• "KYC" — Know Your Customer; the identity verification process required for all lego36 players prior to processing withdrawals.

lego36 collects Personal Data across several categories. The table below summarizes the categories we process and specific examples within each:

We do not intentionally collect special category data (such as racial origin, religious beliefs, or health data) beyond what is strictly necessary for identity verification purposes (e.g., a government ID that may reflect a player's religion or ethnicity). Such data is used solely for identity confirmation and is not processed for any other purpose.

lego36 collects Personal Data through the following channels:

• Direct Submission: Data you provide voluntarily when creating an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated Technical Collection: Data gathered automatically when you visit or interact with the Platform, including IP addresses, device identifiers, browser type, session activity, and clickstream data collected via cookies and server logs.
• Payment Processors: Transaction confirmation data received from Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) following deposit or withdrawal events.
• KYC Verification Providers: Identity data validated or supplemented by third-party KYC service providers engaged by lego36 to confirm the authenticity of identification documents.
• Fraud Detection Systems: Behavioral and technical signals gathered by our fraud prevention systems to identify irregular account activity, potential multi-accounting, or suspicious wagering patterns.
• Communications: Content you share with our customer support team via live chat, email, or any other support channel made available through the Platform.

lego36 processes your Personal Data only for legitimate, clearly defined purposes. The specific purposes for which we use each category of data are as follows:

1. Account Management: To create, maintain, and administer your lego36 player account, including authenticating your identity at login and enforcing account security measures.
2. Identity Verification (KYC): To verify that you meet the eligibility requirements set out in our Terms and Conditions — specifically that you are at least 21 years of age and a resident of Indonesia — and to comply with our anti-money laundering obligations.
3. Transaction Processing: To process deposits via Indonesian banks and e-wallets, record wagering activity, calculate winnings and bonuses, and execute withdrawal requests to your verified payment method.
4. Customer Support: To respond to your queries, resolve disputes, investigate complaints, and deliver the 24/7 Indonesian-speaking support service that lego36 is committed to providing.
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms and Conditions.
6. Legal Compliance: To fulfill any obligations imposed on lego36 by applicable law, regulatory requirements, licensing conditions, or lawful instructions from competent authorities.
7. Platform Improvement: To analyze aggregated usage data, identify technical issues, and improve the features, performance, and user experience of the lego36 Platform.
8. Responsible Gaming: To monitor gaming behavior for signs of problem gambling, enforce self-exclusion and deposit limit settings, and deliver responsible gaming notifications and interventions where appropriate.
9. Marketing Communications: To send you promotional offers, seasonal bonuses (such as Idul Fitri or Indonesian Independence Day campaigns), and personalized game recommendations, where you have opted in to receive such communications. You may withdraw your marketing consent at any time via your account settings or by contacting support.

lego36 processes your Personal Data on one or more of the following legal grounds, depending on the nature of the processing activity:

• Contractual Necessity: Processing required to fulfill our obligations under the Terms and Conditions you accepted at registration — including account management, transaction processing, and customer support.
• Legal Obligation: Processing necessary to comply with applicable laws and regulatory requirements, including KYC verification, anti-money laundering checks, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out for lego36's legitimate business interests — such as fraud detection, platform security, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw this consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

lego36 does not share your Personal Data with third parties except in the following circumstances:

1. Payment Processors: We share the minimum necessary financial data with Indonesian banking partners (BCA, BRI, BNI, Mandiri, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit and withdrawal transactions.
2. KYC and Identity Verification Providers: We engage reputable third-party identity verification services to assist with the KYC process. These providers access only the specific documents and data required to confirm your identity and are contractually prohibited from using that data for any other purpose.
3. Fraud Prevention and Security Partners: We may share technical and behavioral data with specialist fraud detection and cybersecurity providers to protect the Platform and all its players from malicious activity.
4. Game Software Providers: Game studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft may receive session and gameplay data necessary to deliver their games through the Platform. These providers operate under strict data processing agreements.
5. Legal and Regulatory Authorities: We may disclose Personal Data to law enforcement agencies, regulatory bodies, courts, or other competent authorities where we are required to do so by applicable law, court order, or binding regulatory direction.
6. Business Transfers: In the event of a merger, acquisition, or sale of all or part of lego36's business, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and your rights in relation to it.

lego36 retains Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulatory obligations. Our standard retention periods are as follows:

• Account Data: Retained for the duration of your active account relationship with lego36, and for a minimum of five (5) years following account closure, in accordance with standard financial record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification, or longer where required by applicable anti-money laundering regulations.
• Transaction Records: Deposit, withdrawal, and wagering records are retained for a minimum of five (5) years to support dispute resolution, audit requirements, and regulatory inquiries.
• Communication Records: Customer support correspondence and chat transcripts are retained for a minimum of two (2) years from the date of the interaction.
• Technical and Log Data: Server logs and session data are typically retained for ninety (90) days for security monitoring purposes, after which they are deleted or anonymized.
• Marketing Preferences: Retained until you withdraw your consent or close your account, whichever occurs first.

When Personal Data is no longer required for its original purpose and no legal retention obligation applies, lego36 will securely delete or irreversibly anonymize it so that it can no longer be attributed to you as an individual.

lego36 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, and to analyze how players interact with our services. The cookies we deploy fall into the following categories:

• Strictly Necessary Cookies: Essential for the Platform to operate. These include session authentication cookies, security tokens, and cookies that maintain your login state. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, display options, and last-visited game categories. Disabling these cookies will not prevent you from using the Platform but may result in a less personalized experience.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players navigate and use the Platform. This information helps us identify popular features, measure page performance, and prioritize improvements. No personally identifiable information is transmitted via analytics cookies.
• Security and Fraud Prevention Cookies: Used by our fraud detection systems to identify suspicious patterns, detect automated bot activity, and protect player accounts from unauthorized access.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies at the category level. Please note that disabling strictly necessary cookies will prevent you from accessing core Platform features, including account login and deposit functionality.

lego36 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, loss, or destruction. Our security framework includes:

1. SSL/TLS Encryption: All data transmitted between your device and the lego36 Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols. The padlock icon displayed in your browser confirms that your connection is encrypted.
2. Data Encryption at Rest: Sensitive Personal Data, including KYC documents and financial account details, is encrypted at rest using AES-256 or equivalent encryption standards. Encryption keys are managed under strict access controls.
3. Access Controls: Access to Personal Data within lego36 is restricted on a strictly need-to-know basis. Staff members who handle player data are subject to background checks, confidentiality obligations, and regular data protection training.
4. Two-Factor Authentication: lego36 supports two-factor authentication (2FA) for player accounts to add an additional layer of protection against unauthorized login.
5. Penetration Testing: The Platform undergoes regular security assessments and penetration testing by qualified third-party security professionals to identify and remediate vulnerabilities.
6. Incident Response: lego36 maintains a documented data breach response procedure. In the event of a breach that is likely to result in risk to your rights and freedoms, we will notify affected players without undue delay and take all reasonable steps to contain and remediate the incident.

While lego36 takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. We encourage you to use a strong, unique password for your lego36 account and to enable two-factor authentication where available.

As a lego36 player, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team using the details in Section 15:

• Right of Access: You may request a copy of the Personal Data lego36 holds about you, along with information about how it is processed. We will respond to access requests within 30 days of receipt.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. Minor corrections (such as email address changes) may be made directly through your account settings.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where processing is unlawful. Please note that erasure requests may be limited by our legal retention obligations — for example, transaction records required for anti-money laundering compliance cannot be deleted on request.
• Right to Restrict Processing: In certain circumstances, you may request that we limit the processing of your data — for example, while the accuracy of data you have contested is being verified.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your Personal Data in a commonly used, machine-readable format.
• Right to Object: You may object at any time to the processing of your Personal Data for direct marketing purposes. You may also object to processing carried out on the basis of legitimate interests, though lego36 may override this objection where we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. Marketing opt-outs can be made via your account settings or by contacting support.

lego36 will not charge a fee for responding to rights requests and will respond within 30 calendar days. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.

lego36 strictly prohibits access by persons under the age of 21. The Platform is not designed for, marketed to, or intended to be used by minors. We do not knowingly collect Personal Data from individuals under 21 years of age.

If you are a parent or guardian and believe that a minor in your care has registered an account on lego36 or otherwise provided us with their Personal Data, please contact our support team immediately at the email address listed in Section 15. Upon receiving such a report, lego36 will promptly investigate the matter, suspend the relevant account, delete any Personal Data confirmed to belong to a minor, and return any real-money balance to the originating payment source.

Players are required to confirm their age and date of birth at registration. lego36 also conducts KYC verification to independently validate that all players meet the 21+ eligibility requirement before processing any withdrawal.

The lego36 Platform may, from time to time, contain references or links to third-party websites or services — for example, game provider portals, payment gateway pages, or responsible gaming resources. This Privacy Policy applies solely to data collected by lego36 through the Platform.

lego36 has no control over the privacy practices or content of third-party websites and accepts no responsibility for the data handling practices of any external site you may access via a link from the Platform. We encourage you to review the privacy policy of any third-party website before submitting your Personal Data to it.

lego36 reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, Platform features, or applicable legal requirements. The "Last Updated" date displayed at the top of this page will always reflect the date on which the most recent version came into effect.

Where changes to this Privacy Policy are material — meaning they significantly affect how we collect, use, or share your Personal Data — we will notify registered players via email and/or a prominent on-Platform notice at least 14 days before the changes take effect. Continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms.

For minor or administrative updates that do not affect your substantive rights, we may update this page without individual notification. We recommend that you review this Privacy Policy periodically to remain informed of how lego36 protects your information.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way lego36 handles your Personal Data, please reach out to our Data Protection team. We are available 24 hours a day, 7 days a week, including Indonesian public holidays.

For account-specific support unrelated to privacy, general customer service queries, or responsible gaming assistance, you may also contact our support team at the same email address with an appropriate subject line for priority routing.