Privacy Policy

riu4d (accessible at https://riu4d.pro) is an internationally licensed online gaming platform offering sports betting, live casino, slot games, and related entertainment products to players across Indonesia and other eligible jurisdictions. When this Privacy Policy refers to "riu4d", "we", "us", or "our", it means the operating entity behind the riu4d platform acting as the data controller in respect of your personal information.

As the data controller, riu4d determines the purposes and means by which your personal data is processed. We are committed to handling your data in a transparent, lawful, and secure manner consistent with internationally recognized privacy standards, including principles drawn from the General Data Protection Regulation (GDPR) framework, even where that regulation does not apply directly to our operations.

If you have any questions about this Privacy Policy or about how your personal data is handled, please contact our Data Protection team at [email protected]. We aim to respond to all privacy-related inquiries within 5 business days.

riu4d collects personal data across several categories, depending on how you interact with the platform. The table below provides a detailed breakdown of each category, the specific data types within it, and the primary reason for collection:

We do not collect or store full payment card numbers. Where card payments are processed, they are handled by PCI-DSS-compliant payment processors and we receive only a tokenized reference.

riu4d collects personal data through the following channels:

• Direct submission: Information you provide when registering your account, completing KYC verification, making deposits or withdrawals, contacting customer support, or filling out any form on the platform.
• Automated technical collection: Data generated automatically when you browse or use the platform, including IP address, device fingerprint, session logs, and cookie data (see Clause 6 for full cookie details).
• Payment providers: Transaction confirmation data returned by your bank (BCA, BRI, BNI, Mandiri, etc.) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) when a deposit or withdrawal is processed.
• Identity verification providers: Results of document authenticity checks returned by third-party KYC service providers when you submit verification documents.
• Game software providers: Session data returned by live casino and slot game providers (such as Evolution Gaming, Pragmatic Play, and Spribe) including game round IDs, bet amounts, and outcomes, which are linked to your riu4d account for record-keeping.
• Fraud and risk intelligence providers: Risk signals and device reputation data from third-party fraud prevention services used to protect the platform and its players.

riu4d processes your personal data only where there is a recognized legal basis for doing so. The table below maps each processing purpose to its corresponding legal basis:

Where riu4d relies on legitimate interests as the legal basis for processing, we have assessed that those interests are not overridden by your fundamental rights and freedoms. If you wish to challenge a legitimate interests assessment for any specific processing activity, please contact us at [email protected].

riu4d shares your personal data only with the categories of recipients listed below, and only to the extent strictly necessary for the stated purpose. We do not sell or rent personal data to third parties for their own marketing purposes under any circumstances.

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja receive only the transaction details necessary to process your deposit or withdrawal (account holder name, account number, transaction amount, and reference code). They do not receive your full gaming history or other platform data.
• KYC and identity verification providers: Third-party document verification services receive copies of your KYC documents (government ID, proof of address) for the sole purpose of confirming document authenticity and your identity. These providers are bound by strict data processing agreements.
• Game software providers: Live casino providers (such as Evolution Gaming) and slot/RNG game providers (such as Pragmatic Play, Pocket Games Soft, and Spribe) receive a pseudonymous session token linked to your account to enable game operation. They do not receive your full name, payment details, or contact information.
• Fraud prevention and risk intelligence services: Device fingerprinting and fraud-scoring providers receive technical data (IP address, device signature, session metadata) to generate risk assessments. No financial data is shared with these providers.
• Regulatory and law enforcement authorities: riu4d will disclose personal data to competent authorities where required by applicable law, a valid court order, or a binding regulatory instruction. We will notify affected players of such disclosures where we are legally permitted to do so.
• Professional advisors: Lawyers, auditors, and compliance consultants engaged by riu4d may access personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.

riu4d uses cookies and similar tracking technologies (local storage, session tokens, pixel tags) to operate the platform, maintain your session, protect against fraud, and understand how players interact with the site. The following cookie categories are in use:

riu4d does not use third-party advertising cookies or behavioral retargeting pixels. You can manage functional and analytics cookies via the cookie preferences panel accessible from your account settings. Strictly necessary and security cookies cannot be disabled as they are essential to the secure operation of the platform.

riu4d retains personal data for only as long as necessary to fulfill the purpose for which it was collected, or as required to comply with applicable legal and regulatory obligations. The following retention schedule applies:

• Active account data (identity, contact, financial, transaction records): Retained for the lifetime of your active account plus a minimum of 5 years following permanent account closure, in compliance with international AML record-keeping standards.
• KYC documents (government ID copies, proof-of-address documents): Retained for a minimum of 5 years from the date of submission, consistent with standard regulatory KYC retention requirements.
• Transaction logs (individual bet records, deposit/withdrawal history): Retained for 7 years to support potential dispute resolution, tax reporting obligations, and regulatory audit requirements.
• Customer support communications (live chat transcripts, support emails): Retained for 3 years from the date of the communication for service quality and dispute evidence purposes.
• Technical and usage data (IP logs, session logs, analytics data): Retained for 24 months in identifiable form; anonymized thereafter for aggregate analytics.
• Marketing consent records: Retained for the duration of your active marketing opt-in plus 3 years after withdrawal of consent, as evidence of consent management compliance.

Upon expiry of the applicable retention period, personal data is either securely deleted (digital records) or physically destroyed (paper documents), or irreversibly anonymized so that it can no longer be associated with any identifiable individual.

riu4d implements a layered, defense-in-depth security architecture to protect your personal data from unauthorized access, disclosure, alteration, or destruction. The technical and organizational measures currently in place include:

• Transport-layer encryption: All data exchanged between your browser or app and the riu4d platform is encrypted using TLS 1.2 or higher with 256-bit AES cipher suites. HTTP connections are automatically redirected to HTTPS.
• Password hashing: Account passwords are never stored in plain text. They are hashed using bcrypt with a per-user salt, making brute-force and rainbow-table attacks computationally infeasible even if the database were compromised.
• Two-factor authentication (2FA): Players may enable 2FA on their accounts via the security settings panel. riu4d strongly recommends activating 2FA, particularly for accounts with active balances.
• Access controls: Internal access to player personal data is governed by a strict role-based access control (RBAC) policy. Only staff members with a verified operational need are granted access to identifiable player data, and all access is logged and audited.
• Database encryption at rest: All databases containing personal data are encrypted at rest using AES-256. Database backups are encrypted with separate key sets and stored in geographically isolated secure environments.
• Intrusion detection and monitoring: riu4d operates a 24/7 security monitoring service with automated alerts for anomalous access patterns, SQL injection attempts, and credential stuffing attacks.
• Penetration testing: The platform undergoes periodic penetration testing by independent security professionals. Critical findings are remediated within agreed SLA timelines before test results are finalized.

As a player registered on the riu4d platform, you have the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] from your registered email address, quoting your account username and specifying the right you wish to exercise. riu4d will respond within 30 days.

The riu4d platform is strictly intended for adults aged 21 and over. We do not knowingly collect, store, or process personal data from individuals under the age of 21. Registration on the platform requires confirming that you meet the minimum age requirement, and riu4d enforces KYC age verification for accounts flagged by automated risk systems or prior to first withdrawal.

If riu4d discovers or receives credible information that an account has been registered by, or is being operated on behalf of, a person under the age of 21, the account will be immediately suspended without notice. Any deposits made will be returned to the originating payment method, and all associated data will be deleted from our systems in accordance with our data minimization obligations. Winnings accrued on an underage account will not be paid out.

Parents and guardians who believe a minor in their household may have accessed the platform are encouraged to contact [email protected] immediately. riu4d will investigate and respond within 24 hours. We also recommend using parental control software to restrict access to online gaming sites at the device and network level.

As an internationally operating platform, riu4d may transfer personal data to servers, service providers, or partners located in jurisdictions outside Indonesia. This includes game software providers (whose server infrastructure may be located in Malta, Gibraltar, the Isle of Man, or other gaming-regulated jurisdictions), KYC verification services, and cloud infrastructure providers.

Where personal data is transferred internationally, riu4d takes appropriate steps to ensure that the receiving party provides an adequate level of data protection, including:

• Entering into contractual data processing agreements incorporating internationally recognized standard contractual clauses (SCCs) or equivalent binding data transfer mechanisms;
• Conducting transfer impact assessments where required to ensure the destination jurisdiction's laws do not undermine the contractual protections;
• Applying technical supplementary measures (such as end-to-end encryption) where the legal framework in the destination country is assessed as providing insufficient protection on its own.

By registering an account on the riu4d platform, you acknowledge that your personal data may be processed in jurisdictions outside Indonesia, subject to the safeguards described in this clause.

riu4d reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, the services we offer, or the third-party providers we work with. The "Last Updated" date at the top of this page will be revised whenever a change is made.

For material changes — those that significantly alter how we collect, use, or share your personal data — riu4d will notify registered players via their registered email address at least 14 days before the change takes effect. For minor administrative or clarifying amendments that do not affect your rights in a meaningful way, the updated policy will be published without prior email notification, and the revised date will serve as the notice.

Continued use of the riu4d platform following the effective date of an updated Privacy Policy constitutes your acknowledgment of, and agreement to, the revised terms. If you do not agree with the revised Privacy Policy, you should close your account prior to the effective date. Account closure requests should be sent to [email protected].

Archived versions of previous Privacy Policies are available on request by emailing [email protected] with the subject line "Privacy Policy Archive Request".

For any questions, concerns, or requests relating to this Privacy Policy or to the way riu4d handles your personal data, please reach out to our Data Protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly within the platform — select "Privacy & Data" from the support topic menu
• Response Time: General privacy inquiries within 5 business days; formal data subject access or deletion requests within 30 calendar days

When submitting a data subject request by email, please include your registered account username, the nature of your request (access, rectification, deletion, portability, etc.), and any additional context that will help our team locate and process your data efficiently. You may be asked to verify your identity before the request is actioned, to ensure we do not disclose or delete data in response to fraudulent requests.