Privacy Policy — jos55

In this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, including but not limited to name, date of birth, national identity number, residential address, email address, IP address, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Platform" means the jos55 website, mobile interface, and all associated services accessible at jos55.bio and any subdomain thereof.
• "Member" means any individual who has successfully registered an Account on the Platform.
• "Account" means the individual member account created upon successful registration.
• "KYC" means Know Your Customer — the identity and address verification process required before processing withdrawals.
• "Third-Party Service Provider" means any external entity engaged by jos55 to provide a specific operational service (e.g., payment processing, fraud detection, game delivery, customer support tooling), under a contractual data processing agreement.
• "Cookie" means a small text file placed on your device by the Platform to enable session management, analytics, and fraud detection functionality.
• "Data Subject Request" means a formal request submitted by a Member to exercise any of the data rights set out in Clause 10 of this Policy.

jos55 collects personal data across several categories. The table below provides a clear overview of each category, the specific data points within it, and the primary purpose for which that data is collected:

We do not intentionally collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, political opinions, genetic or biometric data, health data, or sexual orientation. If any such data is inadvertently submitted (for example, within a support message), it will be deleted promptly and will not be processed for any purpose.

jos55 collects personal data through the following channels:

• Direct submission: Data you provide when creating an Account (name, email, date of birth, residential address), completing KYC verification (identity documents, proof of address), making deposits or requesting withdrawals (bank account or e-wallet details), or contacting customer support (chat transcripts, email content).
• Automated collection: Technical and usage data collected automatically when you access and interact with the Platform, including via browser cookies, server-side logging, and session tracking technologies. See Clause 9 for full details of our cookie practices.
• Third-party sources: In limited circumstances, jos55 may receive data from third parties for fraud-prevention and identity-verification purposes. This includes device reputation signals from fraud-detection service providers and identity confirmation data from KYC verification partners. Such third-party data is used solely for the purpose for which it was received and is not cross-referenced with marketing databases.
• Payment processors: When you deposit or withdraw funds, your bank or e-wallet provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and others) transmits transaction confirmation data to jos55 sufficient to credit or debit your Account. jos55 does not receive or store full bank account passwords or PINs.

jos55 uses the personal data we collect for the following specific purposes. We will not use your data for any purpose that is incompatible with those listed below without first providing you with notice and, where required, obtaining your consent:

• Account creation and management: To create and maintain your Account, authenticate your identity at login, and manage your Member preferences and settings.
• KYC and compliance: To verify your identity, confirm your age as 21 or above, confirm your Indonesian residency, and comply with anti-money-laundering and counter-terrorism-financing obligations applicable to the Platform's operating jurisdiction.
• Payment processing: To process your deposits and withdrawals via Supported Payment Methods, reconcile transaction records, and investigate any payment discrepancies.
• Platform security and fraud prevention: To detect and prevent fraudulent activity, unauthorised account access, collusion, money laundering, bonus abuse, and use of prohibited automated tools.
• Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and maintain records of support interactions for quality assurance purposes.
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling, enforce self-imposed limits and exclusions, and contact Members where responsible gaming concerns are identified.
• Platform improvement: To analyse aggregated and anonymised usage data in order to improve Platform functionality, game selection, user interface design, and load performance.
• Marketing communications (consented only): To send promotional offers, bonus notifications, and platform updates to Members who have explicitly opted in to receive such communications. You may withdraw this consent at any time via your Account settings.
• Legal obligations: To comply with any applicable legal obligation, court order, regulatory requirement, or lawful request from a competent authority.

Every instance of personal data processing carried out by jos55 rests on one of the following recognised legal bases:

• Contractual necessity: Processing that is necessary to perform the contract between you and jos55 — specifically, to operate your Account, process payments, and deliver the gaming and sportsbook services you have requested.
• Legal obligation: Processing required for jos55 to comply with applicable laws, including KYC and AML obligations, record-keeping requirements, and regulatory reporting duties.
• Legitimate interests: Processing undertaken for purposes that are necessary for jos55's legitimate business interests, provided those interests are not overridden by your fundamental rights. This includes fraud detection, platform security monitoring, and internal analytics for service improvement.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent. This basis applies exclusively to marketing communications and optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

jos55 does not sell, rent, or otherwise commercialise your personal data. We share personal data only in the limited circumstances described below, and always under contractual protections that require the recipient to handle data in accordance with this Policy:

• Payment processors: Your financial data is shared with the relevant Indonesian bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to the extent necessary to execute the deposit or withdrawal transaction you have initiated.
• KYC verification partners: Identity document data submitted during KYC may be processed by a contracted third-party identity verification service. That service operates under a data processing agreement that prohibits any secondary use of the data.
• Game studio providers: When you play a game provided by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), a session token and bet data are transmitted to that provider's servers to facilitate gameplay. Game providers do not receive your full identity profile.
• Fraud-prevention and security services: Technical data including IP address and device fingerprint may be shared with contracted fraud-detection platforms to identify and block suspicious activity.
• Customer support tooling: Support communication data is processed within our contracted helpdesk platform, whose servers may be located outside Indonesia. Data processing agreements govern all such arrangements.
• Legal and regulatory authorities: jos55 will disclose personal data to competent governmental or regulatory authorities, courts, or law enforcement bodies where required to do so by applicable law, valid legal process, or to protect the rights and safety of jos55, its Members, or the public. Where legally permissible, we will notify you of such a disclosure.
• Corporate restructuring: In the event of a merger, acquisition, or sale of all or part of jos55's business assets, your personal data may be transferred to the acquiring entity, subject to the same protections afforded by this Policy. You will be notified of any such transfer via your registered email address.

jos55 operates internationally, and some of the Third-Party Service Providers we use may process personal data on servers located outside Indonesia. Where such cross-border data transfers occur, jos55 takes the following steps to ensure your data remains adequately protected:

• All international data transfers are governed by binding contractual clauses that impose data protection obligations on the receiving entity equivalent to those described in this Policy.
• Where a transfer destination is a jurisdiction with a data protection framework recognised as adequate by relevant authorities, we rely on that adequacy finding as the transfer mechanism.
• jos55 maintains a register of all cross-border transfer arrangements and reviews that register annually to confirm continued adequacy.
• In all cases, personal data transferred internationally is subject to the same access restrictions, encryption standards, and retention limits described elsewhere in this Policy.

jos55 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law or regulatory obligation. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is either permanently deleted from our systems or anonymised such that it can no longer be attributed to any identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and business analysis purposes.

The jos55 Platform uses cookies and similar local storage technologies to deliver a functional, secure, and consistent experience. The following cookie categories are deployed on the Platform:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They manage your authenticated session, maintain your login state across pages, and enforce account-level security controls. These cookies cannot be disabled without preventing access to the Platform.
• Functional cookies: These cookies remember your Platform preferences, such as your preferred language display, notification settings, and responsible gaming limit configurations. Disabling them will not prevent access but will reset your preferences on each visit.
• Analytics cookies: jos55 uses first-party analytics cookies to measure aggregate page visits, feature usage, and session duration. This data is used internally to improve the Platform. Analytics cookies do not contain personally identifiable information in their raw form.
• Fraud-detection cookies: These cookies capture device fingerprint signals (browser version, timezone, screen resolution) to detect and prevent account takeover attempts, bonus abuse, and the creation of multiple accounts from a single device. They are necessary for platform security and cannot be disabled by individual users.

jos55 does not deploy third-party advertising cookies, retargeting pixels, social media tracking scripts, or any cookie that would facilitate cross-site behavioural profiling of our Members.

Most browsers allow you to view, manage, and delete cookies through the browser's settings menu. Deleting strictly necessary or fraud-detection cookies may result in loss of your authenticated session or temporary restriction of Platform access while a new device fingerprint is established.

As a Member whose personal data is processed by jos55, you hold the following rights with respect to your personal data. To exercise any of these rights, submit a Data Subject Request to [email protected] with the subject line "Data Subject Request — [Right Type]". We will acknowledge receipt within 3 business days and respond substantively within 30 calendar days:

• Right of access: You have the right to request a copy of all personal data that jos55 holds about you, together with information about the purposes for which it is processed, the categories of data involved, and the recipients to whom it has been disclosed.
• Right of rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. Many data fields (email address, residential address) can be updated directly via your Account settings without submitting a formal request.
• Right of erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to overriding legal retention obligations described in Clause 8.
• Right to restrict processing: You have the right to request that jos55 suspend active processing of your personal data in certain circumstances — for example, while the accuracy of that data is contested, or while a complaint about jos55's use of your data is under investigation.
• Right to data portability: Where processing is based on your consent or on contractual necessity, and processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON).
• Right to object: You have the right to object at any time to processing of your personal data where that processing is based on jos55's legitimate interests. jos55 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based solely on your consent (marketing communications, optional personalisation), you may withdraw that consent at any time via your Account settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

jos55 implements a comprehensive set of technical and organisational security controls to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure:

• Encryption: All data in transit is protected by TLS 1.3. All data at rest on jos55 servers is encrypted using AES-256. KYC document files are stored in an isolated, access-controlled environment separate from general Platform data stores.
• Access control: Access to personal data systems is restricted to jos55 employees and contractors whose job functions require it. All access is authenticated via multi-factor authentication and governed by the principle of least privilege. Access logs are retained and reviewed regularly.
• Vulnerability management: The Platform undergoes regular penetration testing by qualified third-party security firms. Critical vulnerabilities identified through testing or responsible disclosure are remediated within defined timelines based on severity.
• Incident response: jos55 maintains a documented security incident response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected Members via their registered email address within 72 hours of becoming aware of the breach, and will report to relevant authorities as required by applicable law.
• Staff training: All jos55 staff with access to personal data undergo mandatory data protection training upon onboarding and at least annually thereafter.

While jos55 employs industry-standard security measures, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials. If you suspect unauthorised access to your Account, contact our support team immediately via the live chat function on the Platform.

The jos55 Platform is strictly intended for adults aged 21 and above. jos55 does not knowingly collect personal data from individuals under the age of 21. If we become aware that an Account has been registered by or for a person under 21, we will immediately close the Account, delete all associated personal data to the extent permitted by law, and withhold any winnings generated during the period of underage use.

If you are a parent or guardian and believe that your child or a dependent under your care may have registered or accessed a jos55 Account, please contact our support team at [email protected] immediately. We will investigate and take appropriate action within one business day of receiving your report.

The jos55 Platform does not contain links to third-party websites in its standard navigation. However, promotional content, game provider interfaces, or support tools embedded within the Platform may, in limited circumstances, contain references to third-party services. If you navigate to any third-party service from within or alongside the Platform, please be aware that:

• jos55 has no control over the privacy practices of third-party websites or services.
• This Privacy Policy does not apply to any data collected by third-party services once you have left the jos55 Platform environment.
• You should review the privacy policy of any third-party service before providing it with any personal data.
• jos55 accepts no liability for the privacy practices or data handling of any third party.

jos55 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or Platform functionality. When material changes are made, we will notify all registered Members by email to their registered address at least 7 days before the revised Policy takes effect. The updated Policy will also be published at jos55.bio/privacy-policy with a revised "Last Reviewed" date.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you must stop using the Platform and may request Account closure by contacting our support team.

We encourage Members to review this Policy periodically. The version published on the Platform at the time of your last login is the version applicable to your Account at that time.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or would like to raise a complaint about how jos55 has handled your personal data, please contact our Data Protection team using the details below:

If you are not satisfied with our response to a complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction in which you reside. jos55 will cooperate fully with any such regulatory investigation.

For general account support, deposit and withdrawal queries, and game-related questions, please use the live chat function on the Platform or visit our FAQ page.