Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below:

• "arta4" / "the Company" / "we" / "us" means the licensed entity operating the arta4 platform at arta4.one.
• "Member" / "you" means any natural person who has registered an account on the arta4 platform or who accesses the platform as a visitor.
• "Personal Data" means any information that identifies or could reasonably identify a natural person, including name, email address, mobile number, Indonesian National Identity Card (KTP) number, device identifiers, and payment account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, arta4 and the Company.
• "Third-Party Processor" means an external party that Processes Personal Data on behalf of arta4 under a written data-processing agreement, such as payment service providers, game studios, and fraud prevention services.
• "KYC" means Know Your Customer — the identity and document verification process required under arta4's licensing obligations before full account functionality, including withdrawals, is enabled.
• "Platform" means the arta4 website, web application, and all associated services accessible at arta4.one.

This Privacy Policy applies to all Personal Data collected by arta4 in connection with the operation of the Platform, including data collected from registered Members, prospective members who begin but do not complete registration, and visitors who access the Platform without registering. It applies regardless of the device or method used to access the Platform.

arta4 is the Data Controller in respect of all Personal Data collected and Processed through the Platform. As Data Controller, arta4 is responsible for ensuring that Personal Data is Processed lawfully, fairly, and transparently, and in accordance with applicable data protection legislation and our licensing obligations.

arta4 collects the following categories of Personal Data:

arta4 does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, health data, or biometric data beyond what is strictly required for identity document verification as part of the KYC process.

4.1 Data You Provide Directly

The majority of Personal Data arta4 holds about you is provided by you directly at the time of registration, during the KYC process, when making deposits or requesting withdrawals, and when contacting our support team via live chat, email at [email protected], or WhatsApp.

4.2 Data Collected Automatically

When you access the Platform, certain Technical Data is collected automatically by our servers and analytics infrastructure. This includes your IP address, the device and browser you are using, the pages you visit within the Platform, session start and end times, and any error events that occur during your session. This data is used to maintain platform security, investigate fraud, and improve service performance.

4.3 Data from Third Parties

arta4 may receive Personal Data about you from the following third-party sources:

• Payment service providers processing your deposits and withdrawals, who confirm transaction status and account ownership.
• Identity verification service providers engaged to assist with the KYC process, who return verification status and flag results.
• Fraud prevention and anti-money-laundering screening services, which may cross-reference your details against publicly available sanctions and watchlists.
• Our licensing authority, which may share information relevant to a regulatory investigation or compliance check.

arta4 Processes your Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and arta4, including operating your Account, processing deposits and withdrawals, settling bets, and delivering customer support.
• Legal Obligation: Processing is required to comply with arta4's legal and regulatory obligations, including KYC identity verification, anti-money-laundering screening, responsible gaming obligations, and record-keeping requirements under our gaming licence.
• Legitimate Interests: Processing is necessary for arta4's legitimate business interests, including fraud detection and prevention, platform security, service improvement, and the detection of prohibited conduct, provided those interests are not overridden by your rights and interests.
• Consent: Where arta4 relies on consent as the legal basis — principally for direct marketing communications — you may withdraw that consent at any time through your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of Processing carried out before withdrawal.

arta4 uses your Personal Data for the following purposes:

• Creating and managing your arta4 Account, including authentication and access control.
• Processing deposits via BCA, BRI, BNI, Mandiri, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, and other supported Indonesian payment methods, and processing withdrawal requests to your verified payment accounts.
• Verifying your identity and age (21+) as required by our licensing obligations and responsible gaming commitments.
• Detecting, investigating, and preventing fraudulent activity, money laundering, collusion, and other prohibited conduct on the Platform.
• Fulfilling our responsible gaming obligations, including monitoring play patterns that may indicate problem gambling behaviour and administering deposit limits, cooling-off periods, and self-exclusion requests.
• Delivering customer support via live chat, email, and WhatsApp, and maintaining records of those interactions.
• Sending transactional communications, including deposit confirmations, withdrawal notifications, and Account security alerts.
• Sending promotional communications about arta4 bonuses, offers, and seasonal promotions (Idul Fitri, 17 August Independence Day promotions, etc.) — only where you have opted in to receive such communications.
• Maintaining the technical security and performance of the Platform.
• Complying with requests from our licensing authority and other applicable regulatory bodies.

arta4 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share Personal Data only in the following circumstances:

7.1 Third-Party Processors

arta4 engages third-party service providers who Process Personal Data on our behalf under written data-processing agreements that bind them to confidentiality and security obligations equivalent to those in this Policy. These include payment processors, identity verification providers, fraud screening services, cloud infrastructure providers, and customer support technology platforms.

7.2 Game Providers

When you play a game hosted by a third-party studio (such as Evolution Gaming, Pragmatic Play, NetEnt, or Microgaming), certain session-level data — including your account identifier and game activity — is shared with that studio to facilitate game delivery, dispute resolution, and RNG audit. These studios are bound by arta4's data-sharing agreements and their own regulatory obligations.

7.3 Regulatory and Legal Disclosure

arta4 may disclose Personal Data to its licensing authority, law enforcement agencies, financial intelligence units, or other competent authorities where required by law, court order, or regulatory direction, or where arta4 in good faith believes such disclosure is necessary to prevent fraud, money laundering, or harm to another person.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of arta4's business assets, Personal Data held by arta4 may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations.

arta4 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, and in any case for as long as required by our licensing obligations and applicable law. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of the Account relationship and for a minimum of five years after Account closure, in accordance with anti-money-laundering record-keeping requirements.
• Transaction Records: Retained for a minimum of five years from the date of each transaction.
• KYC Documents: Retained for a minimum of five years after the completion of the KYC process or Account closure, whichever is later.
• Customer Support Records: Retained for a minimum of two years from the date of the relevant interaction.
• Technical Logs: Retained for a minimum of 90 days for security and fraud investigation purposes, and up to 24 months for aggregate analytics.
• Marketing Preferences: Retained until you withdraw consent or close your Account, plus a suppression record to prevent inadvertent re-contact.

Once the applicable retention period expires, Personal Data is securely deleted or anonymised so that it can no longer be associated with you.

arta4 implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and arta4's servers.
• Encryption at rest for sensitive data fields, including KTP numbers, payment account details, and authentication credentials.
• Password hashing using industry-standard algorithms; plaintext passwords are never stored.
• Two-factor authentication (2FA) available to all members and required for high-value withdrawal requests.
• Role-based access controls limiting staff access to Personal Data strictly to those with a job-related need.
• Regular penetration testing and security audits conducted by independent third-party security specialists.
• 24/7 automated monitoring of the Platform infrastructure for anomalous activity, with escalation protocols for suspected breaches.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, arta4 will notify affected members and the relevant regulatory authority in accordance with applicable breach notification obligations.

arta4 uses cookies and similar tracking technologies to operate the Platform, maintain your session, and analyse platform usage. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without affecting core platform functionality.
• Functional Cookies: Remember your preferences such as language settings and game lobby filters to improve your experience on return visits.
• Analytics Cookies: Collect aggregated, anonymised data about how members navigate the Platform to help us identify usability issues and improve performance. arta4 uses privacy-respecting analytics tools and does not share raw analytics data with advertising networks.

arta4 does not use third-party advertising or retargeting cookies. You can manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may prevent you from accessing certain Platform features.

As a member of arta4, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact the arta4 support team via live chat or at [email protected]. arta4 will respond to verified requests within 30 days.

• Right of Access: You may request a copy of the Personal Data arta4 holds about you, together with information about how it is being used.
• Right of Rectification: If any Personal Data arta4 holds about you is inaccurate or incomplete, you may request that it be corrected. You can also update certain data directly through your Account settings.
• Right of Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to any retention obligations imposed by our licensing authority or applicable law (see Section 8).
• Right to Restrict Processing: You may request that arta4 restrict Processing of your Personal Data in certain circumstances, such as while a rectification request is being evaluated.
• Right to Data Portability: You may request that arta4 provide your Personal Data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You may object to Processing based on legitimate interests, and you may withdraw consent to marketing communications at any time through your Account settings or by contacting support.
• Right to Lodge a Complaint: If you believe arta4 has not handled your Personal Data in accordance with this Policy, you have the right to raise a complaint with arta4's internal compliance team or with the relevant regulatory authority.

arta4 strictly prohibits the use of the Platform by anyone under 21 years of age. arta4 does not knowingly collect Personal Data from individuals under 21. Age is verified as part of the KYC process, and any Account found to have been registered by a person under 21 will be immediately closed and all associated data deleted, except where retention is required by law.

If you have reason to believe that a person under 21 has registered an arta4 Account or has provided Personal Data to arta4, please contact support immediately at [email protected] (plain text — not a clickable link) so that the Account can be reviewed and closed.

arta4 operates as an international platform and may transfer Personal Data to servers and third-party processors located outside Indonesia. Where such transfers occur, arta4 takes appropriate steps to ensure that your Personal Data receives a level of protection equivalent to that provided under this Policy, including entering into data-transfer agreements with the relevant Third-Party Processors that incorporate standard contractual clauses or equivalent safeguards.

Specifically, Personal Data may be transferred to: payment processors operating internationally to facilitate IDR transactions; live casino game studios operating certified studio infrastructure outside Indonesia; cloud infrastructure providers whose data centres may be located in Singapore, Japan, or other jurisdictions with recognised data protection frameworks; and fraud prevention services operating global databases.

arta4 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform functionality. Where amendments are material — that is, where they affect your rights or the way in which arta4 uses your Personal Data in a meaningful way — arta4 will notify registered members via their registered email address or through an in-platform notification prior to the change taking effect.

Minor amendments, such as clarifications that do not substantively alter your rights or our data practices, may be made without advance notice. The "Last Updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Platform after an amended Policy has been published constitutes your acceptance of the revised terms.

For any questions about this Privacy Policy, to exercise any of your data rights, or to raise a data protection concern, please contact arta4 through the following channels. All data-related enquiries will be handled by arta4's compliance team.

• 24/7 Live Chat: Available from your arta4 Account dashboard after login — fastest response channel for general enquiries.
• Email: [email protected] — for formal data access, rectification, erasure, or portability requests, please mark your email "Data Privacy Request".
• WhatsApp: +62 811 0000 4444 — for support in Indonesian (Bahasa Indonesia) or English across all Indonesian time zones (WIB, WITA, WIT).

arta4 aims to respond to all data rights requests within 30 calendar days. For complex requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it before the initial 30-day deadline expires.