pen4d takes the privacy of its players seriously. This Privacy Policy explains exactly what personal data we collect, why we collect it, how we use it, and your rights as a data subject. We encourage you to read it in full before creating an account.
Our Commitments
Privacy at pen4d is not an afterthought — it is built into every layer of the platform. These six principles summarise our approach to handling your personal information.
pen4d collects only the personal data that is strictly necessary to operate your account, process transactions, and comply with legal obligations. We do not collect data for its own sake or for resale to third parties.
All data transmitted between your device and pen4d's servers is protected by 256-bit TLS encryption. Sensitive data stored in our systems is encrypted at rest using industry-standard AES-256 protocols.
pen4d does not sell, rent, or trade your personal data to any third party for commercial purposes. Where data is shared with service providers (e.g., payment processors), it is governed by strict contractual data-processing agreements.
You retain the right to access, correct, export, and request deletion of your personal data at any time. pen4d processes all data-rights requests within 30 days and at no cost to you.
Every data category we collect is mapped to a specific, documented purpose. We do not use data collected for one purpose for a materially different purpose without notifying you and, where required, obtaining fresh consent.
pen4d retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Account data is deleted or anonymised within 90 days of verified account closure.
Data Subject Rights
As a pen4d player, you are the data subject. These are the rights you can exercise at any time by contacting our support team.
Request a full copy of all personal data pen4d holds about you, including the purposes for which it is processed and any third parties it has been shared with.
Request correction of any inaccurate or incomplete personal data held in your pen4d account. Corrections to identity documents require re-submission of supporting KYC documentation.
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to legal retention obligations (e.g., financial records required by anti-money laundering regulations).
Request that pen4d limits the processing of your personal data while a rectification request or objection is pending — for example, during an account dispute investigation.
Request an export of your personal data in a commonly used, machine-readable format (JSON or CSV) so you can transfer it to another service provider if you wish.
Object to the processing of your data for direct marketing purposes at any time. You may also object to processing based on pen4d's legitimate interests where your individual circumstances warrant it.
To exercise any of these rights, contact pen4d support with your registered email address. All requests are processed within 30 calendar days at no charge. Identity verification may be required before sensitive data is disclosed.
Summary: pen4d collects your data to run your account and keep it secure. We do not sell your data. You can request access, correction, or deletion at any time. Read below for the full details.
For the purposes of this Privacy Policy, the following definitions apply:
The data controller for all personal data processed in connection with the pen4d platform is the offshore-incorporated operating entity holding pen4d's international gaming licence. The platform is operated from outside Indonesian jurisdiction. Indonesian players access pen4d on their own initiative.
For all data-protection enquiries — including the exercise of data-subject rights, complaints, and requests for the data controller's full legal name and registered address — please contact pen4d's Data Protection contact point via the email address listed in Section 16 of this policy.
pen4d collects personal data in three broad categories: data you provide directly, data generated automatically through your use of the platform, and data we receive from third parties.
| Data Category | Specific Data Points | When Collected |
|---|---|---|
| Identity | Full legal name, date of birth, nationality, government-issued ID number (KTP / passport) | Registration & KYC |
| Contact | Email address, Indonesian mobile phone number, residential address (city, province, country) | Registration |
| Financial | Bank account name & number (BCA, BRI, BNI, Mandiri), e-wallet account details (OVO, DANA, GoPay) | Deposit / Withdrawal setup |
| KYC Documents | Scanned / photographed government ID, proof-of-address documents, source-of-funds evidence | KYC verification |
| Communications | Support chat transcripts, email correspondence, complaint records | Ongoing support interactions |
When you use the pen4d platform, the following data is generated and collected automatically:
pen4d may receive personal data about you from the following third-party sources:
pen4d processes personal data on the following legal bases under internationally recognised data protection frameworks:
pen4d uses the personal data it collects for the following clearly defined purposes:
pen4d does not sell your personal data. We share your data only with the categories of third parties listed below, and only to the extent necessary for the stated purpose:
All third-party processors engaged by pen4d are bound by written data-processing agreements that require them to maintain appropriate technical and organisational security measures and to process data only as instructed.
pen4d uses first-party cookies and similar tracking technologies to operate the platform effectively. We do not use third-party advertising cookies. The categories of cookies we use are:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Maintain your login session, remember your language preference, and enable core platform functions. These cannot be disabled. | Session |
| Functional | Remember your display preferences, default stake settings, and favourite game categories. | 30 days |
| Analytics | Collect anonymised data on platform usage (pages visited, session duration, error events) to identify and fix performance issues. | 12 months |
| Security | Detect and prevent fraudulent login attempts, bot activity, and session hijacking. | Session / 7 days |
You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the platform from functioning correctly.
pen4d retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods:
Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an individual.
pen4d implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:
Your Role in Security: You are responsible for maintaining the confidentiality of your pen4d account password. Use a unique, strong password and enable two-factor authentication in your account settings. pen4d will never ask for your password via email, live chat, or any other channel.
pen4d's servers are located in data centres outside Indonesia. When you use pen4d's services, your personal data is transferred to and processed in these offshore jurisdictions. pen4d ensures that all international transfers of personal data are subject to appropriate safeguards, including:
Indonesian players should be aware that Indonesian personal data protection law (UU PDP, Law No. 27 of 2022 on Personal Data Protection) may apply to cross-border transfers of Indonesian residents' personal data. pen4d's data handling practices are designed to align with the substantive principles of the UU PDP to the extent applicable to an offshore platform serving Indonesian residents.
pen4d's services are strictly for adults aged 21 and over. pen4d does not knowingly collect personal data from persons under the age of 21. If you are under 21, you must not use the pen4d platform or submit any personal data to us.
If pen4d becomes aware that it has collected personal data from a person under the age of 21, the data will be deleted immediately and the associated account closed. Parents or guardians who believe their minor child has registered on pen4d should contact support immediately so the account can be closed and data removed.
With your consent, pen4d may send you promotional communications via email or SMS about new bonuses, promotions, game launches, and seasonal offers relevant to the Indonesian market (including events such as Idul Fitri, Ramadhan promotions, and Indonesian Independence Day specials).
You may withdraw your consent to marketing communications at any time by:
Withdrawal of marketing consent does not affect the lawfulness of processing based on consent before its withdrawal, and does not affect the delivery of transactional communications (e.g., deposit confirmations, withdrawal notifications, KYC requests) which are necessary for account operation.
The pen4d platform may, from time to time, reference third-party services (such as payment processors or responsible gaming support organisations). This Privacy Policy applies only to pen4d's own data processing activities. pen4d is not responsible for the privacy practices of third-party websites or services, and we recommend that you review the privacy policy of any third-party service before providing them with your personal data.
pen4d serves a significant number of players from cities across Indonesia, including Jakarta, Surabaya, Medan, Bandung, Yogyakarta, Bali, and Semarang. Indonesia's personal data protection legal framework is established under Law No. 27 of 2022 on Personal Data Protection (UU PDP), which came into full force in October 2024. pen4d's data handling practices are designed to be consistent with the core principles of the UU PDP — including lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and security.
Indonesian players who believe their data-protection rights have been violated may also lodge a complaint with Indonesia's National Personal Data Protection Commission (Komisi Nasional Pelindungan Data Pribadi) once it is fully constituted, or seek recourse through the civil courts as provided under the UU PDP.
All payment data related to Indonesian bank accounts — including BCA, BRI, BNI, Mandiri, CIMB Niaga, and BSI — is handled with particular care and is never disclosed to parties other than the relevant payment processor for the purpose of completing a transaction.
pen4d may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, pen4d will notify registered players via email and/or a platform notification at least 14 days before the changes take effect, where reasonably practicable.
The "Last Updated" date at the top of this page indicates when the policy was most recently revised. Your continued use of pen4d after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the revised policy, you must discontinue use of the platform and may request account closure.
For any questions, concerns, or requests relating to this Privacy Policy or the exercise of your data-subject rights, please contact pen4d's data protection contact point. All correspondence should include your registered account email address and a clear description of your request or complaint.
Data & Privacy Enquiries: [email protected] — mark your subject line "Privacy Request" or "Data Rights Request".
Response Time: All data-rights requests are acknowledged within 3 business days and fulfilled within 30 calendar days.
If you are not satisfied with pen4d's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction in which pen4d's operating entity is incorporated, or — for Indonesian residents — to the competent Indonesian authority as described in Section 14.
Further Reading
Our FAQ page covers common questions about account management, security, and withdrawals. For the full rules governing use of pen4d, read the Terms & Conditions.