Privacy Policy – jpbray

This Privacy Policy ("Policy") describes how jpbray ("we", "us", "our") collects, processes, stores, and protects personal data relating to individuals ("you", "the Player", "User") who access or use the jpbray platform at https://jpbray.cam, including all associated mobile-optimised interfaces and communication channels.

jpbray operates as an internationally licensed online gaming platform primarily serving players located in Indonesia. This Policy has been prepared in accordance with internationally recognised data protection principles, including those reflected in frameworks such as the General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (UU PDP). Where the two frameworks differ, jpbray applies the more protective standard.

By registering an Account on jpbray or continuing to use the Platform after this Policy has been updated, you acknowledge that you have read and understood its contents. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform and contact us to arrange Account closure.

This Policy applies to all processing activities conducted by jpbray as the data controller. It does not apply to the data practices of third-party game providers, payment processors, or other external services accessed through the Platform — those parties maintain their own independent privacy policies.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, jpbray.
• "Data Processor" means a third party that processes Personal Data on behalf of jpbray under a written contractual agreement, subject to jpbray's instructions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity and address verification process required under our licensing and anti-money laundering obligations.
• "Cookies" means small text files placed on your device by the Platform to store session data, preferences, and analytical information.
• "Platform" means the jpbray website at https://jpbray.cam and all associated digital interfaces.

jpbray collects the minimum personal data necessary to deliver a secure, compliant, and personalised gaming experience. The categories of data we process are outlined in the table below:

jpbray collects personal data through the following channels and mechanisms:

• Directly from you: Information you submit when registering an Account, completing KYC, making a deposit, requesting a withdrawal, contacting customer support, or responding to promotional surveys.
• Automatically through your use of the Platform: Technical and behavioural data collected via server logs, cookies, pixel tags, and session tracking tools as you navigate the jpbray website and play games.
• From third-party payment processors: Transaction confirmation details, payment status, and fraud-screening signals from your bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• From identity verification partners: Data verification results, document authenticity assessments, and watchlist screening outcomes from our KYC service providers.
• From fraud prevention and security providers: Device fingerprint data, IP reputation scores, and behavioural anomaly signals used to protect player accounts from unauthorised access.
• From publicly available sources: Regulatory watchlists, sanctions databases, and publicly accessible adverse-media databases consulted as part of our AML and responsible gaming obligations.

jpbray processes personal data for the following specific, legitimate purposes:

1. Account Creation & Management: To register, maintain, and administer your player account, including verification of your identity and eligibility to use the Platform.
2. Payment Processing: To execute deposits and withdrawals via your chosen local payment method, verify that funds originate from your own registered account, and maintain accurate transaction records.
3. Regulatory Compliance (KYC/AML): To comply with our licensing conditions, anti-money laundering obligations, and fraud prevention requirements. This includes screening against international sanctions lists and politically exposed persons (PEP) databases.
4. Game Delivery & Platform Operation: To provide, maintain, and improve the technical operation of the Platform, ensure games function correctly, and deliver a stable, low-latency gaming experience.
5. Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behaviour, administer sel f-exclusion and cooling-off periods, enforce deposit limits, and fulfil our duty-of-care obligations under responsible gaming frameworks.
6. Security & Fraud Prevention: To detect, investigate, and prevent fraud, collusion, bonus abuse, multi-accounting, and unauthorised access to player accounts.
7. Customer Support: To respond to your enquiries, resolve technical issues, investigate complaints, and maintain records of all support interactions for quality assurance and dispute resolution.
8. Marketing & Promotions: To inform you of new game releases, bonus offers, and promotional campaigns via email or in-platform messaging, where you have consented to receive such communications.
9. Analytics & Service Improvement: To analyse aggregated usage patterns, identify technical bottlenecks, optimise game performance, and improve the overall user experience based on behavioural data.
10. Legal Obligations & Dispute Resolution: To comply with court orders, regulatory requests, and law enforcement investigations, and to establish, exercise, or defend legal claims.

jpbray processes your personal data only where we have a valid legal basis to do so. Under internationally recognised data protection principles, the applicable legal bases are:

• Performance of a Contract: Processing necessary to create your Account, deliver gaming services, process payments, and fulfil our contractual obligations to you under our Terms & Conditions.
• Legal Obligation: Processing required to comply with KYC, AML, tax reporting, player protection, and other regulatory requirements mandated by our licensing jurisdiction.
• Consent: Processing based on your explicit, freely given consent — applicable primarily to marketing communications and optional analytics cookies. You may withdraw consent at any time via your Account settings.
• Legitimate Interests: Processing necessary for fraud prevention, security monitoring, platform improvement, and business analytics, where such interests are not overridden by your fundamental rights and freedoms.

For marketing purposes, we rely on your explicit opt-in consent. You may withdraw marketing consent at any time by clicking the unsubscribe link in any promotional email or by adjusting your communication preferences in your Account dashboard.

jpbray does not sell, rent, or trade personal data to third parties for their own marketing purposes. However, we share personal data with carefully selected third-party service providers and regulatory bodies as necessary to operate the Platform and comply with legal obligations. The categories of recipients are:

• Payment Processors: Your financial data (bank account details, e-wallet credentials) is shared with the relevant payment gateway or banking institution (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals.
• KYC & Identity Verification Providers: Your identity documents and personal details are shared with our contracted KYC verification partners to authenticate your identity, assess document validity, and screen against sanctions lists.
• Game Providers: Technical session data (player ID, game history, bet amounts) is shared with the studios supplying our games (Pragmatic Play, PG Soft, Evolution Gaming, Habanero, Microgaming, NetEnt, Spribe) to deliver game functionality, maintain RTP compliance, and investigate technical issues.
• Fraud Prevention & Security Services: IP addresses, device fingerprints, and transaction patterns are shared with fraud-detection platforms to identify suspicious activity and protect player accounts.
• Customer Support Platforms: Support ticket content, chat transcripts, and contact details are processed via our helpdesk software provider to manage and resolve player enquiries.
• Analytics Providers: Aggregated, pseudonymised usage data is shared with analytics platforms to generate reports on site performance, user engagement, and technical optimisation opportunities.
• Regulatory Authorities: Personal data and transaction records are disclosed to our licensing authority and relevant financial intelligence units upon lawful request, particularly in relation to AML investigations or player complaints.
• Law Enforcement & Legal Processes: We disclose personal data where required by court order, subpoena, or statutory obligation, or where necessary to protect the rights, property, or safety of jpbray, its users, or the public.

All third-party processors are bound by written data processing agreements that require them to protect your data to standards equivalent to or exceeding those set out in this Policy. jpbray conducts due diligence on all processors before engagement and monitors their compliance on an ongoing basis.

jpbray operates an international platform with technical infrastructure, payment partners, and service providers located in multiple jurisdictions. As a result, your personal data may be transferred to, stored in, or processed in countries outside Indonesia, including within the European Economic Area (EEA), United Kingdom, Singapore, and other jurisdictions where our technical infrastructure or contracted processors operate.

When transferring personal data internationally, jpbray ensures adequate protection through one or more of the following safeguards:

• Transfer to jurisdictions recognised as offering adequate data protection by international standards (e.g., EEA member states under GDPR).
• Implementation of Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent contractual safeguards.
• Certification under recognised frameworks such as ISO 27001 for information security management.
• Processor agreements requiring compliance with data protection standards equivalent to those mandated within Indonesia and the EEA.

You may request further information about the specific safeguards applied to international transfers of your data by contacting us at [email protected].

jpbray retains personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our Terms & Conditions. Specific retention periods are outlined below:

• Account Data & KYC Records: Retained for the duration of your Account's active status, plus 7 years following Account closure. This extended retention period is mandated by AML regulations and licensing requirements.
• Transaction Records: Financial transaction logs, deposit and withdrawal records, and game history are retained for 7 years from the date of the transaction, as required by financial record-keeping obligations.
• Communications Records: Support tickets, email correspondence, and live chat transcripts are retained for 3 years from the date of the last communication, to facilitate dispute resolution and quality assurance.
• Marketing Consent Records: Records of your marketing opt-in or opt-out preferences are retained for 3 years from the date of last account activity or until you withdraw consent.
• Security & Fraud Logs: IP logs, device fingerprints, and fraud investigation records are retained for 5 years to support ongoing security monitoring and to defend against future fraudulent claims.
• Self-Exclusion Records: Records of self-exclusion requests are retained permanently to prevent re-registration under the same identity, in compliance with responsible gaming requirements.

At the end of the applicable retention period, personal data is either securely deleted or anonymised such that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for statistical and analytical purposes.

jpbray is committed to protecting your personal data against unauthorised access, alteration, disclosure, or destruction. We implement a comprehensive suite of technical and organisational security measures, including:

• Encryption: All personal data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption. Payment card data (if applicable) is encrypted at rest using AES-256 encryption standards.
• Access Controls: Personal data is accessible only to authorised jpbray employees, contractors, and approved processors who require access to perform their duties. All personnel are subject to confidentiality obligations.
• Multi-Factor Authentication: Administrative access to jpbray's systems requires multi-factor authentication (MFA) to reduce the risk of unauthorised internal access.
• Firewall & Intrusion Detection: Our technical infrastructure is protected by enterprise-grade firewalls, intrusion detection systems (IDS), and distributed denial-of-service (DDoS) mitigation technology.
• Regular Security Audits: jpbray conducts regular internal and third-party security audits, vulnerability assessments, and penetration testing to identify and remediate potential weaknesses.
• Data Segregation: Sensitive personal data (KYC documents, financial records) is stored in segregated databases with restricted access separate from general platform data.
• Incident Response Plan: We maintain a documented data breach response plan to detect, investigate, and respond to security incidents within the timelines mandated by applicable data protection law.

While jpbray implements industry-standard security measures, no online platform can guarantee absolute security. You share responsibility for protecting your Account by maintaining the confidentiality of your login credentials, using strong unique passwords, and reporting any suspected unauthorised access immediately to [email protected].

jpbray uses cookies, pixel tags, local storage, and similar tracking technologies to deliver, secure, and improve the Platform. Cookies are small text files stored on your device that enable the Platform to recognise your browser and remember certain information about your session and preferences.

The types of cookies we use are categorised as follows:

• Strictly Necessary Cookies: Essential for the operation of the Platform. These cookies enable you to log in, navigate between pages, and access secure areas. Without these cookies, core Platform functionality cannot be delivered. These cookies do not require consent.
• Performance & Analytics Cookies: Collect information about how visitors use the Platform — which pages are visited most, session duration, bounce rates, and technical errors. This data is aggregated and anonymised to help us optimise site performance.
• Functionality Cookies: Remember your preferences (language, time zone, display settings) to provide a more personalised experience on return visits.
• Marketing & Advertising Cookies: Track your browsing activity across the Platform to build a profile of your interests and deliver more relevant promotional offers. These cookies require your explicit consent.

You can control cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, although doing so may impair certain features of the Platform. For detailed guidance on managing cookies in specific browsers, visit your browser's help documentation.

jpbray does not use cookies or tracking technologies to collect sensitive personal data such as your precise geolocation, health information, or financial account details beyond what is necessary for payment processing.

Under internationally recognised data protection frameworks and Indonesia's Personal Data Protection Law, you hold the following rights over your personal data:

• Right of Access: You may request a copy of the personal data jpbray holds about you, delivered in a structured, commonly used electronic format. Your first annual access request is free; subsequent requests may incur an administrative fee.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Where feasible, you can update your contact details and payment information directly via your Account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing. This right is subject to our legal retention obligations (see Section 9 above).
• Right to Restrict Processing: You may request that we temporarily suspend processing of your personal data in certain circumstances, such as while we verify the accuracy of contested data or assess whether our legitimate interests override your objection.
• Right to Data Portability: You may request that we transfer your personal data directly to another service provider in a machine-readable format, where technically feasible.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. If you object to marketing, we will cease such processing immediately.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing emails, optional analytics), you may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction if you believe jpbray has processed your personal data unlawfully.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". We will respond within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, and we will notify you of the extension and the reasons for it.

jpbray is an adult-only platform. Use of the Platform is strictly prohibited for any individual under the age of 21 years. We do not knowingly collect, process, or retain personal data from minors.

If we become aware that a registered Account belongs to a person under 21, or that we have inadvertently collected personal data from a minor, we will immediately suspend the Account, void all associated transactions, and delete the personal data in accordance with our data retention obligations.

Parents or legal guardians who believe their child has registered an Account on jpbray or provided personal data to the Platform should contact us immediately at [email protected] so we can take appropriate action.

jpbray employs age verification mechanisms as part of the KYC process to prevent underage gambling. All players are required to submit government-issued identity documents confirming their date of birth before any withdrawal can be processed.

jpbray reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or business operations. When material changes are made — particularly those that reduce your rights or expand the categories of data collected — we will notify you via email to your registered address at least 14 days before the changes take effect.

The most current version of this Policy is always accessible at https://jpbray.cam/privacy-policy. The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically to stay informed about how your data is being protected.

Your continued use of the Platform following the effective date of any update constitutes acceptance of the revised Policy. If you do not agree with the updated terms, you should cease using the Platform and contact us to arrange Account closure before the changes take effect.

If you have questions, concerns, or complaints about this Privacy Policy or jpbray's data processing practices, please contact our Data Protection team through the following channel:

• Email: [email protected]
• Subject Line: "Privacy Policy Enquiry" or "Data Protection Request"
• Response Time: Privacy-related enquiries are prioritised and typically receive a substantive response within 10 business days

When submitting a privacy request, please include your full registered name, Account ID (if applicable), and sufficient detail to enable us to locate your records and understand the nature of your request. We may require additional identity verification before processing requests relating to access, rectification, or erasure of personal data.

If you are dissatisfied with our handling of a privacy complaint, you have the right to escalate the matter to the data protection supervisory authority in your jurisdiction. In Indonesia, complaints may be directed to the relevant ministry or agency responsible for enforcing the Personal Data Protection Law once the full regulatory framework is operational.