epoool is committed to protecting the privacy and personal data of every player on our platform. This policy explains what information we collect, why we collect it, how we use and protect it, and the rights you hold as a data subject.
epoool collects only the personal data necessary to deliver safe, compliant, and personalized gaming services to Indonesian players. We do not sell your data to third parties. We store your information securely using industry-standard encryption and allow you to exercise your data rights at any time by contacting our support team.
This Privacy Policy ("Policy") governs the collection, processing, storage, and disclosure of personal data by epoool ("we," "us," or "our") in connection with the online gaming platform operated at https://epoool.cam (the "Platform"). It applies to all users who visit, register with, or otherwise interact with epoool, regardless of the device or method of access.
By creating an account, depositing funds, or otherwise using epoool services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use our services.
This Policy is to be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the binding agreement between you and epoool.
We may update this Policy periodically to reflect changes in applicable law, our business practices, or the services we offer. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of epoool services after any revision constitutes acceptance of the updated terms.
For the purposes of this Policy, the following terms carry the meanings set out below:
epoool collects Personal Data across several categories depending on your interaction with the Platform. We only collect data that is necessary for a specific, legitimate purpose.
| Category | Examples | Necessity |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, KTP number, selfie photo | Required — KYC compliance |
| Contact Data | Email address, Indonesian mobile phone number, residential address | Required — account communication |
| Financial Data | Bank account names and numbers (BCA, BRI, BNI, Mandiri, etc.), e-wallet IDs (OVO, DANA, GoPay), transaction amounts, deposit and withdrawal history | Required — payment processing |
| Account Data | Username, encrypted password, account balance, bonus status, loyalty tier, session history | Required — service delivery |
| Gaming Activity Data | Bets placed, games played, wager amounts, win/loss records, betting patterns, RTP logs | Required — responsible gaming monitoring |
| Technical Data | IP address, device type, browser type and version, operating system, screen resolution, time zone (WIB/WITA/WIT) | Required — security and fraud prevention |
| Usage Data | Pages visited, click paths, session duration, features interacted with, game preferences | Optional — platform improvement |
| Communications Data | Live chat transcripts, email correspondence, WhatsApp message history, in-app messages | Required — customer support and dispute resolution |
| Marketing Preference Data | Promotional opt-in or opt-out status, preferred communication channels | Optional — personalized promotions |
We do not intentionally collect Sensitive Personal Data beyond what is strictly required for KYC identity verification (i.e., government ID scans and a selfie photograph). Financial data is collected solely for payment processing and is never stored in unencrypted form.
We collect Personal Data through the following channels:
You provide data directly when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or update your account settings. This represents the largest category of data we hold and is provided with your full knowledge and participation.
When you visit or use the Platform, our servers and analytics systems automatically record Technical Data and Usage Data. This includes your IP address, device identifiers, browser session data, and clickstream behavior. This collection is necessary to maintain security, detect fraud, and optimize the user experience. Our use of cookies and similar tracking technologies is explained in detail in Section 11.
We may receive data about you from third-party partners in limited circumstances, including:
Any data received from third parties is handled with the same level of protection as data you provide directly, and we only use it for the specific purpose for which it was shared with us.
epoool processes your Personal Data for the following clearly defined purposes:
We do not process your Personal Data for any purpose incompatible with those listed above without obtaining your explicit prior consent.
Every processing activity epoool undertakes rests on at least one of the following legal grounds:
The majority of our processing is necessary to perform the contract you entered into when you accepted our Terms & Conditions. Without processing Identity Data, Financial Data, and Account Data, we cannot deliver the services you signed up for.
Certain processing activities — particularly KYC verification, transaction monitoring, and record-keeping — are required under applicable anti-money laundering regulations and responsible gaming obligations. We must perform these activities regardless of your preferences.
We process Technical Data and Usage Data on the basis of our legitimate interest in maintaining platform security, preventing fraud, and improving our services. We conduct a balancing test to confirm that our interests do not override your fundamental rights and freedoms before relying on this ground.
Where we send marketing communications or use non-essential cookies, we rely on your freely given, informed, and withdrawable consent. You may withdraw marketing consent at any time by contacting support or adjusting your account notification settings, without affecting the lawfulness of processing carried out before withdrawal.
epoool does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We disclose your data only in the circumstances described below, and only to the extent necessary for the stated purpose.
We engage carefully selected third-party service providers to perform functions on our behalf. These providers are contractually bound to process your data only on our documented instructions, to apply appropriate technical and organizational security measures, and to refrain from any independent use of your data. Categories of service providers include:
We may disclose Personal Data to governmental or regulatory authorities, law enforcement agencies, or courts when required to do so by applicable law, court order, or binding regulatory directive. We will, where legally permitted, notify you of any such disclosure request before complying.
In the event of a merger, acquisition, restructuring, or sale of all or a material portion of our assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will provide notice before your data becomes subject to a materially different privacy policy, and you will have the opportunity to request deletion of your account prior to any transfer taking effect.
We may disclose Personal Data when we reasonably believe disclosure is necessary to protect the rights, property, or safety of epoool, our users, or the public — for example, to investigate fraud, resolve disputes, or enforce our Terms & Conditions.
epoool has never sold, and will never sell, your Personal Data to data brokers, advertisers, or any third party for profit. Your information is used exclusively to deliver and improve the services you have requested.
epoool's primary user base is located in Indonesia, and we design our data infrastructure to keep the majority of Indonesian user data processed within or close to the Indonesian region. However, some of our service providers — particularly cloud infrastructure partners and game technology providers — operate data centers in other countries.
Where Personal Data is transferred outside Indonesia, we ensure an equivalent level of protection is in place through one or more of the following safeguards:
You may request further information about the specific safeguards we apply to any international transfer by contacting us at the address provided in Section 15.
We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. The retention periods set out below represent our standard practice; individual circumstances may warrant shorter or longer retention.
While your account remains open, we retain all Personal Data, Account Data, Gaming Activity Data, and Financial Data associated with your account. This data is necessary to deliver uninterrupted services, maintain accurate account records, and support any retrospective disputes or investigations.
Following account closure — whether initiated by you or by epoool — we typically retain:
Where an account is closed as a result of a self-exclusion request under our Responsible Gaming Policy, we retain a record of the exclusion for the full duration of the exclusion period plus an additional five years. This retention is specifically designed to prevent circumvention of self-exclusion protections and is in your best interest.
Upon expiry of the applicable retention period, we securely delete or irreversibly anonymize your Personal Data so that it can no longer be associated with your identity. You may request early deletion of data not subject to mandatory retention periods by submitting a deletion request as described in Section 12.
epoool implements comprehensive technical and organizational security measures designed to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. While no system can guarantee absolute security, our multi-layered approach reflects current industry best practice.
You also play an important role in keeping your account secure. You are responsible for maintaining the confidentiality of your password, using a unique password not shared with other services, logging out of your account on shared or public devices, and promptly notifying us if you suspect any unauthorized access to your account. epoool will never ask you for your password via email, phone, or chat.
If you discover a vulnerability in our Platform or suspect that your account has been compromised, contact our security team immediately at [email protected] with "Security Report" in the subject line. We will investigate all credible reports and respond within 24 hours.
epoool uses cookies and similar tracking technologies to provide a functional, secure, and optimized platform experience. This section explains what types of cookies we use, why we use them, and how you can manage your preferences.
Cookies are small text files stored on your device when you visit a website. They allow the website to recognize your device across pages and sessions, remember your preferences, and gather information about how you interact with the site. We also use related technologies such as web beacons, pixel tags, and local storage objects that serve similar functions.
You can manage non-essential cookies through your browser settings. Most modern browsers allow you to view, block, and delete cookies via the privacy or security section of the browser settings menu. Please note that disabling certain cookies may affect the functionality of the Platform — for example, disabling strictly necessary cookies will prevent you from staying logged in.
For mobile applications, you can manage tracking permissions through your device's operating system settings. On Android and iOS devices, you can revoke advertising identifier permissions at any time without affecting core app functionality.
As a data subject, you hold the following rights in relation to the Personal Data epoool holds about you. We are committed to honoring these rights promptly and without unnecessary barriers.
You have the right to request a copy of the Personal Data we hold about you, along with information about how it is processed, the categories of data held, the purposes of processing, and any third parties with whom it has been shared. We will respond to valid access requests within 30 days.
If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. For most account details, you can update your information directly through account settings. For KYC-verified fields (such as your legal name or date of birth), contact our support team with updated documentation.
You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. We cannot delete data that we are legally required to retain — such as KYC records and transaction logs subject to anti-money laundering retention requirements — but we will delete all other data and provide you with a clear explanation of what we retain and why.
You have the right to request that we restrict processing of your Personal Data in certain circumstances — for example, while you contest the accuracy of data we hold, or where you object to processing based on legitimate interest and we are assessing your objection.
Where processing is based on your consent or on contract performance and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to request that it be transmitted to another data controller where technically feasible.
You have the right to object to processing of your Personal Data where we rely on legitimate interest as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You may also object at any time to the use of your data for direct marketing, and we will honor that objection immediately.
To exercise any of the rights described above, contact our Data Protection team at [email protected] with the subject line "Data Rights Request." Please include your registered account username, the specific right you wish to exercise, and any relevant details. We will verify your identity before processing your request and will respond within 30 days. Complex or voluminous requests may take up to 60 days, in which case we will notify you of the extension and the reason for it.
epoool's services are strictly intended for adults who are at least 21 years of age. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in our KYC process, and we apply multiple controls — including automated age-gate checks and manual document review — to prevent underage access.
If we become aware that we have inadvertently collected Personal Data from a person under 21, we will immediately suspend the associated account, delete all Personal Data collected from that individual to the extent permitted by anti-money laundering record-keeping requirements, and return any funds held in the account to the depositing payment method where possible.
If you believe that a minor has created an account on epoool or is accessing our platform, please contact us immediately at [email protected]. We treat all such reports seriously and investigate them as a priority.
We reserve the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our business practices, or the services we provide. All amendments will be posted to this page with an updated "Last Updated" date.
For material changes — meaning changes that significantly affect how we use your Personal Data or the rights available to you — we will provide advance notice via email to your registered address and through a prominent notice on the Platform no less than 14 days before the change takes effect. For non-material updates (such as typographical corrections or clarifications that do not alter the substance of the Policy), we will update the page without prior notification.
Your continued use of epoool services after any Privacy Policy update takes effect constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you should close your account and cease using epoool services before the effective date of the change.
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by epoool, please contact us using the details below. Our Data Protection team monitors these channels 24/7 and is staffed by agents fluent in both English and Bahasa Indonesia.
We will acknowledge receipt of your inquiry within one business day and aim to provide a substantive response within 30 days. For complex data rights requests, we may require up to 60 days and will notify you accordingly.
epoool is committed to handling every privacy inquiry with professionalism, transparency, and respect for your rights. We view your trust as the foundation of our relationship, and protecting your Personal Data is not a regulatory obligation we merely comply with — it is a core part of how we operate as a responsible gaming platform serving the Indonesian community.
Six pillars of our data protection commitment
All data in transit is protected by TLS 1.3 with 256-bit AES encryption. Sensitive fields in our database are encrypted at rest so that unauthorized access yields no readable information.
Our identity verification process confirms your age (21+) and Indonesian residency before activating withdrawals, protecting all users from fraud, identity theft, and underage access.
We do not sell, rent, or trade your personal information to any third party for their own commercial use. Your data is used exclusively to deliver and improve epoool services.
You hold the right to access, correct, export, restrict, or delete your Personal Data at any time. Submit a request to our Data Protection team and we will respond within 30 days.
We retain your data only as long as necessary for legal compliance or service delivery. KYC and transaction records are kept for five years post-closure; other data is deleted sooner.
Our Data Protection team is available around the clock via live chat and email. Indonesian-speaking agents are on hand to help you understand and exercise your privacy rights.
Our Data Protection team is available 24/7 to answer any questions about this Privacy Policy, help you exercise your data rights, or address concerns about how epoool handles your information.
21+ only. For responsible gaming guidance, visit our Responsible Gaming page.