Privacy Policy

baru02 ("we", "us", "our") operates the online betting and casino platform accessible at https://baru02.net. In the course of providing our sportsbook, live casino, slot games, Bandar Q, and poker tournament services to players primarily located in Indonesia, we necessarily collect and process certain categories of personal data about you ("the Player", "you", "your").

This Privacy Policy sets out, in plain and accessible language, precisely how we handle that data — from the moment you first visit baru02.net through the entire lifecycle of your Account. We have structured this document to address both the practical reality of operating a modern online betting platform and the legitimate expectations that Indonesian players and international privacy standards impose on us.

This Privacy Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference.

For the purposes of this Privacy Policy, the following definitions apply:

baru02 collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify that you are 21 years of age or older).
• Residential address in Indonesia (city, province, postal code).
• Email address and username chosen during registration.
• Password (stored exclusively in hashed, salted form — we never store plaintext passwords).
• Mobile phone number, where provided for optional two-factor authentication (2FA).

3.2 KYC & Verification Documents

• Scanned or photographed copy of your KTP (Indonesian National Identity Card — Kartu Tanda Penduduk) or valid passport.
• Proof of residential address: bank statement or utility bill dated within the past three months.
• Proof of payment method ownership: screenshot or bank statement for the BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, or Bank Permata account, or the OVO, DANA, GoPay, ShopeePay, or LinkAja e-wallet account, used for deposits.
• Selfie photograph, where requested by our KYC team for liveness verification.

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and reference numbers.
• Bank account numbers and e-wallet identifiers linked to your Account (partial, masked where possible).
• Transaction history, including all deposits, withdrawals, bonus credits, and balance adjustments.
• Currency and denomination (Indonesian Rupiah, IDR / Rp).

3.4 Betting & Gaming Activity Data

• All wagers placed, including game type, market, stake amount, odds, settlement result, and timestamp.
• Bonus eligibility status, active wagering requirements, and bonus redemption history.
• Responsible gaming settings you have activated (deposit limits, loss limits, session reminders, cooling-off periods, self-exclusion).
• Customer support interaction logs, including live chat transcripts and email correspondence.

3.5 Technical & Device Data

• IP address and approximate geolocation derived from it (city and country level).
• Device type, operating system, browser name and version.
• Session start and end timestamps, pages visited, features used.
• Cookie identifiers and similar tracking technologies as described in Section 10.

baru02 collects Personal Data through several distinct channels:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or respond to a promotional offer.
• Automatically: When you visit and navigate the Platform, our servers and analytics tools automatically log your IP address, device identifiers, session data, and behavioural patterns such as page-view sequences and click paths.
• From third-party KYC partners: When you submit identity documents, our KYC vendor processes those documents and returns a verification status along with extracted data fields (name, date of birth, document number) that are stored in your Account record.
• From payment providers: When you initiate a deposit or withdrawal, our payment processing partners transmit confirmation data — such as transaction reference numbers and masked account identifiers — back to baru02 to update your Account balance and transaction history.
• From fraud-prevention tools: Our risk management systems may cross-reference your data against publicly available watchlists, sanctions lists, and politically exposed persons (PEP) databases as part of our AML (anti-money laundering) obligations.

baru02 processes your Personal Data only for defined, legitimate purposes. The table below sets out each processing activity alongside its purpose:

baru02 does not use your Personal Data for automated decision-making that produces legal effects concerning you without human oversight, except where required by our fraud-prevention and AML systems — in which case you have the right to request human review of any decision that materially affects your Account.

Each category of processing described in Section 5 rests on one or more of the following legal bases:

• Contractual necessity: Processing required to enter into and perform the contract constituted by our Terms & Conditions — including Account creation, payment processing, and game operation.
• Legitimate interests: Processing necessary for baru02's legitimate interests where those interests are not overridden by your fundamental rights — including fraud prevention, security monitoring, and Platform analytics.
• Legal obligation: Processing required to comply with applicable laws, including KYC verification, AML record-keeping, and responding to lawful authority requests.
• Consent: Processing based on your freely given, specific, and informed consent — including marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

baru02 does not sell, rent, or trade your Personal Data to any third party for marketing or commercial purposes. We share data only in the following limited circumstances:

7.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process Personal Data on our behalf under written data processing agreements. These include:

• KYC & identity verification vendors who process your identity documents and return verification results.
• Payment processors and banking partners — including technology intermediaries facilitating transactions with BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja — who receive only the data necessary to process your specific transaction.
• Game studio providers such as Evolution Gaming, Pragmatic Play, Microgaming, Spribe, and Pocket Games Soft, who may receive a session token and game-result data to operate their certified game environments.
• Fraud-prevention and AML screening tools that cross-reference Account data against sanctions and watchlist databases.
• Infrastructure and hosting providers who store Platform data on secure servers. All server infrastructure used by baru02 implements industry-standard encryption at rest and in transit.

7.2 Legal and Regulatory Disclosure

baru02 may disclose your Personal Data to governmental authorities, courts, regulators, or law enforcement agencies where required to do so by applicable law, court order, or in connection with our international operating licence obligations. We will, where permitted by law, notify you of any such disclosure.

7.3 Business Transfers

In the event that baru02 undergoes a merger, acquisition, restructuring, or sale of all or part of its business, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this Policy. You will be notified of any such transfer in advance where practicable.

baru02 retains your Personal Data for as long as your Account remains active and for a defined period thereafter, as follows:

• Active Account data (registration details, transaction history, gaming activity) is retained for the full duration of your Account's existence on the Platform.
• KYC documents (identity documents, proof of address) are retained for a minimum of five years from the date of last Account activity, in line with standard AML record-keeping obligations applicable to internationally licensed gaming operators.
• Financial transaction records are retained for a minimum of five years from the date of each transaction.
• Customer support records (live chat transcripts, email correspondence) are retained for two years from the date of the interaction.
• Technical logs (IP address logs, session logs) are retained for 12 months and then automatically purged.
• Following Account closure, residual identifying data is pseudonymised or deleted within 90 days, except where retention is required by legal obligation or ongoing dispute resolution.

Where you request deletion of your Personal Data (see Section 11), baru02 will action that request within 30 days, subject to any overriding legal obligations that require us to retain certain records for a prescribed minimum period.

baru02 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration:

• TLS/SSL encryption is enforced across all Platform communications. All data in transit between your browser and baru02's servers is encrypted using current TLS standards.
• Encryption at rest: All personally identifiable data stored in our databases is encrypted using AES-256 encryption.
• Password hashing: Player passwords are hashed using a modern, salted algorithm (bcrypt). baru02 staff cannot view your plaintext password at any time.
• Access controls: Internal access to Personal Data is restricted on a strict need-to-know basis. Staff with access to Player data are bound by confidentiality obligations and undergo regular data-protection training.
• Two-factor authentication (2FA): Available to all Players and strongly recommended for Account security.
• Penetration testing and vulnerability scanning: The Platform undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach affecting your Personal Data, baru02 will notify affected Players and relevant authorities in accordance with applicable notification obligations, within 72 hours of becoming aware of the breach where practicable.

baru02 uses cookies and similar client-side tracking technologies to operate the Platform, maintain your login session, and understand how the site is used. The following categories of cookies are in use:

baru02 does not use third-party advertising cookies or retargeting pixels. Your browsing activity on baru02.net is not shared with advertising networks for the purpose of displaying targeted ads on other websites.

You may control cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent the Platform from functioning correctly. For all other cookie categories, you may opt out via your browser's cookie management interface without affecting your ability to access the Platform's core features.

As a Player whose Personal Data is processed by baru02, you hold the following rights with respect to that data. To exercise any of the rights listed below, please contact our support team via live chat or email at [email protected] with the subject line "Data Rights Request — [Your Username]".

• Right of Access: You may request a copy of all Personal Data that baru02 holds about you. We will provide this in a structured, commonly used format within 30 days of your request.
• Right to Rectification: If any Personal Data held about you is inaccurate or incomplete, you may request that it be corrected. For name and date-of-birth corrections, a supporting identity document may be required.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where we no longer have a lawful basis for retaining it. Note that certain data must be retained for legal compliance purposes (e.g., AML records) and cannot be deleted on request during the mandatory retention period.
• Right to Restriction of Processing: You may request that baru02 temporarily cease processing your Personal Data in specific circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: You may request that baru02 provide your Personal Data in a machine-readable format (JSON or CSV) so that it can be transferred to another service provider of your choosing.
• Right to Object: You may object to processing based on our legitimate interests at any time. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time by contacting support or by using the unsubscribe mechanism in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

baru02 will respond to all rights requests within 30 days. In complex cases, this period may be extended by a further 30 days, with prior notice given to you. There is no charge for exercising these rights unless requests are manifestly unfounded or excessive, in which case baru02 reserves the right to apply a reasonable administrative fee.

The baru02 Platform is strictly for adults aged 21 years and older. We do not knowingly collect, store, or process Personal Data from individuals under the age of 21. Age verification checks are performed as part of both the registration process and the KYC procedure, specifically to prevent underage access.

If baru02 discovers that Personal Data belonging to a person under 21 years of age has been collected — whether through a fraudulent registration, a failed age check, or any other means — we will immediately suspend the relevant Account, delete the Personal Data in question to the extent permitted by law, and take appropriate steps in accordance with our Terms & Conditions.

If you are a parent or guardian and you believe that a person under 21 in your care has registered an Account on baru02, please contact us immediately at [email protected] so that we can investigate and take prompt remedial action.

baru02 operates as an internationally licensed online betting platform. Some of our third-party service providers — including KYC vendors, game studios such as Evolution Gaming, Pragmatic Play, and Spribe, and certain infrastructure providers — are located outside Indonesia. As a result, your Personal Data may be transferred to and processed in countries other than Indonesia.

Where such international transfers occur, baru02 ensures that appropriate safeguards are in place to protect your Personal Data to a standard equivalent to that applied within Indonesia. These safeguards include:

• Contractual clauses in our data processing agreements with third-party processors that impose data protection obligations consistent with applicable international standards.
• Transfers limited to jurisdictions that baru02 has assessed as providing an adequate level of data protection for the category of data being transferred.
• Encryption of all data in transit, regardless of the jurisdiction to which it is transferred.

You may request information about the specific safeguards baru02 relies upon for any given international transfer by contacting us at [email protected].

baru02 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When we make material changes to this Policy, we will:

• Update the "Last updated" date displayed at the top of this page.
• Publish a notice on the Platform's login page and, where applicable, send an email notification to your registered email address.
• Where required by law, seek fresh consent for new processing activities before they commence.

Your continued use of the baru02 Platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the changes. We encourage all Players to review this page periodically. Where the changes are significant and require your active consent, continued use of the Platform will be contingent on accepting the revised Policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or baru02's handling of your Personal Data, please reach out through any of the following channels:

• Live Chat: Available 24/7 on the baru02 Platform. Average first-response time under 3 minutes. Agents are available in both English and Indonesian.
• Email: [email protected] — Please use the subject line "Privacy Enquiry — [Your Username]" for fastest routing. Responses are provided within 24 hours under normal operating conditions. All times are in WIB (UTC+7).

For formal data rights requests (access, erasure, portability, rectification), please use the subject line "Data Rights Request — [Your Username]" as described in Section 11. baru02 treats all privacy-related correspondence as strictly confidential and will respond to you through your registered Account email address only, to protect against social engineering attempts.

baru02's full legal entity name, registered address, and details of our data protection officer are available upon written request sent to [email protected].