Privacy Policy — gsc111

Introduction

gsc111 ("we", "us", "our") operates Indonesia's premier online gambling destination at https://gsc111.app. We are committed to protecting the privacy and personal data of all Members and visitors who interact with our Platform. This Privacy Policy sets out, in plain and professional language, the full scope of our data practices — what we collect, why we collect it, how long we keep it, and the rights available to you.

This document is part of a suite of legal agreements that govern your relationship with gsc111, alongside our Terms & Conditions and Responsible Gaming Policy. In the event of any conflict between this Privacy Policy and any other document on the Platform, this Privacy Policy governs with respect to all matters of personal data handling.

gsc111 is an internationally licensed and regulated online gambling platform. As such, we are subject to data handling obligations arising from our operating license conditions, international AML standards, and the personal data protection expectations of our Members — the majority of whom are residents of Indonesia. We take these obligations seriously and have designed our data practices accordingly.

If you have questions about this Policy or about how your data is handled, please contact our Data Protection team as described in Section 17 of this document. Our 24/7 Indonesian-speaking support team is also available via live chat for day-to-day privacy enquiries.

Definitions

The following terms carry the meanings assigned below throughout this Privacy Policy. Where context requires, singular includes plural and vice versa.

Data We Collect

3.1 Registration Data. When you create a gsc111 account via the gsc111 login page, we collect: your full legal name as it appears on your Indonesian KTP; your date of birth; a unique username chosen by you; your registered Indonesian mobile number; and your chosen account password (stored in hashed, non-reversible form — we never store your password in plaintext).

3.2 Identity Verification (KYC) Data. To comply with our international licensing obligations and AML requirements, and to process withdrawals, we collect identity documents including: a scan or photograph of your Kartu Tanda Penduduk (KTP) or equivalent Indonesian government-issued identification; a selfie photograph taken alongside your identity document; and, where enhanced due diligence is required, a recent bank statement or e-wallet transaction record confirming that your payment method is registered in your verified name.

3.3 Financial Transaction Data. For every deposit and withdrawal transaction processed through your gsc111 account, we record: the payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja); the transaction amount in Indonesian Rupiah (IDR); the transaction timestamp in WIB (Western Indonesia Time, UTC+7); the transaction reference number; and the outcome (successful, pending, failed). We do not store full bank account numbers; only the last four digits and the bank name are retained in your transaction record.

3.4 Gameplay & Wagering Data. gsc111 records all wagering activity on the Platform — including sportsbook bets (covering BRI Liga 1 matches, EPL, Champions League, and international football), slots sessions, live casino hands, togel (Indonesia's traditional numbers lottery) entries, bingo rounds, and Bandar Ceme hands — along with bet amounts, outcomes, and timestamps. This data is required for account management, dispute resolution, responsible gaming monitoring, and regulatory reporting.

3.5 Technical & Device Data. When you access the Platform, our servers automatically collect: your IP address; browser type and version; operating system; device type (desktop, mobile, tablet); screen resolution; the referring URL (the page you visited before landing on gsc111); pages visited on the Platform; and session duration and click-path data. This data is collected for security monitoring, fraud detection, and service optimization purposes.

3.6 Communications Data. If you contact our support team via live chat, email, or any other channel, we retain a record of the communication — including the content of messages, timestamps, and the resolution outcome. This enables us to maintain continuity of service and to review our support quality.

3.7 Marketing Preference Data. Where you have opted in to receive promotional communications, we record your marketing consent status and the channels through which you have agreed to receive communications (e.g., SMS, email). We also record opt-out actions when you withdraw marketing consent.

How We Collect Your Data

4.1 Directly From You. The majority of your Personal Data is collected directly from you — through the account registration form on the gsc111 login page, KYC document submissions, deposit and withdrawal requests, live chat interactions, and email correspondence with our support team.

4.2 Automatically Via Technology. Technical and device data (Section 3.5) is collected automatically when you access the Platform, using server logs, cookies, and similar tracking technologies. See Section 11 for a full explanation of our cookie practices.

4.3 From Third-Party Service Providers. Where you use a third-party payment method — such as OVO, DANA, GoPay, or a BCA/BRI/BNI/Mandiri bank transfer — the relevant payment processor transmits transaction confirmation data to gsc111 upon completion of your deposit or withdrawal. This data is strictly limited to what is necessary to confirm and record the transaction. gsc111 does not receive your full payment account credentials from these providers.

4.4 From KYC Verification Partners. In some cases, gsc111 uses third-party KYC verification vendors to cross-check identity document data against public databases or identity registries. These vendors provide a verification outcome (confirmed / not confirmed) and limited supporting data; they do not retain copies of your identity documents beyond their own documented retention policies.

Purposes of Processing

gsc111 processes your Personal Data exclusively for the following defined purposes. We do not use your data for any purpose not listed here without first notifying you and, where required by law, obtaining your consent.

Legal Basis for Processing

6.1 Contractual Necessity. The primary legal basis for processing your registration data, KYC data, financial transaction data, and gameplay data is the performance of the contract between you and gsc111 — namely, the Terms & Conditions you accepted upon registration. Without processing this data, gsc111 cannot provide the gambling services you signed up for.

6.2 Legal Obligation. Processing your KYC documents, AML-related transaction records, and responsible gaming monitoring data is required by gsc111's international operating license conditions and applicable financial crime prevention frameworks. This processing is mandatory and cannot be refused by you without consequences for your Account access.

6.3 Legitimate Interests. gsc111 processes technical and device data, fraud detection signals, and anonymized analytics data on the basis of our legitimate interests in maintaining platform security, preventing fraud, and improving the quality of our service. We have assessed that these legitimate interests do not override your rights and freedoms, given the limited personal impact of this processing and the safeguards we have applied.

6.4 Consent. Promotional and marketing communications are processed exclusively on the basis of your explicit consent, which you may withdraw at any time without affecting the operation of your Account. See Section 14 for full details of our marketing consent practices.

Data Sharing

7.1 Payment Processors. To process deposits and withdrawals via Indonesian banking channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), gsc111 shares the minimum necessary transaction data — your verified name, transaction amount, and payment reference — with our licensed payment processing partners. All payment processors are contractually required to process your data only for the purpose of completing the transaction and are prohibited from using it for any other purpose.

7.2 KYC & Identity Verification Partners. Identity document data collected for KYC purposes is shared with our certified KYC verification vendor(s) solely for the purpose of confirming your identity. These partners are bound by strict data processing agreements, and their handling of your identity data is subject to independent security certification.

7.3 Regulatory & Law Enforcement Authorities. gsc111 may be required to disclose personal data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where we are under a legal obligation to do so — for example, in connection with an AML investigation or a court order. We will notify you of any such disclosure to the extent permitted by law.

7.4 Cloud Infrastructure Providers. The Platform operates on cloud infrastructure provided by third-party hosting providers. These providers have access to data stored on their infrastructure solely for the purpose of providing hosting services. They are bound by confidentiality obligations and are not permitted to access or use your data for any other purpose.

7.5 No Sale of Data. gsc111 does not sell, rent, license, or trade your Personal Data to any third party for marketing, advertising, or commercial profiling purposes. This applies to all Member data without exception.

International Data Transfers

8.1 As an internationally licensed platform, gsc111 operates infrastructure and works with service providers located in multiple jurisdictions. As a result, your Personal Data may be transferred to and stored on servers located outside Indonesia.

8.2 Where Personal Data is transferred internationally, gsc111 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections applicable in Indonesia. These safeguards include contractual data transfer agreements with all recipient entities, requiring them to maintain data security standards consistent with international best practice.

8.3 gsc111 does not transfer KYC identity documents to any jurisdiction that does not provide an adequate level of data protection as assessed by our Compliance team. If you have questions about the specific jurisdictions to which your data may be transferred, please contact our Data Protection Officer using the details in Section 17.

Data Security

9.1 Technical Measures. gsc111 implements the following technical security measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform.
• AES-256 encryption for sensitive data stored at rest on our servers, including KYC documents and financial records.
• Bcrypt hashing for all stored account passwords — your password is never stored in a form that can be read by gsc111 staff.
• Two-factor authentication (2FA) available to all Members, strongly recommended at account setup via the gsc111 login page.
• Regular independent penetration testing of the Platform's security infrastructure, conducted by certified third-party security auditors.
• Real-time intrusion detection and anomaly-monitoring systems on all Platform infrastructure.

9.2 Organizational Measures. Access to Member Personal Data within gsc111 is governed by strict role-based access controls. Only personnel who require access to Personal Data to perform their job function are granted that access. All staff with access to Member data are subject to confidentiality obligations and receive regular data protection training. Access logs are maintained and reviewed periodically.

9.3 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gsc111 will notify affected Members within 72 hours of becoming aware of the breach, or as soon as reasonably practicable, providing details of the nature of the breach, the data affected, and the steps we are taking to contain and remediate it.

Data Retention

10.1 General Principle. gsc111 retains your Personal Data only for as long as it is necessary for the purpose for which it was collected, or for as long as required by applicable law, licensing conditions, or regulatory obligation. We do not retain data beyond these periods.

10.2 Retention Schedule. The following retention periods apply to the main categories of Personal Data we hold:

10.3 Secure Deletion. Upon expiry of the applicable retention period, Personal Data is permanently deleted from all active systems and, within the subsequent 90-day cycle, from all backup systems. Where complete deletion is not technically feasible within that timeframe, the data is fully anonymized so that it can no longer identify you.

Cookies & Tracking Technologies

11.1 What Are Cookies. Cookies are small text files placed on your device by the Platform when you visit it. They allow the Platform to recognize your device on subsequent visits and to store session-specific information that enhances your experience — such as keeping you logged in during an active session after you have completed the gsc111 login process.

11.2 Cookies We Use. gsc111 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens that keep you logged in after your gsc111 login, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking the Platform's core functionality.
• Performance & Analytics Cookies: Collect anonymized data about how Members use the Platform — which pages are visited most frequently, where users encounter errors, and how navigation flows are used. This data is aggregated and does not identify individual users. Used to improve the Platform's design and performance.
• Functional Cookies: Remember your preferences — such as your preferred language setting and display preferences — so you do not need to re-enter them on every visit.
• Marketing & Targeting Cookies: Used only where you have provided marketing consent. These may track which promotional offers you have viewed and help personalize promotional communications you have opted in to receive.

11.3 Managing Cookies. You can manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your account and using the Platform. Disabling performance or functional cookies may degrade your experience but will not prevent core Platform access.

11.4 No Third-Party Advertising Networks. gsc111 does not use third-party advertising network cookies (such as those used by social media platforms or programmatic ad exchanges) on the Platform. All cookies we deploy are first-party or come from contracted service providers bound by our data processing agreements.

Your Rights Over Your Personal Data

12.1 As a Member of the gsc111 Platform and a resident of Indonesia, you hold the following rights over the Personal Data we process about you. To exercise any of these rights, contact our Data Protection team as described in Section 17.

• Right of Access: You may request a copy of all Personal Data we hold about you. We will provide this in a structured, readable format within 30 days of a verified request.
• Right of Rectification: If any Personal Data we hold is inaccurate or incomplete, you have the right to request that we correct it. Most registration data can be updated directly from your Account dashboard; KYC-verified name changes require document re-submission.
• Right of Erasure: You may request the deletion of your Personal Data. We will honor erasure requests to the fullest extent possible, subject to our obligation to retain data for the periods specified in Section 10 for legal and regulatory purposes. Data subject to mandatory retention cannot be deleted before the retention period expires.
• Right to Restrict Processing: You may request that we restrict processing of your data — for example, while you contest the accuracy of data we hold — during which period we will only store the data and not actively process it.
• Right to Data Portability: You may request that we provide your Personal Data in a machine-readable format (JSON or CSV) so that you can transfer it to another service provider. This right applies to data you have provided to us directly and that we process on the basis of contract or consent.
• Right to Withdraw Consent: Where processing is based on your consent (specifically, marketing communications — Section 14), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Object: You may object to processing based on our legitimate interests (Section 6.3). We will assess your objection and cease that processing unless we can demonstrate compelling legitimate grounds that override your rights.

12.2 Response Time. gsc111 will acknowledge all data subject requests within 5 business days and will provide a substantive response — either fulfilling the request or explaining why it cannot be fulfilled in full — within 30 calendar days. Complex requests may take up to 60 days; if this is the case, we will notify you of the extension within the initial 30-day period.

12.3 Identity Verification for Requests. To protect your data from unauthorized access, we will verify your identity before processing any data subject request. You will be asked to confirm details matching your registered Account. If identity cannot be confirmed, we may be unable to fulfill the request.

Minors & Age Restriction

13.1 The gsc111 Platform is strictly for adults aged 21 years or older. gsc111 does not knowingly collect Personal Data from any person under the age of 21. If we become aware that an Account has been registered by or for a person under 21 — whether through KYC review, an age-verification failure, or any other means — the Account will be immediately closed and any associated data will be handled in accordance with applicable law.

13.2 Members are responsible for ensuring that their gsc111 login credentials are not accessible to minors who may share their household or devices. gsc111 recommends enabling 2FA and using device-level parental control software where children or young persons share access to internet-connected devices.

13.3 If you are the parent or guardian of a person under 21 and you believe that they may have created a gsc111 account, please contact our support team immediately via live chat or at [email protected]. We will investigate and take appropriate action within 24 hours of receiving a verified report.

Marketing Communications

14.1 Opt-In Only. gsc111 sends promotional communications — including deposit bonus announcements, seasonal promotions tied to events such as Idul Fitri, Lebaran, Nyepi, and Ramadhan, new game launch alerts, and loyalty program updates — exclusively to Members who have explicitly opted in to receive them.

14.2 Channels. Marketing communications are sent via the channels you have opted in to: SMS to your registered Indonesian mobile number, email to your registered address, and/or push notifications via the mobile-optimized Platform. You may opt in or out of each channel independently from your Account dashboard.

14.3 Withdrawing Consent. You may withdraw your marketing consent at any time by: updating your notification preferences in your Account dashboard; clicking the unsubscribe link included in every marketing email; or contacting our support team via live chat and requesting removal from all marketing lists. Opt-out requests are processed within 5 business days.

14.4 Transactional Communications. Certain communications are not marketing and cannot be opted out of, as they are necessary for the operation of your Account. These include: deposit confirmation notifications; withdrawal status updates; Account security alerts (such as login from a new device); KYC request notifications; and material changes to our Terms & Conditions or Privacy Policy.

Third-Party Links & Services

15.1 The gsc111 Platform does not include links to third-party external websites for general browsing purposes. However, the payment interfaces used to process deposits and withdrawals via Indonesian banking partners (BCA, BRI, BNI, Mandiri, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) may redirect you temporarily to secure external payment environments.

15.2 These external payment environments are operated by the respective banks and e-wallet providers, who are independent data controllers with respect to any data you submit directly within their platforms. gsc111 is not responsible for the privacy practices of these external payment environments. We recommend reviewing the privacy policies of your preferred payment provider for full details of how they handle your data.

15.3 Live casino game streams provided by third-party studios such as Evolution Gaming and Pragmatic Play are embedded within the gsc111 Platform interface. While gsc111 controls the overall Platform environment, the game stream itself is delivered from the studio's own servers. These studios may collect limited technical session data necessary to operate the game stream. gsc111 does not share your personal registration or financial data with any game studio.

Policy Amendments

16.1 gsc111 reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes to our data processing practices, new product features, or revised licensing conditions. All amendments are effective from the date of publication on the Platform.

16.2 Where a change to this Privacy Policy is material — meaning it significantly affects how we collect, use, or share your Personal Data, or materially alters your rights — gsc111 will notify you proactively via: a notification displayed prominently on the Platform upon your next gsc111 login; and/or a direct communication to your registered email address or mobile number at least 14 days prior to the change taking effect.

16.3 Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with any amendment, you should discontinue use of the Platform and may request Account closure by contacting our support team. Account closure requests submitted in connection with a Privacy Policy amendment will not result in any penalty to your withdrawable balance.

16.4 The version number and "Last Updated" date displayed at the top of this page represent the current live version. We recommend bookmarking this page and reviewing it periodically, even if you do not receive a material-change notification, to stay informed of our evolving data practices.

Contact & Data Protection Officer

17.1 If you have any questions, concerns, or requests relating to this Privacy Policy or to the handling of your Personal Data by gsc111, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the Platform. Our Indonesian-speaking support agents can handle routine privacy enquiries — including marketing opt-outs and preference updates — and will escalate formal data subject requests to the Data Protection team on your behalf. Live chat is the fastest channel for day-to-day privacy queries.
• Email: For formal data subject requests (access, rectification, erasure, portability, objection), data breach reports, and escalated privacy complaints, please write to: [email protected] — include "Privacy Request" in your subject line. We will acknowledge your request within 5 business days.
• Support Hours: 24 hours / 7 days a week, including Indonesian public holidays. Our primary operations run on WIB (Western Indonesia Time, UTC+7). Members in Bali (WITA, UTC+8) and eastern Indonesia (WIT, UTC+9) are equally supported — response times are not affected by your time zone.

17.2 Data Protection Officer. gsc111 has appointed an internal Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection obligations. The DPO reviews all formal data subject requests, conducts periodic internal data protection audits, and serves as the primary point of contact for data protection regulators. Formal correspondence addressed to the DPO should be sent to the email address above, marked clearly with "Attention: Data Protection Officer".

17.3 Complaints. If you are not satisfied with gsc111's response to a privacy concern or data subject request, you have the right to escalate your complaint to the relevant supervisory or regulatory authority. gsc111 takes all escalated complaints seriously and will cooperate fully with any regulatory investigation.