Privacy Policy

This Privacy Policy applies to all personal data processed by 11boa in connection with the operation of the online betting and casino platform at 11boa.cam (the "Platform"). It governs data collected from all visitors, registered users, and former users of the Platform, regardless of the device or browser used to access it.

11boa operates as an internationally regulated gaming platform and takes its data protection obligations seriously. This Policy has been prepared in accordance with internationally recognised data-protection principles, including those established under frameworks analogous to the General Data Protection Regulation (GDPR) and relevant Indonesian personal data protection standards.

By registering an account, making a deposit, or otherwise using the 11boa Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

This Policy should be read together with the 11boa Terms & Conditions and Responsible Gaming Policy, which together form the complete agreement governing your relationship with 11boa.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data available to 11boa.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, alteration, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, 11boa is the Data Controller.
• "Data Processor" — any third party that processes personal data on behalf of 11boa pursuant to a written agreement and under 11boa's instructions.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose.
• "Cookie" — a small text file placed on a user's device by a website, used to store session information, preferences, and analytics data.
• "KYC" — Know Your Customer; the identity and document verification process required under 11boa's anti-money laundering obligations.
• "IDR / Rp" — Indonesian Rupiah; the official currency of the Republic of Indonesia and the sole transactional currency on the 11boa Platform.

11boa collects the following categories of personal data. The specific data collected from any individual user will depend on their level of engagement with the Platform — for example, casual visitors are subject to limited collection, while registered players who complete KYC verification provide a broader set of data.

11boa collects personal data through the following channels and methods:

• Direct submission: Data you provide when completing the registration form, the KYC verification process, contact forms, or live chat conversations with our support team;
• Transactional activity: Data generated automatically when you make a deposit or withdrawal via Indonesian bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Platform interaction: Data collected automatically through server logs, analytics tools, and in-platform event tracking as you navigate and use the Platform;
• Cookies and similar technologies: Data collected via cookies, web beacons, pixel tags, and local storage as described in Clause 8 of this Policy;
• Third-party verification services: Identity and fraud-screening data received from third-party KYC and AML service providers engaged by 11boa under contractual data-processing agreements;
• Payment processors: Transactional confirmation data returned by payment gateway providers following deposit and withdrawal operations.

11boa processes personal data only where a valid lawful basis exists under applicable data protection law. The following bases apply to our key processing activities:

• Contractual necessity: Processing required to provide you with the services you have contracted for — including account management, payment processing, game delivery, and customer support;
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) checks, KYC verification, and the retention of financial transaction records;
• Legitimate interests: Processing carried out in pursuit of 11boa's legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and improving the player experience — provided such interests are not overridden by your privacy rights;
• Consent: Processing for optional purposes — such as sending marketing communications, deploying non-essential cookies, or sharing anonymised data for research — that is conditional on your explicit, freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

11boa uses the personal data collected from you for the following purposes, each of which is grounded in the lawful bases described in Clause 5:

• Account creation and management: Setting up your player account, verifying your identity and age (21+ requirement), and maintaining your account in good standing;
• Payment processing: Facilitating deposits and withdrawals in IDR through your nominated Indonesian bank account or e-wallet, and maintaining records of all financial transactions;
• KYC and AML compliance: Verifying your identity, screening against sanctions lists and politically exposed persons (PEP) databases, and detecting patterns of financial activity that may indicate money laundering;
• Platform security and fraud prevention: Monitoring login activity, device fingerprints, IP addresses, and wagering patterns to detect unauthorised account access, bonus abuse, and collusion;
• Responsible gaming monitoring: Tracking deposit frequency, session duration, and wagering behaviour to identify potential indicators of problem gambling, in accordance with our Responsible Gaming Policy;
• Customer support: Responding to enquiries, resolving disputes, and maintaining records of communications for quality assurance and regulatory purposes;
• Platform personalisation and improvement: Analysing anonymised and aggregated usage data to optimise the platform interface, game offerings, and promotional calendar;
• Marketing communications: Sending promotional offers, bonus notifications, and event announcements — only to users who have explicitly opted in and have not subsequently withdrawn consent.

11boa does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Data may be shared with external parties only in the following defined circumstances:

• Payment processors and banking partners: Financial transaction data is shared with the Indonesian banking institutions and e-wallet providers — including BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay — that facilitate your deposit and withdrawal requests. These providers are independent data controllers subject to their own privacy policies;
• KYC and AML service providers: Identity document data and screening queries are shared with contracted third-party verification providers under binding data-processing agreements that restrict their use of your data to the specific service for which they have been engaged;
• Game software providers: Technical session data may be processed by licensed game studios — including Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Pocket Games Soft — operating within 11boa's platform environment, solely for game delivery and RNG certification purposes;
• Fraud and security vendors: Technical data (IP addresses, device identifiers, browser fingerprints) may be shared with specialist fraud detection services under contractual terms that prohibit further disclosure;
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory directive, 11boa may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities. Where permitted by law, 11boa will notify affected users of such disclosures;
• Corporate transactions: In the event of a merger, acquisition, or sale of the business, personal data held by 11boa may be transferred to a successor entity, provided that entity agrees to be bound by equivalent data protection obligations.

11boa uses cookies and similar tracking technologies on the Platform for the purposes described below. By continuing to use the Platform, you consent to the use of cookies in accordance with this Policy.

• Strictly necessary cookies: Required for core platform functionality — including session management, login authentication, and shopping cart state. These cannot be disabled without impairing your ability to use the Platform;
• Performance and analytics cookies: Used to collect anonymised data on how visitors interact with the Platform — including which pages are visited most frequently, how long sessions last, and which features generate errors. This data helps us improve the Platform;
• Functionality cookies: Used to remember your preferences — such as your selected language, time zone (WIB, WITA, or WIT), and display settings — to provide a more personalised experience;
• Security cookies: Used to detect fraudulent login attempts, prevent cross-site request forgery (CSRF), and identify unusual device or IP patterns that may indicate account compromise.

You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing the Platform but may limit certain personalisation features. Note that strictly necessary and security cookies cannot be disabled, as they are integral to the safe operation of the Platform.

11boa retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and in any event for the minimum periods required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active account data: Retained for the duration of your relationship with 11boa, plus a period of up to seven (7) years after account closure, to satisfy financial record-keeping and AML reporting obligations;
• KYC documents: Retained for a minimum of five (5) years following the conclusion of the business relationship, in line with international AML standards;
• Transaction records: Retained for seven (7) years from the date of the transaction;
• Customer support communications: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes;
• Marketing consent records: Retained for as long as the marketing consent is active, plus evidence of the consent decision for two (2) years following withdrawal;
• Technical and usage data: Anonymised or deleted within thirteen (13) months of collection, unless required for ongoing fraud investigations or legal proceedings.

When personal data is no longer required under any applicable retention obligation, it is securely deleted or irreversibly anonymised in accordance with our internal data disposal procedures.

11boa employs a layered security architecture designed to protect your personal and financial data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational security measures include, but are not limited to:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the 11boa Platform;
• Encryption at rest for all sensitive personal data and financial records stored on 11boa servers;
• Role-based access controls (RBAC) ensuring that only authorised personnel with a legitimate operational need can access specific categories of personal data;
• Multi-factor authentication (MFA) for internal staff systems and for player account login where the player has enabled this feature;
• Regular penetration testing and vulnerability assessments conducted by independent third-party security specialists;
• Intrusion detection and prevention systems (IDS/IPS) monitoring platform traffic in real time for anomalous activity;
• Incident response procedures covering detection, containment, notification, and remediation of data security incidents.

As an internationally operated platform, 11boa may transfer personal data to, and process it in, countries outside Indonesia. Such transfers may occur when, for example, KYC verification services, fraud detection tools, or cloud infrastructure providers operate data centres in jurisdictions other than Indonesia.

Where personal data is transferred internationally, 11boa takes appropriate safeguards to ensure that such transfers meet standards of protection equivalent to those applicable in the originating jurisdiction. These safeguards may include:

• Contractual clauses in data-processing agreements with third-party vendors that impose binding data protection obligations on the recipient;
• Transfers to jurisdictions recognised as providing an adequate level of data protection by relevant international authorities;
• Technical measures — including pseudonymisation and encryption — applied prior to transfer to minimise the risk of exposure.

If you have questions about the specific safeguards applied to any international transfer of your personal data, you may contact us using the details in Clause 16.

Subject to applicable law and certain limited exceptions, you have the following rights in respect of your personal data held by 11boa. To exercise any of these rights, please contact us as described in Clause 16:

11boa will respond to all verifiable rights requests within thirty (30) calendar days of receipt. Where a request is complex or multiple requests have been received from the same individual, this period may be extended by a further two months — in which case we will notify you of the extension and the reason for it.

The 11boa Platform is strictly intended for adults aged 21 years and over. 11boa does not knowingly collect personal data from individuals under the age of 21. Our registration process includes mandatory age verification, and our KYC process requires documentary proof of age before full account access is granted.

If 11boa becomes aware that personal data has been collected from an individual under the age of 21, that account will be immediately suspended, all associated data will be flagged for review, and the data will be deleted as promptly as possible subject to any applicable legal obligations. Any deposits made by a minor will be returned to the originating payment method following completion of any required investigation.

The 11boa Platform integrates services provided by third-party vendors, including game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), payment processors, and analytical tools. Each of these third parties operates under its own privacy policy and is an independent data controller in respect of data it collects through its own systems.

11boa is not responsible for the privacy practices or the content of third-party services accessible through or integrated within the Platform. We encourage you to review the privacy policies of any third-party providers whose services you use in connection with your 11boa account.

All third-party vendors that process personal data on 11boa's behalf as Data Processors are required to execute binding data-processing agreements that prohibit them from processing your data for any purpose other than the specific service they have been engaged to provide.

11boa reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or the services offered on the Platform. The effective date at the top of this document will be updated whenever a material change is made.

Where changes are material, 11boa will provide advance notice to registered users via the email address on file or through an in-platform notification, where practicable. Your continued use of the Platform following the publication of an amended Privacy Policy constitutes your acceptance of those changes. If you do not accept the revised Policy, you should stop using the Platform and may close your account in accordance with the Terms & Conditions.

We recommend reviewing this Privacy Policy periodically to stay informed of how 11boa protects your personal data.

For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data by 11boa, please contact us through the following channels:

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction in which you reside. 11boa commits to cooperating with supervisory authorities in good faith in the resolution of any such complaint.

Please note: the email address above is displayed as plain text only and is not a clickable link. Copy and paste it into your email client to initiate contact.