Privacy Policy

1Introduction

titi4 ("we", "us", "our", or "the Platform") is an internationally operated online gaming platform serving English-preference players primarily based in Indonesia. We operate the website accessible at https://titi4.cam and are committed to protecting the privacy and personal data of every individual who interacts with our services.

This Privacy Policy explains, in clear and accessible terms, what personal data we collect from players and website visitors, the purposes for which that data is processed, the legal bases on which processing is conducted, how long data is retained, and what rights you hold as a data subject. It also describes the technical and organisational security measures we apply to keep your information safe.

This Policy should be read alongside the titi4 Terms & Conditions, which govern the overall contractual relationship between you and the Platform. In the event of any conflict between this Policy and the Terms & Conditions with respect to data-processing matters, this Privacy Policy takes precedence.

titi4 is committed to processing personal data in a manner that is lawful, fair, transparent, and limited strictly to what is necessary for the stated purposes. We do not sell personal data to third parties for marketing or profiling purposes.

2Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living natural person, either directly (such as a full name or government ID number) or indirectly (such as a device identifier combined with other data).
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, alteration, combination, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is the operator of the titi4 platform.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a formal written agreement and subject to the Controller's instructions.
• "Player" / "You" / "User" — any natural person who has registered for an account on titi4, is in the process of registering, or who accesses the Platform as a guest or visitor.
• "KYC Data" — identity and age verification documents and information submitted during the Know Your Customer process, including government-issued identification, proof of address, and payment method verification records.
• "Cookies" — small text files stored on your device by the Platform to enable certain functionality, preserve session state, and support analytics.
• "Third-Party Service Providers" — external companies engaged by titi4 to assist in delivering the Platform's services, including payment processors, identity verification services, fraud detection providers, and hosting infrastructure providers.

3Data We Collect

titi4 collects personal data across several categories depending on the nature of your interaction with the Platform. The table below summarises the main data categories and specific data points collected:

titi4 does not collect sensitive categories of personal data such as racial or ethnic origin, religious beliefs, health data, or political opinions, except where such information is incidentally contained within KYC documents submitted by the Player (e.g., religion field on an Indonesian KTP). Such incidental data is not recorded or processed separately and is disregarded for all purposes other than identity confirmation.

4How We Collect Data

4.1 Directly from You. The majority of personal data we hold is provided by you directly during the account registration process, KYC verification, deposit and withdrawal transactions, and when you contact our customer support team.

4.2 Automatically. When you access titi4, our servers and client-side scripts automatically record certain technical data including your IP address, browser fingerprint, device identifiers, session duration, and pages visited. This data is collected via server logs, cookies, and similar technologies.

4.3 From Third-Party Verification Partners. During the KYC process, we may share identity information you have provided with third-party identity verification service providers to confirm the authenticity of your documents. Those providers may return additional data points — such as match scores or fraud risk indicators — that are added to your account record.

4.4 From Payment Processors. When you initiate a deposit or withdrawal via a supported Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the relevant payment provider may transmit transaction confirmation data to titi4. We do not receive or store full bank account passwords or full card numbers.

4.5 From Fraud Detection Systems. titi4 uses automated fraud detection tools that analyse behavioural and technical signals to identify suspicious activity. These systems may generate derived data about your account (e.g., a risk score) that is stored alongside your personal data and used to protect the integrity of the Platform.

5Purposes & Legal Bases for Processing

titi4 processes personal data only where a valid legal basis exists. The primary purposes and their corresponding legal bases are:

• Account creation and management — necessary for the performance of the contract between you and titi4.
• Processing deposits and withdrawals — necessary for the performance of the contract; also required for compliance with anti-money-laundering (AML) and counter-terrorism financing (CTF) obligations.
• KYC and age verification — necessary for compliance with legal obligations and our licensing conditions; also required to fulfil our duty to prevent underage gambling (minimum age 21).
• Fraud prevention and security monitoring — necessary for the legitimate interests of titi4 and its players in maintaining a secure and fair gaming environment, provided those interests are not overridden by your rights and interests.
• Customer support communications — necessary for the performance of the contract and for our legitimate interest in resolving player queries efficiently.
• Responsible gaming monitoring — necessary for compliance with our licensing obligations and our legitimate interest in identifying and supporting players who may be experiencing gambling-related harm.
• Platform analytics and improvement — based on our legitimate interest in understanding how the Platform is used so that we can maintain and enhance service quality. Anonymised or aggregated data is used wherever possible for this purpose.
• Marketing and promotional communications — based on your consent, where you have opted in to receive such communications. You may withdraw consent at any time by contacting support or updating your account preferences.
• Legal and regulatory compliance — necessary to comply with applicable laws, regulations, court orders, or directions from competent authorities.

6Data Sharing & Disclosure

6.1 We Do Not Sell Your Data. titi4 does not sell, rent, or trade personal data to any third party for marketing, profiling, or commercial exploitation purposes. This is an absolute commitment with no exceptions.

6.2 Service Providers (Data Processors). We share personal data with carefully vetted third-party service providers who assist us in operating the Platform. These include:

• Payment processing partners (Indonesian bank gateways and e-wallet integrators).
• Identity and age verification providers (for KYC processing).
• Cloud hosting and content delivery infrastructure providers.
• Fraud detection and risk management technology providers.
• Customer support platform providers (live chat infrastructure).
• Email delivery service providers (for transactional notifications).

All service providers are bound by data processing agreements that restrict them to processing your data only on titi4's documented instructions and prohibit independent use of that data for their own purposes.

6.3 Regulatory and Legal Disclosure. titi4 may disclose personal data to competent regulatory authorities, law enforcement agencies, tax authorities, or courts when required to do so by applicable law, a valid legal order, or our licensing obligations. Where permitted, we will inform you of such a disclosure before it occurs.

6.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of the titi4 business, personal data held by the Platform may be transferred to the acquiring entity as part of that transaction. Affected players will be notified in advance and given the opportunity to close their accounts before any transfer of their personal data to the new operator takes effect.

6.5 Aggregated and Anonymised Data. We may share statistical, aggregated, or fully anonymised data (from which individual players cannot be identified) with partners, analysts, or the public for business or research purposes. Such data is not personal data and is not subject to the restrictions in this Policy.

7International Data Transfers

7.1 As an internationally operated platform, titi4 may process and store personal data on servers located outside Indonesia. Where personal data is transferred to a country that does not provide a level of data protection equivalent to that applicable in your jurisdiction, titi4 implements appropriate safeguards to ensure that your rights remain protected.

7.2 Safeguards used for international transfers include:

• Standard contractual clauses approved by recognised data protection authorities, incorporated into agreements with all relevant service providers and data processors.
• Binding corporate rules where applicable within group structures.
• Transfer to jurisdictions with adequacy decisions or equivalent data protection frameworks where available.

7.3 Regardless of the location at which personal data is stored or processed, all data is subject to the same technical security standards described in Section 9 of this Policy, and all access is governed by titi4's internal access-control policies.

7.4 You may request further information about the specific transfer mechanisms applicable to your personal data by contacting the titi4 support team using the contact details in Section 14.

8Data Retention

8.1 titi4 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, tax, and accounting requirements. The table below summarises our standard retention periods by data category:

8.2 At the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with titi4's data disposal procedures. Anonymised data may be retained indefinitely for statistical purposes.

8.3 Where a legal hold, regulatory investigation, or active dispute requires data to be retained beyond the standard period, the data will be preserved until the matter is resolved, after which the standard disposal procedure will apply.

9Security Measures

9.1 titi4 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures include:

• Encryption in transit: All data transmitted between your browser or app and titi4 servers is encrypted using TLS 1.2 or higher with 256-bit AES cipher suites.
• Encryption at rest: Sensitive data fields — including KYC document references, financial identifiers, and authentication credentials — are encrypted at rest using industry-standard symmetric encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Privileged access is subject to multi-factor authentication and comprehensive audit logging.
• Network security: titi4's production infrastructure is protected by Web Application Firewalls (WAF), intrusion detection systems (IDS), and DDoS mitigation services.
• Penetration testing: Independent third-party penetration tests are conducted at least quarterly. Critical findings are remediated within 72 hours; high-severity findings within 14 days.
• Staff training: All personnel with access to personal data undergo mandatory data protection and information security training upon onboarding and annually thereafter.
• Incident response: titi4 maintains a documented data breach response plan. In the event of a breach that poses a risk to your rights, affected players will be notified within a reasonable timeframe consistent with applicable regulatory requirements.

9.2 Notwithstanding these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying titi4 immediately if you suspect any unauthorised access to your account.

10Your Rights as a Data Subject

Subject to applicable law and certain exceptions, you hold the following rights in relation to the personal data titi4 processes about you:

10.1 How to Exercise Your Rights. To exercise any of the rights listed above, contact titi4 customer support via 24/7 live chat or by email at the address in Section 14. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Complex requests may require up to an additional 60 days, in which case we will notify you of the extension and its reason.

10.2 Identity Verification. To protect against fraudulent data subject requests, titi4 will verify your identity before processing any access, rectification, or erasure request. This may require you to confirm your registered email address, answer security questions, or provide a copy of a government-issued ID.

10.3 Limitations. Certain rights are subject to exceptions under applicable law. For example, titi4 is not obliged to erase personal data that must be retained to comply with AML, tax, or licensing regulations, or to support an ongoing legal claim.

11Cookies & Tracking Technologies

11.1 titi4 uses cookies and similar technologies (including pixel tags and local storage) to operate the Platform effectively, maintain session state, support security measures, and gather analytics data. The main categories of cookies we use are:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences and settings (such as language preference and last-used payment method) to personalise your experience.
• Analytics cookies: Collect anonymised information about how the Platform is used — including pages visited, session duration, and navigation paths — to help us improve the service. titi4 uses privacy-respecting analytics tools that do not share this data with advertising networks.
• Security cookies: Support fraud detection and session integrity by identifying anomalous behaviour patterns. These are classed as strictly necessary from a security standpoint.

11.2 titi4 does not use third-party advertising or behavioural tracking cookies. We do not place cookies from advertising networks, social media platforms, or data brokers on the Platform.

11.3 You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions. Disabling analytics cookies will not affect your ability to use any Platform features.

11.4 titi4's use of cookies for analytics purposes is based on our legitimate interest in understanding Platform performance. Where applicable law requires consent for analytics cookies, a consent mechanism will be presented on your first visit.

12Minors & Underage Access

12.1 titi4 strictly prohibits access by persons under the age of 21. The Platform is not directed at, nor does it knowingly collect personal data from, individuals under this age threshold.

12.2 If titi4 becomes aware that personal data has been collected from a person under 21 years of age without the appropriate verification having been completed, that data will be deleted immediately, the associated account will be suspended, and any winnings accumulated during the underage period will be forfeited.

12.3 Parents and guardians who have reason to believe that a minor in their care has registered an account on titi4 are encouraged to contact our support team immediately via live chat. We will investigate and respond promptly.

13Changes to This Privacy Policy

13.1 titi4 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory requirements, or Platform functionality. The "Last updated" date at the top of this page will be revised each time a new version is published.

13.2 For material changes — those that significantly affect how we use your personal data or that reduce your rights — titi4 will provide at least 14 days' advance notice to registered players via account inbox notification or the email address on file. Continued use of the Platform after the effective date of the revised Policy constitutes acceptance of the updated terms.

13.3 For non-material changes — such as corrections of typographical errors, clarification of existing practices, or addition of new data categories that do not change the fundamental nature of processing — the revised Policy will take effect on publication without advance notice, though the updated date will always be reflected at the top of the page.

13.4 We recommend that you review this Privacy Policy periodically. Previous versions of this Policy are available on request from the support team.

14Contact & Data Subject Requests

For all privacy-related enquiries, data subject requests, or concerns about how titi4 handles your personal data, please reach out using the following contact details:

• Live Chat: Available 24 hours a day, 7 days a week, directly from the Platform interface. This is the fastest route for urgent data concerns.
• Email: [email protected] (plain text — not a clickable link). Please mark the subject line with "Privacy Request" so your message is routed to the correct team.
• Response Time: We acknowledge all privacy enquiries within 5 business days and provide a substantive response within 30 calendar days (WIB — Western Indonesia Time, UTC+7).

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction applicable to your claim, or to the dispute resolution body designated under titi4's licensing conditions.