Privacy Policy — wc2026

Definitions

The following defined terms are used throughout this Privacy Policy. Where a term also appears in the wc2026 Terms & Conditions, its meaning here is consistent with the definition given there unless this Policy expressly states otherwise.

• "wc2026" / "we" / "us" / "our" — the wc2026 online gaming platform accessible at https://wc2026.bio, including all subdomains, mobile applications, and associated services.
• "Player" / "you" / "your" — any individual who accesses, browses, registers on, or transacts through the wc2026 Platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, phone numbers, financial account details, device identifiers, and IP addresses.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, and destruction.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. For the purposes of this Policy, wc2026 acts as the Data Controller.
• "Data Processor" — a third party that Processes Personal Data on behalf of wc2026 under a written data-processing agreement, such as payment gateway providers and KYC verification services.
• "Cookies" — small text files placed on your device by the wc2026 Platform to enable session management, personalisation, analytics, and security functions.
• "KYC" — Know Your Customer identity and address verification procedures.
• "IDR" / "Rupiah" — Indonesian Rupiah, the primary transaction currency on the wc2026 Platform.

Scope & Controller

This Privacy Policy applies to all Personal Data collected and processed by wc2026 in connection with the operation of the Platform. It covers data collected from Players located in Indonesia as well as visitors who browse the Platform without registering an Account.

wc2026 operates as the Data Controller for all Personal Data collected directly through the Platform. Where wc2026 engages third-party Data Processors (such as payment providers including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, or KYC verification partners), those processors act under binding contractual obligations that require them to handle your data solely for the purposes specified by wc2026 and in accordance with applicable data protection standards.

By accessing the Platform, creating an Account, or making a deposit, you acknowledge that you have read and understood this Privacy Policy and consent to the Processing of your Personal Data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform and, where applicable, request Account closure in accordance with Clause 13 of the Terms & Conditions.

Data We Collect

wc2026 collects only the Personal Data that is necessary and proportionate for the purposes described in Section 6 of this Policy. The categories of Personal Data we collect are set out below.

wc2026 does not collect special-category Personal Data (such as biometric data, health data, or religious affiliation) unless you voluntarily disclose such information in a support communication, in which case it will be processed solely for the purpose of addressing your enquiry and deleted once that purpose is fulfilled.

How We Collect Data

wc2026 collects Personal Data through the following mechanisms:

• Direct Submission: Data you actively provide when completing the registration form, submitting KYC documents, initiating a deposit or withdrawal, contacting customer support, or updating Account settings.
• Automated Technologies: Data collected automatically when you visit or interact with the Platform, including via cookies, web beacons, server logs, and session-recording tools. This includes Technical Data and Usage Data as defined in Section 3.
• Payment Providers: Confirmation data returned by payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) to verify that a transaction has been successfully completed. wc2026 does not receive or store full bank account credentials — only the name and masked account reference required to reconcile the transaction.
• KYC and Identity Verification Partners: Results and risk scores returned by third-party KYC vendors following document review. These vendors process your identity documents on wc2026's behalf under strict contractual data protection obligations.
• Analytics and Fraud Detection Services: Aggregated behavioural and device-fingerprint data from analytics partners used to detect fraudulent activity, account takeovers, and bonus abuse patterns.

Legal Basis for Processing

wc2026 processes Personal Data on the following legal bases, which apply cumulatively depending on the specific processing activity:

• Contractual Necessity: Processing required to perform our contractual obligations to you, including Account creation, KYC verification, processing deposits and withdrawals in IDR, settling wagers, and providing customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money-laundering (AML) obligations, fraud prevention duties, and cooperation with lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing carried out in pursuit of wc2026's legitimate business interests, including Platform security, fraud detection, responsible gaming monitoring, service improvement, and internal analytics — provided those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent, primarily for direct marketing communications. You may withdraw consent at any time through your Account settings or by contacting [email protected], without affecting the lawfulness of processing prior to withdrawal.

How We Use Your Data

wc2026 uses your Personal Data for the following purposes, each of which is tied to a legal basis identified in Section 5:

• Account Management: Creating, maintaining, and securing your wc2026 Account, verifying your identity and age (21+), and processing your login sessions.
• Transaction Processing: Crediting deposits and processing withdrawal requests to and from your nominated BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja account.
• KYC and Compliance: Verifying your identity, address, and payment method ownership in fulfilment of our AML and fraud prevention obligations.
• Game Provision and Settlement: Recording gaming sessions, calculating wager outcomes, crediting winnings, applying bonuses, and maintaining your gaming history for dispute resolution.
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling indicators and, where necessary, proactively reaching out to Players showing signs of harmful behaviour or applying protective account restrictions.
• Customer Support: Responding to queries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance.
• Security and Fraud Prevention: Detecting and preventing unauthorised account access, collusion, bonus abuse, and money laundering activity.
• Platform Improvement: Analysing aggregated usage patterns to improve Platform performance, user experience, and game content selection for Indonesian players.
• Marketing Communications: Sending promotional offers, bonus notifications, and Platform updates to Players who have opted in to receive such communications. You may opt out at any time.
• Legal and Regulatory Compliance: Retaining records required by applicable law and responding to lawful requests from regulatory or law enforcement authorities.

wc2026 does not use Personal Data for automated individual decision-making that produces legal or similarly significant effects — for example, we do not automatically deny withdrawal requests based solely on algorithmic scoring without human review.

Sharing & Disclosure

wc2026 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. Personal Data is shared only in the following circumstances:

• Payment Processors: Your name and masked financial account reference are shared with the relevant payment provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja) solely to execute your requested transaction.
• KYC and Identity Verification Vendors: Your identity documents and associated data are shared with our contracted KYC partner for the purpose of document review, authentication, and risk scoring.
• Game Studio Providers: Anonymised session identifiers and game-state data are shared with game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) solely for the purpose of delivering game content and resolving technical disputes. These providers do not receive your full identity or financial data.
• Analytics and Security Partners: Pseudonymised Technical Data and Usage Data are shared with Platform analytics and fraud-detection services under strict data-processing agreements that prohibit independent use.
• Legal and Regulatory Authorities: Where required by applicable law, court order, or a lawful request from a regulatory or law enforcement authority, wc2026 will disclose Personal Data to the extent legally required. wc2026 will, where permitted by law, notify you of such a request before complying.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of wc2026's assets, your Personal Data may be transferred to the successor entity, which will be required to honour this Privacy Policy or provide you with prior notice and the opportunity to opt out.

All third-party Data Processors engaged by wc2026 are contractually required to implement technical and organisational security measures that are at minimum equivalent to those described in Section 10 of this Policy.

Cookies & Tracking Technologies

The wc2026 Platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. The categories of cookies used are as follows:

You may control non-essential cookies through your browser settings. Please note that disabling Strictly Necessary or Fraud Prevention cookies may impair Platform functionality, including the ability to log in or complete transactions. wc2026 does not use third-party advertising cookies or behavioural retargeting pixels.

Data Retention

wc2026 retains Personal Data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of your Account and for a period of five years following permanent Account closure, to meet AML record-keeping requirements.
• KYC Documents: Retained for five years from the date of the last transaction on the Account, or longer if required by a specific regulatory obligation.
• Transaction Records: Retained for five years from the date of each transaction in IDR, consistent with standard financial record-keeping practice.
• Gaming Session Logs: Retained for two years from the date of each session for dispute resolution purposes, and in aggregated, anonymised form indefinitely for Platform improvement.
• Support Communications: Retained for two years from the resolution of the relevant query or complaint.
• Marketing Preference Records: Retained until you withdraw consent or close your Account, plus an additional 12 months to evidence the history of your consent status.
• Cookies and Technical Logs: As specified in Section 8 above.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where deletion is not immediately possible (for example, due to data being held in backup archives), wc2026 will isolate the data from active processing and ensure it is purged at the next scheduled archive cycle.

Security Measures

wc2026 implements a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• TLS 1.3 Encryption in Transit: All data exchanged between your device and the wc2026 Platform is transmitted over TLS 1.3-encrypted channels. Downgrade attacks to earlier TLS versions are blocked at the server level.
• AES-256 Encryption at Rest: Sensitive Personal Data stored in wc2026 databases — including identity document references and financial account identifiers — is encrypted using AES-256 symmetric encryption.
• Tokenisation of Financial Data: Payment account details are tokenised immediately upon receipt; raw bank account numbers and e-wallet identifiers are never stored in plain text in any wc2026 system.
• Role-Based Access Controls (RBAC): Access to Personal Data is restricted to wc2026 personnel on a strict need-to-know basis, enforced through role-based permissions, multi-factor authentication for all staff accounts, and comprehensive access audit logs.
• Intrusion Detection and Monitoring: Real-time intrusion detection systems, anomaly alerts, and 24/7 security monitoring are in place across all production infrastructure.
• Penetration Testing: The Platform undergoes scheduled external penetration testing and vulnerability assessments. Critical findings are remediated within defined SLA windows.
• Incident Response: wc2026 maintains a formal data breach incident response plan. In the event of a breach affecting your Personal Data, wc2026 will notify affected Players within 72 hours of becoming aware of the breach, to the extent practicable.

While wc2026 employs industry-standard security controls, no system is entirely immune to risk. You are responsible for maintaining the confidentiality of your Account login credentials and for notifying wc2026 immediately if you suspect unauthorised access to your Account.

International Data Transfers

wc2026 operates infrastructure and engages Data Processors in multiple jurisdictions. As a result, your Personal Data may be transferred to, stored in, or processed in countries outside Indonesia. Where such transfers occur, wc2026 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses in data-processing agreements with all international Data Processors, requiring them to protect Personal Data to a standard consistent with this Policy.
• Transfers exclusively to jurisdictions or processors that maintain security standards equivalent to or exceeding those described in Section 10.
• Restriction of the data transferred to the minimum necessary for the specific processing purpose.

By using the wc2026 Platform, you acknowledge and consent to these international transfers on the basis set out above.

Your Rights

Subject to applicable law and the conditions set out below, you have the following rights in relation to your Personal Data held by wc2026:

• Right of Access: You may request a copy of the Personal Data wc2026 holds about you, along with information about the purposes for which it is processed and the categories of recipients to whom it has been disclosed.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected. You may update basic Account information (email address, phone number, residential address) directly through your Account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to mandatory retention obligations — for example, wc2026 cannot delete AML-required transaction records before the statutory retention period expires.
• Right to Restriction: You may request that wc2026 restrict Processing of your Personal Data in certain circumstances, such as while the accuracy of data is being contested or while an objection is being assessed.
• Right to Portability: Where Processing is based on your consent or on contractual necessity, you may request that your Personal Data be provided to you in a structured, machine-readable format.
• Right to Object: You may object to Processing based on legitimate interests, including profiling. wc2026 will cease such Processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where Processing is based on your consent (primarily for marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Account Username]". wc2026 will respond within 30 days of receiving a complete and valid request. We may ask you to verify your identity before processing your request to prevent unauthorised access to your data.

There is no charge for exercising your rights unless a request is manifestly unfounded or excessive, in which case wc2026 reserves the right to charge a reasonable administrative fee or decline the request, providing written reasons for doing so.

Minors — 21+ Strictly Enforced

The wc2026 Platform is strictly for adults aged 21 and over. wc2026 does not knowingly collect Personal Data from any individual under the age of 21. The Platform's age verification controls are designed to prevent minors from completing registration.

If wc2026 becomes aware that Personal Data has been collected from a person under the age of 21 — whether through a fraudulent registration or otherwise — that Account will be suspended immediately, all associated funds will be frozen pending investigation, and the relevant Personal Data will be deleted in accordance with applicable legal obligations.

If you are a parent or guardian and believe that a minor in your care has registered on the wc2026 Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action without undue delay.

Third-Party Services

The wc2026 Platform integrates third-party services — including game studios, payment gateways, and analytics tools — that operate under their own privacy policies. wc2026 is not responsible for the data practices of these third parties beyond the contractual obligations described in Section 7.

Game content delivered by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may involve data processing by those studios for the purpose of game delivery and integrity verification. Only anonymised session data and game-state identifiers are shared; your full identity and financial data remain within wc2026's controlled environment.

Payment processing is handled directly by the respective payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja). When you initiate a transaction, you are subject to that provider's own terms and privacy policy in addition to this Policy.

The wc2026 Platform does not contain links to external websites. All navigation remains within the wc2026 domain. Third-party services are embedded within the Platform infrastructure rather than redirecting you to external sites.

Amendments

wc2026 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. Material changes — including changes to data retention periods, new categories of data collected, or new third-party processors — will be communicated to registered Players by email to the address on file at least 14 days before the changes take effect.

Non-material amendments (such as typographical corrections, clarifications, or administrative updates) will take effect immediately upon publication on this page. The "Last updated" date and version number at the top of this document will be revised accordingly.

Continued use of the Platform following any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you must cease using the Platform and request Account closure in accordance with Clause 13 of the Terms & Conditions.

Contact & Complaints

For any questions, concerns, or formal requests relating to this Privacy Policy or wc2026's data processing activities, please contact us through one of the following channels:

• Live Chat: Available 24/7 on the wc2026 Platform. Native Indonesian-speaking agents are available for all enquiries.
• Email: [email protected] — use the subject line "Privacy Enquiry" for general questions or "Data Rights Request — [Your Account Username]" for formal rights requests. Please allow up to 30 days for a response to formal requests.

If you are dissatisfied with our response to a privacy complaint, you have the right to escalate the matter to our compliance team by submitting a written escalation via email with the subject line "Formal Privacy Complaint — [Your Account Username]". Our compliance team will review the matter independently and provide a final written response within 30 days.