tha24 Privacy Policy

01 Definitions

The following definitions apply throughout this Privacy Policy unless the context expressly indicates otherwise:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, date of birth, address, email address, phone number, payment details, device identifiers, and IP address.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Controller" means tha24, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means any third-party service provider that processes Personal Data on behalf of tha24, under a binding data processing agreement.
• "Player" or "You" means any individual who registers an account on the tha24 platform at https://tha24.net.
• "Platform" means the tha24 website, including all pages, game interfaces, sportsbook markets, account dashboards, and payment interfaces accessible at https://tha24.net.
• "KYC" means Know Your Customer — the identity and document verification procedures tha24 applies to player accounts for regulatory compliance and fraud prevention purposes.
• "Consent" means freely given, specific, informed, and unambiguous agreement by a Player to the processing of their Personal Data for a stated purpose.

02 Data We Collect

tha24 collects Personal Data across several categories, depending on the nature of your interaction with the Platform. The categories of data we collect are as follows:

A. Registration & Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to confirm you meet the 21+ age requirement).
• Residential address in Indonesia, including city (e.g., Jakarta, Surabaya, Medan, Bandung, or Bali).
• Valid email address and mobile phone number.
• Username and encrypted password (passwords are never stored in plain text).

B. KYC & Verification Documents

• Copy of government-issued photo ID — National Identity Card (KTP), passport, or driving license.
• Proof of residential address — utility bill, bank statement (BCA, BRI, BNI, Mandiri, CIMB Niaga, or equivalent), or official correspondence dated within 90 days.
• Selfie or liveness-check image where required for enhanced identity verification.

C. Financial & Payment Data

• Bank account details for deposit and withdrawal transactions (account number and account holder name — not full account credentials).
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja transactions.
• USDT wallet addresses for cryptocurrency transactions (TRC-20 and ERC-20 networks).
• Transaction history, including deposit amounts in IDR, withdrawal requests, and bonus credit activity.

D. Technical & Device Data

• IP address and approximate geographic location at the time of login and transaction.
• Device type, operating system, and browser version.
• Session timestamps, login history, and account activity logs.
• Cookie identifiers and similar tracking technologies (see Section 6).

E. Behavioral & Gaming Data

• Game history, including titles played, wager amounts, outcomes, and session durations.
• Sportsbook betting history, including markets selected, odds accepted, and settlement outcomes.
• Responsible gaming tool usage, including deposit limits set, cooling-off periods activated, and self-exclusion requests.

03 How We Collect Data

tha24 collects Personal Data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, or interact with any form on the Platform.
• Automatically: Through cookies, server logs, and analytics tools that record technical and behavioral data as you navigate the Platform. See Section 6 for full details.
• From payment processors: tha24's payment partners (Indonesian banks, e-wallet operators, and USDT gateways) may confirm transaction status and account holder names to facilitate payment processing and fraud checks.
• From KYC verification providers: Third-party identity verification services may process your document images and return a verification result (pass/fail/pending) to tha24. The underlying documents are handled in accordance with those providers' own data processing agreements.
• From responsible gaming databases: Where you have registered a self-exclusion with a recognized gambling self-exclusion programme, tha24 may receive a notification to prevent account opening or to close an existing account.

04 How We Use Your Data

tha24 processes your Personal Data for the following purposes, each supported by a lawful basis under applicable data protection principles:

05 Data Sharing

tha24 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share your data only in the following limited and controlled circumstances:

• Payment processors: Your financial data is shared with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), and cryptocurrency gateways solely for the purpose of executing the specific transaction you have requested.
• KYC & identity verification providers: Your identity documents and verification data are shared with licensed third-party KYC service providers operating under contractual data processing agreements with tha24. These providers are prohibited from using your data for any purpose beyond providing their verification service to tha24.
• Game content studios: Game session metadata (wager amounts, outcomes) is shared with licensed game studios including Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, Microgaming, and Spribe for the purpose of game integrity verification and RNG auditing. Personal identifying information is not shared with game studios.
• Regulatory and law enforcement authorities: tha24 will disclose Personal Data to competent regulatory or law enforcement authorities where legally required to do so, or where tha24 has reasonable grounds to believe that disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of tha24's assets, your Personal Data may be transferred to the acquiring entity, provided that the acquiring entity agrees to process your data in a manner consistent with this Privacy Policy.
• Professional advisors: tha24 may share Personal Data with legal counsel, auditors, or security consultants under strict confidentiality obligations where necessary for the conduct of their professional services.

All third-party Processors with whom tha24 shares Personal Data are required to implement appropriate technical and organizational security measures and to process data only in accordance with tha24's documented instructions.

06 Cookies & Tracking Technologies

tha24 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These enable secure login sessions, maintain your account state across page loads, and protect against cross-site request forgery (CSRF). These cookies cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Used to measure how players interact with the Platform — including which pages are visited most frequently, average session duration, and navigation paths. This data is aggregated and anonymized. These cookies help tha24 identify and resolve technical issues and improve user experience.
• Functional Cookies: Store your preferences, such as your preferred language setting, last-used payment method, and responsible gaming tool configurations, so that these settings persist across sessions.
• Targeting & Personalization Cookies: Used to deliver game recommendations and promotional content relevant to your play history and stated preferences. These cookies are only activated with your explicit consent.

You may manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing your account. Most modern browsers (Chrome, Firefox, Safari, Edge) allow you to view, delete, and block cookies via their privacy settings menus.

tha24 does not use cross-site tracking cookies that follow you to other websites outside of the tha24 Platform. We do not operate third-party advertising networks and do not share behavioral data with social media platforms.

07 Data Retention

tha24 retains your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following retention schedule applies:

When retention periods expire, Personal Data is securely deleted or anonymized so that it can no longer be attributed to an individual. Data that is required for ongoing legal proceedings or regulatory investigations will be retained until those proceedings are concluded, regardless of the standard retention schedule above.

08 Data Security

tha24 implements comprehensive technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and tha24's servers is encrypted using Transport Layer Security (TLS 1.2 or higher). This applies to account login sessions, payment requests, KYC document uploads, and all API communications.
• Encrypted Data Storage: Sensitive Personal Data, including KYC documents and payment account details, is stored in encrypted form on access-controlled servers. Passwords are hashed using industry-standard bcrypt algorithms and are never stored in recoverable plain text.
• Access Controls: Access to Personal Data within tha24's internal systems is restricted on a strict need-to-know basis. All staff with data access privileges are subject to background checks, confidentiality agreements, and regular data protection training.
• Two-Factor Authentication (2FA): tha24 strongly recommends that all players enable 2FA on their accounts. 2FA is mandatory for all tha24 internal staff accounts that have access to player data systems.
• Fraud Detection Systems: tha24 operates automated anomaly-detection systems that monitor account activity, login patterns, and transaction behavior in real time to identify and respond to suspicious events, including unauthorized access attempts.
• Penetration Testing: tha24's platform infrastructure undergoes regular third-party security assessments, including penetration testing and vulnerability scanning, to identify and remediate security weaknesses before they can be exploited.
• Incident Response: In the event of a data security incident that poses a risk to your rights and freedoms, tha24 will notify affected players without undue delay and will take all reasonable steps to contain and remediate the incident.

09 Your Rights

As a player whose Personal Data is processed by tha24, you hold the following rights with respect to your information. To exercise any of these rights, please contact our support team at the email address provided in Section 13:

• Right of Access: You have the right to request a copy of the Personal Data tha24 holds about you. We will respond to verified access requests within 30 days. Where the volume of data is substantial, we may provide it in structured batches.
• Right to Rectification: If any Personal Data tha24 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (e.g., phone number updates) can be made directly within your account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request that tha24 delete your Personal Data. This right is subject to tha24's legal obligations to retain certain data (e.g., KYC records and financial transaction logs) for the periods specified in Section 7. Where deletion is not possible due to legal obligations, tha24 will restrict processing of the data to the minimum required.
• Right to Restriction of Processing: You may request that tha24 restrict the processing of your Personal Data in certain circumstances — for example, if you contest the accuracy of the data or if you have objected to processing and a determination is pending.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) and to have it transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to tha24 processing your Personal Data based on legitimate interests, including profiling for personalized game recommendations. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications, personalization cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

tha24 will respond to all rights requests within 30 calendar days of receipt of a verified request. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason within the initial 30-day period.

10 Minors & Age Verification

tha24 operates a strict 21+ age policy across all markets, including Indonesia. The Platform is not directed at, and does not knowingly collect Personal Data from, any person under the age of 21.

• Age is verified at the point of registration using date-of-birth fields and, where flagged, through documentary KYC verification (KTP, passport, or driving license).
• If tha24 discovers or has reasonable grounds to believe that an account belongs to a person under 21, the account will be suspended immediately, all gameplay will be voided, and any deposited funds will be returned to the source payment method following a verification process.
• Parents and guardians who believe that a minor in their care may have registered on the Platform are encouraged to contact our support team urgently so that the account can be closed promptly.
• tha24 recommends the use of parental controls and filtering software on shared household devices to prevent access to online gambling platforms by minors.

11 Third-Party Services

The tha24 Platform integrates with a number of third-party services to deliver its full functionality. These integrations are limited to operational necessities and are governed by contractual data processing agreements. Key third-party service categories include:

• Game Content Providers: Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, Microgaming, and Spribe provide the game engines and live dealer streaming infrastructure. These studios operate their own RNG certification and data security frameworks, certified by independent testing laboratories.
• Payment Gateways: tha24 partners with payment infrastructure providers to facilitate local bank transfers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI), e-wallet settlements (OVO, DANA, GoPay, ShopeePay, LinkAja), and USDT blockchain transactions. These providers process financial data under their own regulated frameworks.
• Analytics & Infrastructure: tha24 uses server-side analytics tools to monitor Platform performance and uptime. These tools process anonymized or pseudonymized technical data only and do not have access to personally identifying information beyond IP address ranges.
• Customer Support Tools: tha24's support team uses a secure ticketing system to manage player enquiries. Support interactions may be recorded and stored for quality assurance purposes, in accordance with the data retention schedule in Section 7.

tha24 is not responsible for the privacy practices of third-party websites linked from the Platform (if any). Players are encouraged to review the privacy policies of any external service they interact with independently of tha24.

12 Policy Changes

tha24 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or Platform functionality. When material changes are made, tha24 will:

• Update the "Last Updated" date at the top of this page.
• Notify active players via email to their registered address at least 14 days before the changes take effect, where the changes materially affect how we process your data.
• Display a prominent notice on the Platform homepage and login page for a period of not less than 7 days following publication of the revised policy.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the Platform and may request account closure in accordance with the process described in our Terms & Conditions.

We encourage all players to review this Privacy Policy periodically. All previous versions of the Privacy Policy are available upon request by contacting our support team.

13 Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or about how tha24 handles your Personal Data, our support team is available 24 hours a day, 7 days a week, across all Indonesian time zones (WIB, WITA, and W IT).

To exercise your data rights or submit a privacy-related enquiry, please contact us using the details below:

When submitting a data rights request, please include your registered username, the email address on file with your account, and a clear description of your request. To protect your privacy, we will verify your identity before processing any request that involves access to, correction of, or deletion of Personal Data.

tha24 is committed to resolving all privacy concerns promptly and transparently. If you are not satisfied with our response, you retain the right to escalate your complaint to a relevant data protection authority or regulatory body in your jurisdiction.