VOGPLAY Privacy Policy

This Privacy Policy explains how PT. Codeweb Kreatif Indonesia, as the personal data controller for VOGPLAY services, collects, uses, stores, discloses, and protects personal data when you access or use VOGPLAY.

We are committed to processing personal data lawfully, within limited boundaries, transparently, accurately, securely, and in accordance with specified purposes.

1. Identity of the personal data controller

The personal data controller for VOGPLAY services is:

PT. Codeweb Kreatif Indonesia
Jl. Linggapura Barat No. 03, RT/RW 001/001, Tonjong, Brebes, Central Java 52271

In this Privacy Policy, PT. Codeweb Kreatif Indonesia is referred to as “VOGPLAY”, “We”, or “Company”.

2. Scope

This Privacy Policy applies to personal data processing conducted through:

• VOGPLAY websites, applications, and electronic systems;
• Account creation and usage;
• purchases, payments, and delivery of digital products;
• customer support and communications;
• VOGPLAY promotions, surveys, or programs; and
• interactions with official VOGPLAY channels.

This policy does not govern independent processing by third-party sites or services that maintain their own privacy policies.

3. Personal data We process

The data processed depends on how you interact with the service.

3.1 Identity and Account data

This data may include:

• full name;
• username;
• email address;
• phone number;
• profile picture or avatar;
• passwords in hashed format;
• Account verification status and history; and
• language, currency, or Account setting preferences.

We do not store passwords in plain text.

3.2 Transaction and Order data

This data may include:

• Order number and timestamp;
• products, denominations, quantities, prices, discounts, and fees;
• payment status, Order status, and delivery status;
• payment methods and payment providers;
• transaction reference numbers from payment providers;
• cancellation, refund, and complaint history; and
• other information necessary for bookkeeping, audit, and dispute resolution.

Sensitive payment instrument information, such as PINs, OTP codes, or banking authentication data, is processed by payment providers and must not be disclosed to VOGPLAY. Card or account data received directly by payment providers is subject to their respective privacy policies.

3.3 Product Destination data

To process Digital Products, We may process:

• User IDs or game account IDs;
• server names, zones, regions, or platforms;
• customer numbers;
• phone numbers;
• destination email addresses; or
• other information explicitly requested on the product page.

You must ensure that Destination Data belongs to you or that you have obtained lawful authorization from its rightful owner.

3.4 Technical and usage data

This data may include:

• Internet Protocol or IP address;
• device type, operating system, browser, and device identifiers;
• date, time, duration, and pages accessed;
• referral URLs;
• system logs, error records, and performance data;
• cookie information or similar technologies;
• login activity and security logs; and
• risk data, fraud prevention signals, and indicators of abuse.

3.5 Communication data

When you contact Us, processed data may include message content, attachments, complaint handling records, survey responses, and communication history via email, forms, telephone, or other official channels.

3.6 Data from third-party services

If you choose to sign in through third-party services or use connected features, We may receive data in accordance with the permissions you grant to those providers, such as name, email, account identifier, and profile picture.

We may also receive payment confirmations, delivery statuses, verification results, or security signals from Partners.

4. How We obtain data

We collect personal data:

1. directly from you when you register, place Orders, fill out forms, or communicate;
2. automatically from your device and Platform usage;
3. from payment providers, publishers, distributors, and Partners involved in transactions;
4. from third-party authentication services or accounts based on your permission;
5. from lawfully available public sources; or
6. from authorities based on valid requests.

5. Purposes of processing

We process personal data to:

• create, manage, secure, and recover Accounts;
• verify identities or contact information;
• receive, process, deliver, and record Orders;
• process payments, cancellations, and refunds;
• link transactions with publishers, distributors, or product providers;
• provide support and handle complaints;
• send transaction, security, and service updates;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• enhance performance, reliability, accessibility, and user experience;
• perform analytics, reporting, auditing, and business planning;
• manage promotions and marketing communications based on your choices or consent;
• comply with tax, accounting, consumer protection, and other legal obligations;
• establish, exercise, or defend legal rights; and
• fulfill other purposes disclosed to you or permitted by law.

We will not process data for purposes inconsistent with the original collection intent without a valid legal basis or providing additional notification where required.

6. Legal bases for processing

Depending on context and applicable law, processing is performed under one or more of the following legal bases:

1. consent, including for marketing communications or specific cookies;
2. performance of a contract, including creating Accounts, processing Orders, payments, and Digital Product delivery;
3. legal obligation, including transactional requirements, bookkeeping, tax, security, and responses to authorities;
4. legitimate interests, such as maintaining security, preventing fraud, improving services, and protecting VOGPLAY’s rights or third-party rights, after balancing potential impacts on your rights;
5. protection of vital interests, where applicable; or
6. other legal bases recognized by statutory laws and regulations.

Where processing is based on consent, you may withdraw your consent in accordance with legal provisions. Withdrawal does not affect the lawfulness of processing conducted prior to the withdrawal.

7. Cookies and similar technologies

We may use cookies, local storage, pixels, or similar technologies to:

• maintain session states and login credentials;
• remember language, currency, and preference settings;
• power shopping cart flows and transaction processes;
• maintain security and prevent abuse;
• measure Platform performance and usage; and
• display relevant communications when consented to.

Strictly necessary cookies are used to ensure basic Platform functionality. Analytical or marketing cookies are deployed based on user settings and legal consent requirements.

You can configure cookies through your browser settings or available preference mechanisms. Disabling certain cookies may cause specific features to malfunction.

8. Disclosure to third parties

We disclose data strictly on a need-to-know basis for legitimate purposes to:

8.1 Payment providers

To generate payment instructions, receive transaction statuses, perform verifications, manage refunds, and prevent fraud.

8.2 Publishers, distributors, and product providers

To validate, process, deliver, repair, or investigate Orders. Shared data is strictly limited to necessary details, including Destination Data.

8.3 Technology service providers

Including hosting, storage, networking, security, authentication, email, communication, analytics, captcha, monitoring, and technical support vendors.

8.4 Professional advisors and service providers

Including auditors, consultants, legal advisors, accountants, and other providers bound by confidentiality obligations.

8.5 Authorities or authorized bodies

Where required by law, court orders, warrants, official legal requests, or as necessary to protect legal rights, safety, and security.

8.6 Corporate transactions

In connection with any merger, acquisition, restructuring, financing, asset transfer, or other corporate transaction, subject to appropriate confidentiality and data protection standards.

We require data processors acting on Our behalf to maintain confidentiality, enforce security standards, and use data strictly according to Our instructions and agreed purposes.

We do not sell personal data as a commercial commodity.

9. Cross-border data transfers

Certain service providers or infrastructure facilities may process data outside Indonesia.

In the event of cross-border transfers, We will apply legally required safeguards, including ensuring an adequate and comparable level of protection, implementing binding data protection mechanisms, obtaining consent where required, or utilizing other lawful mechanisms.

10. Data retention

We retain data for as long as necessary to fulfill collection purposes, provide services, ensure security, maintain bookkeeping, conduct audits, resolve disputes, and comply with legal requirements.

Retention periods vary based on:

• data type and sensitivity;
• Account and transaction status;
• operational and security necessities;
• duration of contractual rights and obligations;
• risks of fraud or legal claims; and
• statutory retention obligations mandated by law.

When data is no longer required, We will delete, destroy, or anonymize it in accordance with standard procedures and legal requirements, unless further retention is required or permitted by law.

Backup copies may persist for limited durations until operational purge cycles complete and will not be accessed for other purposes.

11. Data security

We implement reasonable and proportional technical and organizational measures, including:

• access controls based on the principle of least privilege;
• authentication and credential security safeguards;
• data encryption in transit where appropriate;
• system logging and activity monitoring;
• environment separation and administrative access restrictions;
• backup and disaster recovery systems;
• vulnerability management and security patching;
• third-party vendor evaluations; and
• incident response protocols.

No electronic system is completely risk-free. You also play an active role in maintaining security by using strong passwords, protecting OTP codes, keeping your device updated, and reporting suspicious activities immediately.

12. Your rights

Subject to applicable statutory requirements and exceptions, you may hold the right to:

1. obtain information regarding the identity, legal basis, purpose, and accountability of processing entities;
2. access and request copies of your personal data;
3. complete, update, or rectify inaccurate data;
4. terminate processing, request erasure, or demand data destruction;
5. withdraw consent;
6. suspend or restrict processing activities;
7. object to decisions based solely on automated processing that produce legal or significant effects;
8. obtain or transfer data in a structured, commonly used, and machine-readable format, where applicable;
9. lodge complaints or objections; and
10. claim compensation under applicable law in the event of a data protection breach.

Certain rights are not absolute. We may refuse or restrict requests where mandated or permitted by law, such as to protect third-party rights, prevent fraud, defend legal claims, or comply with statutory retention requirements.

13. How to submit requests

Personal data requests can be submitted through Our Contact Us page or via email at [email protected].

Please provide sufficient details to help Us locate your data and process your request efficiently. To protect your data, We may require identity or authorization verification prior to processing.

We will respond within statutory timeframes and procedures. Submitting requests is generally free of charge, though reasonable administrative fees may apply where permitted by law for repetitive, excessive, or unfounded requests.

14. Service communications and marketing

We may send essential service communications related to transactions and system updates, such as verification codes, Order receipts, payment updates, delivery notifications, security alerts, and key policy revisions.

With your consent or where legally permissible, We may send promotional material. You may opt out of promotional communications via the unsubscribe link in messages or through available settings. Opting out of marketing does not halt operational transaction or security notifications.

15. Automated processing and fraud prevention

We may utilize rule-based automated systems to evaluate transaction risks, detect anomalous activities, rate login attempts, or enforce secondary verification steps.

Where a fully automated decision results in legal consequences or significant personal impact, you may request human review in accordance with applicable legal rights.

16. Children's data

VOGPLAY services are not intended for independent use by children who lack legal capacity. Use by minors must occur under the direct consent and supervision of a legal parent or guardian.

If you become aware that a child's data has been submitted without proper legal consent, please contact Us immediately so We can conduct investigations and take necessary corrective measures.

17. Data protection incidents

In the event of a personal data breach, We will conduct rapid risk assessments, containments, remediations, documentations, and notify affected data subjects as well as regulatory authorities within statutory timelines and prescribed procedures.

Notifications will outline the categories of data affected, event timing and cause, potential consequences, remediation steps taken, and actions you can take to mitigate risks.

18. Third-party links and services

Our Platform may contain links or integrations to third-party services. This Privacy Policy does not apply to independent data processing conducted by third parties. We encourage you to review their respective privacy policies before sharing personal data.

19. Privacy Policy changes

We may update this Privacy Policy to reflect changes in our services, technology, security measures, or relevant legal frameworks.

The updated date will be stated at the top of this document. If changes materially impact your rights or how We handle personal data, We will provide prominent notice and seek renewed consent where legally required.

20. Legal framework

This Privacy Policy is formulated in accordance with applicable Indonesian legislation, including:

• Law No. 27 of 2022 on Personal Data Protection;
• Law No. 11 of 2008 on Electronic Information and Transactions, as amended (most recently by Law No. 1 of 2024);
• Government Regulation No. 71 of 2019 on the Provision of Electronic Systems and Transactions;
• Government Regulation No. 80 of 2019 on Trading Through Electronic Systems; and
• other legal frameworks governing data processing and VOGPLAY operations.

21. Contact Us

For questions, complaints, or exercising your data protection rights, contact:

PT. Codeweb Kreatif Indonesia
Jl. Linggapura Barat No. 03, RT/RW 001/001, Tonjong, Brebes, Central Java 52271
Email: [email protected]
Contact number: +62 813-9000-7520

We may update dedicated data protection channels in this section as they become available.