Privacy Policy
Document version: events-2026-10-08
Controller and data
Nontonio LLC, registered and based in Indonesia, is the Events data controller. Address: Jakarta, Indonesia. Privacy contact: [email protected]. Events processes account ID, alias, age/region declarations, consent version/time, referral attribution, account verification, scores, playback sessions, server time, Play Integrity signals, and social evidence. Identity, bank, and tax details are requested only from prospective winners as needed. Relevant Nontonio account and viewing policies also apply.
Purposes and legal grounds
Consent supports using referred users’ campaign activity. Participant and prize administration performs the program terms. Security and abuse prevention rely on legitimate interests balanced against your rights. Payment and tax records meet legal duties. Events data is not sold; analytics privacy preferences remain respected.
Choice and withdrawal
Campaign consent is voluntary and separate from using Nontonio. Refusal or withdrawal does not limit viewing access. Send withdrawal to [email protected]. Consent-based processing stops within 3 × 24 hours of receiving the request, as required by law. Withdrawal does not change the lawfulness of earlier processing. Data needed for legal duties or disputes remains restricted.
Visible information
The public sees masked aliases, ranks, and points. Referrers see qualification status and points with anonymous referral labels. Emails, phones, viewing titles, social evidence, bank details, and identity documents are not shown to the public or referrers. Your profile photo may appear in your private area.
Access and providers
Upload relevant evidence only and conceal other data. Authorized staff access is restricted and logged. Infrastructure, storage, email, authentication, Play Integrity providers, and banks process data needed for their services. Other disclosures follow legal duties or lawful dispute handling.
Location and transfers
Data may be processed in Indonesia and abroad, including Germany. Cross-border transfers follow data protection requirements, recipient assessment, and necessary safeguards. Specific consent is obtained before a related transfer if required by law.
Retention and cookies
Social evidence and winner verification documents are deleted within 90 days after payment and all related disputes conclude, unless law requires longer retention. Consent, audit, and transaction records are limited to evidentiary needs and legal duties. Unneeded data is deleted or anonymized. Cookies support sessions, referrals, and language. Automatic language uses the IP country received by the server, then browser language; GPS is not requested. Language does not determine region eligibility.
Rights and security
Request information, access/copies, correction, restriction/cessation, consent withdrawal, or deletion through [email protected] as provided by law. The team checks identity proportionately and explains mandatory retention exceptions. Data protection failures are handled and notified within legal deadlines. Important changes are communicated before taking effect. Indonesian is authoritative if translations differ.