PT Indotech Digital Group ("NobiPlay", "we", "us") is the data controller responsible for processing your personal data in connection with NobiPlay's streaming services. This Privacy Policy applies to all NobiPlay products and services, including the nobiplay.id website, mobile applications, and Smart TV applications.

This policy is drafted and updated in accordance with:

• Law No. 27 of 2022 on Personal Data Protection (PDP Law)
• Law No. 11 of 2008 on Electronic Information and Transactions (EIT Law), as amended
• Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions
• International industry best practices, including GDPR principles

We collect the following categories of personal data, each with its own basis and purpose:

3.1 Data you provide directly when registering an account, completing your profile, making a payment, contacting our support team, filling out a survey, or interacting with the Platform's social features.

3.2 Data collected automatically when you use the Platform, including through cookies, web beacons, mobile app SDKs, and similar tracking technologies. See Section 7 for further details.

3.3 Data from third parties, including:

• Social Login: If you sign in using Google, Facebook, or Apple, we receive basic profile data (name, email, photo) from that provider in accordance with the permissions you grant.
• Payment Partners: Payment service providers share transaction confirmations and payment status with us.
• Analytics Partners: Third-party analytics services provide us with aggregated data on how users interact with our Platform.
• Public Sources: Publicly available information relevant for verification or fraud prevention purposes.

In accordance with Article 20 of the PDP Law, we process your personal data based on one of the following legal grounds:

• Performance of a contract: Processing necessary to provide NobiPlay's services in accordance with the Terms and Conditions you have agreed to (account, payment, streaming).
• Consent: For optional processing such as marketing communications, advanced analytics, and data sharing with certain partners — we request your explicit consent, which may be withdrawn at any time.
• Legitimate interest: For account security, fraud prevention, and service improvement, where our interests do not override your rights.
• Legal obligation: Where processing is required under applicable Indonesian law, including tax, cybersecurity, and law enforcement obligations.

NobiPlay does not sell your personal data. We may only share data in the following situations:

All third-party partners that receive your data are bound by confidentiality and data protection agreements equivalent to our own standards.

NobiPlay uses cookies and similar technologies to operate and improve the Platform. Cookies are small text files stored on your device.

You can manage your cookie preferences at any time via Settings → Privacy → Manage Cookies or through your browser settings. Please note that disabling essential cookies will affect the Platform's functionality.

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected or to comply with applicable legal obligations:

Once the retention period ends, data will be securely deleted or permanently anonymized so that it can no longer be attributed back to you.

NobiPlay implements adequate technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: All communications between your device and our servers are encrypted using TLS 1.3.
• Encryption at rest: Sensitive data is stored in encrypted form using AES-256.
• Layered authentication: Our systems support two-factor authentication (2FA) and secure login features.
• Role-based access: Only personnel who require data access to perform their duties are granted access, following the principle of least privilege.
• Regular security audits: We conduct penetration testing and security audits regularly through independent third parties.
• 24/7 monitoring: Intrusion detection and anomaly monitoring systems operate continuously.
• Incident response plan: Documented security incident response procedures with a clear reporting timeline.

10.1 Age Restriction. NobiPlay's services are not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under this age without verified parental consent, we will promptly delete that data.

10.2 Users Aged 13–17. For users aged 13–17, use of NobiPlay's services requires the consent of a parent or guardian. Certain features, such as adult content and in-app purchases, require parental verification.

10.3 Children's Profiles (Kids Mode). Children's profiles created by parents through the Parental Controls feature can only access age-appropriate content. Usage data from children's profiles is not used for targeted advertising.

Under the PDP Law and international best practices, you have the following rights over your personal data:

To exercise the rights above, send a written request to [email protected]. We will respond within 30 calendar days of receiving the request. For complex requests, this period may be extended by 60 days with notice.

Some of our service providers that store or process data are located outside Indonesia. Where an international data transfer occurs, we ensure equivalent protection through:

• Standard Contractual Clauses that require the data recipient to comply with an equivalent standard of data protection.
• Protection level verification — we only transfer data to countries or entities that have an adequate level of data protection.
• Data Processing Agreements with all partners that receive personal data.

Currently, NobiPlay data may be processed at facilities located in: Indonesia (primary servers), Singapore, and the United States (for certain cloud services).

NobiPlay may update this Privacy Policy from time to time to reflect changes in our practices, regulatory changes, or technological developments. We will notify you through:

• In-app notifications or pop-ups on the website for material changes.
• An email to your registered address at least 14 days before the change takes effect.
• An update to the "Effective as of" date at the top of this document.

Continued use of the service after the effective date of a change indicates your acceptance of the updated Privacy Policy. If you do not agree with a material change, you may close your account before the change takes effect.

For questions, objections, or complaints regarding the handling of your personal data, please contact:

We are committed to responding to all privacy inquiries within 5 business days and resolving data subject rights requests within 30 calendar days.