Privacy Policy

1 Introduction

sr999 is committed to protecting the privacy and personal data of every individual who interacts with our Platform. We recognise that members entrust us with sensitive personal and financial information, and we take that responsibility seriously. This Policy has been drafted to meet internationally recognised data protection principles and to provide you — our member — with clear, honest, and complete information about how your data is handled at every stage of your relationship with sr999.

This Policy applies to all personal data collected through the sr999 website (sr999.lat), any associated mobile-optimised interfaces, customer support communications, and any other channel through which sr999 interacts with you. It should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which form part of the complete agreement between you and sr999.

sr999 primarily serves players based in Indonesia, across major cities including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and Makassar. Where this Policy refers to applicable law or regulatory requirements, these are understood to include relevant data protection obligations applicable to the jurisdictions in which sr999 operates internationally.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to names, identification numbers, location data, contact details, financial account information, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means sr999, acting as the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means any third-party service provider that Processes Personal Data on behalf of sr999 in accordance with sr999's instructions and this Policy.
• "Member" / "You" means any individual who has registered or is in the process of registering an Account on the sr999 Platform, or who uses the Platform as a visitor without an Account.
• "Account" means the registered member profile created upon successful completion of the sr999 registration process.
• "KYC" means Know Your Customer — the identity verification process required to activate full Account functionality, including withdrawals.
• "Cookies" means small text files placed on your device by the sr999 Platform to support session management, analytics, and personalisation functions.

3 Data We Collect

sr999 collects Personal Data that falls into the following categories:

3.1 Registration Data

When you create an sr999 Account, we collect the information you provide on the registration form, which includes your full legal name, date of birth, Indonesian residential address, email address, mobile phone number, and the username and password you select.

3.2 Identity Verification (KYC) Data

To comply with anti-money-laundering obligations and to protect the integrity of the Platform, sr999 collects copies of government-issued identity documents (such as KTP, Passport, or Driver's Licence), proof-of-address documents, selfie photographs taken in accordance with sr999's submission guidelines, and evidence of payment method ownership.

3.3 Financial Transaction Data

sr999 records all deposits, withdrawals, and wager transactions processed through your Account. This includes transaction amounts (denominated in IDR), timestamps, payment method references (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja account identifiers), and transaction status logs.

3.4 Gaming Activity Data

sr999 logs your gaming activity on the Platform, including the games played, bet amounts, outcomes, session durations, and any responsible gaming tools you activate. This data supports fraud detection, dispute resolution, and the delivery of personalised gaming recommendations.

3.5 Technical and Device Data

When you access sr999, our servers automatically collect certain technical information, including your IP address, device type and operating system, browser type and version, referring URL, pages visited, and time-stamped activity logs. This information is used to maintain Platform security, diagnose technical issues, and improve user experience.

3.6 Communications Data

When you contact sr999 customer support via live chat or email, we retain records of those communications, including the content of messages, timestamps, and any issue-resolution actions taken. These records are used to provide consistent support and to train our support team.

3.7 Marketing Preference Data

If you opt in to receiving marketing communications from sr999, we record your communication channel preferences (email, SMS, in-platform notifications) and your response history to promotional messages. This data is used solely for the purpose of delivering relevant offers from sr999 and is not shared with external advertising networks.

4 How We Collect Your Data

sr999 collects Personal Data through the following means:

• Direct provision: Information you actively provide during Account registration, KYC submission, deposit and withdrawal requests, and customer support interactions.
• Automated collection: Technical and device data collected automatically by sr999's servers and analytics systems as you browse and interact with the Platform.
• Cookies and similar technologies: Session identifiers, preference cookies, and analytics tags placed on your device as described in Section 9 of this Policy.
• Third-party providers: Identity verification partners, payment processors, and fraud detection services may supply sr999 with data outputs derived from the information you provide to them as part of our shared service workflow (e.g., a verification pass/fail status from our KYC provider).
• Publicly available sources: In limited circumstances related to fraud investigation or compliance checks, sr999 may cross-reference publicly available data sources to verify information you have provided.

5 Purpose & Legal Basis for Processing

sr999 Processes your Personal Data for the purposes and on the legal bases set out in the table below:

6 Data Sharing & Disclosure

sr999 does not sell, rent, or transfer your Personal Data to unaffiliated third parties for their own independent commercial purposes. We may, however, share your data with the following categories of recipients in the course of operating the Platform:

6.1 Payment Processors

To facilitate deposits and withdrawals, sr999 shares necessary financial and identity data with our payment processing partners, which include Indonesian bank transfer networks and e-wallet providers such as OVO, DANA, GoPay, ShopeePay, and LinkAja. These processors act as Data Processors under written agreements that restrict their use of your data to the specific transaction-processing purposes for which it was shared.

6.2 Identity Verification Providers

sr999 engages specialist KYC and identity verification partners to conduct document checks and biometric validation. These partners receive only the data necessary to complete the verification task and are contractually prohibited from using your data for any other purpose.

6.3 Fraud and Security Providers

To maintain the integrity of the Platform, sr999 shares technical and behavioural data with fraud detection and cybersecurity service providers. These providers operate under strict data processing agreements and provide only aggregated or actionable risk-signal outputs back to sr999.

6.4 Game Technology Providers

For games delivered by third-party studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — limited session and transaction data is transmitted to those providers' game servers to operate the game and record the result. This data transfer is technically necessary and governed by sr999's contracts with each provider.

6.5 Legal and Regulatory Authorities

sr999 will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or in the legitimate defence of legal claims. In such cases, sr999 will disclose only the minimum data necessary to comply with the obligation.

6.6 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets involving sr999, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to the data controller's identity in advance of the transaction completing.

7 Data Retention

sr999 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as is required by applicable law. The following retention periods apply:

• Account and KYC data: Retained for the duration of your Account's active life, plus a minimum of five (5) years following Account closure, to meet anti-money-laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the last interaction in a support thread.
• Marketing preference data: Retained until you withdraw consent for marketing communications or for two (2) years of inactivity, whichever comes first.
• Technical and device logs: Retained for up to twelve (12) months, after which anonymised aggregate data may be retained for analytics purposes indefinitely.
• Gaming activity data: Retained for five (5) years from the date of each session, to support dispute resolution and responsible gaming audit obligations.

Once the applicable retention period expires, sr999 will securely delete or anonymise your Personal Data in accordance with our internal data lifecycle management procedures.

8 Security Measures

sr999 implements a comprehensive set of technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and sr999's servers.
• AES-256 encryption for sensitive data at rest, including stored payment references and identity document copies.
• Role-based access controls ensuring that only authorised personnel with a specific operational need can access Personal Data categories, with all access events logged and audited.
• Regular independent penetration testing and vulnerability assessments of the sr999 Platform and supporting infrastructure.
• Two-factor authentication options available to all members for Account login, and mandatory for sr999's internal administrative systems.
• Dedicated incident response procedures that specify notification timelines and containment steps in the event of a confirmed data breach.

9 Cookies & Tracking Technologies

sr999 uses cookies and similar technologies (such as web beacons and local storage objects) to operate and improve the Platform. The following categories of cookies are used:

You may manage cookie preferences through your browser settings. Please note that disabling Strictly Necessary cookies will prevent you from logging in to the Platform. Disabling Functional or Analytics cookies will not affect your ability to play but may reduce the quality of your personalised experience.

10 Your Data Rights

As an sr999 member, you hold the following rights in relation to the Personal Data we hold about you. To exercise any of these rights, contact sr999's data team at [email protected]. We will respond to all verified requests within 30 calendar days.

Please note that certain rights are subject to exceptions where Processing is required for legal compliance, fraud prevention, or the establishment, exercise, or defence of legal claims. sr999 will clearly communicate any applicable exceptions when responding to your request.

11 Minors & Age Restrictions

The sr999 Platform is strictly restricted to individuals aged 21 years and older. sr999 does not knowingly collect or Process Personal Data of individuals under the age of 21. Age verification is performed as part of the KYC process for all members.

If sr999 becomes aware that Personal Data has been collected from an individual under the age of 21 without parental or guardian consent, we will immediately take steps to delete that data and close the associated Account. If you are a parent or guardian and believe that a minor has registered an Account with sr999, please contact us immediately at [email protected].

12 International Data Transfers

sr999 operates a globally distributed technology infrastructure. As a result, your Personal Data may be transferred to and processed in countries outside Indonesia where sr999's service providers and game platform partners maintain servers or operational centres. In all cases where such cross-border transfers occur, sr999 ensures that:

• Transfers are made only to recipients in countries that provide an adequate level of data protection, or to recipients who have agreed to contractual safeguards that are substantially equivalent to internationally recognised data protection standards.
• Data Processing Agreements are in place with all third-party recipients, specifying permissible uses, security requirements, and data return or deletion obligations.
• No Personal Data is transferred in a way that materially increases the risk of exposure beyond what would apply if the data were held exclusively within Indonesia.

If you would like further information about the specific safeguards applied to international transfers of your data, please contact the sr999 data team at [email protected].

13 Amendments to This Policy

sr999 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When material changes are made, sr999 will notify members by displaying a prominent notice on the Platform and, where reasonably practicable, by sending a notification to the email address registered on your Account.

The updated Policy will be published on this page with a revised "Last Updated" date. Your continued use of the sr999 Platform after the effective date of any amendment constitutes your acknowledgment of the revised Policy. We recommend reviewing this page periodically to stay informed of any updates.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way sr999 handles your Personal Data, please contact our data team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week, directly through the sr999 Platform interface.
• Response Time: sr999 aims to acknowledge all data-related enquiries within 5 business days (WIB) and to provide a substantive response within 30 calendar days.