Privacy Policy — 999rp

Definitions

In this Policy the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, contact details, IP address, device identifiers, and financial information.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means 999rp, the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means any third party that Processes Personal Data on behalf of 999rp under a written data processing agreement.
• "KYC Data" means identity and address verification documents submitted by a Player as part of the Know Your Customer process, including copies of national identity cards (KTP), passports, and proof-of-address documents.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, analytics, and personalisation functions.
• "Sensitive Data" means a special category of Personal Data that warrants heightened protection, including health information, religious belief, and financial account details beyond standard payment references.

Data We Collect

2.1 999rp collects Personal Data through the following channels and in the following categories:

Registration Data

• Full legal name as it appears on your Indonesian national identity card (KTP)
• Date of birth (to verify the 21+ age requirement)
• Residential address in Indonesia (city, province, postal code)
• Mobile phone number (Indonesian format)
• Email address
• Username and encrypted password

KYC Verification Data

• Scanned or photographed copy of your KTP or Indonesian passport
• Selfie photograph for liveness verification where required
• Bank account details or e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) used to verify ownership of payment methods
• Recent bank statement from BCA, BRI, BNI, Mandiri, or another accepted Indonesian bank confirming residential address

Transactional Data

• Deposit and withdrawal records, including amounts (in IDR / Rp), timestamps, and payment channel used
• Bet and Wager history, including market selections, odds accepted, stakes, and outcomes
• Bonus and promotion activity records

Technical & Device Data

• IP address and approximate geolocation derived from IP
• Browser type, version, and operating system
• Device type, model, and unique device identifier where applicable
• Session timestamps, page views, and click-path data collected via first-party analytics
• Cookie identifiers and local storage data (see Clause 6)

Communications Data

• Records of live chat conversations with our support team
• Email correspondence sent to or received from [email protected]
• Responsible gaming self-assessment responses and self-exclusion requests

2.2 We do not knowingly collect Sensitive Data beyond what is strictly required for age verification, identity confirmation, and responsible gaming obligations. We do not collect biometric data except where a liveness check is required for high-risk account verification and you have provided explicit consent.

How We Use Your Data

3.1 999rp uses the Personal Data described in Clause 2 for the following purposes:

• Account Management: Creating and maintaining your Account, authenticating your identity at login, and enabling you to access all Platform features including sports betting markets (BRI Liga 1, EPL, Champions League, Timnas Indonesia fixtures), live casino, togel (Indonesia's traditional numbers lottery), and slot gacor (high-payout slot games).
• Transaction Processing: Facilitating deposits and withdrawals via local bank transfer (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), verifying payment instrument ownership, and maintaining accurate financial records.
• Regulatory Compliance & KYC: Verifying your age (21+) and identity in compliance with anti-money laundering (AML) obligations, detecting and preventing fraud, and responding to lawful requests from competent authorities.
• Responsible Gaming: Monitoring account activity for signs of problem gambling behaviour, enforcing deposit limits and self-exclusion requests, and proactively reaching out where our systems flag at-risk patterns.
• Customer Support: Responding to enquiries, resolving disputes, and providing assistance to Players in English and Indonesian via live chat and email.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve site performance, user experience, game offering, and payment infrastructure.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates by email or push notification, where you have opted in to receive such communications. You may opt out at any time via your Account settings or by emailing [email protected].
• Security & Fraud Prevention: Detecting unusual login patterns, investigating suspected account compromise, and protecting the integrity of the Platform and all players using it.

Legal Basis for Processing

4.1 999rp Processes your Personal Data under one or more of the following legal bases:

• Contractual Necessity: Processing is required to perform the contract between you and 999rp (i.e., the Terms & Conditions you accepted at registration). This covers Account creation, transaction processing, and customer support.
• Legal Obligation: Processing is required to comply with applicable legal obligations, including KYC/AML regulations, record-keeping requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing is necessary for the legitimate interests of 999rp, including fraud prevention, platform security, responsible gaming monitoring, and analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where no other legal basis applies, we will seek your explicit consent before Processing your data for that purpose. You may withdraw consent at any time without affecting the lawfulness of Processing carried out prior to withdrawal.

Data Sharing & Disclosure

5.1 999rp does not sell, rent, or trade your Personal Data. We may share your data only in the following limited circumstances:

• Payment Processors: We share necessary transaction details with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing your deposits and withdrawals.
• KYC & Identity Verification Providers: We may engage licensed third-party KYC providers to assist with document verification and liveness checks. These providers operate under strict data processing agreements and are prohibited from using your data for any purpose beyond the verification task.
• Game Content Providers: Aggregated, anonymised session data (not personally identifiable) may be shared with certified game studios such as Pragmatic Play, Evolution Gaming, Spribe, and Pocket Games Soft for game performance and integrity monitoring purposes.
• Legal & Regulatory Authorities: We will disclose Personal Data to competent law enforcement or regulatory bodies where required to do so by applicable law, court order, or where we believe disclosure is necessary to protect the rights, property, or safety of 999rp, our players, or the public.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all assets of 999rp, your Personal Data may be transferred to the successor entity, subject to the same privacy protections set out in this Policy. You will be notified of any such transfer in advance.

5.2 All third-party Data Processors engaged by 999rp are contractually bound to: (a) process your data only on our documented instructions; (b) implement appropriate technical and organisational security measures; and (c) delete or return your data upon termination of the service agreement.

Cookies & Tracking Technologies

6.1 The 999rp platform uses the following categories of Cookies and similar tracking technologies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display options, and last-visited game category. These improve your experience on return visits but are not essential to platform operation.
• Analytics Cookies: Collect anonymised data about how Players navigate the Platform — pages visited, time spent, click sequences, and error events. This data is used to improve platform performance and user experience. We use first-party analytics only; we do not embed Google Analytics or similar third-party tracking scripts.
• Security Cookies: Used to detect and prevent fraudulent access attempts, identify suspicious login patterns, and enforce account security rules.

6.2 You may control Cookie preferences through your browser settings. Blocking strictly necessary Cookies will impair or prevent access to the Platform. Blocking functional or analytics Cookies will not prevent access but may reduce the quality of your experience.

6.3 We do not use third-party advertising or tracking pixels (e.g., Meta Pixel, Google Ads tags) on the 999rp platform. No behavioural advertising profiles are built from your Platform activity.

Data Security

7.1 999rp implements a layered security architecture to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction:

• All data in transit is protected by TLS 1.3 / 256-bit SSL encryption.
• Data at rest is encrypted using AES-256 with key rotation policies enforced quarterly.
• Access to production databases containing Personal Data is restricted to authorised personnel only, governed by role-based access controls and multi-factor authentication.
• Security vulnerabilities are monitored continuously; critical patches are deployed within 24 hours of release.
• Annual independent penetration testing and security audits are conducted by certified third-party firms.
• All staff with access to Personal Data receive mandatory data protection and security training.

7.2 In the event of a data breach that is likely to result in a risk to your rights and freedoms, 999rp will notify affected Players without undue delay and will take all reasonable steps to contain the breach, assess its impact, and prevent recurrence.

7.3 You are responsible for maintaining the confidentiality of your Account password and for logging out of the Platform when using shared or public devices. 999rp is not liable for any loss arising from unauthorised Account access resulting from your own failure to maintain credential security.

Your Data Rights

8.1 As a Player whose Personal Data is Processed by 999rp, you hold the following rights. To exercise any of these rights, contact us at [email protected] with a clear description of your request. We will respond within 30 days.

Data Retention

9.1 999rp retains Personal Data for the minimum period necessary to fulfil the purposes described in this Policy and to comply with our legal obligations. The following retention periods apply as a general guide:

• Account & Registration Data: Retained for the duration of your Account plus five years following permanent closure, to comply with financial record-keeping and AML obligations.
• KYC Documents: Retained for five years from the date of submission or from Account closure, whichever is later, in line with standard AML compliance requirements.
• Transaction Records: Retained for five years from the date of each transaction for financial audit and AML compliance purposes.
• Support Communications: Retained for three years from the date of the last interaction, unless the communication relates to a formal dispute, in which case it is retained until the dispute is fully resolved plus two years.
• Analytics & Session Data: Aggregated and anonymised within 13 months of collection. Raw session logs are deleted after 90 days.
• Cookie Data: Session cookies expire when you close your browser. Persistent cookies expire within 12 months of being set unless renewed by continued Platform use.

9.2 Where you request erasure of your data under Clause 8 and no legal obligation requires us to retain it, we will complete the erasure within 30 days of confirming your verified request.

Minors

10.1 The 999rp platform is strictly intended for adults who are 21 years of age or older. We do not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory step in the Account registration process and is reinforced through our KYC programme.

10.2 If we become aware that Personal Data belonging to a person under the age of 21 has been collected — whether through fraudulent registration, misrepresentation of age, or any other means — we will immediately suspend the relevant Account, delete the associated data, void any related Transactions, and take appropriate further action in accordance with our Terms & Conditions.

10.3 If you are a parent or guardian and believe your child has registered on the 999rp platform without your knowledge, please contact us immediately at [email protected] and we will investigate and act without delay.

International Data Transfers

11.1 999rp operates as an internationally licensed platform. As a result, your Personal Data may be transferred to and Processed in countries outside Indonesia, including the jurisdiction in which our servers and Data Processors are located. Some of these jurisdictions may not offer the same level of data protection as Indonesia.

11.2 Where such transfers occur, 999rp ensures appropriate safeguards are in place, including:

• Contractual clauses that impose data protection obligations on receiving parties equivalent to those in this Policy;
• Transfer only to entities that maintain certified information security management systems (ISO 27001 or equivalent); and
• Processing limited to the minimum data necessary for the specific operational task being performed.

11.3 By using the 999rp platform and accepting this Policy, you consent to the transfer of your Personal Data as described in this clause, subject always to the safeguards outlined above.

Policy Amendments

12.1 999rp reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will notify registered Players by email to the address on file and by displaying a prominent update notice on the Platform for a minimum of 14 days before the revised Policy takes effect.

12.2 The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

12.3 If you disagree with any change to this Policy, you have the right to close your Account before the effective date of the change. Contact us at [email protected] to initiate Account closure and data handling in accordance with Clause 9.

Contact & Complaints

13.1 For any questions, requests, or concerns relating to this Privacy Policy or the way in which 999rp handles your Personal Data, please contact our data protection team using the details below:

Please include "Privacy Request" in the subject line of your email and provide your registered email address and Account username so we can locate your records efficiently. We aim to acknowledge all privacy-related requests within two business days (WIB) and to resolve them fully within 30 calendar days.

13.2 If you are not satisfied with our response to your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to you or to the jurisdiction in which 999rp holds its international operating licence.