Privacy Policy

1. Introduction

sba999 ("we", "us", "our", or "the Company") operates the online betting and gaming platform accessible at https://sba999.cam. The Company offers sports betting markets, live casino games, slot games, togel (Indonesia's traditional numbers lottery), Andar Bahar, Teen Patti, crash games, and other online gaming products to eligible Players in Indonesia and other permitted jurisdictions.

The protection of personal data is a core operational responsibility at sba999. This Privacy Policy sets out in plain, precise terms how we collect, process, store, protect, and — where necessary — transfer personal data in connection with the sba999 Platform and any related communications or support services.

This policy applies to all individuals who visit our website, register an Account, contact our customer support team, subscribe to any promotional communications, or otherwise interact with sba999 in any capacity. If you are accessing sba999 on behalf of another person, you represent that you have obtained their informed consent for the data practices described here prior to submitting their data.

Where this Privacy Policy references other sba999 documents — such as our Terms & Conditions — those documents are incorporated by reference. Capitalised terms used but not defined in this policy carry the meanings assigned to them in the Terms & Conditions.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

3. Data Controller

sba999 acts as the Data Controller in respect of all personal data collected from Players, visitors, and any other individuals who interact with the Platform or its associated communications channels. As Data Controller, sba999 is responsible for ensuring that personal data is processed lawfully, fairly, and transparently, and that appropriate technical and organisational measures are in place to protect data against unauthorised access, loss, or misuse.

4. Data We Collect

sba999 collects personal data only to the extent necessary to provide its services safely and in compliance with applicable legal and regulatory requirements. The categories of personal data we collect are described below.

4.1 Registration Data

When you create an Account on sba999, we collect your full legal name as it appears on a government-issued identification document, your date of birth (to verify that you are at least 21 years of age), your email address, your Indonesian mobile phone number, and your residential address in Indonesia. This data is required to create and maintain your Account and to communicate with you about account activity, security alerts, and service updates.

4.2 KYC and Identity Verification Data

Before processing your first withdrawal, sba999 conducts mandatory Know Your Customer (KYC) verification. This requires you to submit a clear photograph or scan of a valid government-issued photo identification document (such as an Indonesian KTP — Kartu Tanda Penduduk — or a valid passport), a recent proof of residential address dated within 90 days (such as a utility bill or bank statement from BCA, BRI, BNI, or Mandiri), and a live selfie photograph holding your submitted identification document. We may also request a source-of-funds declaration for enhanced due diligence purposes in accordance with applicable anti-money-laundering regulations.

4.3 Financial Transaction Data

sba999 records all financial transactions on the Platform, including deposit amounts, withdrawal requests, payment methods used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja), transaction timestamps, and transaction reference numbers. We do not store complete bank account numbers or e-wallet credentials on our servers; payment data is handled directly by PCI-compliant payment processors under their own security controls.

4.4 Gameplay and Betting Data

We record a complete log of all bets placed, games played, bet amounts, outcomes, and session durations for each Player Account. This data is used for account management, bonus calculation, responsible gaming monitoring, and regulatory compliance purposes.

4.5 Technical and Device Data

When you access the Platform, our servers automatically collect certain technical data, including your IP address, browser type and version, operating system, device model, screen resolution, referring URL, and session timestamps. This data is used for fraud prevention, security monitoring, platform optimization, and geographic compliance checks.

4.6 Communications Data

If you contact sba999's customer support team via email, live chat, or any other channel, we retain records of those communications, including the content of messages, timestamps, and any attachments submitted. This data is retained for quality assurance, dispute resolution, and regulatory audit purposes.

4.7 Marketing Preferences

With your explicit consent, sba999 may collect your marketing preferences to send you promotional communications about bonuses, new game releases, seasonal promotions (such as those tied to Idul Fitri, Ramadhan, or Chinese New Year), and other relevant offers. You may withdraw consent to marketing communications at any time by contacting [email protected] or using the unsubscribe option in any email we send.

5. Lawful Basis for Processing

sba999 processes personal data only where a lawful basis exists for doing so. The table below sets out the primary categories of processing activities and the corresponding lawful basis for each.

6. How We Use Your Data

sba999 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose that is incompatible with those listed here without first obtaining your consent or establishing a new lawful basis.

• Account Services: Creating, maintaining, and securing your Account; processing login sessions; enforcing Account limits and restrictions; and communicating critical account notifications such as password changes, suspicious activity alerts, and withdrawal confirmations.
• Payment Processing: Verifying deposit sources, processing withdrawal requests to your nominated payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or other supported channels), and maintaining an accurate financial ledger for your Account.
• Identity and Age Verification: Confirming that you are at least 21 years of age and that your identity matches the payment methods associated with your Account, in accordance with our legal obligations and our commitment to responsible gaming.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, multi-accounting, money laundering, and any other activity that violates our Terms & Conditions or applicable law.
• Responsible Gaming: Monitoring betting patterns to identify potential signs of problem gambling; enforcing self-imposed deposit limits, loss limits, and cooling-off periods; and proactively reaching out to Players whose behavior suggests they may need support.
• Legal and Regulatory Compliance: Meeting our obligations under applicable anti-money-laundering legislation, player protection regulations, data retention requirements, and any reporting duties to competent authorities.
• Customer Support: Responding to enquiries, resolving disputes, processing complaints, and improving the quality of our support services based on interaction history.
• Platform Improvement: Analysing aggregated, anonymised usage data to identify technical issues, improve game performance, optimise page layouts, and develop new features that better serve our Players in Indonesia and beyond.
• Promotional Communications: Where you have provided consent, sending you personalised offers, bonus alerts, seasonal promotions, and news about new games or betting markets relevant to your interests and play history.

sba999 does not use personal data for automated decision-making that produces legal or similarly significant effects on Players, except where such processing is required by law or where you have given explicit consent. Where automated decisions are made (for example, real-time fraud scoring), you have the right to request human review of any such decision that affects your Account.

7. Data Sharing & Disclosure

7.1 Service Providers and Data Processors

sba999 engages carefully vetted third-party service providers to assist in operating the Platform. These providers act as Data Processors and are contractually bound to process personal data only on sba999's documented instructions and to implement security standards no less rigorous than our own. Categories of service providers include:

• Payment Processors: Banks and e-wallet operators (including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja) who facilitate deposits and withdrawals on the Platform.
• KYC and Identity Verification Providers: Specialist third-party identity verification services that validate government-issued identity documents and perform liveness checks during the KYC process.
• Game Studios: Licensed game providers (including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) who supply game content and related infrastructure. These providers may receive limited technical session data necessary to deliver their games.
• Fraud Prevention and Cybersecurity Vendors: Providers of real-time fraud scoring, IP reputation services, and cybersecurity monitoring tools.
• Cloud Infrastructure Providers: Data storage and server infrastructure providers operating under strict data-processing agreements that include encryption, access controls, and regular security audit obligations.
• Customer Support Platforms: Live chat and ticketing system providers that store support interaction logs on sba999's behalf.

7.2 Legal and Regulatory Disclosure

sba999 may disclose personal data to government authorities, financial intelligence units, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or regulatory directive. Such disclosures are made only to the extent required and, wherever legally permissible, sba999 will notify the affected Player of the disclosure.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a material portion of sba999's business assets, personal data held by the Company may be transferred to the acquiring or successor entity. Players will be notified via email and/or a prominent notice on the Platform prior to such a transfer taking effect, and the successor entity will be bound to honour this Privacy Policy or provide Players with at least equivalent protections.

7.4 Aggregate and Anonymised Data

sba999 may share aggregated, fully anonymised statistical data — from which no individual can be identified — with industry partners, research organisations, and for internal business-performance reporting. Such sharing does not constitute a disclosure of personal data for the purposes of this policy.

8. Data Retention

sba999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods generally apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is technically complex (for example, data held in encrypted backup archives), the data is placed in a restricted access state until it can be securely purged during the next scheduled backup rotation cycle.

9. Security Measures

sba999 implements a layered, defence-in-depth approach to data security, combining technical controls, organisational policies, and ongoing staff training. Key security measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and the sba999 Platform is protected by industry-standard 256-bit SSL/TLS encryption, preventing interception by third parties.
• Data Encryption at Rest: Sensitive data stored on sba999's servers — including identity documents, financial records, and authentication credentials — is encrypted at rest using strong encryption algorithms.
• Access Controls: Access to personal data within sba999's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data undergo background screening and receive mandatory data protection training.
• Two-Factor Authentication (2FA): sba999 offers optional 2FA for Player Accounts and mandates 2FA for all internal administrative access to systems that process personal data.
• Regular Security Audits: The Platform undergoes periodic penetration testing and vulnerability assessments conducted by independent cybersecurity specialists. Critical vulnerabilities are remediated on an emergency basis; medium and low-risk findings are addressed within defined SLA windows.
• Incident Response: sba999 maintains a documented data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected Players and relevant regulatory authorities within the timeframes required by applicable law.

While sba999 takes all reasonable and practicable steps to protect your personal data, no data transmission over the internet or electronic storage system is completely impervious to risk. We strongly encourage Players to use a strong, unique password for their sba999 Account, enable 2FA, and notify us immediately if they suspect any unauthorised access to their Account.

10. Cookies & Tracking Technologies

sba999 uses cookies and similar tracking technologies to operate the Platform efficiently, remember your preferences, maintain your authenticated session, and gather aggregate analytics about Platform usage. The categories of cookies we use are described below.

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as user authentication, session management, and security enforcement. You cannot opt out of strictly necessary cookies while continuing to use the Platform.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, default stake size, and display settings — so that you do not need to reconfigure them on each visit.
• Analytics Cookies: We use anonymised analytics cookies to understand aggregate traffic patterns, page performance, and feature usage across the Platform. This data is used solely for internal improvement purposes and is never shared with third-party advertising networks.
• Security and Fraud-Prevention Cookies: These cookies support our real-time fraud detection systems by helping us identify unusual access patterns, bot traffic, and account takeover attempts.

sba999 does not use third-party behavioural advertising cookies or share cookie data with external advertising platforms. You may manage your cookie preferences through your browser settings at any time; however, disabling strictly necessary or security cookies may impair the functionality and security of your Account.

11. Protection of Minors

sba999 enforces its minimum age requirement through mandatory KYC identity verification on all Accounts before full Platform access and withdrawal privileges are granted. If we become aware — through the KYC process, a third-party report, or any other means — that an Account is held by or has been used by a person under the age of 21, we will immediately suspend the Account, erase all personal data associated with it to the extent legally permissible, and withhold any balance in the Account in accordance with our Terms & Conditions and applicable regulatory requirements.

If you believe that a minor may have accessed sba999, please contact us immediately at [email protected] so that we can take swift protective action.

12. Your Data Rights

Subject to applicable law and regulatory limitations, you have the following rights in respect of your personal data held by sba999. To exercise any of these rights, please submit a written request to [email protected]. We will acknowledge your request within 5 business days and aim to respond fully within 30 calendar days. Complex requests may require up to 60 days; we will inform you if an extension is necessary.

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how and why we process it.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other lawful basis applies, or where processing is unlawful. Note that this right is subject to our legal retention obligations — data we are required to retain by law (such as KYC and financial records) cannot be erased on request until the statutory retention period expires.
• Right to Restrict Processing: You may ask us to suspend the active processing of your personal data in certain circumstances, such as while a rectification request is being resolved or while you contest the lawful basis for processing.
• Right to Data Portability: Where processing is based on your consent or on performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests at any time. You also have an unconditional right to object to the processing of your data for direct marketing purposes, which will result in immediate cessation of such processing.
• Rights Related to Automated Decision-Making: Where sba999 makes automated decisions that significantly affect you, you have the right to request human review of that decision and to contest its outcome.

sba999 will not charge a fee for handling data rights requests unless the request is manifestly unfounded or excessive. In such cases, we reserve the right to charge a reasonable administrative fee or decline to respond, with written reasons provided.

13. International Data Transfers

sba999's primary data infrastructure is hosted in server environments that maintain high standards of data security and regulatory compliance. In operating a global Platform, certain personal data may be transferred to, stored, or processed in jurisdictions outside Indonesia — for example, by cloud infrastructure providers, KYC verification partners, or game-studio technical systems.

Where personal data is transferred internationally, sba999 ensures that appropriate safeguards are in place to provide a level of protection equivalent to that afforded under the applicable data protection framework. These safeguards include contractual data-processing agreements with all third-party recipients, security requirements no less stringent than those described in Section 9 of this policy, and ongoing monitoring of recipient compliance.

By registering an Account and using the sba999 Platform, you acknowledge and consent to the transfer of your personal data as described in this section, subject always to the safeguards outlined above.

14. Amendments to This Policy

sba999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, we will notify registered Players via the email address on their Account and publish a prominent notice on the Platform for a minimum of 14 days before the changes take effect. The "Last Updated" date at the top of this page will be revised accordingly with each update.

We encourage you to review this Privacy Policy periodically to stay informed about how sba999 protects your personal data. Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated policy. If you do not agree with the amended terms, you must cease using the Platform and request Account closure before the effective date.

15. Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way sba999 handles your personal data, please contact our Data Protection team using the details below. All contact details are provided as plain information — please use them to reach us directly.

For urgent security concerns — such as suspected unauthorised access to your Account or a potential data breach — please mark your email subject as "URGENT – Security" and our team will prioritise your case for immediate review.