sob999 Privacy
Policy

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, date of birth, email address, bank account details, device identifiers, and IP address.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means sob999, as the entity that determines the purposes and means of processing personal data collected through the sob999 platform.
• "Data Processor" means any third party that processes personal data on sob999's behalf under a data processing agreement, such as KYC verification providers and payment processors.
• "Player" / "User" / "you" means any individual who registers an account on, or interacts with, the sob999 platform.
• "Cookies" means small text files stored on a player's device by the sob999 platform for functional, analytical, and session management purposes.
• "KYC" means Know Your Customer — the identity and age verification process sob999 applies to all registered accounts.

sob999 collects the following categories of personal data in the course of operating the platform and delivering its services to Indonesian players:

sob999 does not collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond the photograph embedded in a standard government-issued identity document submitted for KYC purposes.

sob999 collects personal data through the following channels:

• Direct Submission: Information you provide when registering an account, completing your profile, submitting KYC documents, initiating a deposit or withdrawal, or contacting our support team via live chat or email.
• Automated Technical Collection: Data collected automatically when you access and navigate the sob999 platform, including IP address, device identifiers, browser attributes, and session activity logs generated by our web servers and analytics infrastructure.
• Cookies and Similar Technologies: First-party cookies and session storage mechanisms used to maintain your logged-in state, remember preferences, and gather aggregated usage statistics. See Section 7 for full details.
• Third-Party Verification Providers: Identity and age verification data returned to sob999 by our licensed KYC partners following document checks. sob999 does not receive raw verification data beyond what is necessary to confirm a player's identity and eligibility.
• Payment Processors: Transaction confirmation data provided by local bank transfer networks and e-wallet operators (OVO, DANA, GoPay, ShopeePay) to confirm successful deposit and withdrawal processing. sob999 does not receive or store full bank account numbers beyond the last four digits required for transaction reconciliation.

sob999 processes personal data on one or more of the following legal grounds, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing required to enter into or perform the contract with you — specifically, operating your sob999 account, processing deposits and withdrawals, settling bets and game rounds, and delivering customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money-laundering (AML) requirements, counter-terrorism financing (CTF) obligations, and the record-keeping requirements of sob999's international gaming licence.
• Legitimate Interests: Processing carried out in pursuit of sob999's legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your rights and interests.
• Consent: Where sob999 relies on your consent as the legal basis for processing — for example, sending promotional communications — you may withdraw that consent at any time by contacting [email protected] or updating your communication preferences in the account dashboard. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

sob999 uses the personal data it collects for the following specific purposes:

• Account Management: Creating, maintaining, and securing your sob999 account; authenticating your identity at login; managing account settings and preferences.
• KYC & Age Verification: Verifying that you are at least 21 years of age and a resident of Indonesia before processing withdrawal requests, in accordance with sob999's responsible gaming obligations and licensing requirements.
• Transaction Processing: Processing deposits from and withdrawals to your registered BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP bank accounts or OVO, DANA, GoPay, and ShopeePay e-wallets; maintaining accurate financial records of all account activity.
• Fraud Prevention & Security: Monitoring account activity for signs of fraudulent behaviour, money laundering, collusion, or terms violations; investigating suspicious activity; cooperating with law enforcement or regulatory authorities where required.
• Responsible Gaming: Monitoring player behaviour patterns to identify potential problem gambling indicators; administering self-exclusion, deposit limit, and cooling-off requests; ensuring compliance with sob999's responsible gaming programme.
• Customer Support: Responding to enquiries, resolving disputes, and providing assistance through sob999's live chat and email support channels — including the availability of native Indonesian-speaking agents.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how players interact with sob999's sportsbook, sob999 Casino, slots, Capsa Susun, and Sakong products in order to improve platform performance and user experience.
• Promotional Communications: Sending you information about sob999 promotions, bonus offers, and upcoming sporting events — including BRI Liga 1 fixtures, UEFA Champions League matches, and Indonesian holiday promotions — where you have consented to receive such communications.
• Legal Compliance: Retaining records as required by sob999's international gaming licence, AML/CTF obligations, and any applicable data protection regulations.

sob999 does not sell, rent, or trade personal data. Data is shared with external parties only in the limited circumstances described below, and in each case only to the extent necessary to fulfil the relevant purpose:

• KYC Verification Partners: Licensed third-party identity verification providers who process identity documents and return a verification outcome to sob999. These providers operate under data processing agreements that restrict their use of player data to the verification service only.
• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay, ShopeePay) receive the minimum transaction data necessary to process deposit and withdrawal instructions.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised session identifiers to facilitate game round delivery and RNG certification. These providers do not receive personally identifiable information.
• Regulatory & Law Enforcement Authorities: sob999 will disclose personal data to competent authorities where required to do so by applicable law, court order, or the directives of sob999's licensing jurisdiction's regulatory body.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged by sob999 may access personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.

sob999 uses first-party cookies and browser session storage to operate the platform effectively. We do not use third-party advertising cookies or cross-site tracking technologies. The cookies sob999 sets fall into the following categories:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens that keep you logged in during an active session, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your preferences — such as your preferred language display or last-visited game lobby — to improve your experience across sessions. These can be disabled via your browser settings, though some features may be affected.
• Analytical Cookies: Aggregated, anonymised data about how players navigate the sob999 platform, used solely to improve platform design and performance. sob999 uses first-party analytics only — no data is sent to third-party analytics services.

You can manage or delete cookies through your browser's settings. Clearing session cookies will log you out of your sob999 account. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

sob999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including any retention periods required by sob999's international gaming licence, AML/CTF obligations, or other applicable legal requirements. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of the account relationship and for a period of five years following account closure.
• Transaction Records: Financial transaction records — including deposit and withdrawal history — are retained for a minimum of five years following each transaction date, in compliance with standard AML record-keeping requirements.
• KYC Documents: Identity verification documents are retained for five years following the date of verification or account closure, whichever is later.
• Support Communications: Live chat transcripts and email correspondence are retained for three years from the date of the interaction.
• Technical Logs: Server access logs and security event logs are retained for 12 months on a rolling basis.

When personal data is no longer required and no legal retention obligation applies, sob999 securely destroys or anonymises it so that it can no longer be attributed to an individual player.

sob999 respects your rights over your personal data. Depending on the applicable data protection framework, you may have the right to:

• Access: Request a copy of the personal data sob999 holds about you, including information on how it is being used and with whom it has been shared.
• Rectification: Request correction of any inaccurate or incomplete personal data held in your sob999 account or our internal records.
• Erasure: Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to sob999's legal retention obligations. Please note that sob999 may be required to retain certain data even after account closure to comply with AML/CTF regulations.
• Restriction of Processing: Request that sob999 restrict the processing of your data in certain circumstances — for example, while a rectification request is being assessed.
• Data Portability: Request a copy of the personal data you provided to sob999 in a structured, commonly used, machine-readable format.
• Objection: Object to processing carried out on the basis of sob999's legitimate interests where you believe your rights and interests override those interests.
• Withdrawal of Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request". sob999 will acknowledge your request within five business days and provide a substantive response within 30 calendar days. Requests may require identity verification before sob999 can act on them.

sob999 is strictly an adults-only platform. Access is restricted to persons aged 21 years and over. sob999 does not knowingly collect personal data from individuals under the age of 21. Age verification is applied during both the registration process and the KYC verification stage.

If sob999 becomes aware that personal data has been submitted by or on behalf of a person under 21, the associated account will be immediately closed, all funds will be returned to the originating payment method to the extent practicable, and all personal data collected in connection with that account will be securely deleted without undue delay.

If you have reason to believe that a person under 21 has registered a sob999 account, please notify us immediately at [email protected] so that we can investigate and take appropriate action.

sob999 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures in place include:

• Transport Security: All data transmitted between players' devices and sob999's servers is encrypted using TLS 1.2 or higher. The sob999 platform enforces HTTPS exclusively — unencrypted HTTP connections are redirected automatically.
• Access Controls: Internal access to personal data is governed by a role-based access control (RBAC) model. Employees and contractors can only access the data required for their specific job function. Access privileges are reviewed quarterly.
• Password Security: Player passwords are stored using a one-way cryptographic hashing algorithm with a unique per-account salt. Plaintext passwords are never stored or transmitted by sob999.
• Monitoring & Anomaly Detection: sob999's infrastructure is monitored 24/7 for anomalous access patterns, failed authentication attempts, and other indicators of compromise. Automated alerts trigger immediate investigation protocols.
• Incident Response: sob999 maintains a documented data breach response procedure. In the event of a breach that poses a risk to players' rights and freedoms, affected players and the relevant supervisory authority will be notified within 72 hours of sob999 becoming aware of the incident.
• Vendor Due Diligence: Third-party data processors (KYC providers, payment processors) are assessed for security compliance before engagement and are contractually required to maintain appropriate technical and organisational security measures.

sob999 is an internationally operated platform. In the course of delivering its services to Indonesian players, personal data may be transferred to and processed in countries outside Indonesia — specifically in the jurisdiction where sob999 holds its international gaming licence and where certain infrastructure and support functions are hosted.

Where personal data is transferred internationally, sob999 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections that would apply in the origin jurisdiction. These safeguards may include:

• Standard contractual clauses incorporated into data processing agreements with recipients in third countries.
• Transfers to jurisdictions that maintain data protection frameworks recognised as providing an adequate level of protection.
• Binding corporate policies where data is shared within a group of companies operating under a unified data governance framework.

Players who wish to obtain further information about the international transfer safeguards sob999 has in place may contact [email protected].

sob999 may update this Privacy Policy from time to time to reflect changes in our data practices, service offerings, or applicable legal requirements. The effective date at the top of this page indicates when the current version entered into force.

Material changes — those that significantly affect how we collect, use, or share your personal data — will be communicated to registered players via email to the address on file, or via a prominent notice on the sob999 platform, at least 14 days before the updated policy takes effect. Your continued use of sob999 following the effective date of a material change constitutes acceptance of the updated Privacy Policy.

For non-material updates (such as corrections to formatting or minor clarifications that do not alter the substance of our data practices), sob999 reserves the right to update the policy without advance notice, though the effective date will always reflect the most recent revision.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way sob999 handles your personal data, please contact our Data Protection team using the details below. sob999 is committed to addressing all privacy-related enquiries promptly and transparently.

• Email: [email protected] (plain text only — not a clickable link; copy and paste into your email client)
• Subject Line for Privacy Enquiries: "Privacy Policy Enquiry" or "Data Rights Request" as appropriate
• Response Time: sob999 acknowledges all privacy enquiries within five business days and aims to provide a full response within 30 calendar days. Complex requests involving large volumes of data may require an extension, of which the player will be notified.
• Support Hours: 24/7 via live chat on the sob999 platform; email responses during standard business hours (WIB, UTC+7). Native Indonesian-speaking agents are available to assist players who prefer to communicate in their first language.