Privacy Policy —
sr699

The following definitions apply throughout this Privacy Policy:

• "sr699", "We", "Us", or "the Operator" means the internationally incorporated entity that owns and operates the online betting and casino platform at https://sr699.cam.
• "You" or "Player" means any individual who registers an account, browses the platform, or interacts with any sr699 service.
• "Personal Data" means any information that identifies or can reasonably be used to identify you as a natural person — including your name, national identity number, contact details, financial account references, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, modification, anonymisation, or deletion.
• "KYC" (Know Your Customer) means the identity and address verification procedures the Operator is obligated to conduct under applicable anti-money-laundering and fraud prevention standards.
• "Third Party" means any natural or legal person other than the Operator and you.
• "Cookie" means a small text file placed on your device by the platform to store session or preference information.
• "Sensitive Data" means a subset of Personal Data requiring heightened protection — specifically, government-issued identity document numbers (KTP Nasional), financial account details, and any data relating to health or judicial records.

sr699 collects Personal Data across the following categories. We collect only what is necessary for the identified purpose and do not retain categories of data beyond their stated use.

sr699 does not intentionally collect Sensitive Data categories beyond those required for KYC (specifically, government ID numbers and document images). We do not collect racial or ethnic origin data, political opinions, religious beliefs, biometric data for identification purposes, or health data except where voluntarily provided in the context of a self-exclusion or responsible gaming request.

Personal Data is collected through the following channels:

• Direct Submission: Information you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated Technical Collection: Data collected automatically when you access the platform — including IP address, device identifiers, browser headers, and session activity — via server logs, cookies, and analytics tools operated by or on behalf of sr699.
• Payment Processor Data: Transaction confirmation data received from banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you complete deposit or withdrawal transactions.
• Identity Verification Partners: Where sr699 uses a third-party KYC service to verify the authenticity of identity documents, that provider may return a verification status and risk score. sr699 does not receive raw biometric data from such providers.
• Fraud Detection Services: Device fingerprint data and behavioural signals from fraud prevention tools used to detect account takeover attempts, multi-accounting, and payment fraud.

Each processing activity at sr699 rests on one or more of the following legal bases:

• Contractual Necessity: Processing required to provide the services you have contracted for — account creation, bet placement, deposit and withdrawal execution, bonus administration, and customer support.
• Legal Obligation: Processing required to comply with applicable legal requirements, including anti-money-laundering (AML) regulations, counter-terrorist financing (CTF) obligations, and record-keeping requirements imposed by the Operator's licensing jurisdiction.
• Legitimate Interests: Processing conducted to pursue the Operator's legitimate business interests where those interests are not overridden by your rights — specifically, fraud prevention, platform security, responsible gaming monitoring, and service improvement through anonymised analytics.
• Consent: Where processing is not covered by the above bases — for example, the use of non-essential cookies or the delivery of promotional communications via email or SMS — we will seek your explicit, informed consent and provide a clear mechanism to withdraw it at any time.

sr699 uses your Personal Data for the following purposes:

1. Account Management: Creating, maintaining, and securing your player account, including password reset flows, session management, and two-factor authentication.
2. Identity Verification: Confirming that you meet the eligibility requirements (21 years of age or older, Indonesian resident) and fulfilling KYC obligations prior to processing withdrawals.
3. Transaction Processing: Executing deposits and withdrawals to and from your nominated payment method across BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.
4. Fraud and Security: Detecting and preventing account takeover, multi-accounting, payment fraud, bonus abuse, match-fixing collusion, money laundering, and other prohibited conduct identified in the Terms & Conditions.
5. Responsible Gaming: Monitoring for behavioural indicators of problem gambling (rapid session increases, large deposit spikes, unusual loss patterns), administering deposit limits and self-exclusion requests, and routing responsible gaming communications to affected players.
6. Customer Support: Resolving account queries, disputes, technical issues, and formal complaints. Support interaction records are retained for audit and quality assurance purposes.
7. Legal Compliance: Retaining transaction and identity records for the periods required by the Operator's licensing jurisdiction and applicable AML/CTF regulations.
8. Service Improvement: Analysing aggregated, anonymised usage data to improve platform performance, identify popular game categories, optimise the deposit and withdrawal flow, and develop new features tailored to Indonesian players.
9. Promotional Communications: Sending you information about promotions, bonuses, and platform updates — but only where you have given explicit consent. You may withdraw consent at any time by contacting support or updating your notification preferences.

sr699 does not sell, rent, or trade your Personal Data. We share data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment Processors: Financial data is shared with your nominated bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your requested transaction. These providers operate under their own privacy policies and data protection obligations.
• KYC / Identity Verification Providers: Identity document images and related data are transmitted to our accredited identity verification partner to confirm authenticity. The provider returns a verification result; it does not retain your document images beyond the verification process.
• Fraud Prevention Services: Device and behavioural signals are shared with fraud detection technology providers to identify and block malicious activity. These providers process data on sr699's behalf under strict data processor agreements.
• Game Content Providers: When you play a game supplied by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), a session token and your anonymised player identifier are passed to that provider to initialise your game session. No financial or identity data is shared with game studios.
• Legal and Regulatory Authorities: sr699 will disclose Personal Data to competent governmental, regulatory, or law enforcement authorities when legally required to do so, or when the Operator has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or a threat to safety.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of the Operator's assets, Personal Data held may be transferred to the successor entity. You will be notified in advance of any such transfer and of any material change to data processing practices that results from it.

All Third Parties with whom sr699 shares Personal Data are required by contract to implement appropriate technical and organisational security measures and to use data only for the authorised purpose.

sr699 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal obligations, whichever is longer. The following standard retention windows apply:

Upon expiry of the applicable retention window, Personal Data is either securely deleted from all active systems or irreversibly anonymised so that it can no longer be associated with you. Anonymised aggregated data used for statistical analysis may be retained indefinitely, as it does not constitute Personal Data.

sr699 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• Transport Encryption: All data in transit between your browser/app and sr699 servers is encrypted using TLS 1.2 or higher, enforced via HTTPS on every page and API endpoint.
• Data at Rest Encryption: Databases containing Personal Data are encrypted using AES-256. Encryption keys are managed separately from the encrypted data and rotated on a regular schedule.
• Access Controls: Access to systems containing Personal Data is restricted on a strict need-to-know basis. All internal access is authenticated using multi-factor credentials and is logged for audit purposes. Access privileges are reviewed quarterly.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. The Operator enforces 2FA for all internal staff accessing production systems.
• Vulnerability Management: The platform undergoes regular penetration testing by independent security researchers and participates in a responsible disclosure programme. Identified vulnerabilities are triaged and remediated according to severity within defined SLA windows.
• Incident Response: sr699 maintains a documented data breach response procedure. In the event of a confirmed breach posing material risk to player rights, affected individuals will be notified without undue delay.

sr699 uses cookies and similar tracking technologies (local storage, session tokens, device fingerprinting signals) to operate the platform, ensure security, and improve the player experience. The following cookie categories are used:

• Strictly Necessary Cookies: Required for core platform functionality — session authentication, CSRF protection, load balancing, and remembering your login state. These cannot be disabled without breaking platform functionality.
• Performance & Analytics Cookies: Used to measure page load performance, identify error rates, and understand aggregate player navigation patterns. Data is collected in anonymised or pseudonymised form and is not used to build individual player profiles for marketing purposes.
• Functionality Cookies: Remember your display preferences, language settings, and responsible gaming notification dismissal states to deliver a consistent experience across sessions.
• Security Cookies: Used by fraud detection systems to recognise your device across sessions and flag anomalous login patterns that may indicate an account takeover attempt.

sr699 does not use third-party advertising cookies or allow external ad networks to place tracking pixels on the platform. You may manage cookie preferences through your browser settings, noting that disabling strictly necessary cookies will impair your ability to log in and use the platform.

Subject to applicable law and to the limitations imposed by the Operator's legal obligations (such as AML record-keeping requirements), you have the following rights with respect to your Personal Data held by sr699:

• Right of Access: You may request a copy of the Personal Data we hold about you and an explanation of how it is used.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you may request that it be corrected. Account details can be updated via your Account settings or by contacting support.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where you successfully object to processing. Note that erasure requests cannot override mandatory AML/CTF retention obligations.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances — for example, while a rectification request is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request a structured, machine-readable export of your Personal Data.
• Right to Object: You may object at any time to processing based on the Operator's legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications, non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact the sr699 support team via live chat or email (see Clause 14). Requests are acknowledged within 72 hours and resolved within 30 calendar days. Where a request is complex or involves large volumes of data, the resolution period may be extended by a further 30 days with prior notification to you.

sr699 is strictly for users aged 21 and above. We do not knowingly collect Personal Data from individuals under 21 years of age. Age verification is a mandatory step in the account registration and KYC processes.

If we become aware that Personal Data has been collected from a person under the age of 21 — whether through a misrepresentation during registration or otherwise — we will immediately suspend the account, investigate the circumstances, and permanently delete all associated Personal Data unless retention is required for legal or investigative purposes. Any balance held in a minor's account will be returned to the source payment method after deducting any bonuses received.

If you believe that a minor may have registered an account on sr699, please contact our support team immediately via live chat or at [email protected].

sr699 operates internationally and your Personal Data may be processed by the Operator or its authorised sub-processors in jurisdictions outside Indonesia. Where such transfers occur, sr699 ensures that appropriate safeguards are in place to protect your Personal Data to a standard at least equivalent to that described in this Privacy Policy.

Safeguards may include:

• Data processing agreements incorporating standard contractual clauses that impose binding data protection obligations on the recipient.
• Transfers only to third-party sub-processors that operate in jurisdictions recognised as providing an adequate level of data protection, or that have implemented equivalent internal data protection standards certified by an internationally recognised framework.
• Where game studios or technical service providers are based in other regions, transfers are limited to the minimum data necessary for service delivery (typically, a pseudonymous session token) and are governed by contractual data protection requirements.

sr699 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform functionality. When material amendments are made — for example, changes to the categories of data collected, the purposes for which it is used, or the third parties with whom it is shared — we will notify registered players by email or via an in-platform notification at least 7 calendar days before the changes take effect.

Minor amendments — such as clarifications to existing language, typographical corrections, or updates to contact details — may be made without advance notice and take effect upon publication. The "Effective Date" at the top of this page will always reflect the date of the most recent version.

Your continued use of sr699 after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised terms, you must cease using the platform and contact support to close your account and arrange return of your Balance.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how sr699 has handled your Personal Data, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the sr699 platform. This is the fastest channel for most queries — median response time is under 5 minutes during WIB business hours.
• Email: [email protected] — include "Privacy Request" or "Data Rights" in the subject line to ensure prompt routing to the appropriate team. Responses are typically issued within 2 hours for general queries and within 72 hours for formal data rights requests.

If you remain dissatisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority or consumer protection body in your jurisdiction.

This Privacy Policy was last reviewed and updated on 1 January 2026. The current version is Version 2.4. Previous versions are available on request by contacting the support team.