Your Privacy at s99sl

s99sl ("we", "us", "our") operates the online gambling platform accessible at https://s99sl.net (the "Platform"). This Privacy Policy describes how s99sl collects, uses, discloses, stores, and protects the personal data of individuals who register accounts, visit the Platform, or otherwise interact with our services (collectively, "Members" or "you").

s99sl is committed to handling your personal data with transparency, integrity, and respect. This policy has been drafted in accordance with internationally recognised data-protection principles and reflects the specific context of operating a licensed online gaming platform serving Indonesian players.

This Privacy Policy should be read alongside s99sl's Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a data-related matter, this Privacy Policy prevails.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or indirectly, including but not limited to a name, identification number, location data, online identifier, or factors specific to the physical, economic, or social identity of that individual.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Controller" means s99sl, the entity that determines the purposes and means of the processing of Personal Data.
• "Processor" means a third-party service provider that processes Personal Data on behalf of s99sl under a contractual data-processing agreement.
• "Member" means any individual who has registered a real-money or play-money account on the s99sl Platform.
• "Visitor" means any individual who browses the s99sl website without completing account registration.
• "KYC Data" means identity verification documents submitted by a Member in fulfilment of s99sl's Know Your Customer programme, including government-issued identity cards, passports, and proof-of-address documents.
• "Cookie" means a small text file placed on your device by the Platform for the purposes described in Section 8 of this policy.

s99sl collects Personal Data across several categories, depending on the nature of your interaction with the Platform. The table below summarises the categories of data collected and their primary sources:

s99sl does not intentionally collect special-category data (such as health data, political opinions, or biometric data beyond the liveness photograph required for KYC verification). If special-category data is inadvertently submitted through a support channel, it will be deleted promptly once identified, unless retention is required by law.

s99sl collects your Personal Data through the following channels and mechanisms:

• Direct submission: Information you provide actively when creating an account, completing KYC verification, making a deposit or withdrawal, submitting a support request, or updating your account profile.
• Automated technical collection: Data collected automatically as you interact with the Platform, including your IP address, device identifiers, session timestamps, and browsing behaviour within the site. This data is collected via server-side logs and client-side cookies (see Section 8).
• Payment processors: When you initiate a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or an e-wallet service (OVO, DANA, GoPay, ShopeePay, LinkAja), the relevant payment processor shares transaction confirmation data with s99sl sufficient to credit or debit your account accurately.
• Identity verification partners: Where s99sl uses a third-party KYC service provider to cross-check the documents you submit, that provider may return a verified/unverified status flag and associated data points to s99sl. The documents themselves remain under s99sl's direct control.
• Fraud and security systems: Anti-fraud and security monitoring tools may collect behavioural signals (e.g., mouse movement patterns, keystroke timing, device fingerprint attributes) to distinguish legitimate member activity from automated or fraudulent access attempts.

s99sl processes your Personal Data for the following specific purposes:

1. Account creation and management: To register your account, verify your identity, maintain accurate account records, and enable you to log in, manage settings, and access the Platform's features.
2. Identity and age verification (KYC): To confirm that you are a real person, that you are at least 21 years of age, and that your submitted identity documents are genuine. This is a mandatory responsible gaming and anti-fraud obligation. 21+ Only
3. Transaction processing: To execute your deposit and withdrawal requests accurately, reconcile your IDR balance, generate transaction receipts, and maintain an auditable financial record of your account activity.
4. Game delivery and integrity: To operate the Platform's casino, sportsbook, slots, and card game products; to log game results for dispute resolution; and to ensure the integrity of random-number-generator outcomes.
5. Customer support: To respond to your enquiries, investigate complaints, resolve disputes over game outcomes or transaction discrepancies, and maintain a record of support interactions for quality assurance.
6. Responsible gaming: To monitor your gaming behaviour for indicators of problem gambling; to apply any self-exclusion, deposit limit, or session-time-limit settings you have activated; and to fulfil our obligations under our responsible gaming policy.
7. Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and unauthorised account access.
8. Legal and regulatory compliance: To meet applicable record-keeping, identity verification, and reporting obligations under the laws and regulations of the jurisdiction in which s99sl is licensed and incorporated.
9. Marketing communications (opt-in only): To send you promotional emails, bonus notifications, and personalised game recommendations where you have given your explicit consent to receive marketing communications. You may withdraw this consent at any time.
10. Platform improvement and analytics: To analyse aggregate usage patterns, identify technical issues, optimise the user experience, and plan new platform features. Analytics processing uses pseudonymised or aggregated data wherever possible.

s99sl does not process your Personal Data for any purpose that is incompatible with the purposes listed above without first seeking your consent or otherwise establishing a valid legal basis for that additional processing.

For each processing activity, s99sl relies on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and s99sl — i.e., to operate your account, credit your deposits, process your withdrawals, and deliver the gaming products you have chosen to use. Without this processing, s99sl cannot provide its services to you.
• Compliance with legal obligations: Processing required to comply with applicable laws and regulations, including anti-money-laundering (AML) obligations, age-verification mandates, and responsible gaming requirements imposed by s99sl's licensing jurisdiction.
• Legitimate interests: Processing necessary for s99sl's legitimate interests, provided those interests are not overridden by your fundamental rights. Legitimate interests include fraud prevention, network and information security, improving Platform quality, and protecting s99sl's intellectual property. s99sl has conducted a Legitimate Interests Assessment (LIA) for each processing activity in this category.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — principally for marketing communications and for the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing that took place before the withdrawal.

s99sl shares your Personal Data only in the circumstances described below. In all cases, data recipients are required to handle your data with the same level of care and security that s99sl applies internally.

• KYC and identity verification partners: Third-party verification services used to cross-check government-issued identity documents (e.g., KTP, passport). These providers act as Processors under a formal data-processing agreement and are prohibited from using your data for their own purposes.
• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to execute your deposit or withdrawal instruction. s99sl does not pass full account details to payment processors — only transaction-specific routing information.
• Fraud prevention and security services: Anti-fraud platforms that help s99sl identify suspicious activity, multi-accounting patterns, or automated bot access. These services process Technical and Usage Data on s99sl's behalf.
• Cloud infrastructure and hosting providers: The servers and infrastructure on which the Platform is hosted and on which your data is stored. These providers operate under strict data-processing agreements and are not permitted to access Member data for their own purposes.
• Customer support tooling: Helpdesk and live-chat software providers used to manage support ticket workflows. Support data shared with these providers is limited to the content of your support interactions and the account identifiers necessary to locate your account.
• Legal and regulatory authorities: Where s99sl is required by a court order, regulatory directive, or applicable law to disclose Member data to a government body or law enforcement authority, s99sl will comply with such requirements. Where legally permitted to do so, s99sl will notify you of such disclosure requests.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of s99sl's assets, Member data may be transferred to the acquiring entity. You will be notified in advance and given the opportunity to close your account before the transfer takes effect if you do not wish your data to be included.

s99sl uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device that allows the Platform to recognise your browser across sessions and deliver a consistent, personalised experience.

The cookies s99sl uses fall into the following categories:

• Strictly necessary cookies: Required for the Platform to function correctly. They enable core capabilities such as maintaining your login session, remembering your preferred language, and securing your account from cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without rendering the Platform non-functional.
• Performance and analytics cookies: Used to understand how Members interact with the Platform — which pages are visited most, where users encounter errors, and how sessions flow through the site. This data is collected in aggregated, pseudonymised form. These cookies are optional and require your consent.
• Functionality cookies: Enable the Platform to remember your preferences (e.g., game lobby view settings, betting interface layout) to deliver a more personalised experience. Optional and require consent.
• Security and fraud-detection cookies: Used by s99sl's anti-fraud systems to detect and prevent automated attacks, credential-stuffing attempts, and suspicious session behaviour. These are treated as necessary for security purposes.

You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform's core functionality but may degrade certain personalisation features. Note that blocking strictly necessary cookies may prevent you from logging in or completing transactions.

s99sl does not use cross-site tracking cookies to build advertising profiles about you or to share your browsing activity with third-party ad networks.

s99sl retains your Personal Data for as long as is necessary to fulfil the purposes described in this Privacy Policy, subject to the following retention guidelines:

• Active accounts: All Personal Data associated with an active Member account is retained for the duration of the account's active status plus a minimum post-closure retention period as described below.
• Closed accounts — standard: Following account closure at the Member's request, core identity, financial, and transaction data is retained for a minimum of 5 years to comply with anti-money-laundering record-keeping requirements and to support any future dispute resolution or legal proceedings.
• Closed accounts — fraud or abuse cases: Where an account was closed due to confirmed fraud, bonus abuse, or violations of the Terms & Conditions, relevant records are retained for up to 10 years to prevent re-registration and to support potential legal action.
• KYC documents: Identity verification documents are retained for the minimum period required by the applicable AML regulations in s99sl's licensing jurisdiction, typically 5 years from the date of the last transaction or account closure, whichever is later.
• Support communications: Support ticket records and live-chat transcripts are retained for 3 years from the date of the interaction for quality assurance and dispute-resolution purposes.
• Marketing data: Marketing preference records and consent logs are retained for the duration of your account plus 2 years post-closure. If you have opted out of marketing, the opt-out record itself is retained indefinitely to ensure we do not re-contact you.
• Technical and usage logs: Server logs and analytics data are retained in identifiable form for a maximum of 13 months, after which they are aggregated and anonymised. Anonymised data may be retained indefinitely for trend analysis.

At the end of each applicable retention period, s99sl will securely delete or irreversibly anonymise your Personal Data using methods appropriate to the sensitivity of the data involved.

As a Member of s99sl, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact us at support@s99sl.net with the subject line "Data Rights Request". We will acknowledge your request within 2 business days (WIB) and aim to resolve it within 30 calendar days.

• Right of access: You may request a copy of all Personal Data that s99sl holds about you, along with information about how it is processed, the legal basis for processing, and any third parties with whom it has been shared.
• Right to rectification: If any Personal Data held by s99sl is inaccurate or incomplete, you may request that it be corrected. Note that corrections to identity data may require submission of updated KYC documentation.
• Right to erasure ("right to be forgotten"): You may request that s99sl delete your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to legitimate-interests processing and s99sl has no overriding grounds to continue. This right is subject to s99sl's legal retention obligations — some data must be retained regardless of an erasure request.
• Right to restriction of processing: You may request that s99sl restrict the processing of your data in certain circumstances — for example, while a rectification request is being verified, or while an objection is being assessed.
• Right to data portability: For data processed on the basis of contract or consent, and processed by automated means, you may request that s99sl provide your data in a structured, commonly used, machine-readable format for transfer to another service provider.
• Right to object: You may object at any time to the processing of your Personal Data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case s99sl must demonstrate compelling legitimate grounds that override your rights.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

s99sl implements a multi-layered security programme designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security measures include, but are not limited to:

• Encryption in transit: All data transmitted between your browser or mobile device and the s99sl Platform is encrypted using TLS 1.2 or higher with 256-bit AES encryption. Our SSL certificate is renewed and audited regularly.
• Encryption at rest: Sensitive data categories — including identity documents, payment method details, and password hashes — are encrypted at rest using AES-256 on secured database infrastructure.
• Access controls: Access to Member Personal Data within s99sl's internal systems is governed by role-based access controls (RBAC). Only staff with a legitimate operational need can access identifiable Member data, and all access events are logged and audited.
• Password security: Member passwords are stored as salted cryptographic hashes. s99sl staff cannot view your plaintext password. If you forget your password, it must be reset rather than recovered.
• Infrastructure security: s99sl's servers are hosted in data centres with physical access controls, 24/7 monitoring, redundant network connectivity, and regular third-party penetration testing.
• Incident response: s99sl maintains a documented data-breach response procedure. In the event of a security incident that poses a risk to Member data, affected Members will be notified promptly with details of the incident, the data affected, and the remedial actions taken.

While s99sl takes all reasonable technical and organisational measures to protect your data, no online platform can guarantee absolute security against all possible threats. You are also responsible for keeping your login credentials secure and for notifying s99sl immediately if you suspect unauthorised access to your account.

The s99sl Platform is strictly for use by adults aged 21 years and over. s99sl does not knowingly collect, process, or store Personal Data relating to individuals under the age of 21. 21+ Only

Age verification checks are conducted at registration and at the point of first withdrawal. If s99sl discovers that Personal Data belonging to a person under 21 has been collected — whether through misrepresentation during registration or any other means — the following steps will be taken immediately:

• The relevant account will be suspended pending investigation.
• Any real-money balance will be held pending return of the original deposit amount (net of any bonus funds) to the originating payment account, subject to verification.
• The Personal Data of the underage individual will be securely deleted from s99sl's systems once the account closure process is complete, except where retention is required for legal compliance.

If you have reason to believe that a person under 21 has registered an account on s99sl, please report this immediately to support@s99sl.net. s99sl will investigate the report and take appropriate action within 24 hours of receipt.

s99sl reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or Platform features. When material changes are made, we will:

• Post a notice on the Platform homepage and the Privacy Policy page for a minimum of 30 days before the revised policy takes effect.
• Where practicable, send an email notification to all active Members at their registered email address summarising the key changes.
• Update the "Last Updated" date at the top of this page.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the Platform and request account closure before the effective date. s99sl will return any remaining balance to your verified payment account in accordance with the standard withdrawal process.

Previous versions of the Privacy Policy are archived and available upon request by contacting support@s99sl.net.

For all privacy-related enquiries, data rights requests, security reports, or complaints regarding s99sl's data-handling practices, please contact our Data Support team using the details below:

• Email: support@s99sl.net — use the subject line "Privacy Enquiry" or "Data Rights Request" for fastest routing.
• Response time: Standard privacy enquiries are acknowledged within 2 business days (WIB) and resolved within 30 calendar days. Complex data rights requests may require up to 60 days where permitted by applicable law.
• Support hours: 24 hours a day, 7 days a week, including all Indonesian national public holidays. Native Indonesian-speaking agents are available around the clock.