Privacy Policy

1Introduction

sob99 is committed to protecting the privacy of everyone who uses our platform. We recognise that the personal information you share with us is valuable and deserves to be handled with the utmost care, transparency, and respect. This Privacy Policy has been drafted to give you a clear and comprehensive understanding of our data practices.

sob99 operates as an online betting and gaming platform primarily serving members in Indonesia. As part of delivering our services — including sports betting markets such as bandar bola (football bookmaking), live casino, and slot titles — we necessarily collect and process certain categories of personal data. This policy describes that processing in full.

This policy should be read alongside the sob99 Terms & Conditions, which govern the contractual relationship between you and sob99, and the Responsible Gaming page, which explains the tools available to help you manage your play.

2Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, either on its own or in combination with other information held by sob99.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means sob99, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of sob99, subject to sob99's instructions and this policy.
• "Member" means any individual who has registered and holds an active account on the sob99 platform.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Member's agreement to the processing of their Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification process sob99 conducts to meet its compliance and responsible gaming obligations.

3Data We Collect

sob99 collects personal data across several categories depending on how you interact with the platform. The table below summarises the data categories, specific data points, and the primary reason each is collected:

sob99 does not collect sensitive special-category data such as health records, biometric identifiers beyond identity document photographs, racial or ethnic origin data, political opinions, or religious beliefs.

4How We Collect Data

sob99 collects personal data through the following channels:

• Direct Submission: Information you provide when you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or respond to a survey.
• Automated Collection: Technical data collected automatically when you access the sob99 platform, including IP address, device identifiers, and session data via cookies and server logs. See Section 9 for full details on our cookie practices.
• Third-Party Verification Services: Where sob99 uses licensed identity verification or anti-fraud service providers, those providers may return additional data points to confirm the accuracy of the information you have submitted.
• Payment Processors: When you make a deposit via local bank transfer or e-wallet, our payment processing partners transmit transaction confirmation data — including bank account name, transfer reference, and amount — to sob99 to credit your account balance.
• Game and Sportsbook Providers: Licensed third-party game studios and data feed providers (such as those supplying live sports odds) may share anonymised session data with sob99 for the purpose of settling wagers and detecting irregular activity.

5Purpose & Legal Basis for Processing

sob99 processes your personal data only where a valid legal basis exists. The primary bases and corresponding purposes are as follows:

• Contract Performance: Processing necessary to provide our services to you, including account creation, identity verification, processing deposits and withdrawals in IDR, settling wagers, and managing your account lifecycle. Without this processing, sob99 cannot deliver its services to you.
• Legal Obligation: Processing necessary to comply with applicable legal and regulatory requirements, including anti-money-laundering (AML) obligations, Know Your Customer (KYC) checks, fraud prevention reporting, and the retention of financial records for the periods required by law.
• Legitimate Interests: Processing carried out to pursue sob99's legitimate business interests where those interests are not overridden by your fundamental rights. This includes platform security monitoring, fraud detection, network and information security, responsible gaming analysis, and internal analytics to improve our products and services.
• Consent: Where sob99 sends you optional promotional communications (such as bonus offers, seasonal promotions tied to events like Idul Fitri, Ramadhan, or the BRI Liga 1 season), we do so only on the basis of your opt-in consent. You may withdraw this consent at any time by contacting [email protected] or adjusting your account communication preferences.

6Data Sharing & Disclosure

sob99 does not sell your personal data. We share personal data only in the limited circumstances described below, and only to the extent necessary for each stated purpose:

• Payment Service Providers: Local bank transfer processors and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum payment data required to execute your requested transaction. These providers are contractually bound to process data only for the stated payment purpose.
• Identity Verification Partners: Licensed KYC and AML service providers receive identity document data and supporting information to perform verification checks. These partners operate under strict data processing agreements with sob99.
• Game Technology Providers: Third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive pseudonymised session identifiers to operate game sessions and return results. No directly identifiable personal data such as your legal name or bank details is shared with game providers.
• Legal and Regulatory Disclosure: sob99 will disclose personal data to competent authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or to prevent, detect, or prosecute fraud or financial crime.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of sob99's assets, personal data held by sob99 may be transferred to the successor entity, subject to equivalent privacy protections. Members will be notified of any such transfer in advance where practicable.
• Professional Advisors: sob99 may share limited personal data with legal counsel, auditors, or other professional advisors where required for the conduct of legitimate legal or business advisory services, under confidentiality obligations.

7Data Retention

sob99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Personal data associated with an active sob99 account is retained for the duration of the account's active status plus a minimum period of 5 years following permanent account closure, to meet anti-money-laundering record-keeping requirements.
• Financial Transaction Records: Records of deposits, withdrawals, and wager activity in IDR are retained for a minimum of 5 years from the date of each transaction, consistent with applicable financial record-keeping obligations.
• KYC Documents: Identity documents and verification records are retained for the duration of the account plus 5 years post-closure, or longer where required by a specific legal obligation or ongoing investigation.
• Support Communications: Customer support transcripts and email correspondence are retained for 3 years from the date of the last interaction in a given support case, to facilitate dispute resolution.
• Technical and Log Data: Server access logs, IP logs, and device session data are retained for a maximum of 12 months from the date of collection, unless retention beyond this period is required for a security investigation or legal proceeding.
• Marketing Consent Records: Records of your opt-in consent for marketing communications are retained for the period of your active consent plus 3 years, to demonstrate compliance in the event of a regulatory query.

On expiry of the applicable retention period, sob99 will securely delete or irreversibly anonymise the relevant personal data so that it can no longer be linked to you.

8Security Measures

sob99 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in Transit: All data transmitted between your browser or application and sob99's servers is encrypted using TLS 1.2 or higher. sob99.cam enforces HTTPS across all pages and API endpoints.
• Encryption at Rest: Sensitive personal data — including identity document images, bank account details, and KYC records — is encrypted at rest using AES-256 or equivalent-strength encryption standards.
• Access Controls: Access to systems containing personal data is restricted to authorised sob99 personnel on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication and logged for audit purposes.
• Security Audits: sob99 conducts regular internal security reviews and engages independent third-party security professionals to perform periodic penetration tests and vulnerability assessments of its platform and infrastructure.
• Incident Response: In the event of a personal data breach that is likely to result in a risk to members' rights, sob99 will take immediate containment measures, investigate the root cause, and notify affected members within a reasonable timeframe, including the nature of the breach and recommended protective steps.
• Member Responsibility: You are responsible for maintaining the confidentiality of your sob99 account password and for ensuring that you log out of the platform at the end of each session, particularly on shared or public devices. sob99 will not be liable for losses arising from your failure to keep your credentials secure.

9Cookies & Tracking Technologies

sob99 uses cookies and similar tracking technologies on the sob99.cam website to provide core platform functionality, remember your session state, and gather aggregate analytics data. A cookie is a small text file placed on your device by a website you visit.

sob99 uses the following categories of cookies:

sob99 does not use third-party advertising or retargeting cookies. Analytics data collected via cookies is aggregated and anonymised; it is not linked back to your personal account profile.

You may manage cookie settings through your browser's privacy controls. Please note that disabling essential cookies will impair the functionality of the sob99 platform, including your ability to remain logged in to your account.

10Your Data Rights

sob99 respects your rights in relation to your personal data. The following rights are available to you as a sob99 member, subject to the limitations and conditions set out below:

• Right of Access: You may request a copy of the personal data sob99 holds about you. sob99 will respond to verified access requests within 30 calendar days of receipt. We may ask you to confirm your identity before fulfilling the request.
• Right to Rectification: If you believe that personal data sob99 holds about you is inaccurate or incomplete, you may request that it be corrected. Minor corrections to contact details (such as email address or phone number) can be made by contacting our support team directly.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where you object to processing on legitimate interests grounds and sob99 has no overriding legitimate grounds. Please note that sob99 is required to retain certain data for legal and regulatory compliance purposes (see Section 7), and erasure requests cannot override those retention obligations.
• Right to Restriction: You may request that sob99 restricts the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data while sob99 verifies it, or where you have objected to processing pending sob99's assessment of that objection.
• Right to Data Portability: Where processing is based on your consent or on contract performance, and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case sob99 will assess whether its legitimate interests are overridden by your specific circumstances.
• Withdrawal of Consent: Where sob99 processes your data on the basis of consent (such as for promotional communications), you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11Minors & Age Restriction

The sob99 platform is strictly restricted to individuals who are 21 years of age or older. sob99 does not knowingly collect, store, or process personal data relating to individuals under the age of 21.

• If sob99 discovers, through KYC verification or any other means, that a member is under 21 years of age, sob99 will immediately suspend the account, void any wagers placed, and permanently close the account. Any balance associated with the account will be handled in accordance with applicable legal guidance.
• If you are a parent or guardian and believe that your child has registered an account with sob99, please contact us immediately at the address in Section 14. sob99 will investigate and, where confirmed, close the account and delete the associated personal data promptly.
• sob99 employs age verification technology as part of its KYC process to minimise the risk of underage registration. However, the ultimate responsibility for preventing minors from accessing the platform rests with the adults in the household who control access to devices and accounts.

12International Data Transfers

sob99 serves members based in Indonesia, and our primary data storage infrastructure is operated with Indonesia-serving members in mind. However, some of sob99's third-party service providers — including certain game technology providers and identity verification platforms — may process data on servers located outside Indonesia.

• Where personal data is transferred to a third-party processor located outside Indonesia, sob99 takes appropriate steps to ensure that adequate safeguards are in place, including contractual data processing agreements that impose equivalent data protection obligations on the recipient.
• sob99 will not transfer personal data to a jurisdiction that does not provide an adequate level of data protection without implementing appropriate supplementary safeguards.
• If you would like further information about the specific safeguards sob99 has implemented for any international data transfer, you may submit a request via the contact details in Section 14.

13Changes to This Policy

• sob99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. The date at the top of this page will be updated to reflect the most recent revision.
• For material changes — such as new categories of data being collected, new sharing arrangements, or significant changes to your rights — sob99 will notify active members via the registered email address at least 14 days before the changes take effect.
• Your continued use of the sob99 platform following the effective date of any amendment constitutes your acknowledgement of the revised Privacy Policy. If you do not accept the amended policy, you should cease using the platform and request account closure in accordance with Section 11.3 of the Terms & Conditions.

14Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy concern, please contact the sob99 data protection team using the details below. All privacy-related correspondence is handled confidentially.

When submitting a privacy query or data rights request, please include your registered account email address, the nature of your request, and any relevant reference numbers or dates. sob99 targets an initial response within 5 business days and a substantive response within 30 calendar days of receiving a complete request.