Privacy Policy

Who We Are

1.1 sob99 is an internationally licensed online gambling platform operating at sob99.club. sob99 provides sports betting, live casino games, slot games, and related wagering services primarily to adult players in Indonesia. When this Privacy Policy refers to "sob99", "we", "us", or "our", it refers to the sob99 platform and its operating entity.

1.2 sob99 acts as the data controller with respect to the personal data of its registered Members. This means sob99 determines the purposes and means by which your personal data is collected and processed. For specific processing activities carried out by third-party service providers on sob99's behalf (such as payment processors and game studios), those providers act as data processors operating under sob99's instructions and under contractual data-processing agreements that impose equivalent data-protection obligations.

1.3 sob99 is committed to handling your personal data responsibly, transparently, and in accordance with internationally recognised data-protection principles. By creating a Member Account and using the sob99 platform, you acknowledge that you have read and understood this Privacy Policy in full.

Data We Collect

2.1 sob99 collects only the personal data that is necessary to deliver the Services, fulfil legal obligations, prevent fraud, and maintain the security of the platform. The categories of personal data sob99 may collect are set out in the table below.

2.2 sob99 does not intentionally collect sensitive personal data beyond what is strictly required for identity verification and fraud prevention. sob99 does not collect racial or ethnic origin data, political opinions, religious beliefs, biometric data (other than a photo ID selfie used solely for identity matching), or health data, except where voluntarily disclosed by the Member in a support communication.

How We Collect Your Data

3.1 Directly from You. The majority of personal data sob99 holds about you is provided directly by you at the point of registration, during KYC verification, when you make a deposit or withdrawal, when you contact our support team via live chat or email, or when you update your Account settings or responsible gaming preferences.

3.2 Automatically Through Platform Use. When you access and use the sob99 platform — whether on desktop, mobile browser, or any future app — certain technical and usage data is collected automatically via server logs, session tracking systems, and first-party analytics tools. This data is used to maintain platform performance, detect anomalous activity, and improve the player experience.

3.3 From Third-Party Payment Providers. When you initiate a deposit or withdrawal through a supported payment channel (such as BCA, Mandiri, OVO, or GoPay), the relevant financial institution or e-wallet provider communicates transaction confirmation data to sob99, including the transaction reference, amount in IDR, timestamp, and the account identifier on your end. sob99 does not receive your full bank account PIN or e-wallet password at any point.

3.4 From Game Studios and Content Providers. sob99's platform integrates game content from studios including Pragmatic Play, Evolution Gaming, Pocket Games Soft, Microgaming, NetEnt, and Spribe. These studios may pass anonymised game-session data (round ID, wager amount, RNG outcome reference) to sob99 for settlement and auditing purposes. No additional personal data beyond what sob99 already holds is shared by these studios.

3.5 From Fraud Detection and Security Partners. sob99 uses third-party fraud detection services that may analyse technical signals — such as IP address, device fingerprint, and behaviour patterns — to identify suspicious account activity, duplicate registrations, or bot behaviour. These services process data on sob99's behalf under strict contractual data-processing agreements.

Purpose & Legal Basis for Processing

4.1 sob99 processes your personal data only for defined, legitimate purposes. The table below maps each processing activity to its purpose and the legal basis under which it is conducted.

4.2 sob99 will not use your personal data for any purpose that is materially different from those listed above without first notifying you and, where required, obtaining your explicit consent.

Data Sharing & Disclosure

5.1 sob99 does not sell, rent, or trade your personal data to any third party for their own independent marketing or commercial purposes. Personal data is shared externally only where necessary for the delivery of the Services or where required by law, under the following circumstances:

• Payment Processors: Indonesian bank transfer partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to process your deposit or withdrawal transactions.
• KYC and Identity Verification Providers: Third-party identity verification services receive your submitted KYC documents solely for the purpose of verifying your identity and age on sob99's behalf. These providers are contractually prohibited from using your data for any other purpose.
• Game Content Studios: Pragmatic Play, Evolution Gaming, Pocket Games Soft, and other integrated studios receive anonymised session-level data for game settlement, RTP auditing, and jackpot management purposes only.
• Fraud Detection and Security Services: Technical signals (IP address, device fingerprint, session metadata) are shared with fraud prevention partners operating under data-processing agreements for the sole purpose of protecting sob99 Members from account fraud and unauthorised access.
• Legal and Regulatory Authorities: sob99 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by a valid legal order, warrant, or regulatory directive — and only to the extent required by that order.
• Business Transfers: In the event of a merger, acquisition, or transfer of substantially all of sob99's assets, Member personal data may be transferred to the acquiring entity, subject to equivalent data-protection obligations. Members will be notified of any such transfer in advance.

5.2 In all cases where personal data is shared with a third-party processor, sob99 ensures that a written data-processing agreement is in place that obligates the processor to process your data only on sob99's documented instructions, to maintain appropriate security measures, and not to sub-process your data without sob99's prior written authorisation.

Data Retention

6.1 sob99 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following standard retention periods apply:

• Active Account Data (identity, contact, financial data): Retained for the lifetime of the Account and for a period of 5 years after Account closure.
• KYC Documents (government-issued ID, proof of address, selfie): Retained for a minimum of 5 years from the date of verification, in accordance with anti-money-laundering record-keeping obligations.
• Transaction Records (deposit, withdrawal, wagering history in IDR): Retained for a minimum of 7 years from the date of each transaction, consistent with standard financial record-keeping requirements.
• Support Communications (live chat logs, email correspondence): Retained for 3 years from the date of the most recent interaction, to enable dispute resolution and quality assurance.
• Technical and Usage Data (IP logs, session data): Retained for 12 months on a rolling basis, after which they are aggregated and anonymised for analytics purposes.
• Marketing Preferences and Opt-In Records: Retained for the lifetime of the Account plus 3 years to evidence consent and honour opt-out requests.
• Self-Exclusion Records: Retained indefinitely to prevent a self-excluded Member from re-registering under a new Account during the exclusion period.

6.2 At the end of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be linked to any individual Member. Deletion is carried out in accordance with sob99's internal data lifecycle management policy.

6.3 Where sob99 is required by a legal hold (such as an ongoing investigation or litigation) to preserve data beyond its standard retention period, that data will be isolated and access-restricted until the legal hold is lifted, after which normal retention timelines resume.

Security Measures

7.1 sob99 implements a layered, defence-in-depth approach to data security. The following technical and organisational measures are in place to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• 256-Bit SSL/TLS Encryption: All data in transit between your device and sob99's servers is encrypted using 256-bit SSL/TLS. This applies to login sessions, deposit and withdrawal flows, KYC document uploads, and live chat communications.
• Password Hashing: Member account passwords are never stored in plain text. sob99 uses industry-standard one-way cryptographic hashing with salting to store password credentials, ensuring that even in the event of a data breach, raw passwords cannot be recovered.
• Access Controls: Access to Member personal data within sob99's internal systems is restricted on a strict need-to-know basis. All staff access to sensitive data is logged, audited, and subject to role-based access control policies.
• Two-Factor Authentication (2FA): sob99 strongly recommends that Members enable 2FA on their Accounts. 2FA adds a second layer of verification — via a one-time code sent to your registered mobile number — that prevents unauthorised access even if your password is compromised.
• Intrusion Detection Systems: sob99's infrastructure is monitored 24/7 by automated intrusion detection systems that flag and quarantine anomalous access patterns in real time.
• Periodic Security Audits: sob99 engages independent third-party cybersecurity firms to conduct penetration tests and security audits at regular intervals. Findings are acted upon within defined remediation timeframes.
• Data Minimisation: sob99's systems are designed to collect, process, and store only the minimum personal data required for each specific function, reducing the potential impact of any security incident.

7.2 Despite sob99's best efforts, no digital platform can guarantee absolute security. sob99 encourages all Members to use a unique, strong password for their sob99 Account, to enable 2FA, to avoid accessing their Account from shared or public devices, and to contact support immediately at [email protected] if they suspect any unauthorised activity on their Account.

7.3 Data Breach Response. In the event of a personal data breach that poses a risk to Members' rights and freedoms, sob99 will notify affected Members without undue delay and will take immediate remedial action including isolating affected systems, resetting compromised credentials, and engaging forensic security specialists.

Cookies & Tracking Technologies

8.1 sob99 uses first-party cookies and similar session-tracking technologies to operate the platform effectively. The following categories of cookies are in use:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They maintain your login session, preserve your Account settings between page loads, and enable secure transactions. These cookies cannot be disabled without impairing core platform functionality.
• Performance and Analytics Cookies: These cookies collect anonymised data about how Members navigate the platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used solely to improve sob99's platform performance and user experience. No individually identifiable data is included in analytics reports.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and last-visited game category — to personalise your experience across sessions.

8.2 sob99 does not use third-party advertising cookies, cross-site tracking cookies, or any cookie technology that shares your behavioural data with external advertising networks. sob99 does not participate in real-time bidding or programmatic advertising ecosystems that would require sharing Member browsing data.

8.3 Standard browser settings allow you to view, manage, and delete cookies at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use the platform. sob99 recommends consulting your browser's help documentation for guidance on cookie management.

8.4 sob99 may use server-side session tokens in addition to, or in place of, browser cookies for certain security-sensitive functions (such as verifying that a withdrawal request originates from an authenticated session). These tokens are stored server-side and are not accessible via JavaScript, providing enhanced protection against cross-site scripting attacks.

Your Rights Over Your Data

9.1 sob99 respects your rights as a data subject. The following rights are available to all registered Members in connection with the personal data sob99 holds about them:

• Right of Access: You may request a copy of the personal data sob99 holds about you at any time. sob99 will respond to verified access requests within 30 calendar days.
• Right to Rectification: If any personal data sob99 holds about you is inaccurate or incomplete, you have the right to request its correction. You may update many data fields directly from your Account dashboard; for others (such as your legal name or date of birth on your identity document), contact support at [email protected].
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where sob99 no longer needs it for the original purpose, where you withdraw consent (for consent-based processing), or where the data has been unlawfully processed. sob99 will fulfil erasure requests within 30 days, subject to legal retention obligations that require sob99 to retain certain data (see Section 6).
• Right to Restriction: You may request that sob99 restrict processing of your data in certain circumstances — for example, while a dispute over data accuracy is pending, or where you have objected to processing and sob99 is considering that objection.
• Right to Data Portability: You may request that sob99 provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) so that you can transfer it to another service, where technically feasible.
• Right to Object: You may object at any time to processing carried out on the basis of legitimate interest, including profiling for marketing purposes. If you object to marketing communications, sob99 will cease sending them within 5 business days of receiving your request.
• Right to Withdraw Consent: Where sob99 processes your data based on your consent (for example, marketing opt-in), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal can be made via your Account settings or by contacting support.

9.2 To exercise any of the rights listed above, submit a written request to [email protected] with the subject line "Data Rights Request". sob99 may need to verify your identity before processing the request. sob99 will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. Complex or voluminous requests may be extended by a further 30 days, with notification to you.

9.3 sob99 will not charge a fee for handling data rights requests unless the request is manifestly unfounded or excessive (for example, repetitive requests for the same data within a short period), in which case a reasonable administrative fee may be applied.

Minors & Underage Access

10.1 sob99's Services are strictly restricted to adults who are at least 21 years of age. sob99 does not knowingly collect personal data from individuals under the age of 21. The 21+ age threshold is enforced through mandatory KYC verification on all registered Accounts.

10.2 If sob99 becomes aware that personal data has been collected from a person under the age of 21 — whether through a fraudulent registration, a parent or guardian report, or any other means — sob99 will immediately suspend the Account, void any associated transactions, delete the personal data collected, and report the matter to the appropriate authorities where required.

10.3 Parents and guardians who are concerned that a minor may have accessed the sob99 platform should contact [email protected] immediately. sob99 will respond on a priority basis and take all steps necessary to investigate and remediate the situation.

10.4 sob99 recommends that households with minors install parental control software and configure browser-level content filters to block access to online gambling sites. Several reputable parental control tools are available for Android and iOS devices, which are the primary access devices for Indonesian internet users.

Third-Party Services & Links

11.1 The sob99 platform integrates content and services from third-party providers — including game studios, payment gateways, and analytics tools — as described in Sections 3 and 5. While sob99 selects these providers carefully and holds them to contractual data-protection standards, sob99 is not responsible for the independent privacy practices of third-party providers operating their own customer-facing interfaces.

11.2 sob99 does not include links to external websites within its platform content. However, if you navigate away from sob99 via a URL you have entered directly, sob99 has no control over the data-collection practices of any third-party website you visit. sob99 recommends reviewing the privacy policies of any website you visit independently.

11.3 sob99's platform does not embed social media plugins (such as Facebook Like buttons, Twitter share widgets, or WhatsApp chat buttons) that would allow social media platforms to track your activity on sob99 without your knowledge.

International Data Transfers

12.1 sob99 operates as an international platform. Some of the third-party service providers sob99 uses — including cloud infrastructure providers, KYC verification services, and game studios — may process and store personal data on servers located outside Indonesia. Where such international transfers occur, sob99 ensures that appropriate safeguards are in place.

12.2 Appropriate safeguards for international transfers include: (a) contractual data-processing agreements that incorporate internationally recognised standard contractual clauses for cross-border data transfers; (b) transfers to jurisdictions that maintain an internationally recognised adequate level of data protection; and (c) binding corporate rules where data is transferred within a corporate group.

12.3 sob99's primary data infrastructure is located in data centres with ISO 27001 certification for information security management. sob99 evaluates the data-protection standards of all jurisdictions to which Member data may be transferred as part of its vendor assessment process.

12.4 You may request information about the specific international transfers that apply to your personal data, and the safeguards in place, by contacting [email protected] with the subject line "International Transfer Query".

Policy Amendments

13.1 sob99 reserves the right to update this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or platform functionality. When material changes are made, sob99 will notify registered Members by email to the address on file and by displaying a prominent notice on the sob99 platform for a period of at least 14 days prior to the updated Policy taking effect.

13.2 The version of this Privacy Policy bearing the effective date displayed at the top of this page is the version currently in force. Your continued use of the sob99 platform following the effective date of any updated Policy constitutes your acceptance of the changes. If you do not accept the updated Policy, you must cease using the platform and request Account closure via support.

13.3 Previous versions of this Privacy Policy are available on request by contacting [email protected] with the subject line "Previous Privacy Policy Version". sob99 maintains a version history of all prior Policies for a minimum of 5 years.

Contact & Data Protection Officer

14.1 If you have any questions about this Privacy Policy, wish to exercise a data subject right, or wish to raise a concern about sob99's data-handling practices, please contact the sob99 data protection team through the following channels:

• Email: [email protected] — for data rights requests, use the subject line "Data Rights Request". Monitored 08:00–22:00 WIB daily; responses within 5 business days for privacy enquiries.
• Live Chat: Available 24/7 (00:00–24:00 WIB) via the sob99 platform. For privacy-related queries that do not require detailed written documentation, live chat is the fastest channel. The live chat team will escalate formal data rights requests to the appropriate internal team.

14.2 sob99 has designated an internal Data Protection Officer (DPO ) responsible for overseeing compliance with this Privacy Policy and applicable data-protection standards. The DPO can be reached via the email address above with the subject line "Attention: Data Protection Officer".

14.3 sob99 is committed to resolving all privacy complaints internally in a fair, timely, and transparent manner. If you are not satisfied with sob99's response to your complaint, you retain the right to escalate the matter to the relevant data-protection supervisory authority in the jurisdiction under whose laws your complaint falls.

14.4 sob99 will never charge you a fee for submitting a privacy complaint or for exercising your data subject rights, as described in Section 9. sob99's support team is available in English and with native Indonesian-speaking agents to assist Members across Jakarta, Surabaya, Bali, Medan, Bandung, Yogyakarta, and all other regions of Indonesia.