Privacy Policy

1. Definitions

The following definitions apply throughout this Privacy Policy. Terms not defined here carry the same meaning as assigned in rp99's Terms & Conditions.

• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, including but not limited to name, date of birth, national ID number, contact details, financial account information, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, transmission, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data; in this context, rp99.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller (e.g., payment processors, game providers, analytics vendors).
• "Platform" — the rp99 website at https://rp99.world, its mobile-optimized site, and any associated applications.
• "User" / "you" / "your" — any individual who accesses, registers on, or otherwise interacts with the Platform.
• "Cookies" — small text files placed on your device by the Platform to store session and preference information.
• "KYC" — Know Your Customer; the identity verification process required for account compliance.

2. Data Controller

rp99 is the Data Controller responsible for the Personal Data collected through the Platform. As Data Controller, rp99 determines the purposes for which your data is used and is accountable for ensuring that Processing activities comply with applicable data protection principles, including purpose limitation, data minimization, accuracy, storage limitation, and integrity.

For all data protection enquiries, requests, or complaints, you may contact us directly at the address provided in Section 16 of this Policy. We will acknowledge your request within 5 business days and endeavor to provide a substantive response within 30 calendar days, consistent with applicable regulatory timeframes.

3. Data We Collect

rp99 collects the minimum amount of Personal Data necessary to deliver our services safely, fairly, and in compliance with our legal obligations. The categories of data we collect are described below.

3.1 Registration & Account Data

• Full legal name (as it appears on your government-issued ID)
• Date of birth (for age verification — you must be 21 or older)
• Email address and mobile phone number
• Residential address (street, city, province, postal code)
• Username and encrypted password hash
• Preferred language and communication preferences

3.2 Identity Verification (KYC) Data

• Government-issued photo ID (KTP, passport, or SIM driving license)
• Proof of address documentation (utility bills, bank statements)
• Proof of payment method ownership (bank card image or e-wallet screenshot)
• Selfie or liveness-check image where explicitly requested for account verification
• Indonesian National Identity Number (NIK) where disclosed on submitted documents

3.3 Financial & Transaction Data

• Deposit amounts, methods, and timestamps
• Withdrawal amounts, methods, and processing status
• Bank account names and numbers (partial masking applied for display purposes)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) registered in your name
• Bonus claims, wagering activity, and promotional participation records
• Running account balance and transaction history

3.4 Gaming Activity Data

• Bet placement history including stake amounts, odds, and outcomes
• Casino game session data including duration, game titles, and results
• Sports betting market preferences and in-play activity
• Responsible gaming tool settings (deposit limits, session timers, self-exclusion status)

3.5 Technical & Device Data

• IP address and geolocation data (city/region level)
• Device type, operating system, and browser version
• Session login and logout timestamps
• Cookie identifiers and session tokens
• Platform interaction logs (pages visited, features used, error reports)

3.6 Communications Data

• Customer support chat and email correspondence records
• Complaint and dispute records
• Marketing communication preferences and opt-in/opt-out history
• Survey or feedback responses where voluntarily provided

4. How We Collect Data

4.1 Directly from You

The majority of your Personal Data is collected directly from you when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, respond to a survey, or otherwise interact with Platform features. You are under no obligation to provide Personal Data, but certain data is required to deliver core services such as account creation and payment processing.

4.2 Automatically via Technology

When you visit the Platform, our servers and third-party analytics tools automatically collect technical data including your IP address, device characteristics, session duration, and interaction logs. This data is collected through server logs, cookies, web beacons, and similar tracking technologies described further in Section 8.

4.3 From Third Parties

In limited circumstances, rp99 may receive Personal Data from third-party sources to supplement your account record, including:

• Identity verification providers used to validate KYC documents
• Payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and others) confirming transaction status and account ownership
• Fraud detection and anti-money-laundering screening services
• Responsible gaming databases to screen for active self-exclusion registrations

5. Legal Basis for Processing

rp99 processes your Personal Data only where a valid legal basis exists. The following table summarizes the primary legal bases applied to the main Processing activities on the Platform:

Processing Activity	Legal Basis
Account creation and management	Performance of contract with the User
Processing deposits and withdrawals	Performance of contract; compliance with payment regulations
KYC identity verification	Legal obligation (anti-money laundering compliance)
Age verification (21+ requirement)	Legal obligation; protection of vulnerable persons
Fraud prevention and security monitoring	Legitimate interest of rp99; legal obligation
Responsible gaming monitoring	Legal obligation; legitimate interest
Customer support correspondence	Performance of contract; legitimate interest
Sending promotional communications	Consent (opt-in); may be withdrawn at any time
Platform analytics and improvement	Legitimate interest of rp99
Compliance with regulatory requests	Legal obligation

6. How We Use Your Data

rp99 uses your Personal Data for the following purposes. We do not use your data for purposes incompatible with those described here without obtaining your fresh consent or identifying a new legal basis.

6.1 Service Delivery

• Creating and managing your Account on the rp99 Platform
• Processing deposits and withdrawals through your chosen Indonesian payment method
• Crediting bonuses and tracking wagering requirement progress
• Providing access to sports betting markets, live casino, and slot game content
• Delivering customer support and resolving disputes or complaints

6.2 Compliance & Risk Management

• Verifying your identity and age (21+) as required under our operating obligations
• Screening transactions for money laundering, fraud, and terrorist financing indicators
• Monitoring gaming patterns to identify problem gambling behaviors and trigger responsible gaming interventions where appropriate
• Maintaining audit records and responding to lawful regulatory or law enforcement requests

6.3 Platform Improvement

• Analyzing aggregated usage data to improve Platform performance, navigation, and features
• Conducting A/B testing to evaluate new interface designs and betting market presentations
• Diagnosing technical errors and optimizing server response times for Users in Jakarta, Surabaya, Bandung, Medan, and other cities across Indonesia

6.4 Marketing Communications

Where you have given explicit consent, rp99 may send you promotional emails or in-platform notifications about new games, bonus offers, seasonal promotions (such as those tied to Idul Fitri, Ramadhan, or Indonesian Independence Day), and sports betting highlights (including BRI Liga 1 match previews and international tournaments). You may withdraw consent at any time by updating your communication preferences within Account Settings or by contacting our support team.

7. Data Sharing & Disclosure

rp99 does not sell your Personal Data to third parties for their own marketing purposes. We share data only in the circumstances described below, and only to the extent necessary for the stated purpose.

7.1 Service Providers (Data Processors)

We engage trusted third-party Data Processors who act under our instruction and are contractually bound to protect your data. These include:

• Payment processors — BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja, for the purpose of executing deposit and withdrawal transactions
• Game content providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others, for the purpose of delivering game sessions; these providers receive only session tokens, not your full account profile
• Identity verification services — third-party KYC platforms that authenticate government-issued documents
• Fraud and AML screening providers — services that cross-reference transaction data against known risk databases
• Cloud hosting and infrastructure providers — who store Platform data on secured, encrypted servers
• Analytics platforms — for aggregated, pseudonymized usage analysis

7.2 Legal & Regulatory Disclosure

rp99 may disclose your Personal Data to governmental authorities, regulatory bodies, or law enforcement agencies where required to do so by applicable law, court order, or enforceable regulatory directive. We will notify you of such disclosure where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of rp99's business, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified via your registered email address prior to any such transfer taking effect, and you retain the right to request deletion of your data before the transfer is completed.

8. Cookies & Tracking Technologies

8.1 What Are Cookies

Cookies are small data files placed on your browser or device when you visit the Platform. They enable core functionality, remember your preferences, and help us understand how Users interact with the site. rp99 also uses similar technologies including web beacons, pixel tags, and local storage objects.

8.2 Types of Cookies We Use

Cookie Type	Purpose	Duration
Strictly Necessary	Session management, login authentication, security tokens. Cannot be disabled without breaking core Platform functionality.	Session / up to 24 hours
Functional	Remembering language preference, odds display format, and responsible gaming tool settings between sessions.	Up to 12 months
Analytical	Pseudonymized usage analytics to understand Platform performance and user navigation patterns. Data is aggregated and cannot identify individuals.	Up to 24 months
Marketing	Tracking whether promotional content has been displayed to avoid repetitive messaging. Only active where marketing consent has been given.	Up to 12 months

8.3 Managing Cookies

You may manage or disable non-essential cookies at any time through your browser settings. Please note that disabling Strictly Necessary cookies will impair the Platform's ability to authenticate your session and may prevent you from logging in or completing transactions. Detailed browser-specific cookie management instructions are available in your browser's help documentation.

9. Data Retention

rp99 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Data Category	Retention Period	Basis
Account registration data	Duration of account + 5 years post-closure	Legal obligation / AML compliance
KYC identity documents	Duration of account + 5 years post-closure	Legal obligation
Financial transaction records	5 years from transaction date	Legal obligation / audit requirements
Betting and gaming history	3 years from account closure	Dispute resolution / legitimate interest
Customer support correspondence	3 years from last interaction	Legitimate interest / dispute resolution
Marketing consent records	Until withdrawal of consent + 1 year	Legal obligation (proof of consent)
Technical / access logs	90 days rolling	Security monitoring / fraud prevention
Anonymized analytics data	Up to 36 months	Legitimate interest (Platform improvement)

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. Where deletion is not immediately practicable (for example, data held in encrypted backup archives), the data is isolated from active Processing until it can be permanently removed.

10. Data Security

rp99 implements a layered security architecture designed to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Our key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers, ensuring that payment details and personal information cannot be intercepted in transit
• Password hashing using industry-standard algorithms — your login password is never stored in plain text and cannot be retrieved by rp99 staff
• Access controls limiting employee access to Personal Data strictly to those with a documented need-to-know, enforced through role-based permission systems
• Multi-factor authentication available for User accounts and mandatory for all rp99 administrative systems
• Regular penetration testing and security audits conducted by independent cybersecurity specialists
• Encrypted database storage for sensitive fields including financial account details and KYC document data
• Incident response procedures with defined escalation paths and User notification protocols in the event of a confirmed data breach

Despite these measures, no internet-connected system can guarantee absolute security. You are encouraged to use a strong, unique password for your rp99 Account, enable two-factor authentication where available, and report any suspected unauthorized account activity to our support team immediately.

11. Your Rights

As a User of the rp99 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact us as described in Section 16. We will respond within 30 calendar days and will not charge a fee for reasonable requests.

11.1 Right of Access

You have the right to request a copy of the Personal Data rp99 holds about you, along with information about how it is used and with whom it is shared. We will provide this in a structured, commonly used format.

11.2 Right to Rectification

If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. For certain fields (such as your registered name or date of birth), we may require documentary evidence before making a change, in order to maintain the integrity of our KYC records.

11.3 Right to Erasure

You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent on which Processing was based. Please note that this right is subject to overriding legal retention obligations — for example, transaction records required for AML compliance cannot be deleted on request during the mandatory retention period.

11.4 Right to Restriction

You may request that rp99 restrict the Processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to Processing based on legitimate interest, pending verification of our grounds.

11.5 Right to Data Portability

Where Processing is based on your consent or performance of a contract, and is carried out by automated means, you have the right to receive your Personal Data in a machine-readable format (such as CSV or JSON) for transfer to another service provider.

11.6 Right to Object

You have the right to object to Processing carried out on the basis of rp99's legitimate interests, including profiling for marketing purposes. Upon receipt of a valid objection, rp99 will cease that Processing unless we can demonstrate compelling legitimate grounds that override your interests.

11.7 Right to Withdraw Consent

Where Processing is based solely on your consent (such as receiving marketing communications), you may withdraw that consent at any time without affecting the lawfulness of Processing carried out before withdrawal. To opt out of marketing emails, use the unsubscribe link in any communication or update your preferences in Account Settings.

12. Minors

The rp99 Platform is strictly prohibited for persons under the age of 21 years. We do not knowingly collect Personal Data from minors. Age verification is performed at registration and during KYC review. If rp99 becomes aware that Personal Data has been collected from a person under the age of 21, that Account will be immediately closed, all funds returned to the source payment method, and the associated Personal Data permanently deleted from our active systems within 30 days, subject to any mandatory legal retention requirements.

If you are a parent or guardian and believe that a minor has registered an Account on the Platform, please contact us immediately at [email protected] so that we may take prompt action.

13. Cross-Border Data Transfers

rp99 operates internationally, and your Personal Data may be transferred to and processed in countries other than Indonesia. Such transfers occur when we engage third-party service providers (such as cloud infrastructure or game content providers) whose servers are located outside Indonesia.

Wherever Personal Data is transferred internationally, rp99 takes appropriate safeguards to ensure that the receiving party provides an adequate level of protection, which may include:

• Data processing agreements incorporating standard contractual clauses
• Transfers to jurisdictions recognized as providing an adequate level of data protection by relevant authorities
• Binding corporate rules where transfers occur within a corporate group

By using the rp99 Platform and submitting your Personal Data, you acknowledge that your data may be transferred, stored, and processed internationally in accordance with the safeguards described above.

14. Third-Party Services

The rp99 Platform integrates third-party services necessary to deliver our gaming and payment offerings. While these providers act as Data Processors under our instruction, each maintains its own privacy practices governing data it independently collects. rp99 is not responsible for the privacy practices of third-party platforms or services beyond the contractual obligations we impose on them as Data Processors.

Key third-party categories integrated into the Platform include:

• Game studios — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft deliver game content through embedded iframes; session tokens are passed to these providers but not your full account profile
• Payment gateways — processing partners facilitating transfers via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja
• Analytics providers — pseudonymized behavioral analytics to improve Platform experience
• Identity verification platforms — for automated KYC document validation

rp99 does not embed social media plugins or advertising network trackers that would share your behavioral data with social platforms without your explicit knowledge and consent.

15. Policy Amendments

rp99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we provide. When material changes are made, we will update the "Last Updated" date at the top of this page and notify registered Users via their registered email address or through a prominent in-Platform notification.

We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you must cease using the Platform and may request account closure as described in our Terms & Conditions.

16. Contact & Data Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or the Personal Data rp99 holds about you, please contact our Data Protection team through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "DATA PRIVACY REQUEST — [your registered email address]"
• Response time: Acknowledgment within 5 business days; substantive response within 30 calendar days
• Support hours: 24 hours a day, 7 days a week, including Indonesian public holidays
• Languages: Requests may be submitted in English or Bahasa Indonesia

To verify your identity before processing a data access or deletion request, we may ask you to confirm certain account details or submit a copy of your government-issued ID. This step is taken solely to prevent unauthorized disclosure of your data to third parties.