Privacy Policy

This Privacy Policy applies to all personal data collected, processed, and stored by sgp138 in connection with the operation of the gaming and wagering platform accessible at sgp138.cam (the "Platform"). It applies to all registered members, visitors browsing the Platform without an account, and former members whose data is retained for compliance purposes.

This policy covers data collected through:

• The sgp138 website and all associated subdomains.
• Account registration and KYC verification processes.
• Deposit and withdrawal transactions conducted via supported Indonesian payment channels, including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Communications between players and the sgp138 customer support team.
• Promotional and marketing campaigns, where a player has opted in to receive such communications.
• Automated data collection technologies, including cookies and session identifiers, as described in Section 10.

This policy does not extend to third-party websites, payment processor portals, or game studio environments that may be accessible via links or embedded frames within the Platform. Each such third party maintains its own privacy practices, for which sgp138 bears no responsibility.

The following terms carry the meanings set out below wherever they appear in this Privacy Policy:

• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, either directly (e.g., full name, national ID number) or indirectly (e.g., device identifier, account number, IP address).
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — sgp138, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of sgp138, under a written data processing agreement, for specified purposes only.
• "Data Subject" — the individual whose personal data is being processed — in this context, the registered sgp138 member or Platform visitor.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement by the data subject to the processing of their personal data for a stated purpose.
• "KYC" — Know Your Customer: the identity and age verification process required before a player may withdraw funds from their sgp138 account.

The categories of personal data collected by sgp138 and the rationale for collecting each category are summarized in the table below:

We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, biometric data (beyond document photographs for KYC), or health information, except where expressly required by a responsible gaming intervention and with the player's explicit consent.

sgp138 collects personal data through the following channels:

• Direct submission: Information you provide when completing the registration form, submitting KYC documentation, contacting customer support, or entering a promotion.
• Automated collection: Technical and behavioral data collected automatically when you access and interact with the Platform, via cookies, session tracking, and server logs (see Section 10).
• Payment processors: Transaction confirmation data received from third-party payment intermediaries when you complete a deposit or withdrawal via a supported Indonesian bank or e-wallet.
• Identity verification services: During KYC processing, sgp138 may use a third-party identity verification provider to cross-reference submitted documents against publicly available databases. Any such provider operates under a strict data processing agreement with sgp138.
• Fraud detection systems: Our automated risk management tools analyze technical and behavioral data in real time to identify patterns associated with fraudulent activity, multiple account creation, or money laundering.

sgp138 uses your personal data for the following clearly defined purposes:

• Account management: Creating, maintaining, and administering your sgp138 account, including processing login requests, password resets, and account setting changes.
• Service delivery: Enabling you to access and participate in all Platform services, including casino games, live dealer tables, sportsbook markets, and togel (Indonesia's traditional numbers lottery) draws.
• Payment processing: Facilitating deposits and withdrawals in Indonesian Rupiah (IDR) via your chosen local bank or e-wallet, and maintaining accurate transaction records.
• Identity verification (KYC): Confirming your legal name, date of birth, and Indonesian residency to satisfy age verification (21+) and anti-money laundering obligations.
• Fraud prevention and security: Monitoring account activity for signs of unauthorized access, bonus abuse, multi-accounting, collusion, or other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: Analyzing behavioral and wagering data to identify players who may be exhibiting signs of problematic gambling, and activating appropriate protective measures in line with our Responsible Gaming policy.
• Customer support: Responding to your inquiries, resolving disputes, and maintaining records of communications for quality assurance and training purposes.
• Legal and regulatory compliance: Retaining records as required by our international gaming license and applicable AML regulations, and responding to lawful requests from competent authorities.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates by email or SMS — but only where you have opted in to receive such communications. You may withdraw this consent at any time.
• Platform improvement: Using aggregated, anonymized behavioral data to analyze usage patterns and optimize the Platform's performance, game selection, and user experience.

sgp138 processes personal data only where a valid legal basis exists. The legal bases we rely on are as follows:

• Contractual necessity: Processing required to perform our obligations under the Player Account Agreement — including account creation, payment processing, and game access — is conducted on the basis that it is necessary to fulfill the contract between sgp138 and the player.
• Legal obligation: Processing necessary to comply with our regulatory requirements under our international gaming license, including KYC verification, AML record-keeping, and reporting obligations to competent authorities.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform integrity, and responsible gaming analysis, where these interests are not overridden by the player's fundamental rights and freedoms.
• Consent: Processing for optional purposes — specifically, sending marketing communications by email or SMS — is conducted on the basis of your explicit, freely given consent. You may withdraw this consent at any time by contacting us at [email protected] or updating your account preferences.

sgp138 does not sell, rent, or trade your personal data to any third party. We may, however, share personal data with the following categories of recipients for the stated purposes, under appropriate contractual or legal safeguards:

• Payment service providers: Indonesian local banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transactional data strictly necessary to process deposits and withdrawals.
• Identity verification providers: Third-party KYC and AML screening services that assist sgp138 in verifying player identities and screening against international sanctions lists. These providers act as data processors under binding agreements.
• Game content providers: Licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive a limited set of session and account identifiers to deliver game content and maintain fairness certification. No directly identifying personal data is shared beyond what is operationally required.
• IT and security service providers: Cloud hosting, content delivery, and cybersecurity vendors engaged by sgp138 to operate and protect the Platform infrastructure. These vendors are contractually prohibited from using your data for any purpose beyond the service they provide to sgp138.
• Regulatory authorities and law enforcement: Where required by a valid legal obligation, court order, or official regulatory request, sgp138 may disclose personal data to competent governmental or law enforcement authorities. We will notify affected players where legally permitted to do so.
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by sgp138, subject to professional confidentiality obligations.

sgp138 retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, and in compliance with our regulatory obligations. The general retention schedule is as follows:

• Active account data: Retained for the full duration of the player's account registration and for a period of 5 years following account closure, in accordance with standard AML and gaming compliance record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from the date of submission, or longer if required by applicable regulatory obligations in force at the time.
• Transaction records: Financial transaction records, including deposits and withdrawals in IDR, are retained for a minimum of 5 years from the date of the transaction.
• Support communications: Customer support transcripts and email correspondence are retained for 2 years from the date of the interaction, unless the communication relates to a formal dispute or compliance matter, in which case the retention period mirrors that of the relevant account data.
• Marketing data (where consent was given): Retained until consent is withdrawn or the player's account is closed, whichever is earlier.
• Anonymized behavioral data: Aggregated, de-identified usage data used for platform analytics may be retained indefinitely, as it no longer constitutes personal data once anonymization has been applied.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with our internal data lifecycle procedures.

sgp138 implements a comprehensive, layered security framework to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your browser and the sgp138 Platform is encrypted in transit using industry-standard TLS protocols.
• Encrypted data storage: Personal data and KYC documents are stored in encrypted form on secure cloud infrastructure. Encryption keys are managed independently from the data they protect.
• Access controls: Access to player personal data is restricted to sgp138 personnel with a demonstrated operational need. All internal access is logged and subject to regular review.
• Penetration testing: The Platform undergoes regular third-party security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses.
• Multi-factor authentication: Internal systems containing player data require multi-factor authentication for staff access.
• Incident response plan: In the event of a confirmed personal data breach that poses a risk to player rights, sgp138 will notify affected players within 72 hours of becoming aware of the incident, and will take all necessary steps to contain and remediate the breach.

While sgp138 maintains robust technical and organizational security measures, no system is entirely immune to risk. Players are encouraged to protect their own account security by using a strong, unique password and enabling any two-factor authentication options offered on the Platform.

sgp138 uses cookies and similar tracking technologies to operate the Platform effectively, remember your session preferences, and analyze aggregated usage patterns. The categories of cookies we use are described below:

• Strictly necessary cookies: Essential for core Platform functionality, including maintaining your login session, remembering your language and currency preferences, and ensuring security measures function correctly. These cookies cannot be disabled without rendering the Platform inoperable.
• Functional cookies: Used to remember your preferences and personalize your experience — for example, recalling your preferred game lobby view or deposit method. These cookies are activated based on your account settings.
• Analytical cookies: Used to collect aggregated, anonymized data on how players navigate the Platform, which games are most frequently accessed, and where technical issues arise. This data informs Platform improvements. No personally identifying information is transmitted through analytical cookies.
• Security cookies: Used by our fraud detection and abuse prevention systems to identify unusual session behavior, detect bot activity, and protect the integrity of the Platform.

sgp138 does not use third-party advertising cookies or retargeting pixels. We do not share cookie-derived data with advertising networks.

As a data subject, you are entitled to exercise the following rights in relation to the personal data sgp138 holds about you. All rights requests are processed free of charge within 5 business days of receipt:

To exercise any of the above rights, please submit your request in writing to [email protected] with the subject line "Data Rights Request". We may ask you to verify your identity before processing the request to prevent unauthorized access to your account data.

sgp138 does not knowingly collect personal data from individuals under the age of 21. Our registration process requires all applicants to confirm they are 21 years of age or older, and our KYC verification process independently confirms this through government-issued identity documentation.

If sgp138 becomes aware — through any means — that a minor has registered an account or accessed the Platform, we will take the following immediate steps:

• Suspend the account and block access pending investigation.
• Void any transactions, bets, or bonuses associated with the account.
• Return any real-money deposits to the originating payment method where technically possible.
• Delete all personal data associated with the minor's account in accordance with our data deletion procedures.

Parents or guardians who believe a minor may have accessed sgp138 are encouraged to contact us immediately at [email protected]. We also recommend the use of parental control software to restrict access to online gambling platforms on shared or family devices.

As an internationally licensed platform serving Indonesian players, sgp138 may transfer personal data to servers and service providers located outside Indonesia. In all cases where such transfers occur, sgp138 ensures that appropriate safeguards are in place to protect the transferred data to a standard equivalent to that described in this Privacy Policy. These safeguards include:

• Binding contractual clauses (data processing agreements) with all third-party recipients, prohibiting onward transfer or use of data beyond the agreed purpose.
• Selection of cloud infrastructure providers operating under recognized international security certifications (such as ISO 27001).
• Regular review of third-party data processor compliance as part of sgp138's ongoing vendor management program.

By using the sgp138 Platform, you acknowledge that your personal data may be transferred to, stored, and processed in jurisdictions outside Indonesia. Where such transfers occur, they are conducted with the same protections described throughout this Privacy Policy.

sgp138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or Platform features. When material changes are made, we will notify registered members by email to the address on file at least 7 days before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this page periodically. Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

Where a proposed change to this policy would involve a materially different use of your personal data that goes beyond what you originally consented to, we will seek your explicit consent before proceeding with such processing.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by sgp138, please contact us through the following channel:

• Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Rights Request" as appropriate.
• Response time: General privacy inquiries are acknowledged within 24 hours. Formal data rights requests are processed within 5 business days.
• Support hours: Our Indonesian-speaking support team is available daily from 08.00 to 24.00 WIB (UTC+7) and will escalate privacy matters to the appropriate compliance contact.

sgp138 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection standards. The DPO may be contacted via the email address above, clearly marked for the attention of the Data Protection Officer.