Privacy Policy
of sr66

sr66 operates as an online betting and live casino platform serving players primarily located in Indonesia. In the course of providing our services — which include sports betting, togel (Indonesia's traditional numbers lottery), live dealer casino games, sabung ayam (live cockfighting) streaming, and slot gacor (high-frequency online slot) titles — we necessarily collect and process certain categories of personal data from our Members.

We understand that the privacy of our Members is not merely a regulatory obligation but a cornerstone of the trust that underpins every interaction on our platform. This Policy is written in clear, accessible English to ensure that every Member — regardless of technical or legal background — understands precisely what data we hold, why we hold it, how we protect it, and what rights you have over it.

sr66 is committed to handling personal data in a manner consistent with internationally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, accuracy, integrity, and confidentiality. We do not sell, rent, or trade your personal data to third-party marketing entities under any circumstances.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person. This includes, but is not limited to, names, identity card numbers, phone numbers, email addresses, bank account details, IP addresses, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" refers to sr66 as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" refers to any third party that processes Personal Data on behalf of sr66, strictly under contractual instruction and subject to confidentiality obligations.
• "KYC Data" means identity verification documents collected during the Know Your Customer process, including government-issued identity cards (KTP), passports, proof-of-address documents, and proof-of-payment-method records.
• "Cookies" means small text files placed on your device by the sr66 platform to facilitate session management, preference storage, and analytical functions.
• "Device Data" means technical information automatically transmitted by your browser or application when you access the Platform, including IP address, browser type, operating system, screen resolution, and referring URL.

sr66 collects the minimum personal data necessary to deliver a secure, compliant, and high-quality betting and gaming service. The categories of data we collect are set out in the table below:

sr66 collects Personal Data through the following channels:

• Direct Submission: Data you actively provide during account registration, KYC document upload, payment method registration, support communications, or the completion of responsible gaming self-assessment tools.
• Automated Technical Collection: Device Data and Behavioural Data collected automatically when you access the Platform via browser cookies, server logs, and analytics systems embedded within the platform interface.
• Transaction Records: Financial data generated as a consequence of deposits, withdrawals, and wagering activity conducted through the Platform.
• Third-Party Payment Processors: Confirmation data (transaction reference numbers, payment status codes) received from Indonesian bank transfer gateways and e-wallet providers (such as OVO, DANA, GoPay, ShopeePay, and LinkAja) in connection with your deposit and withdrawal instructions. sr66 does not receive or store full bank account passwords or e-wallet PINs — these credentials remain entirely within your bank or e-wallet provider's systems.
• Game Providers: Session outcome data (win/loss records, game duration, RTP data) received from licensed third-party game studios (including Pragmatic Play, Evolution Gaming, Spribe, and Pocket Games Soft) to populate your Account history.

sr66 processes your Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing your registration data, KYC documents, and financial data is necessary to form and perform the contract between you and sr66 — without this data, we cannot create your Account, process deposits, or settle withdrawals.
• Legal Obligation: Processing for AML/CTF compliance, age verification (21+ minimum), and the maintenance of transaction records as required by the terms of sr66's international gaming licence and applicable financial regulations.
• Legitimate Interests: Processing for fraud detection, platform security, responsible gaming monitoring, system analytics, and the improvement of our services — where these interests are not overridden by your privacy rights.
• Consent: Processing for optional communications (such as promotional offers, seasonal bonus notifications related to Idul Fitri, Independence Day, or Ramadhan cashback campaigns) where you have provided explicit opt-in consent. You may withdraw consent for marketing communications at any time by contacting support or updating your Account notification settings.

sr66 uses the Personal Data we collect for the following specific purposes, each of which is grounded in the legal bases described in Clause 5:

• Account Management: Creating, maintaining, and securing your sr66 Account, processing login authentication, and enabling account recovery.
• Payment Processing: Verifying deposit instructions, crediting your Account balance, processing withdrawal requests to your nominated Indonesian bank account or e-wallet, and maintaining complete transaction audit trails.
• Identity & Age Verification: Confirming that all registered Members are at least 21 years of age and that account details match verified identity documents, as required by responsible gaming standards and our licensing obligations.
• Fraud Prevention & AML Compliance: Monitoring transaction patterns, device activity, and login behaviour to detect and prevent fraudulent account access, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Fraud Prevention & AML Compliance: Monitoring transaction patterns, device activity, and login behaviour to detect and prevent fraudulent account access, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Customer Support: Using your registration data, account history, and communication records to respond to support enquiries, investigate disputes, and deliver effective resolutions within committed response times.
• Platform Improvement: Analysing aggregated and anonymised Behavioural Data and Device Data to identify usability issues, optimise game loading performance, and improve the overall Member experience across desktop and mobile interfaces.
• Promotional Communications: Where you have provided consent, sending you information about bonuses, promotions, and seasonal offers relevant to the Indonesian market — such as welcome bonus updates, reload promotions, and holiday cashback events. You may opt out of these communications at any time.
• Legal & Regulatory Compliance: Retaining records as required by applicable law, responding to lawful requests from competent authorities, and enforcing our Terms & Conditions where necessary.

sr66 does not sell, rent, or trade your Personal Data to any third party for marketing or commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose:

7.1 Licensed Service Providers (Data Processors)

sr66 engages a small number of trusted third-party technology and service providers who process Personal Data strictly on our behalf and under binding data processing agreements. These include:

• Payment gateway operators facilitating bank transfers through BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, and Bank Permata, and e-wallet connections to OVO, DANA, GoPay, ShopeePay, and LinkAja — solely for the purpose of processing your deposit and withdrawal instructions.
• Game studio providers (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, Microgaming, NetEnt) who receive session identifiers necessary to deliver game content and return verified outcome data to your Account history.
• Identity verification platform operators used to assist with KYC document validation, who process identity document images for verification and immediately delete source files upon completion of the check.
• Platform infrastructure and hosting providers who maintain the servers and databases on which the sr66 platform operates, under strict confidentiality and security obligations.

All third-party Data Processors engaged by sr66 are contractually prohibited from using your Personal Data for any purpose other than the specific service they provide to sr66.

7.2 Legal & Regulatory Disclosure

sr66 may disclose Personal Data to governmental authorities, law enforcement agencies, or regulatory bodies where we are legally compelled to do so, or where disclosure is necessary to:

• Comply with a valid court order, subpoena, or statutory request from a competent authority.
• Report suspected money laundering or terrorist financing activity under applicable AML/CTF obligations.
• Protect the rights, property, or safety of sr66, its Members, or the public, where disclosure is proportionate and lawful.

Where legally permitted, sr66 will notify the affected Member of any such disclosure prior to its execution.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring of sr66's business, Personal Data held by sr66 may be transferred to the acquiring or successor entity as part of that transaction, subject to equivalent privacy protections being maintained. sr66 will provide reasonable advance notice to affected Members via their registered email address if such a transfer is to occur.

sr66 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our internal data lifecycle procedures. Where data is anonymised rather than deleted, the resulting anonymised dataset no longer constitutes Personal Data and may be retained for statistical and analytical purposes indefinitely.

sr66 implements a comprehensive, multi-layered security framework to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our technical and organisational security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the sr66 Platform is encrypted in transit using industry-standard TLS 1.2 or higher protocols.
• Encrypted Data Storage: Sensitive Personal Data — including KYC documents and financial account details — is encrypted at rest using AES-256 encryption on secured, access-controlled servers.
• Password Security: Member passwords are stored exclusively as salted cryptographic hashes; no plaintext passwords are stored or accessible by sr66 staff.
• Access Controls: Access to Personal Data within sr66's internal systems is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all staff accounts.
• Intrusion Detection: sr66's infrastructure is monitored 24/7 by automated intrusion detection systems that alert our security team to anomalous access patterns in real time.
• Regular Security Audits: sr66 conducts periodic internal and third-party security assessments to identify and remediate vulnerabilities in our platform infrastructure.
• Incident Response: In the event of a data breach that poses a material risk to Members' Personal Data, sr66 will notify affected Members via their registered email address within 72 hours of becoming aware of the breach, describing the nature of the incident and the steps being taken to address it.

sr66 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files stored on your device that allow the Platform to recognise your session, remember your preferences, and gather analytical data about platform usage. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies enable core functions such as user authentication, session management, and security token validation. The Platform cannot function correctly without these cookies, and they cannot be disabled.
• Functional Cookies: Used to remember your preferences — such as your preferred language, deposit method, or responsible gaming settings — so that you do not need to reconfigure them on each visit. These cookies do not track your activity on other websites.
• Analytical Cookies: Used to collect aggregated, anonymised data about how Members navigate and interact with the Platform. This data informs product improvements and performance optimisation. No personally identifiable data is transmitted via analytical cookies.
• Security Cookies: Used as part of our fraud detection and bot prevention systems, enabling us to identify and block automated or malicious access attempts without disrupting legitimate Member sessions.

sr66 does not use third-party advertising or retargeting cookies. No cookie data collected on the sr66 Platform is shared with external advertising networks or social media platforms for the purpose of targeting you with advertisements on other websites.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform, as authenticated sessions rely on session cookies to function securely.

As a Member of sr66, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact sr66's support team using the details provided in Clause 15:

• Right of Access: You have the right to request a copy of the Personal Data that sr66 holds about you. We will provide this information within 30 days of a verified request, free of charge for reasonable requests.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held by sr66. Updates to core account details (name, date of birth) will require re-verification of supporting KYC documents.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected and where no overriding legal retention obligation applies. Please note that AML/CTF regulations require sr66 to retain certain transaction and identity records for a minimum of five years following Account closure, regardless of erasure requests.
• Right to Restrict Processing: You may request that sr66 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of disputed data is being verified.
• Right to Data Portability: You may request that sr66 provide your Personal Data in a structured, commonly used, machine-readable format (such as CSV), applicable to data processed on the basis of your consent or contractual necessity.
• Right to Withdraw Consent: Where processing is based on your consent (primarily marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Object: You may object to processing based on sr66's legitimate interests where you believe your privacy rights override those interests. Sr66 will assess each objection on its merits and respond within 30 days.

sr66 will acknowledge all data rights requests within five (5) business days and aim to provide a full response within thirty (30) calendar days of receipt. Where a request is complex or voluminous, we may extend this period by a further 30 days, with prior written notification to the requesting Member.

The sr66 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from any individual under the age of 21. Our KYC process is specifically designed to prevent underage registration by requiring documentary proof of age before full Account functionality is enabled.

If sr66 becomes aware that Personal Data has been collected from a person under the age of 21, we will immediately suspend the Account, delete all associated Personal Data to the extent permitted by AML retention obligations, and — where applicable — return any deposited funds to the payment method used, net of any costs incurred in processing the refund.

If you are a parent or guardian and believe that a minor in your care has created an sr66 Account, please contact our support team immediately at [email protected] with the relevant details so that we may act without delay.

As an internationally operated platform serving Indonesian players, sr66's infrastructure — including its servers, data backup systems, and certain third-party service providers — may be located in jurisdictions outside of Indonesia. Where Personal Data is transferred internationally, sr66 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

These safeguards include:

• Contractual data processing agreements with all international service providers that incorporate internationally recognised data protection standards equivalent to those applied within the European Economic Area (EEA).
• Selection of hosting and infrastructure providers that hold recognised security certifications (such as ISO 27001) and are subject to binding security obligations under their service contracts with sr66.
• Restriction of data transfers to jurisdictions or providers that sr66 has assessed as offering adequate protections for the rights and interests of data subjects.

sr66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The "Last Updated" date at the top of this page will always reflect the date on which the most recent version of the Policy took effect.

Where amendments are material — particularly those that expand the categories of data we collect, change the purposes for which data is used, or introduce new third-party sharing arrangements — sr66 will notify affected Members via their registered email address at least seven (7) days before the revised Policy takes effect. For non-material amendments (such as typographical corrections or clarifications that do not alter the substance of our data practices), the updated Policy will take effect on the date of publication.

Your continued use of the sr66 Platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the amended terms, you should cease using the Platform and request voluntary Account closure in accordance with our Terms & Conditions.

We encourage all Members to review this Privacy Policy periodically to stay informed about how we are protecting your data and what rights you hold.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which sr66 processes your Personal Data, please contact our Data Protection team through the following channels:

• Email: [email protected] (plain text only — not a clickable link)
• Live Chat: Available 24/7 directly within the sr66 Platform interface
• Response Time: Live chat — under 5 minutes; Email enquiries — within 24 hours (WIB)
• Support Hours: 24 hours a day, 7 days a week (WIB, UTC+7)

When contacting us regarding a data rights request, please include your registered Account username, a description of your request, and (where applicable) a copy of a government-issued identity document to allow us to verify your identity before disclosing or modifying any Personal Data. This verification step is a necessary safeguard to protect your data from unauthorised access by third parties.