Privacy Policy

1Definitions

In this Privacy Policy, the following terms have the meanings assigned below unless context requires otherwise:

• "rrr99" / "the Company" / "we" / "us" / "our" — the operator of the website accessible at https://rrr99.cam and all associated pages and services.
• "Platform" — the rrr99 website, mobile interface, and any related software or service environment operated by the Company.
• "Player" / "User" / "you" / "your" — any individual who registers for, accesses, or uses the Platform.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, including but not limited to name, email address, phone number, identification number, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data; in this case, rrr99.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller, under contractual obligation.
• "Cookies" — small text files placed on a Player's device by the Platform to store preference, session, and analytical data.
• "KYC" — Know Your Customer; the identity verification process conducted prior to processing withdrawals or as otherwise required.
• "IDR" / "Rp" — Indonesian Rupiah, the currency used for all financial transactions on the Platform.

2Data Controller

rrr99 acts as the Data Controller in respect of all Personal Data collected through the Platform. We are responsible for determining why and how your data is processed, and we are accountable for ensuring that processing is carried out lawfully, fairly, and transparently.

All data-related inquiries, access requests, correction requests, and deletion requests should be directed to our support team using the contact details provided in Clause 15 of this Policy. We aim to acknowledge all data-related requests within 3 business days and to resolve them within 30 calendar days.

3Personal Data We Collect

The categories of Personal Data that rrr99 collects from Players are set out in the table below. We collect only the data that is reasonably necessary for the purposes described in this Policy.

We do not intentionally collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, health information, or political opinions unless explicitly required for regulatory compliance and with appropriate safeguards in place.

4How We Collect Data

4.1 Directly from You

The majority of Personal Data we hold is provided directly by you during registration, KYC submission, customer support interactions, form completions, and promotional participation. This includes the information you enter at account creation and any documentation you submit for verification purposes.

4.2 Automatically Through the Platform

When you access and use the Platform, certain Technical Data and Usage Data are collected automatically through server logs, cookies, and similar tracking technologies. This data collection occurs as a standard part of operating a secure and functional web service and does not require your active input.

4.3 From Third Parties

We may receive Personal Data from third-party service providers in limited circumstances, including:

• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) for transaction confirmation and fraud screening
• Identity verification services used to cross-check the accuracy of KYC documentation
• Anti-fraud and anti-money-laundering screening databases where required by our compliance obligations
• Analytics providers who supply aggregated usage statistics to help us improve Platform performance

5Purpose and Legal Basis for Processi ng

rrr99 processes your Personal Data only where a valid legal basis exists. The table below outlines the primary purposes for which we process data and the corresponding legal basis for each.

6Sharing of Personal Data

rrr99 does not sell, rent, or trade your Personal Data to any third party. We may, however, share your data with carefully selected third parties in the following circumstances:

6.1 Service Providers and Data Processors

We engage trusted third-party service providers who process Personal Data strictly on our behalf and under binding contractual obligations. These include payment processing partners (including local Indonesian banks and e-wallet providers), identity verification services, cloud hosting and data storage providers, customer support platform operators, and analytics and fraud prevention tools. All such providers are prohibited from using your data for any purpose other than delivering the contracted service to rrr99.

6.2 Legal and Regulatory Disclosure

We may disclose your Personal Data to government bodies, law enforcement agencies, or regulatory authorities where we are legally compelled to do so, where disclosure is necessary to protect the safety or rights of any person, or where required to comply with a valid court order or regulatory investigation. Such disclosures are made only to the extent strictly necessary and with appropriate confidentiality protections where permitted.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of rrr99's assets, your Personal Data may be transferred to the successor entity as part of that transaction. We will notify affected Players via registered email prior to any such transfer, and the successor entity will be required to honor the terms of this Privacy Policy or provide Players with a reasonable opportunity to close their accounts before new terms take effect.

6.4 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data — from which no individual Player can reasonably be identified — with third parties for research, analytics, marketing, or industry reporting purposes. Such data sharing does not constitute a disclosure of Personal Data under this Policy.

7Data Retention

rrr99 retains Personal Data for as long as is necessary to fulfill the purposes described in this Policy and to comply with our legal, regulatory, and contractual obligations. The following general retention periods apply:

• Active Account data: Retained for the full duration of your Account's active status plus a minimum of five years following Account closure, to satisfy anti-money-laundering record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of five years from the date of submission or the date of Account closure, whichever is later.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction, in accordance with applicable financial record-keeping standards.
• Customer support communications: Retained for three years from the date of each interaction, unless the communication is relevant to an ongoing dispute or investigation, in which case it is retained until resolution.
• Marketing consent records: Retained for three years from the date of consent or until consent is withdrawn, whichever is earlier.
• Technical and usage logs: Typically retained for 12 months on active servers, then archived securely for up to three years before permanent deletion.

Upon expiry of the applicable retention period, Personal Data will be securely deleted, anonymized, or de-identified in a manner that prevents reconstruction of the original data.

8Data Security

rrr99 implements a comprehensive set of technical and organizational security measures designed to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Key security measures in place include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encrypted data storage with access restricted to authorized personnel on a strict need-to-know basis
• Multi-factor authentication (MFA) options for Player accounts to reduce the risk of unauthorized access
• Regular penetration testing and vulnerability assessments conducted by independent security specialists
• Automated fraud monitoring systems that flag unusual transaction patterns or login behavior in real time
• Staff training and background checks for all personnel with access to Personal Data
• Incident response procedures to identify, contain, and remediate any data security breach promptly

While we apply industry-standard safeguards, no method of transmission over the internet or electronic storage is entirely infallible. In the event of a security breach that is likely to result in a high risk to your rights and freedoms, we will notify affected Players without undue delay and will take all reasonable steps to mitigate harm.

9Cookies and Tracking Technologies

rrr99 uses cookies and similar tracking technologies to deliver a functional, secure, and personalized experience on the Platform. The categories of cookies we use are described below:

Strictly necessary cookies are applied automatically as they are essential for the Platform to function. All other cookie categories are applied only where you have provided consent, or where a legitimate interest applies as described in this Policy. You may manage your cookie preferences through your browser settings at any time; however, disabling functional or performance cookies may affect your experience on the Platform.

10Minors and Age Verification

As part of our registration and KYC process, rrr99 takes active steps to verify that all Players meet the minimum age requirement of 21 years. Where we discover or reasonably suspect that a Player is under the age of 21, we will immediately suspend the Account, void any pending transactions, and securely delete or anonymize the minor's Personal Data as promptly as practicable.

Parents and guardians are encouraged to make use of parental control software and to monitor minors' internet usage to prevent unauthorized access to gambling platforms. If you believe a minor has created an account on rrr99, please contact us immediately at the details provided in Clause 15.

11Your Data Rights

Subject to applicable law and our legitimate regulatory obligations, you hold the following rights with respect to your Personal Data held by rrr99. You may exercise any of these rights by contacting our support team as described in Clause 15.

We will respond to all valid data rights requests within 30 calendar days of receipt. In complex cases we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it before the initial 30-day period expires.

12International Data Transfers

rrr99 operates internationally and may transfer your Personal Data to servers or service providers located outside of Indonesia. Where such transfers occur, we take steps to ensure that your data receives an equivalent level of protection to that afforded within Indonesia, including by:

• Entering into contractual data processing agreements with all third-party recipients that impose obligations equivalent to those in this Policy
• Selecting service providers that operate under internationally recognized data protection frameworks
• Applying technical safeguards such as encryption both in transit and at rest for all cross-border data flows
• Conducting due diligence assessments on all third-country recipients before any transfer takes place

By registering an Account and using the Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia as described in this Clause, subject to the protections outlined above.

13Third-Party Links and Services

The rrr99 Platform may reference or interact with third-party services — for example, payment gateways operated by BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja — that have their own independent privacy policies. When you interact with a third-party payment interface, you are subject to that party's privacy practices in addition to ours.

rrr99 is not responsible for the privacy practices, content, or security standards of any third-party service or website. We encourage you to review the privacy policy of any third-party service with which you interact. The inclusion of any third-party service in connection with the Platform does not constitute our endorsement of that party's privacy practices.

14Amendments to This Policy

rrr99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform functionality. The date of the most recent revision is displayed prominently at the top of this page.

Where amendments are material — meaning they substantively affect how we collect, use, or share your Personal Data — we will provide advance notice via the Platform or by email to your registered address, giving you a reasonable opportunity to review the changes before they take effect. For minor or clarificatory amendments, updated terms will take effect upon publication.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with the revised terms, you should discontinue use of the Platform and contact our support team to arrange Account closure in accordance with our Terms and Conditions.

15Contact and Data Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how rrr99 handles your Personal Data, please contact our Data Protection team using the details below:

• Email: [email protected]
• Support Availability: 24 hours a day, 7 days a week, 365 days a year
• Response Commitment: Acknowledgment within 3 business days; resolution within 30 calendar days
• Languages: English and Bahasa Indonesia

When submitting a data rights request, please include your registered email address and a brief description of your request to help us locate your records and respond efficiently. We may ask you to verify your identity before processing certain requests — particularly access, erasure, or portability requests — to protect the security of your data.