Privacy Policy — sip9 Data Protection

1.1 This Privacy Policy applies to all personal data collected and processed by sip9 in connection with the operation of its online betting and gaming platform, accessible at sip9.cam, including any mobile applications, APIs, or affiliated sub-domains associated with the sip9 brand.

1.2 Data Controller: sip9 acts as the data controller in respect of personal data collected directly from Players and website visitors. As data controller, sip9 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.

1.3 Geographic Scope: sip9 primarily serves players who are residents of Indonesia. Where Players access the Platform from other jurisdictions, the data-protection standards described in this Policy continue to apply in full. Players located in Indonesia are subject to the data-protection provisions of applicable Indonesian law, including Law No. 27 of 2022 on Personal Data Protection (UU PDP), in addition to sip9's internal data-handling standards.

sip9 collects the following categories of personal data, grouped by collection context:

sip9 collects personal data through the following channels:

• Direct Collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting our support team, or participating in promotions.
• Automated Collection: Technical and device data collected automatically when you access the Platform — including via cookies, session tokens, server logs, and analytics software. See Section 9 (Cookies & Tracking) for full details.
• Third-Party Sources: Identity verification data from our licensed KYC partners; transaction-status data from payment processors including BCA, BRI, OVO, DANA, and GoPay; and fraud-detection signals from our anti-fraud service providers.
• Publicly Available Sources: Where permitted by applicable law, sip9 may supplement account data with information from publicly available sources (such as sanction screening lists) to fulfil its anti-money-laundering compliance obligations.

sip9 processes your personal data only where a valid legal basis exists. The primary bases we rely on are:

• Contractual Necessity: Processing that is necessary to perform our contract with you — namely, operating your account, processing deposits and withdrawals, settling bets, and providing customer support.
• Legal Obligation: Processing required to comply with applicable law — including anti-money-laundering (AML) regulations, coun ter-terrorism financing (CTF) rules, KYC obligations, and financial record-keeping requirements.
• Legitimate Interests: Processing that serves sip9's legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent as the legal basis (for example, for optional marketing communications), you have the right to withdraw that consent at any time by contacting sip9 support or updating your account notification preferences.

sip9 uses collected personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your player account; verifying your identity at registration and during ongoing KYC reviews; resetting credentials on verified request.
• Transaction Processing: Executing deposits and withdrawals via your chosen payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja); maintaining a full transaction ledger denominated in Indonesian Rupiah (Rp); resolving payment disputes.
• Platform Delivery: Providing access to sports betting markets (including BRI Liga 1, EPL, La Liga, Champions League, and Timnas Indonesia fixtures), live casino games (Evolution Gaming, Pragmatic Play), togel (Indonesia's traditional numbers lottery) draws, and slot gacor content from studios including Pragmatic Play, NetEnt, and Pocket Games Soft.
• Fraud Prevention & Security: Detecting and preventing account takeovers, collusion, multi-accounting, money laundering, and other forms of platform abuse. Monitoring for unusual activity patterns that may indicate fraudulent or prohibited conduct under our Terms & Conditions.
• Responsible Gaming: Monitoring betting patterns to identify potential problem gambling indicators; enforcing self-imposed limits and self-exclusion requests; proactively reaching out to Players who show behavioral risk signals.
• Legal Compliance: Fulfilling anti-money-laundering (AML) and counter-terrorism financing (CTF) reporting obligations; responding to lawful requests from regulatory authorities; retaining financial records as required by applicable law.
• Customer Support: Resolving account queries, payment disputes, and technical issues submitted via our support channels; maintaining records of communication to ensure consistent service quality.
• Service Improvement: Analyzing aggregated, anonymized usage data to improve platform performance, optimize betting markets, and enhance the overall user experience for Players across Jakarta, Surabaya, Bandung, Bali, and beyond.
• Marketing (Consent-Based): Sending promotional offers, bonus announcements, and seasonal campaigns (such as Ramadhan, Idul Fitri, or BRI Liga 1 season promotions) only where you have opted in to receive such communications. You may opt out at any time.

6.1 sip9 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Data sharing is strictly limited to the categories described below, each of which operates under a data-processing agreement or equivalent contractual obligation with sip9:

• Payment Processors: Your bank account details and transaction amounts are shared with the relevant payment provider (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute your requested transaction. These providers process payment data under their own privacy policies and applicable Indonesian banking regulations.
• KYC & Identity Verification Partners: Your identity documents and biometric liveness data are shared with sip9's licensed KYC verification service providers for the sole purpose of fulfilling our legal identity-verification obligations.
• Anti-Fraud & Security Providers: Technical data (IP address, device fingerprint, behavioral signals) may be shared with our anti-fraud service providers to detect and prevent account abuse, collusion, and money laundering.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive a session token and game-history data necessary to deliver and settle game rounds. They do not receive your full identity or financial data.
• Regulatory & Law Enforcement Authorities: sip9 will disclose personal data to competent regulatory authorities or law enforcement agencies where required to do so by applicable law or a valid court order. sip9 will notify you of such disclosure where legally permissible to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of sip9 or substantially all of its assets, your personal data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and given the opportunity to close your account if you do not wish your data to be transferred.

7.1 sip9 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention schedule applies:

7.2 Upon expiry of the applicable retention period, sip9 will securely delete or irreversibly anonymize your personal data in accordance with its data destruction procedures.

8.1 sip9 implements a layered security architecture to protect personal data against unauthorized access, disclosure, alteration, and destruction. Our key technical and organizational security measures include:

• Transport Security: All data in transit is encrypted using TLS 1.3 with 256-bit AES encryption. HTTP connections are automatically redirected to HTTPS. HSTS (HTTP Strict Transport Security) headers are enforced across all Platform domains.
• Data at Rest: Databases containing personal data — including KYC documents and financial records — are encrypted at rest using AES-256. Encryption keys are managed via a dedicated key management service with regular key rotation.
• Access Controls: Access to personal data is granted on a strict need-to-know basis. Role-based access controls (RBAC) ensure that only authorized sip9 personnel — such as compliance officers and KYC reviewers — can access sensitive data categories. All internal access is logged and audited.
• Two-Factor Authentication (2FA): Internal systems containing personal data are protected by mandatory two-factor authentication for all staff. Players are strongly encouraged to enable 2FA on their sip9 accounts for additional protection.
• Penetration Testing: sip9 conducts regular third-party penetration tests and vulnerability assessments of its Platform infrastructure. Critical vulnerabilities are remediated within 48 hours of identification.
• Incident Response: In the event of a personal data breach that poses a risk to Players' rights and freedoms, sip9 will notify affected Players and relevant authorities within the timeframe required by applicable law, providing details of the nature of the breach, likely consequences, and remediation measures taken.

8.2 While sip9 takes every reasonable precaution to protect your data, no system is entirely immune to security risks. You play an important role in protecting your own account by using a strong, unique password, enabling 2FA, and never sharing your login credentials with any third party.

9.1 sip9 uses cookies and similar tracking technologies to operate the Platform securely, remember your preferences, and analyze usage patterns. The cookies we use fall into three categories:

9.2 sip9 does not use third-party advertising cookies or behavioral tracking technologies that build cross-site profiles of individual users. We do not participate in real-time bidding (RTB) advertising ecosystems.

9.3 You can manage cookie preferences through your browser settings. Most modern browsers (Chrome, Firefox, Safari, Edge) allow you to view, block, or delete cookies at the domain level. Note that blocking essential cookies will prevent you from logging in to your sip9 account.

10.1 Subject to applicable law — including Indonesia's Personal Data Protection Law (UU PDP No. 27/2022) — you have the following rights in relation to the personal data sip9 holds about you:

• Right of Access: You have the right to request a copy of the personal data we hold about you, together with information about how it is being used. sip9 will respond to verified access requests within 30 days.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. You can update most account details directly through your account dashboard; for identity document corrections, please contact support.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent. Note that erasure requests cannot override sip9's legal obligation to retain financial records and KYC documents for a minimum of 5 years.
• Right to Restriction: You have the right to request that sip9 restricts the processing of your data — for example, while a dispute about its accuracy is being resolved.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to sip9 in a structured, machine-readable format (e.g., CSV), and to request that this data be transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to processing based on legitimate interests — including profiling for responsible gaming monitoring purposes. sip9 will honor such objections unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

10.2 Exercising Your Rights: To exercise any of the rights listed above, contact sip9's Data Protection Officer via the support email address listed in Section 14. sip9 will verify your identity before processing any data rights request to prevent unauthorized disclosure. All requests will be handled within 30 days of receipt; complex requests may take up to 60 days, with prior notification to you.

11.1 The sip9 Platform is strictly intended for adults aged 21 and above. sip9 does not knowingly collect personal data from any individual under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately close the associated account, void all transactions, and delete the relevant data as promptly as possible in accordance with our data-retention obligations.

11.2 If you are a parent or guardian and believe that a minor in your care has registered on the sip9 Platform without your knowledge, please contact our support team immediately at the address listed in Section 14. We will investigate and take appropriate action within 24 hours (WIB business hours).

12.1 sip9 operates infrastructure located in data centers with strong physical and logical security controls. Some of our third-party service providers — including cloud infrastructure providers, KYC verification partners, and game content studios — may process data in jurisdictions outside Indonesia.

12.2 Where personal data is transferred internationally, sip9 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required under Indonesian law. These safeguards include contractual data-protection clauses (equivalent to standard contractual clauses), adequacy assessments of the recipient jurisdiction, and technical security requirements imposed on the receiving entity.

12.3 By using the sip9 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Indonesia as described in this Section. If you have concerns about any specific international transfer, please contact our Data Protection Officer as described in Section 14.

13.1 sip9 may update this Privacy Policy periodically to reflect changes in our data-processing practices, applicable law, or operational requirements. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

13.2 Where a proposed change is material — for example, where we introduce a new purpose for processing your data or share data with a new category of third party — sip9 will provide at least 14 days' advance notice via a prominent notice on the Platform homepage and/or by email to your registered address. Non-material updates (such as clarifications of existing language) may take effect without advance notice.

13.3 Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Privacy Policy. If you do not agree with a material change, you may close your account before the change takes effect by contacting sip9 support.

13.4 Previous versions of this Privacy Policy are archived and available upon written request to our Data Protection Officer.

14.1 If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a privacy-related complaint, please contact sip9's Data Protection Officer through the following channel:

14.2 sip9 takes privacy complaints seriously. If you submit a formal complaint and are not satisfied with our response, you have the right to escalate the matter to the relevant data-protection supervisory authority in your jurisdiction.

14.3 This Privacy Policy was last reviewed and updated in January 2026. It constitutes the complete and current statement of sip9's data-protection practices and supersedes all previous versions. By using the sip9 Platform, you confirm that you have read and understood this Policy in full.