Privacy Policy — How sura88 Protects Your Personal Data

1. Introduction

sura88 ("we", "us", "our") is committed to protecting and respecting the privacy of every user who accesses or interacts with our online gaming and sports betting platform. This Privacy Policy constitutes a binding legal agreement between sura88 and you, the user ("you", "your"), and governs the collection, processing, storage, and disclosure of all personal data submitted to or generated by your use of the sura88 platform.

By registering an account on sura88, depositing funds, placing wagers, or otherwise accessing any part of our service, you confirm that you have read, understood, and consented to the data practices described in this Privacy Policy. If you do not agree with any part of this policy, you must discontinue use of the sura88 platform and close your account.

This Privacy Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy, which together form the complete user agreement governing your relationship with sura88.

2. Definitions

In this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" — any information that directly or indirectly identifies a natural person, including but not limited to name, email address, date of birth, phone number, and financial account details.
• "Processing" — any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — sura88, as the entity that determines the purposes and means of processing personal data.
• "Data Processor" — any third party engaged by sura88 to process personal data on our behalf, under contractual obligation and our instructions.
• "KYC Data" — identity verification documents submitted as part of the Know Your Customer process, including government-issued photo ID and proof of address.
• "Transaction Data" — records of deposits, withdrawals, wagers, and bonus transactions conducted through your sura88 account.
• "Device Data" — technical information about the device used to access sura88, including IP address, browser type, operating system, and device identifiers.
• "Sensitive Data" — a subset of personal data warranting enhanced protection, including copies of government ID, financial account numbers, and health-related information submitted in the context of responsible gaming requests.

3. Personal Data We Collect

sura88 collects the following categories of personal data. We collect only data that is necessary, proportionate, and relevant to the purposes described in section 5 of this policy.

3.1 Registration Data

When you create a sura88 account, we collect:

• Full legal name (as shown on government-issued identification)
• Date of birth (to verify 21+ age eligibility)
• Email address
• Indonesian mobile phone number
• Residential address in Indonesia (city, province, postal code)
• Username and hashed password (passwords are never stored in plain text)
• Preferred language and currency settings

3.2 KYC Verification Data

To comply with anti-money-laundering and responsible gaming regulations, we collect:

• Copy of government-issued photo ID (KTP, passport, or Indonesian driver's license)
• Proof of residential address (utility bill, bank statement, or government letter, issued within the previous 3 months)
• Selfie photograph for liveness verification (when required)
• Source of funds declaration (for large deposits or withdrawals above specified thresholds)

3.3 Financial & Transaction Data

In connection with deposits and withdrawals, we collect:

• Bank account name and account number (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, Bank Danamon)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja registered phone number or account ID)
• Transaction history (deposit amounts, withdrawal amounts, dates, and status)
• Betting and wagering history (game type, stake in IDR, outcome, payout)

3.4 Device & Technical Data

Automatically collected when you access sura88:

• IP address and approximate geolocation (country, province)
• Device type (desktop, mobile, tablet) and operating system
• Browser type and version
• Session duration, page views, and click-path data
• Referring URL and exit URL
• Cookie identifiers and session tokens (see section 10)

3.5 Responsible Gaming Data

Where you voluntarily use responsible gaming tools or contact support regarding gambling concerns, we may collect:

• Self-exclusion requests and duration preferences
• Deposit limit, loss limit, and session time limit settings
• Communications related to problem gambling support
• Any health or personal circumstances disclosed voluntarily in the context of a support interaction

Responsible gaming data is classified as Sensitive Data and is subject to enhanced access controls and restricted disclosure rules.

4. How We Collect Personal Data

sura88 collects personal data through the following channels:

• Direct submission: Data you provide when registering, completing KYC, making deposits or withdrawals, contacting customer support, or completing responsible gaming settings.
• Automated collection: Device data, session data, and cookie data collected automatically when you access the sura88 platform (see section 10).
• Third-party sources: Identity verification data confirmed or supplemented by licensed KYC service providers. Fraud risk signals from industry-shared fraud prevention databases. Payment confirmation data from bank and e-wallet processing partners.
• Inferred data: Behavioral analytics derived from your interaction patterns, betting history, and account activity, used to personalize your experience and identify responsible gaming concerns.

5. How We Use Your Personal Data

sura88 processes personal data only for specific, legitimate purposes. The table below summarizes our primary data uses and the legal basis for each:

Purpose	Data Categories Used	Legal Basis
Account registration and management	Registration Data	Contractual necessity
Age and identity verification (KYC)	KYC Verification Data, Registration Data	Legal obligation; contractual necessity
Processing deposits and withdrawals	Financial & Transaction Data	Contractual necessity
Fraud prevention and anti-money-laundering compliance	KYC Data, Transaction Data, Device Data	Legal obligation; legitimate interest
Responsible gaming monitoring and intervention	Transaction Data, Responsible Gaming Data, Behavioral Data	Legal obligation; legitimate interest
Customer support and dispute resolution	All relevant categories	Contractual necessity; legitimate interest
Platform security and abuse prevention	Device Data, Transaction Data, Session Data	Legitimate interest
Personalization of platform experience	Behavioral Data, Transaction History	Legitimate interest; consent
Sending promotional communications	Registration Data (email, phone)	Consent (opt-in)
Statistical analysis and product improvement	Anonymized / aggregated data	Legitimate interest

6. Disclosure & Data Sharing

sura88 does not sell, rent, or trade your personal data to third parties. We share data only in the following defined circumstances:

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers to assist in operating the sura88 platform. These providers act strictly as Data Processors under binding contractual agreements and may only process your data according to our documented instructions:

• KYC & Identity Verification: Licensed identity verification service providers for document authentication and facial recognition liveness checks.
• Payment Processing: Bank transfer gateways and e-wallet integration providers (processing transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) — these providers receive only the minimum data necessary to process the specific transaction.
• Cloud Infrastructure: Hosting and data storage providers operating secured data centers.
• Fraud Prevention: Industry-shared fraud detection platforms that cross-reference account and transaction signals against known fraud patterns.
• Customer Support Tools: Helpdesk and live chat software providers used to manage support interactions.
• Analytics: Anonymized platform analytics tools used to measure performance and improve the user experience.

6.2 Legal & Regulatory Disclosure

sura88 may disclose personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction when required to do so by applicable law, valid legal process, or a binding regulatory order. In such cases, we will disclose only the minimum data necessary to satisfy the legal requirement and, where permitted by law, will notify the affected user prior to disclosure.

6.3 Business Continuity

In the event of a merger, acquisition, restructuring, or sale of assets involving sura88, personal data held by sura88 may be transferred to the successor entity as part of that transaction. Users will be notified via email and prominent platform notice no less than 30 days prior to any such transfer. The successor entity will be contractually bound to honor this Privacy Policy or provide users with an opportunity to delete their accounts prior to the transfer taking effect.

6.4 Responsible Gaming Partners

Where a user requests referral to external problem gambling support services, sura88 may share limited contact information (first name and email address) with accredited support organizations strictly for the purpose of facilitating that support referral. This sharing is conducted only with your explicit consent, obtained at the point of referral request.

7. Data Retention

sura88 retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

Data Category	Retention Period	Basis for Retention
Registration & Account Data	Duration of active account + 5 years post-closure	Regulatory obligation; dispute resolution
KYC Verification Documents	Duration of active account + 5 years post-closure	Anti-money-laundering legal obligation
Transaction & Betting History	7 years from date of transaction	Financial regulatory obligation
Customer Support Communications	3 years from date of last interaction	Legitimate interest; dispute resolution
Responsible Gaming Records	5 years post-closure or post-self-exclusion end	Regulatory obligation; user protection
Device & Technical Data (logs)	13 months from date of collection	Security; fraud prevention
Marketing Consent Records	Until opt-out + 3 years	Proof of consent; regulatory obligation

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be linked to any individual. KYC documents are destroyed using certified secure deletion methods. Anonymized and aggregated statistical data may be retained indefinitely for product analytics purposes.

8. Security Measures

sura88 implements a layered security framework to protect your personal data against unauthorized access, loss, alteration, or disclosure. Our security measures include:

• Encryption in transit: All data transmitted between your device and sura88 servers is protected by 256-bit SSL/TLS encryption.
• Encryption at rest: Sensitive data including KYC documents and financial account details are encrypted at rest using AES-256 encryption.
• Access controls: Personal data is accessible only to authorized sura88 personnel on a strict need-to-know basis. All internal access is logged and audited.
• Password security: User passwords are hashed using a modern cryptographic algorithm (bcrypt or equivalent). Plain-text passwords are never stored.
• Two-factor authentication (2FA): Available to all users for account login. Strongly recommended for all sura88 accounts.
• Regular security assessments: sura88 conducts periodic security audits, penetration testing, and vulnerability assessments of our platform infrastructure.
• Incident response: We maintain a documented data breach response plan. In the event of a breach affecting your personal data, we will notify affected users and relevant regulatory authorities within 72 hours of becoming aware of the incident.

While sura88 applies industry-standard security practices, no digital system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorized access to your account.

9. Your Data Rights

As a sura88 user, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our data privacy team at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days.

• Right of Access: You may request a copy of all personal data held about you by sura88, along with information about how it is being processed.
• Right of Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. Basic account details (name, email, phone) can be updated directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Note that this right is subject to our legal obligation to retain certain data categories (e.g., KYC records, transaction history) for the periods defined in section 7. Data subject to mandatory retention cannot be deleted prior to the applicable retention expiry.
• Right to Restriction of Processing: You may request that sura88 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of disputed data is being verified.
• Right to Data Portability: You may request a machine-readable export of personal data you have provided to sura88 (registration data, transaction history) in JSON or CSV format.
• Right to Object: You may object to processing of your personal data conducted on the basis of legitimate interest, including behavioral profiling for personalization purposes. This right does not apply to processing that is contractually necessary or legally obligated.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

10. Cookies & Tracking Technologies

sura88 uses cookies and similar tracking technologies to ensure the platform functions correctly, to secure your session, and to improve your experience. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without disrupting platform functionality.
• Functional Cookies: Store your preferences such as language settings, odds format (decimal / fractional / Indonesian), and responsible gaming notification settings. Persist across sessions.
• Analytics Cookies: Used to measure platform performance, page load times, error rates, and user navigation flows. Data is aggregated and anonymized.
• Marketing & Attribution Cookies: Used to track the source of your registration (which promotional campaign or referring page you arrived from) to measure marketing effectiveness. No cross-site behavioral advertising profiles are built using sura88 cookie data.

You may manage your cookie preferences through your browser settings. Disabling analytics or functional cookies may affect certain aspects of your platform experience but will not prevent you from accessing core services. Strictly necessary cookies cannot be disabled via browser settings without logging out of your account.

11. Minors & Age Verification

The sura88 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you are prohibited from registering an account or using the sura88 service in any capacity.

sura88 employs age-gate technology and KYC verification to prevent underage access. Any account found to have been registered by a person under 21 years of age will be immediately suspended, all funds will be returned to the source payment method, and all associated personal data will be securely deleted — except where retention is required under law to document the incident and prevention measures taken.

If you are a parent or guardian and believe that a minor has created a sura88 account, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

12. International Data Transfers

sura88 is an internationally operated platform and your personal data may be processed on servers located outside of Indonesia. Where personal data is transferred to a country that does not offer a level of data protection equivalent to international standards, sura88 implements appropriate safeguards including:

• Standard contractual clauses between sura88 and the receiving entity
• Data processing agreements binding recipient processors to confidentiality and security obligations equivalent to those described in this policy
• Technical measures (encryption in transit and at rest) applied regardless of where data is processed

By using the sura88 platform, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia. sura88 takes all reasonable steps to ensure such transfers are conducted lawfully and securely.

13. Changes to This Privacy Policy

sura88 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform services. The "Last Updated" date at the top of this policy will be revised to reflect any changes. Where changes are material — meaning they significantly affect your rights or how your data is used — sura88 will notify registered users by email and by prominent notice on the platform at least 14 days before the changes take effect.

Your continued use of the sura88 platform after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not agree with the updated policy, you must discontinue use of the platform and request account closure.

14. Contact Our Data Privacy Team

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact sura88's data privacy team:

sura88 Data Privacy
Email: [email protected]
Subject line: "Data Privacy Request" or "Data Rights Request"
Response time: Within 30 calendar days of receipt

For urgent account security matters (suspected unauthorized access, account compromise), please contact our 24/7 live chat support directly via the platform for the fastest possible response.