rp99k Privacy Policy

rp99k ("we", "us", "our") operates the online casino and sportsbook platform accessible at rp99k.pro, serving registered players primarily based in Indonesia. As part of delivering a secure, personalised gaming experience, rp99k necessarily collects and processes certain personal data relating to the individuals who register and use the platform.

This Privacy Policy describes in clear terms what personal data rp99k collects from players and site visitors, the purposes for which that data is processed, the legal bases on which processing is conducted, the parties with whom data may be shared, the security measures we apply to protect it, the period for which it is retained, and the rights available to data subjects in relation to their personal information.

This Privacy Policy applies to all personal data processing activities conducted by rp99k in connection with the platform, including account registration, identity verification (KYC), financial transactions, gameplay, customer support interactions, and marketing communications. It applies to all registered users of rp99k regardless of the device or browser used to access the platform.

This policy should be read alongside the rp99k Terms & Conditions, which govern the overall contractual relationship between rp99k and its users. Defined terms used but not defined in this Privacy Policy carry the meanings given to them in the Terms & Conditions.

For the purposes of applicable data protection law, rp99k is the data controller in respect of the personal data of registered users and site visitors collected through the rp99k platform at rp99k.pro.

As data controller, rp99k determines the purposes and means by which personal data is processed. rp99k takes its obligations as data controller seriously and has implemented appropriate technical and organisational measures to ensure that personal data is handled lawfully, fairly, and transparently, and is protected against unauthorised access, accidental loss, or destruction.

For all data-related enquiries, requests to exercise data subject rights, or complaints regarding rp99k's handling of personal data, please contact our designated data protection contact using the details provided in Section 14 of this policy.

rp99k collects personal data in several categories depending on the nature of your interaction with the platform. The following table summarises the categories of personal data we may hold about registered users:

rp99k does not collect or process special categories of personal data (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data used for identification purposes) beyond what is strictly necessary for age verification and KYC compliance where required by applicable regulations.

rp99k collects personal data through the following channels and mechanisms:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting the support team, or participating in a promotion.
• Automated collection: Technical data collected automatically when you access the platform, including IP address, device identifiers, browser attributes, and session activity logs collected via server-side logging and first-party analytics tools.
• Payment processing partners: Confirmation data (transaction reference, masked account number, amount in IDR) received from payment partners such as BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay when processing deposits and withdrawals. rp99k does not receive full unmasked payment credentials from payment partners.
• Identity verification services: Document verification outcomes from third-party KYC providers engaged to validate government-issued identification submitted during account verification.
• Cookies and similar technologies: Session and preference data collected via first-party cookies as described in Section 9 of this policy.

rp99k processes personal data only for specified, explicit, and legitimate purposes. The following table sets out the primary processing purposes and the corresponding legal basis for each:

Where rp99k relies on legitimate interests as the legal basis for processing, we have conducted a balancing assessment and are satisfied that our legitimate interests are not overridden by your privacy interests or fundamental rights. You have the right to object to processing based on legitimate interests as described in Section 10.

rp99k does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Personal data is shared with third parties only in the following circumstances and on the strict basis of necessity:

• Payment processing partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja receive only the transaction data necessary to process your deposit or withdrawal. These partners operate under their own privacy policies and are bound by applicable banking and financial services regulations in Indonesia.
• Identity verification providers: Third-party KYC service providers receive identity documents and photographs you submit during verification solely for the purpose of confirming your identity and age. These providers are engaged under data processing agreements that restrict their use of your data to the verification purpose only.
• Game studio providers: Licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive gameplay session data necessary to deliver real-time game content and settle bet outcomes. These studios do not receive your financial account details or full identity documents.
• Fraud and AML screening services: Specialist compliance technology providers may receive transaction and account data necessary to perform automated screening against sanctions lists and known fraud indicators.
• Regulatory and law enforcement authorities: rp99k may disclose personal data to competent authorities where required to do so by applicable law, court order, or regulatory directive. rp99k will notify you of any such disclosure to the extent permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of rp99k's business, personal data held by rp99k may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this policy.

All third-party data processors engaged by rp99k are subject to contractual data processing obligations consistent with applicable data protection standards. rp99k conducts due diligence on processors prior to engagement and reviews those arrangements on a periodic basis.

rp99k retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting obligations. The following retention guidelines apply:

• Account and identity data: Retained for the duration of your active rp99k Account plus a minimum period of five (5) years following account closure. This retention period reflects AML and financial record-keeping obligations applicable to online gaming operators.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• Gameplay and bet history: Retained for a minimum of two (2) years from the date of each session or wager, to support dispute resolution and responsible gaming monitoring.
• Customer support communications: Retained for two (2) years from the date of the last communication in each support thread, to facilitate follow-up and improve support quality.
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year thereafter for audit purposes.
• Technical and device data: Session-level technical logs are retained for up to ninety (90) days. Aggregated, anonymised analytics data may be retained indefinitely.

When personal data is no longer required and the relevant retention period has expired, rp99k applies secure deletion or anonymisation procedures to ensure that the data cannot be recovered or reconstructed.

rp99k implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental disclosure, alteration, or destruction. Key measures include:

• TLS/SSL encryption: All data transmitted between your device and the rp99k platform is encrypted in transit using industry-standard TLS 1.2 or higher. This protects your login credentials, financial data, and personal information from interception during transmission.
• Encryption at rest: Sensitive data fields — including identity documents, financial account numbers, and authentication credentials — are encrypted at rest using AES-256 encryption within rp99k's database infrastructure.
• Password hashing: User passwords are never stored in plain text. rp99k uses a strong, salted cryptographic hashing algorithm to store password credentials, such that even rp99k staff cannot retrieve your original password.
• Access controls: Access to personal data within rp99k's internal systems is restricted on a strict need-to-know basis. Staff with access to personal data undergo background screening and receive data protection training. Access privileges are reviewed regularly and revoked promptly upon role change or departure.
• Multi-factor authentication: rp99k supports multi-factor authentication (MFA) for user accounts, and its use is strongly encouraged. MFA is mandatory for all administrative access to internal rp99k systems.
• Penetration testing and security audits: rp99k engages independent security specialists to conduct regular penetration tests and vulnerability assessments of the platform. Identified vulnerabilities are remediated according to a risk-prioritised schedule.
• Incident response: rp99k maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a risk to your rights and freedoms, rp99k will notify affected users without undue delay and will take immediate steps to contain the incident.

While rp99k takes all reasonable precautions to safeguard your personal data, no internet-based system can guarantee absolute security. You are responsible for keeping your rp99k Account credentials confidential and for notifying us immediately if you suspect any unauthorised access to your account.

rp99k uses cookies and similar first-party tracking technologies on the rp99k.pro platform to support essential platform functionality, maintain session continuity, and gather anonymised usage analytics. rp99k does not use third-party advertising cookies or cross-site tracking technologies.

The following categories of cookies are used on the rp99k platform:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your login session, store your language and display preferences, protect against cross-site request forgery (CSRF), and ensure that the platform responds correctly to your actions. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional cookies: These cookies remember your choices and preferences — such as your preferred deposit method or responsible gaming limit settings — so you do not need to re-enter them on each visit.
• Analytics cookies: rp99k uses first-party analytics cookies to collect anonymised, aggregated data about how users navigate the platform — including pages visited, time spent on each section, and the sequence of actions taken before a deposit or game launch. This data is used solely to improve the platform experience and does not identify individual users.
• Security cookies: Short-lived cookies used to detect and mitigate fraudulent login attempts, bot activity, and session hijacking. These are strictly necessary for platform security.

You may manage cookie preferences through your browser settings. Disabling strictly necessary or security cookies will impair the functionality of the rp99k platform. Disabling analytics or functional cookies will not prevent you from accessing core platform features.

As a data subject, you have the following rights in relation to your personal data held by rp99k. To exercise any of these rights, please contact the rp99k data protection team using the details in Section 14. rp99k will respond to all valid requests within thirty (30) calendar days of receipt.

The rp99k platform is strictly intended for adults aged 21 years and older. rp99k does not knowingly collect, store, or process personal data relating to any individual under the age of 21. Account registration by persons under 21 is prohibited under the rp99k Terms & Conditions and this Privacy Policy.

rp99k applies identity and age verification (KYC) procedures to all registered accounts to detect and prevent underage access. Where rp99k becomes aware that an account has been registered by or on behalf of a person under the age of 21, the account will be immediately suspended, all balances will be frozen pending investigation, and all personal data associated with that account will be deleted as soon as the investigation is concluded, subject to any applicable legal obligations requiring retention.

Parents and guardians who believe that a minor may have registered on the rp99k platform using false information are urged to contact the rp99k support team immediately via live chat or email at [email protected].

rp99k's primary user base is located in Indonesia, and we take the data protection expectations of Indonesian players seriously. In the course of delivering platform services, certain personal data may be transferred to and processed in countries outside Indonesia — for example, in connection with cloud infrastructure hosting, game studio integrations, or the engagement of internationally based KYC verification providers.

Where such international transfers occur, rp99k ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that applied within Indonesia. Safeguards may include contractual data processing clauses incorporating internationally recognised data protection standards, assessments of the recipient country's data protection framework, and technical measures such as end-to-end encryption of data in transit.

rp99k does not transfer personal data to any jurisdiction that rp99k's compliance team has assessed as providing an inadequate level of protection for personal data without the additional safeguards described above. You may request details of the specific safeguards applied to any international transfer of your personal data by contacting us at the address in Section 14.

rp99k reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulation, or improvements to the platform. The "Last Revised" date at the top of this document will be updated each time a revision is made.

Where a material change is made to this Privacy Policy — one that substantially affects your rights as a data subject or the way in which rp99k processes your personal data — rp99k will notify registered users via the email address on file or via an in-platform notification prior to the change taking effect. For non-material updates (such as minor clarifications, formatting changes, or corrections of typographical errors), publication of the revised policy on rp99k.pro constitutes sufficient notice.

Your continued use of the rp99k platform following the publication of a revised Privacy Policy constitutes your acknowledgement of, and agreement to, the updated terms. If you do not agree with any revision to this policy, you should discontinue use of the platform and may contact the support team to request account closure and data deletion in accordance with Section 10.

For all privacy-related enquiries, requests to exercise your data subject rights, or concerns about rp99k's handling of your personal data, please contact our data protection team through the following channels. All communications should be in English to ensure the fastest possible response from our team.

• Email: [email protected] — please use the subject line "Privacy Request" or "Data Subject Rights" so your message is routed to the correct team promptly. (Plain text only; this address is not a clickable link.)
• WhatsApp: +62 812 0000 9900 — available for urgent privacy concerns. Please note that detailed data subject requests are best submitted via email for documentation purposes. (Plain text only; not a clickable link.)
• Live Chat: Available 24/7 on the rp99k platform. Indonesian-speaking agents are available during WIB (UTC+7) peak staffing hours. For formal data subject requests, our live chat team will direct you to the appropriate written channel.

rp99k aims to acknowledge all privacy-related communications within two (2) business days of receipt and to provide a substantive response within thirty (30) calendar days. Where a request is complex or involves a large volume of data, rp99k may extend this period by a further thirty (30) days, with notice to you of the extension and the reasons for it.

If you are not satisfied with rp99k's response to a privacy complaint, you have the right to escalate the matter to the relevant supervisory authority in your jurisdiction. rp99k takes all privacy complaints seriously and will cooperate fully with any regulatory enquiry or investigation.