sb028 Privacy Policy

This Privacy Policy governs how sb028 — the online betting and casino platform accessible at https://sb028.app — collects, uses, stores, discloses, and protects the personal data of individuals who visit, register on, or interact with the platform. It applies to all users of the sb028 website, mobile-responsive platform, and any associated communication channels including live chat and email support.

sb028 is committed to handling personal data with transparency, integrity, and proportionality. This document has been drafted in accordance with internationally recognised privacy principles, including those reflected in frameworks such as the General Data Protection Regulation (GDPR) and equivalent data protection legislation applicable in the jurisdictions where sb028 operates. Indonesian members are advised that while Indonesia's Personal Data Protection Law (UU PDP) continues to develop its implementing regulations, sb028 applies privacy standards consistent with leading international practice.

By registering an account on sb028, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not create an account or use the platform's services.

The following terms carry the meanings set out below throughout this Privacy Policy:

sb028 collects personal data through three primary channels: information you provide directly, information generated automatically through your use of the platform, and information obtained from verified third-party sources. The categories of data collected are as follows:

sb028 uses personal data only for clearly defined, legitimate purposes. The table below sets out the primary purposes for which your data is processed and the corresponding lawful basis for each:

sb028 does not use personal data to make fully automated decisions that produce legal or similarly significant effects on members without providing a mechanism for human review and appeal.

sb028 relies on the following legal bases to process personal data, depending on the activity in question:

• Contractual necessity: Processing required to fulfil the member agreement — including account creation, KYC verification, payment processing, and customer support — is carried out because it is necessary to perform the contract between sb028 and the member.
• Legal obligation: Processing required to comply with AML, CTF, age-verification, and other applicable legal and regulatory requirements is carried out because sb028 is legally obligated to do so.
• Legitimate interests: Processing conducted to detect and prevent fraud, improve platform security, and maintain the integrity of the gaming environment is carried out on the basis of sb028's legitimate interests, balanced against members' privacy interests.
• Consent: Processing for optional marketing communications and non-essential cookies is conducted only where you have provided clear, freely given, and withdrawable consent. You may withdraw consent at any time by contacting support or adjusting your account preferences.

sb028 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared with external parties only in the following limited circumstances:

• Payment service providers: Bank and digital wallet providers (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) receive the minimum data necessary to process your deposit or withdrawal transaction securely.
• KYC and identity verification partners: Certified identity verification services receive document scans and personal details solely for the purpose of age and identity confirmation. These partners are contractually bound to process data only for that specified purpose.
• Game content providers: Licensed game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe — may receive anonymised session data required to render and operate their games. No personally identifiable information is shared with game studios beyond what is strictly necessary for game delivery and integrity monitoring.
• Fraud prevention and AML services: Third-party risk and compliance platforms may process transactional and behavioural data to detect suspicious activity in accordance with applicable anti-money laundering standards.
• Legal authorities: sb028 will disclose personal data to law enforcement, regulatory bodies, or other government authorities when required to do so by applicable law, court order, or regulatory direction. sb028 will notify affected members of such disclosure where permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of sb028's business assets, member personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Members will be notified of any such transfer in advance.

sb028 retains personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The general retention periods applied by sb028 are as follows:

• Active account data (profile information, transaction history, game logs): retained for the duration of the account's active status plus a minimum of 5 years following account closure, to satisfy AML record-keeping requirements.
• KYC verification documents: retained for a minimum of 5 years from the date of submission, in accordance with AML and CTF regulatory requirements.
• Support communications: retained for 3 years from the date of the last interaction, to support dispute resolution and quality assurance processes.
• Marketing consent records: retained until consent is withdrawn, plus an additional 3 years as evidence of the lawful basis for prior communications.
• Security and fraud logs: retained for up to 7 years where an investigation is ongoing or a legal hold has been applied.

When personal data is no longer required for any legitimate purpose and no legal retention obligation applies, sb028 will securely delete or anonymise the data in a manner that prevents reconstruction of identifiable records.

sb028 applies a layered security architecture designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption applied to every page, every login session, and every financial transaction on the sb028 platform — providing the same level of protection used by Indonesia's major banks.
• Encrypted data storage: Sensitive data fields, including identity document scans and payment method details, are encrypted at rest using industry-standard algorithms.
• Access controls: Strict role-based access controls ensure that only authorised sb028 personnel can access personal data, and only to the extent required for their specific duties.
• Regular security audits: The sb028 platform undergoes periodic security assessments and penetration testing by independent third-party specialists.
• Intrusion detection: Automated monitoring systems detect and respond to anomalous access patterns, potential brute-force attempts, and other indicators of compromise in real time.
• Staff training: All sb028 personnel with access to personal data receive regular training on data protection obligations and secure data handling procedures.

Despite these measures, no system is entirely immune to security threats. In the event of a data breach that is likely to result in a risk to your rights and freedoms, sb028 will notify affected members without undue delay and will take immediate steps to contain and remediate the breach.

The sb028 platform uses cookies and similar tracking technologies to deliver core functionality, maintain session integrity, and improve the overall member experience. The categories of cookies used are described below:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the sb028 platform. Disabling other cookie categories will not affect your ability to place bets or access your account balance, but may reduce the quality of your browsing experience.

As a member of the sb028 platform, you hold the following privacy rights with respect to your personal data. sb028 will respond to verified rights requests within 30 days of receipt. To exercise any of these rights, contact our support team at [email protected] or via live chat.

sb028 employs KYC verification procedures specifically designed to confirm that all registered members meet the minimum age requirement of 21 years before any withdrawal is authorised. Where sb028 discovers or has reasonable grounds to believe that a member is under the age of 21, the account will be suspended immediately, all transactions will be reviewed, and any funds deposited by the underage individual will be returned to the originating payment method following investigation.

If you are a parent or guardian and believe that a minor under your care has registered an account on sb028 without authorisation, please contact our support team immediately at [email protected]. We will act on such reports promptly and with full discretion.

As an internationally operated platform, sb028 may process and store personal data on servers located in jurisdictions outside of Indonesia. When personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to the standards applied by sb028, we ensure that appropriate safeguards are in place. These safeguards include contractual clauses that bind the receiving party to process data only in accordance with sb028's privacy standards and applicable law.

sb028's third-party data processors — including payment providers, KYC services, and game studios such as Pragmatic Play, Evolution Gaming, and others — operate under data processing agreements that restrict their use of member data to specified, limited purposes and require them to maintain security standards equivalent to those applied by sb028 itself.

sb028 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform operations. The date of the most recent revision is displayed prominently at the top of this document. When material changes are made to this Policy, sb028 will notify registered members by posting a notice on the platform and, where appropriate, by sending a communication to the email address on file.

Your continued use of the sb028 platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the platform and contact support to request account closure and data handling instructions.

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or want to raise a complaint about how sb028 has handled your personal data, please contact us through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly from the sb028 platform. Our Indonesian-speaking support agents can assist in both English and Bahasa Indonesia. Average response time is under 2 minutes.
• Email: [email protected] — privacy-related enquiries are prioritised and typically acknowledged within 4 hours.

sb028 will acknowledge all privacy rights requests and data-related complaints within 5 business days and aims to resolve them fully within 30 calendar days. Where a request is complex or involves a high volume of data, we may extend this period by a further 30 days with prior notification.

If you are not satisfied with sb028's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. Indonesian members may contact the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital) for guidance on privacy complaint procedures under Indonesian law.