Privacy Policy — on999

1 Who We Are

on999 is an internationally licensed online gaming platform offering sports betting, live casino, slot games, and togel (Indonesia's traditional numbers lottery) markets to adult players. The platform is operated by the on999 group of companies, collectively referred to in this Privacy Policy as "on999", "we", "us", or "our". For all data protection enquiries, on999 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed.

Our primary contact email for data protection matters is [email protected]. This address is a plain text reference only and is not a clickable mailto link.

2 Data We Collect

on999 collects the following categories of personal data in connection with your use of the platform:

2.1 Identity Data

Your legal full name, date of birth, nationality, and government-issued identification number (e.g., Indonesian National ID / KTP number or passport number). This data is required for account registration and mandatory KYC verification.

2.2 Contact Data

Your email address, mobile phone number, and residential address in Indonesia (including city, province, and postal code). Contact data is used for account communications, transactional notifications, and responsible gaming outreach.

2.3 Identity Verification Documents

Scanned or photographed copies of government-issued identity documents (KTP, passport, or driving licence), proof of address documents (bank statements, utility bills), and, where required by our compliance team, a selfie photograph holding your identity document. These documents are collected as part of our KYC process and are stored securely with strict access controls.

2.4 Financial Data

Your registered bank account details (bank name, account number, and account holder name) for Indonesian payment channels including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, and Bank Permata, as well as e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja. Full card numbers and PIN codes are never stored by on999.

2.5 Transaction Data

Records of all deposits, withdrawals, wagers placed, game sessions, bonuses claimed, and account balance movements, including timestamps expressed in Western Indonesia Time (WIB, UTC+7).

2.6 Technical Data

Your IP address, device type and model, operating system, browser type and version, screen resolution, time zone setting, approximate geographic location derived from IP, session duration, and referring URL. This data is collected automatically when you visit the on999 platform and is used for security, fraud detection, and platform optimisation purposes.

2.7 Usage Data

Clickstream data, page views, feature interactions, game preferences, search queries entered within the platform, and betting history patterns. This data is analysed in aggregate to improve the player experience and to identify problem gambling indicators for responsible gaming intervention.

2.8 Communications Data

Records of your correspondence with on999's customer support team via live chat or email, including chat transcripts and support ticket history. These records are retained for quality assurance, training, and dispute resolution purposes.

3 How Data Is Collected

on999 collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically via cookies, server logs, and analytics tools when you interact with the platform.
• Third-party sources: Identity and fraud-risk data received from KYC verification service providers, payment processors (BCA, BRI, OVO, DANA, etc.), and industry-standard fraud-intelligence feeds, where applicable.
• Publicly available sources: In limited circumstances, on999 may supplement your profile with information from publicly available registries where this is necessary for compliance with anti-money laundering obligations.

4 How We Use Your Data

on999 uses your personal data for the following purposes:

Purpose	Categories of Data Used
Account registration and management	Identity, Contact
KYC identity verification	Identity, Identity Verification Documents, Financial
Processing deposits and withdrawals	Financial, Transaction, Identity
Providing gaming and betting services	Transaction, Usage, Technical
Fraud prevention and security	Technical, Transaction, Identity, Financial
Anti-money laundering compliance	Identity, Financial, Transaction
Responsible gaming monitoring	Usage, Transaction, Communications
Customer support	Identity, Contact, Communications
Platform analytics and improvement	Technical, Usage (aggregated and anonymised)
Promotional communications (with consent)	Contact, Usage

5 Legal Basis for Processing

on999 relies on the following legal bases for processing personal data:

• Contractual necessity: Processing required to perform the contract between on999 and you as a registered player — including account creation, KYC, payment processing, and game delivery.
• Legal obligation: Processing required for compliance with anti-money laundering laws, financial crime reporting obligations, and applicable gaming regulations.
• Legitimate interests: Processing necessary for on999's legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications and optional analytics features. Consent may be withdrawn at any time.

6 Sharing Your Data

on999 does not sell your personal data. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to contractual data protection obligations:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja, for the purpose of processing your deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged to verify the authenticity of identity documents and perform sanctions screening.
• Game content providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive aggregated, anonymised session data necessary to deliver their game content. They do not receive your identity or financial data.
• IT and infrastructure providers: Cloud hosting, content delivery, and cybersecurity service providers who process data on on999's behalf under strict data processing agreements.
• Fraud and security intelligence services: Industry-standard fraud-detection networks that receive transaction metadata (not identity data) to assess risk signals.
• Regulatory and law enforcement authorities: Where on999 is legally required to disclose data by court order, regulatory direction, or applicable law — for example, suspicious transaction reporting to anti-money laundering authorities.
• Professional advisers: Legal counsel, auditors, and accountants engaged on a confidential basis where necessary for the operation of the business.

7 Cookies & Tracking Technologies

on999 uses cookies and similar tracking technologies on the platform. The following categories of cookies are deployed:

• Strictly necessary cookies: Essential for the platform to function correctly, including session authentication, load balancing, and security tokens. These cannot be disabled without impairing your ability to use the platform.
• Functional cookies: Remember your preferences such as language setting, display options, and last-visited game category to personalise your experience across sessions.
• Analytics cookies: Collect anonymised data about how players navigate the platform — page visit counts, session durations, and feature interaction rates — to help on999 improve the user experience. Analytics data is aggregated and cannot be used to identify individual players.
• Fraud prevention cookies: Assign a persistent device fingerprint used to identify suspicious login patterns, account takeover attempts, and bonus abuse signals.

You may manage your cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent you from logging in to your account. on999 does not use cross-site advertising tracking cookies or share cookie data with advertising networks.

8 Data Security

on999 implements a layered approach to data security that includes the following controls:

• 256-bit SSL/TLS encryption for all data in transit between your device and on999 servers.
• AES-256 encryption for sensitive data stored at rest, including KYC document scans and financial account details.
• Role-based access controls ensuring that only authorised personnel with a demonstrated need to access specific data categories are granted access.
• Multi-factor authentication enforced for all internal administrative accounts with access to player data systems.
• Regular independent security audits and penetration tests carried out by certified third-party security firms.
• Intrusion detection systems and 24/7 security monitoring of all production infrastructure.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, on999 will notify affected players without undue delay in accordance with applicable notification obligations.

9 Retention Periods

on999 retains personal data for the following periods:

• Account and identity data: Retained for the duration of your active account, plus a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping obligations.
• KYC documents: Retained for a minimum of five (5) years after the end of the business relationship.
• Transaction records: Retained for a minimum of five (5) years after the date of the transaction.
• Customer support communications: Retained for two (2) years after the closure of the relevant support ticket, unless the matter relates to an ongoing dispute or regulatory investigation.
• Marketing consent records: Retained for the duration of your marketing subscription plus three (3) years after you withdraw consent, to demonstrate the lawful basis for communications sent during the subscription period.
• Technical and usage logs: Retained for thirteen (13) months in rolling log files, after which they are aggregated and anonymised for analytical purposes.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with on999's data disposal procedures.

10 Your Rights

As a player whose personal data is processed by on999, you hold the following rights with respect to that data. These rights are not absolute — they may be subject to limitations under applicable law, including anti-money laundering record-keeping obligations — but on999 will always assess and respond to your request in good faith:

• Right of access: You may request a copy of the personal data on999 holds about you, along with information about the purposes for which it is processed, the categories of data held, and the third parties with whom it has been shared.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data. Where data is used for active KYC or compliance purposes, additional verification may be required before a correction is applied.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where processing is unlawful. This right does not apply where retention is required by law — for example, transaction records subject to anti-money laundering retention obligations.
• Right to restriction: You may request that on999 restrict the processing of your data — meaning we may store it but not actively use it — in circumstances where its accuracy is contested, where processing is unlawful but you prefer restriction over erasure, or where you have objected to processing pending verification of whether legitimate grounds override your objection.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that on999 provide your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON).
• Right to object: You may object at any time to processing based on legitimate interests, including profiling for responsible gaming monitoring. on999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact on999 at [email protected]. All requests are acknowledged within five (5) business days. Complex requests will be resolved within thirty (30) calendar days; in exceptional circumstances this may be extended by a further two months, in which case you will be notified of the extension and the reason for the delay.

11 Minors & Age Restriction

on999 operates a strict 21+ only policy. The platform is not directed at, nor intended to be used by, any person under the age of 21. on999 does not knowingly collect personal data from anyone under 21 years of age. If on999 becomes aware that personal data has been collected from a person under the age of 21, the relevant account will be immediately suspended and all associated data will be reviewed and handled in accordance with applicable child data protection requirements.

12 International Data Transfers

on999 may transfer your personal data to countries outside Indonesia in connection with the use of cloud infrastructure, KYC verification services, or game content delivery networks. Where such transfers occur, on999 ensures that appropriate safeguards are in place to protect the transferred data, including:

• Contractual data protection clauses equivalent to international standard contractual clauses.
• Transfer only to countries or organisations that maintain an adequate level of data protection as assessed by on999's data protection team.
• Binding corporate rules or equivalent frameworks where data is shared within on999's corporate group.

For further information about the specific safeguards applied to any international transfer of your data, please contact on999 using the details in Section 15.

13 Third-Party Links

The on999 platform may contain references to third-party services, such as game studio websites or payment provider portals. This Privacy Policy applies only to the on999 platform and does not cover the privacy practices of any third-party website or service. on999 takes no responsibility for the content or privacy practices of third-party services. We encourage you to read the privacy policy of any third-party service you access.

14 Policy Amendments

on999 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, or regulatory guidance. Material changes will be communicated to registered players by email to the address associated with your account and will be published on this page with an updated "Last Updated" date at the top of the policy. Your continued use of the platform following the effective date of any amendment constitutes your acknowledgement of the revised Privacy Policy.

Where any amendment involves a new or materially different use of your personal data that requires your consent, on999 will seek your fresh consent before applying the new processing activity to your data.

15 Contact & Complaints

If you have any questions, concerns, or formal complaints regarding this Privacy Policy or on999's data processing activities, please contact us through the following channel:

• Email: [email protected] — plain text only, not a clickable link.
• Live Chat: Available 24/7 via the on-platform chat widget, with native Indonesian-speaking agents available across WIB, WITA, and WIT time zones.

on999 aims to acknowledge all formal data protection complaints within five (5) business days and to resolve them within thirty (30) calendar days. If you are not satisfied with on999's response to your complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction of residence.