rk999 Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below. References to the singular include the plural where the context requires.

rk999 collects the following categories of Personal Data in connection with the registration, operation, and maintenance of member accounts and the delivery of our betting and gaming services.

2.1 Identity & Registration Data. When you create an rk999 account, we collect your full legal name, date of birth, nationality, residential address (including city — for example, Jakarta, Surabaya, Bandung, or Bali), email address, and mobile phone number. This data is mandatory; without it, we cannot create or maintain a verified account.

2.2 Identity Verification (KYC) Data. To comply with our international licensing obligations and anti-money-laundering (AML) requirements, rk999 may require copies of government-issued identity documents — including your national identity card (KTP), passport, or driving licence — as well as proof of residential address and, in certain cases, documentation evidencing the source of funds used for deposits.

2.3 Financial Data. We collect details of the Indonesian bank accounts, e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and other payment instruments you use to deposit and withdraw funds. This includes account numbers, account holder names, and transaction reference data. rk999 does not store full card numbers or one-time PINs.

2.4 Transaction & Wagering Data. rk999 maintains a complete record of all deposits, withdrawals, bonus credits, wagers, game sessions, and winnings associated with your account. This includes timestamps, amounts in IDR, game titles (including sportsbook, live casino, togel (Indonesia's traditional numbers lottery), and slots), and settlement outcomes.

2.5 Technical & Device Data. When you access the rk999 platform, we automatically collect your IP address, browser type and version, operating system, device model, screen resolution, referring URL, and session duration. This data is used for security monitoring, fraud detection, and platform optimisation.

2.6 Behavioural & Usage Data. We collect data about how you navigate and interact with the platform — including pages visited, features used, bet placement patterns, and customer support interactions. This informs our responsible gaming monitoring and personalisation of your experience.

2.7 Communications Data. If you contact rk999 via live chat, WhatsApp, or email, we retain records of those communications — including chat transcripts, email correspondence, and call logs where applicable — for quality assurance, dispute resolution, and legal compliance purposes.

rk999 collects Personal Data through the following channels and mechanisms:

• Direct Submission: Data you provide when completing the registration form, KYC verification upload, deposit or withdrawal request, bonus claim, or customer support enquiry.
• Automated Collection: Data generated automatically when you access the platform, including server logs, session cookies, and analytics scripts that record technical and behavioural data as described in Section 2.5 and 2.6.
• Payment Processors: Financial transaction confirmation data received from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate deposit or withdrawal transactions.
• Identity Verification Providers: Confirmation responses from third-party KYC service providers who verify the authenticity of identity documents submitted during the verification process.
• Game Studios: Session and outcome data passed from certified third-party game studios (including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to rk999's platform servers for the purposes of account settlement and game history recording.
• Fraud Prevention Partners: Risk signals and device fingerprinting data from third-party fraud detection services engaged by rk999 to protect the integrity of the platform and the security of member accounts.

rk999 processes your Personal Data for the following specific purposes. We do not process Personal Data for any purpose that is incompatible with those listed below without first obtaining your explicit consent or as otherwise required by applicable law.

rk999 processes your Personal Data on the following legal grounds, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to perform the contract between rk999 and you as a member — including account creation, transaction processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC/AML verification, record-keeping obligations under our international operating licence, and responding to lawful government or regulatory requests.
• Legitimate Interests: Processing carried out to pursue rk999's legitimate business interests — including fraud prevention, platform security, multi-accounting detection, and improvement of services — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit consent — primarily for the receipt of promotional communications. You may withdraw consent at any time by contacting rk999 support, without affecting the lawfulness of processing carried out prior to withdrawal.

rk999 does not sell, rent, or trade your Personal Data to third parties for commercial marketing purposes. We may share Personal Data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment Processors & Financial Institutions: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) require transaction details to process deposits and withdrawals. These institutions operate under their own regulatory obligations and privacy frameworks.
• Identity Verification Providers: Third-party KYC service providers receive copies of identity documents and member-submitted verification data solely for the purpose of conducting identity and age verification checks on rk999's behalf.
• Game Studios & Content Providers: Session initiation data — including member identifiers, account balance, and stake amounts — is exchanged with certified game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) to enable real-money gameplay and settle outcomes. These studios are prohibited by their licence agreements from using member data for any purpose other than game delivery and settlement.
• Fraud Prevention & Security Partners: Device fingerprinting, IP reputation, and behavioural risk data may be shared with specialist fraud detection partners to protect the platform and its members from fraudulent activity.
• Regulatory Authorities & Law Enforcement: rk999 will disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts where required by applicable law, a court order, or a lawful regulatory demand. Where legally permissible, rk999 will notify affected members of such disclosure.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of rk999's business, Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. Members will be notified of any such transfer in advance where legally permissible.

All Third-Party Processors engaged by rk999 are required to enter into data processing agreements that mandate confidentiality, restrict the use of data to the specified purpose, and require the implementation of appropriate technical and organisational security measures.

rk999 uses cookies and similar tracking technologies — including pixel tags, local storage objects, and session tokens — to operate the platform, maintain your session, and analyse usage patterns. The following categories of cookies are in use:

You may manage cookie preferences through your browser settings. Disabling strictly necessary or security cookies will impair your ability to use the rk999 platform. Disabling performance and functional cookies will reduce the personalisation of your experience but will not prevent you from accessing core services.

rk999 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, subject to the following retention periods and considerations:

• Active Account Data: Personal Data associated with an active member account is retained for the duration of the membership and for a period of five (5) years following the closure of the account, to satisfy anti-money-laundering record-keeping obligations and to resolve any latent disputes or regulatory enquiries.
• KYC Documents: Copies of identity documents submitted during KYC verification are retained for a minimum of five (5) years following the closure or last active transaction on the associated account, consistent with international AML standards applicable to rk999's operating licence.
• Transaction Records: Complete records of all deposits, withdrawals, and wagers are retained for a minimum of seven (7) years to satisfy financial record-keeping requirements under rk999's licensing obligations.
• Customer Support Records: Communications records — including live chat transcripts, WhatsApp message logs, and email correspondence — are retained for a period of three (3) years from the date of the interaction, except where the content is relevant to an open dispute or regulatory investigation, in which case retention is extended until final resolution.
• Technical Logs: Server logs, IP address records, and device fingerprint data are retained for a period of twelve (12) months for security monitoring and fraud investigation purposes, after which they are deleted or irreversibly anonymised.
• Inactive Accounts: Where a member account has recorded no login or transaction activity for a continuous period of twenty-four (24) months, rk999 will issue a reactivation notice via the member's registered contact details. If no response is received within 30 days, Personal Data not subject to mandatory retention obligations may be anonymised or deleted in accordance with rk999's data minimisation policy.

rk999 implements a layered set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and rk999 servers is encrypted using TLS 1.3, the current industry standard for secure web communications.
• AES-256 Encryption at Rest: Sensitive Personal Data — including KYC documents, financial account details, and hashed authentication credentials — is encrypted at rest using AES-256 encryption.
• Two-Factor Authentication (2FA): rk999 offers and strongly recommends two-factor authentication for member accounts. Critical account changes — including withdrawal destination modifications and password resets — require 2FA confirmation.
• Access Controls: Access to Personal Data within rk999's organisation is restricted on a strict need-to-know basis, enforced through role-based access controls and privileged access management protocols. All staff with access to member data are subject to confidentiality agreements.
• Intrusion Detection & Monitoring: rk999 operates continuous network intrusion detection systems and security information and event management (SIEM) tools to identify and respond to security incidents in real time.
• Vulnerability Management: The rk999 platform undergoes regular security assessments, penetration testing, and code reviews conducted by qualified internal and external security professionals.
• Incident Response: In the event of a confirmed data breach that is likely to result in a risk to members' rights and freedoms, rk999 will notify affected members within 72 hours of becoming aware of the breach, via registered email or WhatsApp, and will take immediate remedial action to contain the breach and prevent recurrence.

As an rk999 member, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact rk999's Data Protection team via the channels listed in Section 15. We will acknowledge your request within 5 business days and respond in full within 30 calendar days.

• Right of Access: You have the right to request a copy of all Personal Data that rk999 holds about you, together with information about the purposes for which it is processed, the categories of data involved, and the recipients with whom it has been shared.
• Right to Rectification: If any Personal Data held by rk999 is inaccurate or incomplete, you have the right to request its correction. Identity-related corrections may require supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where you object to processing based on legitimate interests. This right is subject to overriding legal obligations — for example, rk999 cannot delete transaction records that must be retained for AML compliance.
• Right to Restriction: You may request that rk999 restrict the processing of your Personal Data in circumstances where the accuracy of the data is contested, the processing is unlawful but you prefer restriction over deletion, or you have objected to processing pending verification of rk999's legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive a structured, machine-readable copy of the Personal Data you have provided to rk999, and to request that it be transmitted directly to another service provider where technically feasible.
• Right to Object: You have the right to object to the processing of your Personal Data where rk999 relies on legitimate interests as the legal basis, and where your individual circumstances warrant overriding those interests. You may also object at any time to the use of your data for direct marketing purposes, including profiling related to such marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

The rk999 platform is strictly intended for adults aged 21 years and over. rk999 does not knowingly collect Personal Data from individuals under the age of 21. The 21+ minimum age requirement is enforced at registration through age declaration and, upon withdrawal request, through mandatory KYC document verification.

If rk999 becomes aware that Personal Data has been collected from an individual who is under 21 years of age, the following actions will be taken immediately:

• The account will be suspended and access to the platform will be revoked.
• Any funds deposited by the minor will be returned to the originating payment method.
• All Personal Data associated with the minor's account will be deleted from rk999's active systems as promptly as is consistent with any mandatory legal retention obligations.

If you are a parent or guardian and believe that a person under the age of 21 has created an account on rk999 using information under your household, please contact our support team immediately via live chat or WhatsApp (+62 811 9999 0000). rk999 takes underage gambling with the utmost seriousness and will act on all such reports within 24 hours.

The rk999 platform integrates with a number of third-party service providers whose software or infrastructure forms part of the overall member experience. These include:

• Game Studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft operate their game engines on their own servers. When you launch a game, certain data — including your member ID and current balance — is passed to the studio's systems to initialise and settle the session. Each studio operates under its own privacy policy and is bound by contractual data processing obligations with rk999.
• Payment Infrastructure: Indonesian bank transfer processing and e-wallet settlement (OVO, DANA, GoPay, ShopeePay, LinkAja) is facilitated through licensed payment gateway providers operating in Indonesia. These providers are subject to Bank Indonesia regulations governing the handling of payment data.
• Analytics Providers: rk999 may use anonymised session analytics tools to monitor platform performance. No personally identifiable information is shared with analytics providers; data is aggregated and stripped of direct identifiers before transmission.
• Customer Communication Platforms: Live chat and messaging services integrated into the rk999 platform may be powered by third-party communication infrastructure providers. All such providers are bound by data processing agreements with rk999 that prohibit independent use of member communication data.

rk999 is not responsible for the privacy practices of third-party websites or services that are not operated by rk999 and are not integrated into the platform pursuant to a data processing agreement. Members should review the privacy policies of third-party services independently.

rk999 operates under an international gaming licence and engages service providers located in various jurisdictions. As a result, your Personal Data may be transferred to, stored in, or processed in countries outside of Indonesia. Where such transfers occur, rk999 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses in data processing agreements with Third-Party Processors that impose data protection standards equivalent to those required by rk999's operating licence.
• Technical measures — including end-to-end encryption and tokenisation — that protect Personal Data in transit and at rest regardless of the processing location.
• Restriction of international transfers to jurisdictions that maintain adequate data protection frameworks or to service providers that have implemented certified data security standards.

Where technically and commercially feasible, rk999 prefers to engage service providers with data centre presence in Southeast Asia to minimise latency and to align with the data sovereignty expectations of our Indonesian member base.

rk999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the services we offer. When material changes are made, rk999 will:

• Post the updated Privacy Policy at rk999.cam/privacy-policy with a revised "Last Updated" date.
• Notify active members via a prominent notice displayed on the platform and/or a direct message to the registered email address or WhatsApp number, at least 7 days before the updated Policy takes effect — except where immediate amendment is required by a regulatory authority or emergency legal obligation.

Your continued use of the rk999 platform following the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease using the platform and may request account closure in accordance with the procedures set out in the rk999 Terms & Conditions.

rk999 recommends that members review this Privacy Policy periodically. The current version will always be accessible at rk999.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way rk999 handles your Personal Data, please contact our Data Protection team through any of the following channels:

All formal privacy requests — including access, rectification, erasure, restriction, portability, and objection requests — will be acknowledged within 5 business days of receipt and resolved within 30 calendar days, extendable by a further 60 days where the complexity or volume of requests requires it, with written notice of the extension provided to you.

rk999 takes privacy complaints seriously. If you are not satisfied with our response to your complaint, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction applicable to rk999's operating licence.