Privacy Policy

1. Scope and Data Controller

This Privacy Policy applies to all personal data processed by sga058 in connection with the operation of the website sga058.cam, its mobile-optimised interface, associated applications, and all related betting and gaming services (collectively, the "Services"). It governs data collected from registered members, prospective members who have commenced the registration process, and anonymous visitors.

For the purposes of applicable data-protection law, sga058 acts as the data controller in respect of personal data collected directly from users. Where we use third-party processors—such as payment gateway providers, game studios, and fraud-detection services—those parties act as data processors under our instruction and are contractually bound by data-processing agreements consistent with the standards described in this policy.

2. Personal Data We Collect

2.1 Registration and Identity Data

When you create an account with sga058, we collect the following information:

• Full legal name as it appears on your Indonesian National Identity Card (KTP)
• Date of birth (to verify that you meet the minimum age of 21 years)
• Gender (optional, for personalisation purposes)
• Indonesian residential address, including province and postal code
• Valid email address
• Indonesian mobile telephone number
• Username chosen during registration
• Hashed and salted account password (we do not store passwords in plaintext)

2.2 Know Your Customer (KYC) Verification Data

Prior to processing your first withdrawal, and in accordance with our anti-money-laundering obligations, we collect:

• A clear photograph or certified scan of your KTP (National Identity Card) — front face
• A selfie photograph of you holding your KTP alongside your face
• Proof of residential address: a bank statement, utility bill, or government document issued within the preceding three months
• Source-of-funds declaration for accounts that exceed prescribed deposit thresholds

2.3 Financial and Transaction Data

To process deposits and withdrawals securely, we collect:

• Bank account name, account number, and the name of the Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, or Bank Danamon)
• E-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment references
• Wagering and gaming history necessary for bonus settlement and responsible-gaming monitoring

We do not store full bank account numbers or e-wallet credentials in an unmasked form beyond the requirements of the payment transaction itself. All payment data is handled by PCI-DSS-compliant payment processors.

2.4 Technical and Device Data

When you access the sga058 platform, our systems automatically record:

• IP address and approximate geographic location derived from IP geolocation
• Browser type, version, and language settings
• Operating system and device type (desktop, tablet, mobile)
• Session duration, pages visited, and navigation path through the site
• Referral URL (the website from which you arrived, if applicable)
• Error logs and crash reports

2.5 Communications Data

When you contact our customer support team via live chat, email, or WhatsApp, we retain:

• The content of your message, including any attachments
• Timestamps and the support channel used
• Assigned ticket or conversation reference numbers
• Resolution notes and follow-up records

2.6 Responsible Gaming Data

Where you make use of our responsible gaming tools—such as deposit limits, session time limits, loss limits, or self-exclusion—we record your preferences and the dates on which they were applied. This data is processed for your protection and cannot be overridden by marketing or customer-retention activities.

3. How We Collect Your Data

sga058 collects personal data through three principal channels:

1. Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, use live chat or email support, update your account settings, or respond to a survey or promotion.
2. Automatically — through cookies, web beacons, and server logs when you browse or interact with the sga058 platform, regardless of whether you are logged in.
3. From third parties — including payment processors confirming transaction status, identity-verification services cross-checking your KTP details, and fraud-detection partners flagging anomalous activity patterns.

4. Purposes and Legal Basis for Processing

We process your personal data only where we have a lawful basis for doing so. The table below summarises our primary processing activities:

Where we rely on consent as a legal basis (principally for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, adjust your communication preferences in your account settings or contact our support team directly.

5. Sharing Your Personal Data

sga058 does not sell, rent, or license your personal data to third parties for their own commercial purposes. We share data only in the following limited circumstances:

5.1 Service Providers and Data Processors

We engage carefully vetted third-party vendors who process data on our behalf under written data-processing agreements. These include:

• Payment processors: Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the data necessary to execute your transaction.
• Identity verification providers: KYC and document-verification partners receive the identity documents you submit to validate your identity against government records.
• Game studios and content providers: Providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Spribe receive a pseudonymised player identifier and session token to deliver game content. They do not receive your full name, bank details, or KTP number.
• Fraud-detection and cybersecurity vendors: These partners receive IP addresses, device fingerprints, and behavioural signals to identify and block fraudulent or abusive activity.
• Cloud hosting and infrastructure providers: Our platform is hosted on enterprise-grade servers. Infrastructure providers have access to server environments but operate under strict confidentiality agreements and have no independent right to access user data.

5.2 Legal and Regulatory Disclosure

We may disclose your personal data to government authorities, law enforcement agencies, or financial intelligence units when required by applicable law, a valid court order, or a lawful regulatory request. We will notify you of such a disclosure where we are legally permitted to do so.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of sga058, your personal data may be transferred to the acquiring entity. We will provide notice prior to any such transfer and ensure the receiving entity is bound by privacy obligations at least as protective as those set out in this policy.

6. International Data Transfers

As an internationally operated platform serving the Indonesian market, some of the third-party processors we engage may store or process data on servers located outside Indonesia. Where such transfers occur, sga058 ensures that adequate safeguards are in place, including:

• Standard contractual clauses approved by internationally recognised data-protection authorities
• Vendor certification under recognised data-protection frameworks
• Binding corporate rules where applicable

Core account data and KYC documents are stored on servers located within or proximate to the Asia-Pacific region to minimise transfer latency and limit cross-border exposure.

7. Data Retention Periods

We retain your personal data for as long as necessary to fulfil the purposes described in this policy and to comply with our legal obligations. Specific retention periods are as follows:

• Account and registration data: Retained for the duration of your active account plus five (5) years after account closure, to satisfy financial-record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission in line with anti-money-laundering obligations.
• Transaction records (deposits and withdrawals): Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the last interaction in a support thread.
• Technical logs (IP addresses, session data): Retained for thirteen (13) months on a rolling basis for security and fraud-investigation purposes.
• Marketing consent records: Retained for the duration of your consent plus three (3) years, to demonstrate compliance if queried.
• Responsible gaming records (deposit limits, self-exclusion): Retained permanently for accounts subject to permanent self-exclusion; for time-limited restrictions, retained for five (5) years after the restriction expires.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

8. Security Measures

sga058 maintains a comprehensive information-security programme designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational measures include:

8.1 Technical Controls

• Encryption in transit: All data transmitted between your browser and our servers is protected using TLS 1.3, the current industry standard for secure web communication.
• Encryption at rest: Stored personal data is encrypted using AES-256.
• Firewall and intrusion detection: Our network perimeter is protected by enterprise-grade firewalls and real-time intrusion-detection systems that alert on anomalous traffic patterns.
• Penetration testing: We commission independent security assessments and penetration tests on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Access controls: Internal access to production systems and user data is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all staff.

8.2 Organisational Controls

• All employees and contractors who handle personal data are subject to confidentiality obligations and receive regular data-protection training.
• A documented incident-response plan is maintained and tested annually, enabling us to detect, contain, and notify affected users of any data breach within the timeframes required by applicable law.
• Third-party vendors undergo a formal privacy and security assessment prior to engagement, and are subject to periodic reassessment.

9. Cookies and Tracking Technologies

sga058 uses cookies and similar technologies to operate the platform effectively and to understand how users interact with our services. A cookie is a small text file placed on your device by a web server. We use the following categories of cookies:

9.1 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled. They include session tokens that keep you logged in during a visit, CSRF-protection tokens that secure form submissions, and load-balancing cookies that route your requests to the appropriate server. No consent is required for strictly necessary cookies.

9.2 Functional Cookies

Functional cookies remember your preferences — such as your preferred language, currency display, and game lobby filter settings — so that you do not have to re-enter them on each visit. These cookies improve your experience but are not essential to basic platform operation.

9.3 Analytics Cookies

We use analytics tools to measure aggregate platform usage, identify popular features, track error rates, and evaluate the performance of promotional campaigns. Analytics data is collected in pseudonymised or aggregated form and is not used to identify individual users for marketing purposes.

9.4 Managing Cookies

You can control cookies through your browser settings. Most modern browsers allow you to block, delete, or receive notifications before a cookie is set. Please be aware that disabling certain cookies may impair the functionality of the sga058 platform — in particular, blocking strictly necessary cookies will prevent you from logging in or maintaining a secure session.

10. Your Data-Subject Rights

As a user of the sga058 platform, you have the following rights in respect of your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request." We will respond within fourteen (14) business days of receiving a verified request.

• Right of Access: You may request a copy of all personal data we hold about you, including the categories of data, the purposes for which it is processed, and any third parties to whom it has been disclosed.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request correction. For most account details, you can update information directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right is subject to our legal obligations to retain certain records (see Section 7).
• Right to Restriction of Processing: You may request that we temporarily halt processing of your data — for example, while a rectification request is being assessed.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and have it transmitted to another controller where technically feasible.
• Right to Object: You may object to processing carried out on the basis of legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

We will not charge a fee for handling data-rights requests unless requests are manifestly unfounded, excessive, or repetitive, in which case we reserve the right to charge a reasonable administrative fee or decline the request, with written reasons provided.

11. Minors — Users Under 21 Years of Age

The sga058 platform is strictly intended for adults aged 21 years and older. We do not knowingly collect, process, or retain personal data from individuals below this age threshold.

If we discover or are notified that an account has been created by a person under 21 years of age, we will immediately:

• Suspend and permanently close the account
• Void all bets placed and forfeit all balances associated with the account
• Securely delete all personal data collected from the underage individual, except where retention is required by law

If you are a parent or legal guardian and believe your child has created an account on sga058 without your knowledge, please contact us immediately at [email protected] so that we can act without delay.

12. Changes to This Privacy Policy

sga058 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, technological developments, regulatory requirements, or operational needs.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Display a prominent notice on the sga058 homepage for a period of at least 30 days
• Send an email notification to all registered users at their account email address

Your continued use of the sga058 platform following notification of changes constitutes acceptance of the revised policy. If you do not agree with material changes, you should close your account and cease using our services before the changes take effect.

We encourage you to review this Privacy Policy periodically to remain informed of how we protect your data.

13. Contact Us — Privacy and Data Queries

If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which sga058 processes your personal data, please reach out through any of the following channels:

Please include your registered account username or email address in any data-rights communication so that we can verify your identity and locate your records efficiently. We may request additional proof of identity before fulfilling a data-access or erasure request to ensure that data is not disclosed to or deleted at the request of an unauthorised party.