Privacy Policy — ug900

This Privacy Policy applies to all personal data processed by ug900 in connection with the operation of the online betting and casino platform accessible at https://ug900.onl (the "Platform"). It covers data collected through the Platform website, mobile-optimized interfaces, live chat support, email communications, and any other channel through which a Player interacts with ug900.

ug900 operates primarily to serve English-preference players based in Indonesia. Where applicable, this Policy reflects data protection standards consistent with internationally recognized privacy frameworks, including principles of data minimization, purpose limitation, storage limitation, and data subject rights.

This Privacy Policy forms part of the ug900 Terms & Conditions and should be read alongside them. By registering an Account or using the Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

If you do not agree with any part of this Privacy Policy, you should discontinue use of the Platform immediately and contact our support team to request account closure and withdrawal of any remaining IDR Balance.

The following defined terms are used throughout this Privacy Policy. Where a term is also defined in the ug900 Terms & Conditions, the same meaning applies here.

ug900 collects Personal Data in the following categories. We apply the principle of data minimization — we collect only the data that is strictly necessary for the stated purpose.

Registration & Identity Data:

• Full legal name as it appears on a government-issued identity document
• Date of birth (used to verify the 21+ age requirement)
• Email address (primary communication channel and Account identifier)
• Indonesian mobile phone number
• Username and hashed password (passwords are never stored in plain text)
• Preferred IDR payment method

KYC Verification Data:

• Scanned copy or photograph of a valid government-issued photo ID (Indonesian KTP, passport, or driver's license)
• Proof of residential address (utility bill, bank statement from BCA, BRI, BNI, Mandiri, or official correspondence — issued within the last 3 months)
• Proof of payment method ownership (where required for e-wallet or bank transfer verification)

Financial Transaction Data:

• Deposit and withdrawal amounts in Indonesian Rupiah (IDR)
• Payment method identifiers (bank account number last four digits, e-wallet phone number) — full account numbers are not stored on ug900 servers
• Transaction timestamps and reference numbers
• IDR Balance history and wagering activity records

Technical & Device Data:

• IP address at the time of registration and each subsequent login
• Device type, operating system, and browser version
• Session timestamps, login history, and geographic location derived from IP
• Cookie identifiers and session tokens

Communication Data:

• Live chat transcripts between the Player and ug900 support agents
• Email correspondence sent to or received from [email protected]
• Support ticket records and resolution notes

Responsible Gaming Data:

• Deposit limit settings and modification history
• Cooling-off and self-exclusion requests and their effective dates
• Session time reminder preferences

ug900 collects Personal Data through three primary channels:

• Directly from You: When you register an Account, complete KYC verification, make a deposit or withdrawal request, contact our support team, or update your Account preferences, you provide Personal Data directly to ug900.
• Automatically from Your Device: When you access the Platform, our servers and analytics tools automatically collect technical data including your IP address, browser type, device identifiers, session duration, pages visited, and in-game activity. This data is collected via server logs, cookies, and similar tracking technologies described in Clause 8.
• From Third-Party Service Providers: Our payment processing partners (operating the BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and CIMB Niaga payment rails) confirm transaction status and may supply transaction reference data to ug900 for reconciliation. Our fraud detection and KYC verification providers may supply risk scores, identity verification outcomes, or watchlist screening results associated with your submitted documents.

ug900 processes Personal Data for the following specific purposes. We do not use your data for any purpose incompatible with those listed below without first seeking your explicit consent.

ug900 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing that is necessary to perform the contract between ug900 and the Player — including Account registration, IDR transaction processing, KYC verification, and the provision of betting and gaming services. Without this processing, ug900 cannot provide the Platform services to you.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations — including anti-money laundering (AML) obligations, identity verification requirements, responsible gaming regulations, and record-keeping requirements imposed by ug900's international gaming license.
• Legitimate Interests: Processing carried out in the legitimate interests of ug900 or third parties, where those interests are not overridden by your privacy rights. This covers fraud prevention, platform security, abuse detection, and anonymized product analytics. ug900 performs a balancing test before relying on legitimate interests as a legal basis, and the results of those assessments are available upon request.
• Consent: Processing based on your freely given, informed, and specific consent — primarily for marketing communications via email or SMS. You may withdraw consent for marketing communications at any time by updating your Account notification preferences or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal.

ug900 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share Personal Data only in the following limited and controlled circumstances:

• Payment Processors: To complete IDR deposits and withdrawals, ug900 shares necessary transaction data with the relevant payment rails — BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, and ShopeePay. Each of these providers operates under its own privacy policy and data security obligations.
• KYC & Identity Verification Providers: ug900 uses third-party identity verification services to assist with document authentication, watchlist screening, and age verification. These providers process KYC documents strictly under our instruction and are contractually prohibited from using your data for any other purpose.
• Game Studios: When you play a game provided by Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Spribe, or Pocket Games Soft, limited session data (Player ID, wager amounts, game results) is shared with the studio's Remote Gaming Server (RGS) to generate and settle game outcomes. Studios do not receive your full name, payment details, or KTP number.
• Fraud & Security Providers: Anonymized or pseudonymized device and behavioral data may be shared with third-party fraud detection tools to identify account takeover attempts, multi-account abuse, and suspicious wagering patterns.
• Legal Authorities: ug900 will disclose Personal Data to law enforcement, regulators, or judicial authorities where required to do so by applicable law, court order, or regulatory mandate. We will notify you of any such disclosure to the extent permitted by law.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all assets of ug900, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer in advance.

The ug900 Platform uses cookies and similar tracking technologies to operate core Platform functions, remember your preferences, and analyze aggregate usage patterns. Below is a breakdown of the cookie categories in use:

You can manage functional and analytics cookies through your browser settings. Disabling strictly necessary or security cookies will impair or prevent your ability to use the Platform. ug900 does not use third-party advertising cookies or cross-site behavioral tracking cookies. No advertising network or retargeting pixel is installed on the Platform.

ug900 retains Personal Data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law, whichever is longer. The following retention schedules apply:

• Active Account Data: Retained for the lifetime of the Account plus a minimum of 5 years after Account closure, to satisfy anti-money laundering record-keeping obligations and to support dispute resolution.
• KYC Documents: Retained for a minimum of 5 years from the date of submission, regardless of whether the Account remains active, in accordance with standard KYC compliance requirements applicable to internationally licensed gaming operators.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of the transaction. IDR transaction logs are retained in full — including deposit amounts, withdrawal amounts, and wagering history — for audit and regulatory compliance purposes.
• Support Communications: Live chat transcripts and email correspondence are retained for 2 years from the date of the last interaction in a given support thread, after which they are permanently deleted unless subject to an active dispute or legal hold.
• Marketing Consent Records: Records of consent and withdrawal of consent for marketing communications are retained for 5 years to demonstrate compliance with consent obligations.
• Technical & Device Logs: Raw server access logs (containing IP addresses and session data) are retained for 12 months, after which they are deleted or anonymized for aggregate analytics purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual. ug900 conducts annual data retention audits to ensure that data is not held beyond its prescribed retention period.

ug900 implements a layered technical and organizational security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Our security framework includes the following controls:

• Encryption in Transit: All data exchanged between your device and ug900 servers is encrypted using TLS 1.2 or TLS 1.3 with 256-bit AES encryption. HTTPS is enforced on all Platform pages with HTTP Strict Transport Security (HSTS) headers activated.
• Encryption at Rest: Sensitive Personal Data stored in ug900 databases — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256.
• Password Security: Player passwords are never stored in plain text. ug900 uses a salted cryptographic hashing function (bcrypt) to store password credentials. ug900 staff cannot retrieve your password; they can only trigger a password reset on your behalf.
• Access Controls: Access to Personal Data within ug900's internal systems is restricted on a strict need-to-know basis. Role-based access controls (RBAC) limit which staff members can view which categories of data. All internal access is logged and subject to quarterly review.
• Two-Factor Authentication: 2FA is available to all Players and is strongly recommended. ug900 internal staff are required to use 2FA on all systems that access Personal Data.
• Security Audits: ug900 commissions independent penetration testing and vulnerability assessments on a periodic basis. Critical vulnerabilities are remediated within 72 hours of discovery.
• Data Breach Response: In the event of a confirmed data breach affecting Player Personal Data, ug900 will notify affected Players within 72 hours of becoming aware of the breach, describing the nature of the data affected, the likely consequences, and the steps taken to mitigate harm.

As a Player on the ug900 Platform, you have the following rights with respect to your Personal Data. ug900 is committed to honoring these rights promptly and without undue delay — in all cases within 30 days of receiving a valid request.

To exercise any of the above rights, please contact our support team via live chat or email at [email protected] with the subject line "Data Rights Request — [Your Account Username]". We may need to verify your identity before processing the request.

The ug900 Platform is strictly an adults-only service. You must be at least 21 years of age to register an Account, deposit funds, and participate in real-money betting and gaming on the Platform. This age threshold is applied consistently across all product categories — sportsbook, live casino, slots, crash games, and card game formats.

ug900 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that an Account has been registered by a minor, or that a minor has circumvented our age verification controls, we will immediately close the Account, return any deposited IDR funds (less any withdrawals already made), delete all associated Personal Data, and report the matter to the relevant authorities where required.

If you are a parent or guardian and believe that a minor under your care has registered on the ug900 Platform, please contact our support team immediately at [email protected]. We will investigate and respond within 24 hours.

The ug900 Platform may contain links to or embed content from third-party services, including game studio interfaces (Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Spribe, Pocket Games Soft) and payment method provider pages. This Privacy Policy does not extend to the privacy practices of those third-party services.

When you interact with a game studio's Remote Gaming Server (RGS) environment, you are subject to that studio's data practices in addition to ug900's. We encourage you to review the privacy policies of any third-party service you interact with through the Platform.

ug900 is not responsible for the privacy practices, content, or security of any third-party service provider. However, all Third-Party Service Providers who process Personal Data on ug900's behalf are contractually required to maintain privacy and security standards consistent with this Policy.

ug900 reserves the right to update this Privacy Policy at any time. Where changes are material — meaning they could reasonably affect your privacy rights or how your data is used — ug900 will provide at least 7 days' advance notice via email to your registered address and via a Platform notification.

Non-material changes (such as formatting corrections, clarifications that do not change substantive meaning, or updates to reflect new contact details) may be made without prior notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent amendment.

Your continued use of the Platform following the effective date of any amended Privacy Policy constitutes your acknowledgment of the updated Policy. If you do not agree to the updated Policy, you must cease using the Platform and request account closure before the effective date.

For all privacy-related queries, data rights requests, or concerns about how ug900 handles your Personal Data, please contact us through one of the following channels:

• Live Chat: Available 24/7 directly within the ug900 Platform. Native Indonesian-speaking agents are available across all shifts. For privacy and data rights requests, please state "Data Rights Request" at the start of your chat session so the query is routed to the appropriate team.
• Email: [email protected] (plain text — not a clickable link). Use the subject line "Privacy Query — [Your Account Username]" for general privacy questions, or "Data Rights Request — [Your Account Username]" for formal rights exercises. We aim to respond to all privacy-related emails within 2 business hours during WIB (UTC+7) business hours, and within 12 hours outside those hours.