sga508 Privacy Policy

1. Introduction

sga508 ("we," "us," or "our") operates an online betting and casino platform accessible at https://sga508.cam (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect personal data relating to our users ("you" or "your").

By registering for an account, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this policy, you must not use our services.

2. Data Controller

For the purposes of applicable data protection laws, the data controller responsible for your personal information is the entity operating sga508 under its international gaming license. Specific data controller details, including registered address and license number, are available upon request by contacting [email protected] (plain text, non-clickable).

sga508 serves users located in Indonesia. While Indonesia does not currently have comprehensive data protection legislation equivalent to the EU's General Data Protection Regulation (GDPR), sga508 voluntarily applies GDPR-equivalent principles to the processing of all user data, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

3. Information We Collect

3.1 Information You Provide Directly

When you register for an account or use our services, you directly provide us with the following categories of personal data:

• Identity Data: Full legal name, date of birth, gender, nationality, government-issued ID number (e.g., Indonesian KTP number).
• Contact Data: Residential address, email address, mobile phone number.
• Account Credentials: Username, password (stored in hashed form only).
• Financial Data: Bank account details, e-wallet account information, payment card details (processed securely via third-party payment processors; sga508 does not store full card numbers).
• Verification Documents: Copies of government-issued photo ID, proof of address, selfie photographs for identity verification (KYC) purposes.
• Communication Data: Any information you provide when contacting customer support, including chat transcripts, email correspondence, and attached files.

3.2 Information We Collect Automatically

When you access or use the Platform, we automatically collect certain technical and usage data:

• Device Data: IP address, device type, operating system, browser type and version, screen resolution, device identifiers.
• Usage Data: Pages visited, time spent on pages, click patterns, referral sources, search queries entered on the Platform.
• Transaction Data: Details of deposits, withdrawals, bets placed, games played, winnings, losses, bonus claims, and account balance history.
• Location Data: Approximate geographic location derived from IP address (used for fraud prevention and regulatory compliance).
• Cookie Data: Information collected via cookies and similar tracking technologies (see Section 9 for details).

3.3 Information from Third Parties

In limited circumstances, we may receive information about you from third-party sources:

• Identity Verification Providers: Data from KYC service providers that assist with verifying your identity and detecting fraudulent documents.
• Payment Processors: Transaction status information from banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Fraud Prevention Services: Risk scores and fraud indicators from specialized security vendors.

4. How We Use Your Data

sga508 processes your personal data for the following purposes, each based on a specific legal basis:

4.1 Account Management & Service Provision

Legal Basis: Performance of Contract

• Creating and maintaining your account;
• Processing deposits, withdrawals, and wagers;
• Delivering betting and gaming services, including sports betting, live casino, slots, and togel draws;
• Managing bonuses, promotions, and loyalty rewards;
• Providing customer support and responding to your inquiries.

4.2 Identity Verification & Compliance

Legal Basis: Legal Obligation & Legitimate Interests

• Verifying your identity and age (21+ requirement);
• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations;
• Preventing fraud, money laundering, and terrorist financing;
• Detecting and preventing prohibited activities such as bonus abuse, collusion, and use of automated bots;
• Complying with lawful requests from law enforcement, regulatory authorities, or courts.

4.3 Security & Fraud Prevention

Legal Basis: Legitimate Interests

• Monitoring account activity for suspicious behavior;
• Implementing technical and organizational security measures to protect your data;
• Investigating security incidents, policy violations, and user disputes;
• Blocking access from high-risk jurisdictions or IP addresses associated with fraudulent activity.

4.4 Marketing & Communications (with Consent)

Legal Basis: Consent

• Sending promotional emails about bonuses, new games, and special offers;
• Delivering personalized recommendations based on your gaming preferences;
• Conducting user surveys and requesting feedback on our services.

You may withdraw your consent to marketing communications at any time by clicking the "unsubscribe" link in any promotional email or by adjusting your account preferences. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.5 Analytics & Service Improvement

Legal Basis: Legitimate Interests

• Analyzing user behavior and platform performance to improve our services;
• Conducting A/B testing to optimize user experience;
• Identifying technical issues and troubleshooting platform errors;
• Generating aggregated, anonymized statistics for business intelligence purposes.

5. Data Sharing & Third Parties

sga508 does not sell or rent your personal data to third parties for their own marketing purposes. However, we do share your data with the following categories of third-party service providers, strictly to the extent necessary for the purposes outlined above:

5.1 Payment Processors

We share financial data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals. These providers operate under their own privacy policies and data protection obligations.

5.2 Game Providers

When you play casino games or place sports bets, certain session data (username, bet amounts, game outcomes) is shared with our licensed game suppliers, including Pragmatic Play, Microgaming, Evolution Gaming, NetEnt, and PG Soft. These providers use the data solely to deliver game services and for regulatory reporting.

5.3 Identity Verification & Fraud Prevention Services

We share identity documents and personal data with specialized KYC and AML service providers to verify your identity, detect fraudulent documents, and assess transaction risk. These providers are contractually bound to use your data only for verification purposes and to maintain strict confidentiality.

5.4 Cloud Infrastructure & IT Services

sga508 uses cloud hosting and infrastructure services to store data and operate the Platform. These providers have access to your data solely for the purpose of providing hosting, storage, and technical support services, and are subject to strict data processing agreements.

5.5 Legal & Regulatory Authorities

We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts when required by law, legal process, or in response to lawful requests. We will only disclose the minimum amount of information necessary to comply with such requests.

5.6 Business Transfers

In the event of a merger, acquisition, or sale of all or part of sga508's business, your personal data may be transferred to the acquiring entity. We will notify you of any such change in ownership or control of your personal data.

6. Data Security Measures

sga508 implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL (Secure Socket Layer) technology.
• Password Security: User passwords are hashed using strong cryptographic algorithms (bcrypt) and are never stored in plain text.
• Access Controls: Access to personal data is restricted to authorized sga508 personnel on a strict need-to-know basis.
• Intrusion Detection: Automated systems monitor for suspicious activity, unauthorized access attempts, and potential security breaches.
• Regular Audits: Independent security audits and penetration testing are conducted periodically to identify and remediate vulnerabilities.
• Data Segregation: Financial data and identity documents are stored separately from general account data, with enhanced access restrictions.

While we take every reasonable precaution to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

7. Data Retention

sga508 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods are as follows:

• Active Accounts: Personal data is retained for the duration of your active account relationship with sga508.
• Closed Accounts: After account closure, we retain identity verification documents and transaction records for 7 years to comply with AML and financial recordkeeping regulations.
• Marketing Data: If you unsubscribe from marketing communications, your email address is retained only for suppression purposes (to ensure we do not contact you again).
• Chat Logs & Support Records: Customer support communications are retained for 3 years for quality assurance and dispute resolution purposes.
• Anonymized Analytics Data: Aggregated, anonymized usage data may be retained indefinitely for statistical analysis.

At the end of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents reconstruction of the original data.

8. Your Data Rights

Subject to applicable law, you have the following rights regarding your personal data:

8.1 Right of Access

You have the right to request a copy of the personal data we hold about you. You can access most of your account data directly through your account dashboard. For a comprehensive data export, contact [email protected] (plain text, non-clickable).

8.2 Right to Rectification

If any of your personal data is inaccurate or incomplete, you have the right to request correction. You can update your contact details directly in your account settings. For changes to verified identity data, contact customer support with supporting documentation.

8.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected. However, we may be required to retain certain data to comply with legal obligations (e.g., AML recordkeeping requirements). Account deletion requests can be submitted via customer support.

8.4 Right to Restriction of Processing

You may request that we temporarily restrict processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing. During the restriction period, we will store the data but not process it further, except with your consent or for legal claims.

8.5 Right to Data Portability

You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) and to transmit that data to another service provider, where technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal data based on our legitimate interests. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims.

8.7 Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

8.8 Exercising Your Rights

To exercise any of these rights, contact [email protected] (plain text, non-clickable) with the subject line "DATA REQUEST." We will respond to verified requests within 30 days. We may require additional information to verify your identity before fulfilling the request.

9. Cookies & Tracking Technologies

sga508 uses cookies and similar tracking technologies to enhance your experience on the Platform. A cookie is a small text file stored on your device that allows us to recognize your browser and remember certain information.

9.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function, including session management and security authentication. These cannot be disabled.
• Performance Cookies: Collect anonymous information about how you use the Platform, such as which pages are visited most often. Used to improve site performance.
• Functionality Cookies: Remember your preferences (language, currency, display settings) to personalize your experience.
• Targeting/Advertising Cookies: Track your activity to deliver personalized promotional content. These cookies are only used with your consent.

9.2 Managing Cookies

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies if you prefer. Note that disabling certain cookies may impair the functionality of the Platform. To manage cookie preferences, adjust your browser settings or use our cookie consent tool (accessible via the cookie banner on your first visit).

10. International Data Transfers

sga508 operates internationally and may transfer your personal data to servers located outside Indonesia, including to jurisdictions that may not provide the same level of data protection as your home country. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities;
• Data processing agreements with third-party service providers that contractually commit them to GDPR-equivalent data protection standards;
• Technical security measures (encryption in transit and at rest).

By using sga508, you acknowledge and consent to the transfer of your personal data to such international locations for the purposes described in this Privacy Policy.

11. Protection of Minors

sga508 services are intended exclusively for individuals aged 21 years or older. We do not knowingly collect personal data from anyone under the age of 21. If we become aware that we have inadvertently collected data from a minor, we will immediately delete that data and close the associated account.

If you are a parent or guardian and believe that your child has provided personal data to sga508, please contact us immediately at [email protected] (plain text, non-clickable).

12. Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact sga508's Data Protection Officer:

• Email: [email protected] (plain text, non-clickable)
• Subject Line: "PRIVACY INQUIRY" or "DATA PROTECTION COMPLAINT"

We will investigate all complaints and respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in the jurisdiction where sga508's data controller is registered, or (for EU residents) with your local supervisory authority.

Last Updated: 1 January 2026
Version: 2026.01

By continuing to use sga508 after the effective date above, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.