Privacy Policy

1 Introduction

sga388 ("we", "us", "our") operates the online gaming platform accessible at https://sga388.cam and is committed to handling personal data responsibly, transparently, and in compliance with applicable data protection principles. This Privacy Policy sets out the legal framework under which we collect, process, store, and share information about you as a registered Player or visitor to the sga388 Platform.

We recognize that players accessing the sga388 Platform from Indonesia, including residents of Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and across the archipelago, entrust us with sensitive personal and financial information. That trust is something we work actively to deserve. We do not treat data protection as a compliance formality; it is a genuine operational commitment embedded in every system and process we operate.

This Policy should be read alongside our Terms & Conditions, which govern the overall legal relationship between sga388 and its Players.

2 Data Controller

For the purposes of this Privacy Policy, the data controller — the entity that determines the purposes and means of processing your personal data — is the sga388 operating entity holding the international gaming license under which this Platform is run.

All data subject requests, privacy complaints, and inquiries regarding this Policy should be directed to our Data Protection contact, reachable via the contact information in Section 15 of this document. We will respond to all formal data subject requests within 30 calendar days of receipt.

3 Data We Collect

sga388 collects the following categories of personal data, depending on your interaction with the Platform:

We do not collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, health data, or biometric identifiers) unless specifically required by KYC compliance obligations and only to the minimum extent necessary.

4 How We Collect Data

We collect personal data through the following means:

• Direct submission: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, or contacting our support team.
• Automated technical collection: Data gathered automatically when you access the Platform, including IP addresses, device identifiers, cookies, and session logs.
• Third-party payment processors: Transaction confirmation data received from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• Identity verification services: Data returned by third-party KYC and anti-money-laundering screening providers during the account verification process.
• Fraud prevention tools: Data from device fingerprinting and behavioral analytics systems used to detect unauthorized access, multi-accounting, and fraudulent activity.

5 Purposes of Processing

sga388 processes your personal data for the following defined purposes only. We do not process data for any purpose incompatible with those listed below without first obtaining your consent or establishing a separate legal basis:

1. Account creation and management: To register, authenticate, and maintain your Player Account, including password recovery and account security.
2. KYC and identity verification: To verify your age (21+ requirement), identity, and address as required by our anti-money-laundering obligations and our own player protection standards.
3. Payment processing: To process deposits in IDR via local Indonesian banks and e-wallets, and to execute withdrawal requests to your verified payment accounts.
4. Contractual performance: To deliver the gaming services described in our Terms & Conditions, including game access, sportsbook markets, bonus crediting, and VIP tier management.
5. Customer support: To respond to your inquiries, resolve disputes, process complaints, and provide technical assistance via live chat, WhatsApp, and email.
6. Fraud prevention and security: To detect and prevent unauthorized access, multi-accounting, bonus abuse, money laundering, and other prohibited conduct.
7. Responsible gaming: To monitor gaming patterns for indicators of problem gambling, apply self-exclusion and deposit limit tools, and fulfill our duty-of-care obligations to Players.
8. Legal and regulatory compliance: To fulfill obligations under applicable anti-money-laundering laws, international gaming licensing conditions, and data retention requirements.
9. Platform improvement: To analyze aggregate behavioral data for the purpose of improving game offerings, Platform performance, and user experience.
10. Marketing communications: To send you promotional offers, bonus notifications, and seasonal promotions (e.g., Idul Fitri, Ramadhan, and other relevant events) — only where you have provided explicit opt-in consent and subject to your right to withdraw consent at any time.

6 Legal Basis for Processing

For each processing activity, sga388 relies on one or more of the following legal bases:

Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment to confirm that our interests do not override your fundamental rights and freedoms. You may request a copy of that assessment by contacting us at the details in Section 15.

7 Data Sharing

sga388 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share personal data only in the following limited circumstances, and only to the minimum extent necessary:

• Payment processors and banks: Financial data is shared with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute deposit and withdrawal transactions.
• KYC and AML service providers: Identity documents and verification data are shared with licensed third-party identity verification and anti-money-laundering screening providers operating under strict confidentiality obligations.
• Game software providers: Aggregated, non-personally-identifiable gameplay data may be shared with game studio partners such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft for the purpose of game performance analysis and RTP auditing.
• Fraud prevention and security vendors: Technical and behavioral data may be shared with fraud detection partners solely for the purpose of protecting Platform integrity and Player accounts.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of sga388 or its Players.
• Corporate transactions: In the event of a merger, acquisition, or restructuring involving sga388, Player data may be transferred to the successor entity subject to equivalent privacy protections.

All third-party service providers with whom we share data are contractually bound to process that data only for the specified purpose, to maintain appropriate security standards, and to delete or return data upon termination of the service relationship.

8 International Transfers

As an internationally licensed online gaming platform serving Players across Indonesia — including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and beyond — sga388 may process and store personal data on servers located outside Indonesia. Where data is transferred internationally, we implement safeguards to ensure that your data receives a level of protection consistent with the standards set out in this Privacy Policy.

Safeguards for international data transfers include:

• Standard contractual clauses incorporated into agreements with data processors in third countries.
• Use of service providers who maintain internationally recognized security certifications (e.g., ISO/IEC 27001).
• Data minimization practices that limit the volume of personal data transferred across borders to only what is strictly necessary for the processing purpose.

You may request information about the specific safeguards applicable to any international transfer of your personal data by contacting us as set out in Section 15.

9 Data Retention

sga388 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be attributed to any individual. Anonymized aggregate data may be retained indefinitely for statistical and analytical purposes.

10 Your Rights

As a data subject, you hold the following rights in relation to your personal data held by sga388. To exercise any of these rights, please contact us using the details in Section 15. We will respond within 30 calendar days and will not charge a fee for reasonable requests:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. For Account details, many fields can be updated directly within your Account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: You may ask us to suspend processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: You may request a machine-readable export of personal data you have provided to us directly, where processing is based on consent or contractual necessity.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease marketing communications promptly upon receipt of an opt-out request.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

11 Cookies & Tracking Technologies

sga388 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device by your browser when you visit the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, last-visited game categories, and display options. Disabling these may affect your user experience.
• Analytics Cookies: Used to collect aggregated, anonymized data about how Players interact with the Platform — including which games are most popular, session lengths, and navigation paths — for the purpose of improving Platform design and performance.
• Security and Fraud Detection Cookies: Used to identify device fingerprints, detect suspicious login patterns, and prevent multi-accounting and unauthorized access.

We do not use third-party advertising cookies or behavioral profiling cookies for the purpose of serving targeted advertisements on external websites. All cookies set by sga388 are first-party in nature or issued by contracted service providers bound by strict data processing agreements.

You may manage cookie preferences through your browser settings. However, please note that disabling strictly necessary cookies will prevent you from logging in to or using the Platform. Session and authentication cookies are deleted automatically when you close your browser or log out.

12 Security Measures

sga388 implements a comprehensive suite of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security infrastructure includes:

• SSL/TLS Encryption: All data transmitted between your device and the sga388 Platform is encrypted using industry-standard TLS protocols. Look for the padlock icon in your browser's address bar.
• Data Encryption at Rest: Sensitive data — including financial records, identity documents, and password hashes — is stored in encrypted form on secured servers.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff with access to sensitive data undergo background screening and mandatory data protection training.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their Accounts via the security settings dashboard. sga388 staff accounts are required to use 2FA without exception.
• Penetration Testing: The Platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities.
• Incident Response: sga388 maintains a formal data breach response procedure. In the event of a breach affecting your personal data, we will notify affected Players within 72 hours of becoming aware of the incident, where technically and legally feasible.

While we apply industry-leading security practices, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for reporting any suspected unauthorized access to our support team immediately.

13 Minors & Age Restriction

The sga388 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the Account registration and KYC process, and any Account found to belong to a person under 21 will be suspended immediately, with all funds potentially forfeited in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a minor in your care has accessed the sga388 Platform or submitted personal data without your consent, please contact us immediately using the details in Section 15. We will investigate and take appropriate action, including permanent Account closure and deletion of the minor's data, as expeditiously as possible.

We also encourage parents and guardians to make use of parental control software and device-level content filtering tools to prevent minors from accessing online gaming platforms.

14 Policy Amendments

sga388 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, we will:

• Update the "Last Updated" date prominently at the top of this page.
• Display a notification banner on the Platform for a minimum of 7 days following the effective date of the change.
• Where feasible and where the change materially affects your rights, notify you directly via your registered email address or through in-Platform messaging (WIB time).

Your continued use of the sga388 Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed of how we protect your data. If you do not accept the revised Policy, you must cease using the Platform and contact support to request Account closure.

15 Contact & Complaints

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by sga388, please reach out through the following channels. All contact details are provided as plain text only and are not clickable links:

• Email: [email protected]
• WhatsApp: +62-812-3456-7890
• Live Chat: Available 24/7 directly on the sga388 Platform — our fastest channel for urgent data concerns.
• Response Commitment: All formal data subject requests will receive a substantive written response within 30 calendar days of receipt (WIB, UTC+7).

Our support team includes native Indonesian-speaking agents available around the clock. If you are unsatisfied with our response to a data protection concern, you have the right to escalate the matter to the relevant supervisory authority in your jurisdiction.