Privacy Policy —
on999 Data Commitment

In this Privacy Policy, the following terms have the meanings set out below unless the context requires otherwise:

This Privacy Policy applies to all Personal Data collected and processed by on999 in connection with the operation of the Platform. It covers data collected from Members registered in Indonesia and from any person who accesses the Platform regardless of geographic location.

This Policy applies to Personal Data collected through:

• Account registration and profile management on the Platform.
• Deposits, withdrawals, and all financial transactions conducted via BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Wagering activity, including sports betting, live casino play, togel (Indonesia's traditional numbers lottery) participation, and slot game sessions.
• KYC identity verification submissions.
• Communications with the on999 support team via email, live chat, or any other supported channel.
• Use of the Platform website, including automated data collected through browser interactions, cookies, and server logs.

This Policy does not apply to third-party websites, payment portals, or game studio platforms that may be accessed through links or integrations on the on999 Platform. Those entities operate under their own privacy policies, and on999 accepts no responsibility for their data practices.

on999 collects Personal Data across several categories, each tied to a specific operational or regulatory purpose. We do not collect data beyond what is necessary for those purposes.

3.1 Registration & Identity Data. When you open an account, we collect your full legal name, date of birth, gender, residential address in Indonesia (including city, province, and postal code), email address, and mobile phone number. This data is used to create and manage your account and to verify that you meet the eligibility requirements set out in the on999 Terms & Conditions.

3.2 KYC & Verification Documents. Before processing your first withdrawal or when flagged by our risk systems, we collect copies of government-issued identity documents — typically your Indonesian National Identity Card (Kartu Tanda Penduduk / KTP) or passport — and proof of ownership of the bank account or e-wallet registered on your profile. These documents are used solely for identity verification and anti-money laundering compliance.

3.3 Financial & Transaction Data. We record all deposit and withdrawal transactions, including the amount (in IDR), payment method used (e.g., BCA, BRI, OVO, GoPay), transaction timestamp, and transaction reference number. We do not store full bank account numbers or card numbers; financial credentials are handled directly by the respective payment providers under their own security standards.

3.4 Wagering & Activity Data. We maintain records of all bets and wagers placed on the Platform, including market type, stake amount, odds, outcome, and session timestamps. This data is required for account management, dispute resolution, responsible gaming monitoring, and regulatory reporting.

3.5 Technical & Device Data. When you access the Platform, our servers automatically collect your IP address, browser type and version, operating system, device type, screen resolution, referring URL, session duration, and pages visited. This data is used for security monitoring, fraud detection, and aggregate platform performance analytics.

3.6 Communications Data. When you contact on999 support — whether via email or live chat — we retain a record of the communication, including the content of your messages, any attachments you submit, and the date and time of the exchange. This record is retained for quality assurance, dispute resolution, and training purposes.

on999 processes Personal Data only for specified, legitimate purposes. The following table sets out the primary purposes for which each category of data is used and the legal basis for that processing:

• Account creation and management: Processing registration and identity data to establish and maintain your on999 account, authenticate logins, and manage account settings. Legal basis: performance of contract.
• Transaction processing: Recording and reconciling deposits and withdrawals to ensure accurate account balances and enable timely payments. Legal basis: performance of contract.
• KYC and AML compliance: Verifying your identity and monitoring transactions to meet anti-money laundering obligations applicable to on999's international operating licence. Legal basis: legal obligation.
• Fraud prevention and security: Using technical and device data alongside account activity patterns to detect and prevent fraudulent access, bonus abuse, multi-accounting, and other prohibited conduct described in the on999 Terms & Conditions. Legal basis: legitimate interest.
• Responsible gaming monitoring: Reviewing wagering and session data to identify patterns consistent with problem gambling and to apply deposit limits or self-exclusion measures where appropriate. Legal basis: legal obligation and legitimate interest.
• Customer support: Using communications data and account history to respond to your inquiries, resolve disputes, and improve support quality. Legal basis: performance of contract and legitimate interest.
• Platform improvement: Analyzing anonymized or aggregated technical and activity data to understand platform performance, identify bugs, and inform product development decisions. Legal basis: legitimate interest.
• Promotional communications: Sending you information about on999 promotions and offers relevant to Indonesian players — such as bonus offers, Idul Fitri seasonal promotions, or BRI Liga 1 betting specials — where you have opted in to receive such communications. Legal basis: consent. You may withdraw consent at any time by contacting support.
• Legal and regulatory compliance: Retaining records as required by applicable law, responding to lawful requests from regulatory or law-enforcement authorities, and defending or pursuing legal claims. Legal basis: legal obligation.

on999 does not use Personal Data for automated decision-making that produces legal or similarly significant effects on Members without human review. Risk-based account flags generated by automated systems are always reviewed by a member of the on999 compliance team before any action is taken on a Member's account.

on999 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes under any circumstances. Data is shared externally only in the limited circumstances described below:

5.1 Payment Processors. To execute deposits and withdrawals, on999 shares the minimum necessary transaction data with the relevant payment provider — for example, BCA, BRI, BNI, Mandiri, OVO, or GoPay. Each provider receives only the data required to process the specific transaction and is contractually prohibited from using that data for any other purpose.

5.2 Identity Verification Services. KYC document submissions may be processed by a contracted identity verification service operating under a formal data processing agreement with on999. These services are used solely to authenticate documents and confirm identity; they do not retain Member data beyond the period required to complete the verification.

5.3 Platform Technology Partners. on999 may engage third-party technology providers for services including cloud hosting, platform analytics, and cybersecurity monitoring. These providers act as data processors under contract and are permitted to process Member data only as directed by on999 and only for the purposes specified in their service agreements.

5.4 Game Studio Providers. Live casino content from Evolution Gaming and slot content from Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft is streamed through third-party platforms. These providers may process session data (such as game round IDs and bet values) for the purpose of game integrity and RNG certification. Member identity data is not shared with game studios.

5.5 Legal and Regulatory Disclosure. on999 may disclose Personal Data to regulatory authorities, law-enforcement agencies, or courts where required to do so by applicable law or by a lawful order. In such cases, we will disclose only the minimum data necessary to comply with the legal requirement and will, where permissible, notify the affected Member of the disclosure.

5.6 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of on999's business or assets, Personal Data held by the Company may be transferred to the acquiring entity as part of that transaction. Members will be notified of any such transfer and of any material changes to data processing that result from it.

on999 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory and legal obligations. The following retention periods apply:

• Account registration and identity data: Retained for the duration of the active account plus 5 years following permanent account closure, to meet AML record-keeping requirements.
• KYC documents: Retained for 5 years from the date of the most recent verification or from account closure, whichever is later. This retention period reflects standard international AML compliance requirements.
• Transaction records: Retained for 5 years from the date of each transaction, in line with financial record-keeping obligations applicable to on999's operating licence.
• Wagering and activity records: Retained for 3 years from the date of each wagering session, or for the full duration of any open dispute, whichever is later.
• Technical and device data (server logs): Retained for 12 months from collection date, then automatically deleted or anonymized.
• Support communications: Retained for 2 years from the date of the last message in a given conversation thread, unless the communication is directly related to an open dispute, in which case it is retained until the dispute is resolved plus 1 year.
• Promotional consent records: Retained for as long as your consent is active, plus 2 years from the date of consent withdrawal, for audit purposes.

Upon expiry of the applicable retention period, Personal Data is either permanently deleted from on999 systems or irreversibly anonymized so that it can no longer be linked to an identifiable individual. Anonymized data may be retained indefinitely for aggregate statistical analysis.

on999 uses cookies and similar technologies on the Platform for three specific purposes: session management, security, and performance analytics. We do not use advertising cookies, third-party tracking pixels, or cross-site behavioral profiling technologies.

7.1 Session Cookies. These are temporary cookies that expire when you close your browser. They are essential to Platform functionality — maintaining your authenticated session, preserving your betting slip content between page navigations, and keeping your account settings active during a visit. The Platform cannot function correctly without session cookies, and they cannot be disabled without preventing login.

7.2 Security Cookies. on999 sets persistent security cookies with a defined expiry (typically 30 days) to support two-factor authentication flows, device recognition, and suspicious login detection. These cookies help us identify when a login originates from a device or location that differs materially from your established access pattern, enabling us to apply additional verification steps.

7.3 Analytics Cookies. on999 uses first-party analytics cookies to measure aggregate Platform performance — including page load times, error rates, feature usage rates, and traffic source data. This data is processed in aggregate and is not linked to individual Member identities. Third-party analytics services that would involve sharing Member data externally are not used.

7.4 Cookie Management. You may configure your browser to block or delete cookies at any time. Please note that blocking session and security cookies will prevent access to your on999 account. Blocking analytics cookies will not affect your ability to use the Platform but will reduce our ability to identify and resolve performance issues that may affect your experience.

on999 implements a layered security architecture to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Transport encryption: All data transmitted between your browser or app and on999 servers is encrypted using TLS 1.2 or higher with 256-bit AES encryption.
• At-rest encryption: Personal Data and KYC documents stored on on999 servers are encrypted at rest using AES-256. Encryption keys are managed separately from the data they protect.
• Access controls: Access to Member Personal Data within on999 is restricted to authorized personnel on a strict need-to-know basis. All internal access is logged and subject to periodic review.
• Two-factor authentication (2FA): Members are strongly encouraged to enable 2FA on their accounts. on999 staff accounts with access to Member data are required to use 2FA without exception.
• Penetration testing: on999's platform and infrastructure undergo regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: on999 maintains a documented data breach response procedure. In the event of a security incident affecting Member Personal Data, the Company will notify affected Members and relevant regulatory authorities within the timeframes required by applicable law.

While on999 employs robust security measures, no internet-based system can guarantee absolute security. Members are reminded of their own responsibility to protect their account credentials — including not sharing passwords, enabling 2FA, and using a strong unique password for their on999 account. If you believe your account has been compromised, contact on999 support immediately.

As a Member of on999 and a data subject, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact the on999 Data Privacy team at the email address provided in Section 13.

All rights requests must be submitted in writing to the contact address in Section 13, with sufficient information to verify your identity. on999 will acknowledge receipt within 5 business days and provide a substantive response within 30 days. Where a request is complex or numerous, we may extend this period by a further 30 days — you will be informed of any extension.

Please note that some rights are subject to limitations where on999 has overriding legal obligations — in particular, AML and KYC record-keeping requirements may prevent full erasure of certain data categories within the applicable regulatory retention period.

on999 operates on infrastructure that may be hosted in data centers located outside of Indonesia. Where Personal Data is transferred internationally — for example, to cloud hosting providers or identity verification services — on999 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to that described in this Privacy Policy.

Safeguards employed for international data transfers include:

• Contractual data processing agreements with all Third-Party Processors that include binding data protection obligations.
• Selection of cloud infrastructure and service providers that maintain internationally recognized security certifications (such as ISO 27001 or SOC 2 Type II).
• Technical controls including encryption in transit and at rest, as described in Section 8, applied uniformly regardless of the geographic location of the infrastructure.

on999 does not transfer Personal Data to jurisdictions that do not provide an adequate level of data protection without first implementing the contractual safeguards described above.

on999 applies mandatory age verification as part of the account registration process. Where the Company discovers that a Member has provided false information about their age and is in fact under 21 years of age, the account will be permanently closed without notice, all associated funds will be forfeited, and any Personal Data collected in connection with that account will be deleted in accordance with applicable law.

If you are a parent or guardian and believe that a minor has registered an account on on999 using false information, please contact us immediately at the address provided in Section 13. We will investigate and act promptly.

on999 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or Platform functionality. When material changes are made, we will update the "Last Updated" date at the top of this page and, where practicable, notify active Members via the email address registered to their account.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the revised terms. If you disagree with any changes, you may exercise your rights under Section 9 — including requesting account closure and deletion of your Personal Data — by contacting the support team.

We recommend reviewing this page periodically. Archived versions of prior Privacy Policies are available on request from the Data Privacy team.

For any questions about this Privacy Policy, to exercise a data subject right, or to raise a privacy-related complaint, please contact the on999 Data Privacy team through the following channel:

Please include your registered account username, a clear description of your inquiry or complaint, and any relevant reference numbers in your communication. This will help us locate your records and respond as efficiently as possible.

If you are not satisfied with on999's response to a privacy complaint, you may escalate the matter to the regulatory authority overseeing on999's operating licence. Contact details for the relevant supervisory authority are available from the on999 support team upon request.