Privacy Policy — suka28 Data Protection Statement

The following definitions apply throughout this Privacy Policy. Capitalized terms not defined here carry the meanings assigned in the suka28 Terms & Conditions.

The Data Controller responsible for the personal data of players registered on the suka28 platform is the legal entity that owns and operates suka28, as identified in our Terms & Conditions. All privacy-related enquiries, data subject access requests, and complaints should be directed to our Data Protection contact as detailed in Section 14 of this Policy.

suka28 processes personal data in accordance with internationally recognized data protection principles — including purpose limitation, data minimization, storage limitation, accuracy, integrity, and confidentiality. We do not collect data beyond what is reasonably necessary for the legitimate operational, legal compliance, and security purposes described in this Policy.

suka28 collects personal data through several channels: directly from you when you register and use our platform, automatically through your browser and device, and from third-party service providers where necessary. The categories of data we collect are as follows:

3.1 Registration & Account Data

• Full legal name (as it appears on your KTP)
• Date of birth (for age verification — you must be 21 or older)
• Email address and account password (stored in hashed form)
• Mobile phone number (for two-factor authentication where enabled)
• Preferred currency (Indonesian Rupiah, Rp / IDR)
• Residential address in Indonesia

3.2 KYC Verification Data

• Photograph or scan of your KTP (Indonesian National Identity Card) — front and back
• Proof of current residential address (utility bill, bank statement, or government document dated within 3 months)
• Proof of payment method — bank account screenshot or passbook confirming the account name matches your suka28 registration name (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, or other supported banks)
• Selfie photograph for liveness verification where required by our fraud prevention protocols

3.3 Financial Transaction Data

• Deposit and withdrawal amounts, timestamps, and reference numbers
• Payment method identifiers (bank account numbers — partially masked in our systems), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction history and account balance records
• Bonus and promotional credit records

3.4 Gaming Activity Data

• Game sessions, bet placements, wager amounts, game outcomes, and win/loss records
• Sports betting selections across markets including football (BRI Liga 1, EPL, La Liga, Champions League), togel (Indonesia's traditional numbers lottery) draw participation, and live casino sessions
• Responsible gaming tool usage (deposit limit settings, self-exclusion requests, cooling-off periods)

3.5 Technical & Device Data

• IP address and approximate geolocation (city/region level)
• Browser type, version, and operating system
• Device type (desktop, mobile, tablet) and device identifiers
• Session timestamps, page views, click patterns, and navigation paths
• Referral URL and traffic source

3.6 Customer Support Data

• Chat transcripts and email correspondence with our support team
• Complaint and dispute records
• Feedback and survey responses

suka28 processes your personal data only where a valid legal basis exists. The primary legal bases we rely upon are as follows:

suka28 uses the personal data we collect strictly for the purposes outlined below. We do not use your data in ways that are incompatible with the purposes for which it was originally collected:

• Account Management: Creating, maintaining, and securing your player account; authenticating your identity at login; processing password resets and account recovery requests.
• Payment Processing: Facilitating deposits from and withdrawals to your registered Indonesian bank account (BCA, BRI, BNI, Mandiri, and others) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja); reconciling transaction records; issuing receipts.
• KYC & Compliance: Verifying your identity and age (21+); conducting AML screening; complying with applicable regulatory obligations; maintaining legally required records.
• Platform Delivery: Delivering gaming content from providers including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and others; recording game sessions and bet outcomes; managing your balance and bonus credits.
• Responsible Gaming: Monitoring gaming patterns for signs of problem gambling; implementing self-exclusion, deposit limits, loss limits, and cooling-off periods at your request or where required by our responsible gaming policy.
• Customer Support: Responding to queries, complaints, and disputes submitted via live chat or email; maintaining support interaction records for quality assurance.
• Fraud Prevention & Security: Detecting and preventing fraud, collusion, bonus abuse, money laundering, and unauthorized account access; operating our internal risk and security systems.
• Marketing (with consent): Sending promotional offers, seasonal bonuses (e.g., Idul Fitri specials, Ramadhan promotions, Independence Day offers), and platform updates to players who have opted in to receive marketing communications.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve site performance, user experience, and game selection.

suka28 uses cookies and similar tracking technologies to operate the platform effectively, remember your preferences, and analyze usage patterns. The cookies we deploy fall into the following categories:

You may manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to use the suka28 platform. Most modern browsers allow you to view, delete, and block cookies — refer to your browser's help documentation for specific instructions.

suka28 does not use cookies to collect sensitive personal data (such as health information or religious affiliation) and does not permit third-party advertising networks to place tracking cookies on the platform for behavioral advertising targeting.

suka28 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary:

• Game Software Providers: Licensed game studios (including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) receive session identifiers and bet data necessary to deliver their games within the suka28 platform. These providers operate as Data Processors under contractual data-processing agreements.
• Payment Service Partners: Indonesian bank partners and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data required to process your deposits and withdrawals. Payment data is transmitted over encrypted channels.
• Identity Verification Services: Third-party KYC and AML screening providers may receive your identity documents and personal details solely for the purpose of verifying your identity and screening against sanction lists.
• Customer Support Platforms: Our live chat and ticketing software providers process support interaction data as Data Processors under contractual agreements with suka28.
• Legal & Regulatory Authorities: We may disclose personal data to competent law enforcement agencies, regulatory bodies, or courts where required by applicable law, valid legal process, or to protect the rights, property, or safety of suka28, its players, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of suka28's business assets, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and your rights in relation to it via your registered email address.

suka28 retains your personal data for only as long as necessary to fulfill the purposes for which it was collected, to comply with applicable legal obligations, and to resolve disputes. The general retention periods we apply are as follows:

• Active Account Data: Retained for the full duration of your account and for a period of 5 years following permanent account closure.
• KYC Documents: Retained for a minimum of 5 years following account closure to satisfy AML record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction.
• Gaming Activity Logs: Retained for 2 years from the date of each session, then anonymized for aggregate analytics purposes.
• Customer Support Records: Retained for 2 years from the date of each interaction, unless the matter involves an unresolved dispute.
• Marketing Consent Records: Retained until you withdraw consent, plus 1 year thereafter to demonstrate compliance.
• Cookie & Analytics Data: Retained in accordance with the periods specified in Section 6 above.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is not immediately technically feasible (for example, data held in backup archives), your data will be isolated from active processing until deletion can be completed at the next scheduled backup purge cycle.

suka28 applies a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data transmissions between your browser and the suka28 platform are encrypted using industry-standard 256-bit SSL/TLS protocols. Our SSL certificate is validated and renewed continuously.
• Password Hashing: Account passwords are never stored in plain text. They are hashed using a strong one-way cryptographic algorithm (bcrypt with a work factor appropriate to current computational standards).
• Access Controls: Access to personal data within suka28's internal systems is restricted on a strict need-to-know basis. Staff members access only the data categories required to perform their designated role.
• KYC Document Vaulting: Identity verification documents are stored in encrypted, access-controlled document vaults that are logically isolated from the main platform database.
• Penetration Testing: suka28 conducts regular third-party penetration tests and vulnerability assessments to identify and remediate security weaknesses.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities within the timeframe required by applicable law.
• Staff Training: All suka28 staff with access to personal data receive regular data protection and information security training.

As a player and data subject, you hold the following rights with respect to your personal data held by suka28. To exercise any of these rights, please contact our support team using the details in Section 14:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed. We will respond within 30 calendar days of receiving a valid request.
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request correction. You may also update certain account details directly through your profile settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that legal retention obligations may prevent immediate full erasure of certain records.
• Right to Restrict Processing: You may request that we limit processing of your data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or contract performance, you may request your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

suka28 will not charge a fee for exercising your rights under normal circumstances. We may request identity verification before fulfilling a data subject request to ensure we do not disclose your data to an unauthorized third party.

suka28 implements mandatory age verification as part of our KYC process. Any account found to belong to a person under the age of 21 will be immediately closed, all balances forfeited, and associated personal data deleted in accordance with our data retention schedule.

If you have reason to believe that a minor has accessed suka28 and submitted personal data, please contact our support team immediately at the address provided in Section 14. We will investigate and take appropriate remedial action within 48 hours of receiving the report.

As an internationally operated platform, suka28 may transfer certain categories of personal data to third-party service providers — including game studios, payment processors, and cloud infrastructure providers — whose systems are located outside Indonesia. Such transfers may include countries with data protection frameworks that differ from those applicable in Indonesia.

Where international transfers occur, suka28 ensures appropriate safeguards are in place, which may include:

• Contractual clauses (Data Processing Agreements) incorporating standard data protection obligations equivalent to those applied to domestic processing
• Transfer to countries or service providers that have demonstrated an adequate level of data protection
• Technical safeguards — encryption in transit and at rest — applied to all data regardless of transfer destination

You may request details of the specific safeguards applied to any international transfer of your personal data by contacting us as described in Section 14.

suka28 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When we make material changes, we will:

• Update the version number and effective date at the top of this document
• Display a prominent notice on the suka28 platform for a period of at least 14 days before the revised Policy takes effect
• Send an email notification to your registered email address summarizing the key changes

Your continued use of the suka28 platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with a material change, you may exercise your right to close your account and request erasure of your personal data before the revised Policy takes effect.

Archive copies of previous versions of this Privacy Policy are available upon written request to our Data Protection contact.

For any privacy-related enquiries, data subject access requests, or complaints regarding how suka28 processes your personal data, please contact our Data Protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please include "Privacy Request" or "Data Subject Access Request" in the subject line to ensure your message is routed to the correct team
• Live Chat: Available 24/7 via the in-platform chat widget — select "Privacy & Data" from the topic menu
• Response Time: We acknowledge all privacy-related requests within 48 hours and provide a substantive response within 30 calendar days. Complex requests may take up to 90 days, in which case we will notify you of the extended timeline.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to a relevant data protection authority or seek independent legal advice. suka28 is committed to resolving all privacy disputes fairly, transparently, and promptly.