sm505 Privacy Policy

The following terms are used throughout this Privacy Policy and carry the meanings assigned below.

sm505 collects personal data through several channels: directly from you during registration and account use, automatically through your interactions with the platform, and in limited circumstances from trusted third-party verification services. The categories of data we collect are as follows.

Registration and account data:

• Full legal name as it appears on your national identity card (KTP) or passport.
• Date of birth, used to verify that you meet the 21+ age requirement applicable to all sm505 players.
• A valid email address and Indonesian mobile phone number for account authentication and support communications.
• Username and encrypted password (we do not store passwords in plain text under any circumstances).
• Preferred currency (IDR) and time-zone preference (defaulting to WIB, UTC+7).

Identity verification (KYC) data:

• Scanned or photographed copies of government-issued identity documents, including the Indonesian national ID card (KTP), passport, or driving licence.
• Proof of address documents such as utility bills or bank statements issued within the preceding 3 months.
• Bank account details or e-wallet account information (OVO, DANA, GoPay, ShopeePay, LinkAja) used to verify payment method ownership — we record the account number and registered account holder name, not card numbers or full financial account credentials.

Transaction and gameplay data:

• Deposit and withdrawal transaction records, including amounts in IDR, timestamps, payment method references, and processing status.
• Wagering history across all product verticals including sportsbook, live casino, slots, and togel (Indonesia's traditional numbers lottery) markets.
• Bonus claims, wagering-requirement progress, and promotional participation records.
• Account balance snapshots and wallet transaction logs.

Technical and device data:

• IP address and approximate geolocation derived from IP, used for fraud prevention and to confirm Indonesian residency.
• Device type, operating system, browser version, and screen resolution.
• Session timestamps, login history, and logout records.
• Referral source and landing-page URL where applicable.

Communications data:

• Content of live-chat transcripts and email correspondence with sm505's support team, retained for quality assurance and dispute resolution purposes.
• Records of marketing consent and opt-out preferences.

sm505 processes personal data for specific, explicit, and legitimate purposes only. We do not use your data for any purpose incompatible with the purposes for which it was originally collected. The primary purposes of processing are:

sm505 processes personal data on one or more of the following legal bases depending on the nature and purpose of the processing activity:

• Contractual necessity: Processing required to fulfil the sm505 player agreement, including account creation, transaction execution, and KYC verification. Without this processing, sm505 cannot provide its services to you.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering record-keeping requirements, regulatory reporting obligations, and responses to lawful requests from competent authorities.
• Legitimate interests: Processing necessary for sm505's legitimate business interests, including fraud prevention, platform security, and abuse detection, provided those interests are not overridden by your privacy rights. sm505 conducts a balancing assessment before relying on this basis.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and the use of non-essential cookies. Consent is obtained at the point of data collection and can be withdrawn at any time without detriment to your account status.

sm505 does not sell, rent, or trade your personal data. We share personal data only with the categories of recipient listed below, and only to the extent strictly necessary for the stated purpose.

• Payment processors and banking partners: Local Indonesian banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, and Bank Permata, and e-wallet providers including OVO, DANA, GoPay, ShopeePay, and LinkAja, receive the minimum transaction data required to execute your deposits and withdrawals. These partners are bound by their own regulatory obligations and contractual data-protection requirements with sm505.
• Identity verification providers: Third-party KYC service providers receive identity document images and biographic data solely for the purpose of confirming identity and age. These providers operate under strict contractual data-processing agreements and are prohibited from using your data for any purpose other than the verification task.
• Fraud prevention and security services: Specialised fraud-detection platforms may receive device fingerprint data, IP addresses, and behavioural metadata to assist in identifying suspicious account activity. No document images or financial account numbers are shared for this purpose.
• Regulatory and legal authorities: sm505 may disclose personal data to competent government authorities, law-enforcement agencies, or courts when required to do so by applicable law, a valid court order, or a regulatory directive. sm505 will notify affected players of such disclosures where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or asset sale involving sm505, player data may be transferred to the successor entity. Players will be notified before their data is transferred and subjected to a materially different privacy policy.

All third-party recipients of sm505 player data are required to implement technical and organisational security measures commensurate with the sensitivity of the data received and to process that data only for the specified purpose.

The sm505 platform uses cookies and similar tracking technologies to enable core platform functionality, improve performance, and — where consent is given — deliver personalised content. The categories of cookies used are described below.

You may manage your cookie preferences at any time by updating your browser settings to block or delete cookies. Note that disabling strictly necessary cookies will impair your ability to log in and use the sm505 platform. Disabling analytics or marketing cookies will not affect your access to games or your account features.

sm505 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to applicable legal minimum retention obligations. The following retention periods apply:

• Active account data: Retained for the full duration of your account relationship with sm505 and for a minimum of 5 years after account closure, to satisfy anti-money-laundering record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from the date of verification. After this period, documents are securely deleted from sm505's systems unless an ongoing legal or regulatory obligation requires continued retention.
• Transaction records: Retained for a minimum of 5 years from the transaction date in accordance with financial record-keeping obligations.
• Support communications: Live-chat transcripts and email correspondence are retained for 2 years from the date of the interaction, after which they are anonymised or deleted.
• Marketing data: Retained until you withdraw your consent to marketing communications, at which point your data is removed from active marketing lists within 30 days.
• Technical / log data: Server logs and session records are retained for up to 12 months for security and fraud-prevention purposes, then automatically purged.

Upon the expiry of a retention period, personal data is either securely deleted or anonymised such that it can no longer be associated with any individual player. sm505 conducts periodic data audits to ensure compliance with these retention schedules.

sm505 implements technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls in place include:

• Encryption in transit: All data exchanged between your device and sm505 servers is encrypted using TLS 1.2 or higher. Plain-text data transmission is not permitted on any production endpoint.
• Encryption at rest: Sensitive data fields including passwords (hashed with a modern, salted algorithm), identity document images, and bank account references are encrypted at rest using AES-256 or equivalent.
• Access controls: Internal access to personal data is governed by role-based access controls on a strict need-to-know basis. All internal access events are logged and subject to periodic review.
• Intrusion detection: sm505 operates continuous network monitoring and intrusion-detection systems to identify and respond to anomalous activity in real time.
• Penetration testing: The platform undergoes regular independent security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Incident response: sm505 maintains a documented data-breach response procedure. In the event of a breach affecting your personal data, you will be notified without undue delay where that breach is likely to result in a risk to your rights and interests.

As a player on the sm505 platform, you hold the following rights in relation to your personal data. sm505 will respond to all valid requests within 30 days of receipt. Requests can be submitted by contacting support at the details listed in Clause 12.

sm505 will not charge a fee for handling data rights requests in the majority of cases. Where a request is manifestly unfounded or excessive, a reasonable administrative fee may be levied. sm505 reserves the right to verify your identity before processing any data rights request to prevent unauthorised access to another player's information.

The sm505 platform is strictly intended for adults who are 21 years of age or older. sm505 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the KYC process, and accounts found to belong to individuals under the required age are closed immediately with any associated balances handled in accordance with applicable regulatory guidance.

If sm505 becomes aware that personal data has been collected from a person under the age of 21 without the required age verification having been completed, we will take immediate steps to delete that data from our systems and close the associated account. If you have reason to believe that a minor has registered an sm505 account, please contact our support team immediately using the contact details in Clause 12.

Parents and guardians are encouraged to use device-level parental control software to prevent minors from accessing online gambling platforms. sm505 supports the principle of responsible digital access and will cooperate with any reasonable request from a parent or guardian to verify whether a particular individual holds an sm505 account.

sm505 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. All material changes — defined as changes that meaningfully affect how your personal data is collected, used, or shared — will be communicated to registered players via email to the address associated with their account at least 7 days before the revised policy takes effect.

Non-material changes, such as clarifications of existing language or corrections of typographical errors, may be made without advance notice and will be indicated by updating the "Last updated" date at the top of this page.

Your continued use of the sm505 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you must discontinue use of the platform and may request account closure and a withdrawal of your remaining real-money balance before the effective date of the change.

All previous versions of this Privacy Policy are archived and can be requested from our support team for reference purposes.

If you have any questions about this Privacy Policy, wish to exercise a data right, or need to report a privacy concern, please contact sm505 using one of the following channels:

• Live chat: Available 24 hours a day, 7 days a week directly through the sm505 platform. Indonesian-speaking agents are available at all hours to assist with privacy-related queries.
• Email: [email protected] — for formal data rights requests and privacy complaints. Please include your registered account username and a clear description of your request to allow our team to respond efficiently. We aim to acknowledge all email requests within 24 hours (WIB).

Formal data rights requests submitted by email are handled by sm505's dedicated player data team. We will confirm receipt of your request and provide a substantive response within 30 calendar days. Where a request is particularly complex or involves a large volume of data, we may extend this period by a further 30 days and will notify you accordingly.