Your privacy matters to us. This Privacy Policy explains exactly what personal data spin99 collects from users in Indonesia, why we collect it, how we use and protect it, and the rights you hold over your own information. Please read this document in full before registering an account.
Throughout this Privacy Policy, the following terms carry the meanings assigned below:
spin99 acts as the data controller in respect of all Personal Data collected through the Platform. As data controller, spin99 determines the purposes and means of processing your information and bears responsibility for ensuring that processing is carried out in a lawful, fair, and transparent manner.
All inquiries, requests to exercise data rights, and formal complaints relating to this Privacy Policy should be directed to our Data Protection contact:
Data Protection Team — spin99
Email: [email protected]
Subject line: "Data Privacy Request"
Response target: within five (5) business days for standard requests.
spin99 collects Personal Data through several channels. The categories of data we collect, and the circumstances in which we collect them, are set out below.
When you create a spin99 account, we collect:
For KYC compliance, we may collect copies of:
To process deposits and withdrawals in IDR, we collect:
When you use the Platform, we automatically record:
Our servers and analytics tools collect:
When you contact our support team, we retain:
Minimum Data Principle: spin99 collects only the data that is necessary for the specific purpose identified. We do not collect sensitive personal data (e.g., ethnicity, religion, political views, biometric data beyond facial verification for KYC) unless mandated by applicable compliance requirements.
spin99 processes your Personal Data on one or more of the following legal bases:
| Legal Basis | Examples of Processing Activities |
|---|---|
| Contractual Necessity | Account registration, deposit and withdrawal processing, bet settlement, customer support responses. |
| Legal Obligation | KYC identity verification, AML transaction monitoring, regulatory reporting, fraud investigation. |
| Legitimate Interests | Fraud detection and prevention, platform security, analytics to improve service quality, responsible gaming monitoring. |
| Consent | Optional marketing communications (email / SMS promotions). You may withdraw consent at any time via account settings or by contacting support. |
spin99 uses the Personal Data we collect for the following specific purposes:
To create, maintain, and administer your spin99 account; to verify your identity and age (21+ enforcement); to process password resets and account security requests; and to communicate essential account notifications such as withdrawal confirmations and security alerts.
To process IDR deposits and withdrawals via Indonesian bank transfers (BCA, BRI, BNI, Mandiri, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); to reconcile transaction records; to detect and prevent fraudulent payment activity; and to comply with AML reporting obligations.
To record, settle, and display the results of your wagers across sportsbook markets (including BRI Liga 1, EPL, and Champions League football), live casino games, togel (Indonesia's traditional numbers lottery) draws, and slot titles; to calculate and distribute bonus wagering progress; and to maintain an auditable record of all gaming activity.
To monitor player behavior for signs of problem gambling; to enforce self-imposed deposit limits, loss limits, and self-exclusion periods; to deliver reality-check notifications; and to contact Users who show patterns consistent with gambling-related harm, as part of our duty of care obligations.
To meet our obligations under applicable international gaming regulations, AML standards, and any lawful requests from competent authorities. Records maintained for legal compliance purposes are subject to specific retention schedules (see Section 8).
To analyze aggregate usage patterns, optimize page performance, test new features, and personalize the Platform experience — for example, by surfacing relevant promotions during Ramadhan, Idul Fitri, or other culturally significant periods for Indonesian users.
With your explicit consent, to send promotional offers, bonus announcements, and platform updates via email or SMS. You may opt out of marketing communications at any time through the "Notifications" section of your account settings or by emailing our support team.
spin99 does not sell, rent, or trade your Personal Data to unaffiliated third parties for their own independent marketing or commercial purposes. We may share your data in the following limited circumstances:
We engage trusted third-party service providers who process data on our behalf under strict contractual data protection obligations. These include:
spin99 may disclose Personal Data to law enforcement agencies, regulatory bodies, or other competent authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of spin99, its users, or the public. We will notify affected Users of such disclosures where permitted by law.
In the event of a merger, acquisition, asset sale, or corporate restructuring involving spin99, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified via your registered email address prior to any such transfer, and the successor entity will be bound by the terms of this Privacy Policy or an equivalent instrument.
Where we have reasonable grounds to suspect fraud, bonus abuse, or money laundering, we may share relevant account data with industry-recognized fraud prevention networks and partner platforms. Data shared for this purpose is limited strictly to what is necessary to investigate and prevent the suspected activity.
No Sale of Data: spin99 will never sell, auction, or otherwise monetize your Personal Data to advertisers, data brokers, or any other commercial third party. Your data exists to serve your account — not to generate revenue from external parties.
Cookies are small text files placed on your device by a website when you visit it. They allow the site to recognize your device on subsequent visits and to store preferences, session state, and certain behavioral information. In addition to cookies, spin99 may use related technologies such as web beacons, local storage, and session tokens.
| Cookie Type | Purpose | Retention |
|---|---|---|
| Strictly Necessary | Maintain login sessions, process transactions, enforce security controls. These cannot be disabled without breaking core Platform functionality. | Session / up to 24 hours |
| Functional | Remember your language preferences, display settings, and last-visited game categories. | Up to 30 days |
| Analytics | Collect pseudonymized data about page visits, click paths, and feature usage to help us improve the Platform. | Up to 13 months |
| Responsible Gaming | Track session duration and trigger reality-check notifications at your elected intervals. | Session-bound |
You may configure your browser to block or delete cookies at any time. Note that disabling strictly necessary cookies will prevent you from logging in or conducting transactions on the Platform. Instructions for managing cookies in common browsers (Chrome, Firefox, Safari, Edge, Samsung Internet) are available in each browser's help documentation. spin99 does not currently respond to "Do Not Track" browser signals as there is no universally accepted standard for this mechanism.
spin99 retains your Personal Data for as long as is necessary to fulfill the purposes described in this Privacy Policy, subject to the following schedule:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account Registration Data | Duration of account + 5 years after closure | Contractual and regulatory obligation |
| KYC Documents | 5 years from submission date | AML regulatory requirement |
| Financial Transaction Records | 7 years from transaction date | AML and financial audit standards |
| Betting & Gaming History | 5 years from date of wager | Dispute resolution and regulatory audit |
| Support Communications | 3 years from last interaction | Complaint resolution and quality assurance |
| Marketing Consent Records | Until consent is withdrawn + 3 years | Proof of lawful marketing basis |
| Analytics Data | 13 months (rolling) | Platform performance trend analysis |
Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymized. Where anonymization is not technically feasible within the prescribed timeframe, data will be encrypted and access-restricted pending secure deletion.
spin99 implements a layered security framework to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:
In the event of a confirmed Personal Data breach that is likely to result in risk to the rights and freedoms of affected Users, spin99 will notify affected individuals without undue delay — and in any event within 72 hours of becoming aware of the breach — via their registered email address. Notifications will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps spin99 is taking to address the incident.
Your Role in Security: No technical safeguard can fully compensate for a compromised password. We strongly recommend using a unique, complex password for your spin99 account and enabling two-factor authentication. Never share your login credentials with any other person.
As a spin99 User, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our Data Protection Team at [email protected] with the subject line "Data Privacy Request".
You may request a copy of the Personal Data we hold about you, along with information about how it is being processed. We will provide this within 30 days of a verified request, free of charge for the first request in any 12-month period.
If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Name and date-of-birth corrections require supporting documentation consistent with our KYC standards.
You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other legal basis for processing applies. Note that we are required to retain certain data for the minimum periods described in Section 8 even following an erasure request — in such cases, data will be access-restricted rather than deleted until the retention period expires.
In certain circumstances (e.g., while a rectification request is being assessed, or where you have objected to processing), you may request that we restrict our use of your Personal Data to storage only.
Where processing is based on your consent or contractual necessity, and is carried out by automated means, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) for transfer to another service provider.
You may object at any time to processing of your Personal Data for direct marketing purposes. Upon receipt of an objection, we will cease processing your data for that purpose immediately. You may also object to processing carried out on the basis of legitimate interests, subject to an assessment of competing interests.
Where processing is based solely on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.
Response Timeframe: spin99 will acknowledge all data rights requests within five (5) business days and provide a substantive response within 30 calendar days. Where a request is complex or high in volume, we may extend this period by a further 30 days with prior notice to you.
The spin99 Platform is strictly restricted to individuals aged 21 years or older. We do not knowingly collect Personal Data from persons under the age of 21. Age verification is conducted as part of the KYC process, and accounts where the registered User is subsequently found to be under 21 will be immediately closed.
If you are a parent or guardian and believe that a minor in your care has registered on the Platform, please contact us immediately at [email protected] with subject line "Underage Account Report". We will investigate the report promptly, close the account if confirmed, and securely delete any Personal Data associated with the minor's registration.
We recommend that households with minors install parental control and internet filtering software on shared devices to prevent inadvertent access to gambling platforms.
The spin99 Platform integrates third-party services — including game engines from Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — and may display informational references to external data sources such as official sports results for BRI Liga 1, EPL, Champions League, and other leagues. These third-party providers operate under their own privacy policies and data practices, over which spin99 has no direct control.
spin99 does not include outbound links to external websites in its navigational structure. Where any third-party technology is embedded within the Platform (e.g., a live game interface), that provider's data processing is governed by the contractual terms between spin99 and that provider, which include data protection requirements consistent with this Privacy Policy.
spin99 is not responsible for the privacy practices of any third-party service, and we encourage you to review the privacy policies of any external services you interact with independently of the spin99 Platform.
spin99 operates infrastructure across multiple jurisdictions as part of delivering a reliable, high-availability platform to users across Indonesia — including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and other regions. As a result, your Personal Data may be transferred to and stored on servers located outside Indonesia.
Where such transfers occur, spin99 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Privacy Policy. These safeguards may include:
By registering on the Platform and accepting this Privacy Policy, you acknowledge and consent to the international transfer of your Personal Data under the safeguards described above.
spin99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When material changes are made, we will:
Your continued use of the Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Privacy Policy, you must cease using the Platform and request account closure in accordance with the Terms & Conditions. Previous versions of this Privacy Policy are available upon request from our Data Protection Team.
For any questions, concerns, or formal requests relating to this Privacy Policy or our data practices, please contact our Data Protection Team through any of the following channels:
Our support team operates in both English and Bahasa Indonesia, around the clock, including during Idul Fitri, Nyepi, Christmas, and all other Indonesian public holidays. All Western Indonesia Time (WIB, UTC+7) business hours are fully staffed.
Formal Complaints: If you are dissatisfied with how spin99 has handled your Personal Data, you are entitled to lodge a formal complaint by emailing [email protected] with the subject line "Formal Data Complaint." We will acknowledge your complaint within 48 hours and provide a full written response within 10 business days. If you remain dissatisfied following our response, you may escalate the matter to the relevant supervisory authority in the jurisdiction of spin99's operating license.
spin99 treats your personal data as a responsibility, not a resource. Here is what our privacy framework delivers in practice.
Every byte of data transmitted between your device and our servers is protected by industry-standard TLS encryption. Your login credentials, payment details, and betting history travel exclusively over encrypted channels.
Our identity verification process protects both you and the broader player community. KYC prevents unauthorized account access, underage gambling, and fraudulent financial activity — all without storing more data than is strictly necessary.
spin99 will never sell, rent, or monetize your personal information to advertisers, data brokers, or any commercial third party. Your data serves your account and our compliance obligations — nothing else.
Access, correct, export, or delete your data at any time. Withdraw marketing consent with a single click. Manage cookie preferences directly from your browser. Your information belongs to you — we simply steward it responsibly.
We publish clear retention schedules for every data category we hold. When the retention period expires, your data is securely deleted or irreversibly anonymized — no indefinite storage, no ambiguity.
Our Data Protection Team handles all privacy requests in English and Bahasa Indonesia, 24/7. Whether you need a copy of your data or want to report a concern, we respond within five business days — guaranteed.
Our support team is available around the clock to address any data privacy concern. You can also explore our full Terms & Conditions or visit the FAQ for quick answers to common questions.