Privacy Policy — crs99

This Privacy Policy applies to all personal data processed by crs99 in connection with the website accessible at https://crs99.asia (the "Platform"), including all games, betting markets, account management features, customer support channels, and promotional communications offered through or in association with the Platform.

crs99 acts as the data controller for the personal information described in this Policy. As data controller, crs99 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

This Policy applies to all current and former Members, prospective Members who have commenced but not completed registration, and any visitor who browses the Platform without creating an Account. By accessing the Platform or submitting personal data to crs99 in any form, you acknowledge that you have read and understood this Privacy Policy.

References to "we", "us", and "our" throughout this document refer to crs99. References to "you" and "your" refer to the individual whose personal data is being processed.

We collect personal data across several categories depending on how you interact with the Platform. The table below summarises the key data types we process:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, or health data, except where health-related information is voluntarily provided in connection with a responsible gaming request (e.g., a request for self-exclusion citing problem gambling concerns). Such information is treated with the highest level of confidentiality and used only for the purpose for which it was disclosed.

crs99 collects personal data through the following channels:

• Direct submission: Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to a promotion.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, and server log files. See Clause 8 for full details.
• Third-party payment processors: Confirmation data returned by Indonesian payment rails (bank transfer gateways, OVO, DANA, GoPay, ShopeePay, LinkAja) when a financial transaction is processed.
• Identity verification providers: Data returned by third-party KYC or anti-fraud vendors that we engage to verify the identity and address of our Members in compliance with our anti-money laundering obligations.
• Publicly available sources: In limited circumstances, we may supplement the data you have provided with information from public registers or databases to assist with fraud prevention or legal compliance.

We process your personal data only where we have a valid legal basis for doing so. The table below sets out our primary processing activities, the purposes they serve, and the legal basis relied upon:

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests — see Clause 10 for details.

crs99 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We share data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment processors and banking partners: We share the financial and identity data strictly necessary to process your deposits and withdrawals through our supported Indonesian payment channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja).
• KYC and identity verification vendors: We engage accredited third-party providers to verify the identity documents submitted during KYC. These providers are contractually prohibited from using your data for any purpose beyond the verification service.
• Fraud prevention and anti-money laundering services: We may share data with specialist fraud-detection and AML screening providers where we have a legitimate interest or legal obligation to do so.
• Game content providers: Certain gaming data (e.g., game session identifiers) may be shared with the studios whose games are hosted on the Platform — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft — to the extent necessary to deliver and settle the game.
• IT infrastructure and hosting providers: We use third-party cloud hosting and infrastructure services to operate the Platform. These providers process data only on our instructions and under strict data processing agreements.
• Legal and regulatory authorities: We will disclose personal data to law enforcement, regulatory bodies, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of crs99, our Members, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or a substantial part of crs99's business assets, personal data held about Members may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The following general retention principles apply:

• Active Account data: Retained for the duration of your Account membership plus a minimum of five (5) years following Account closure, to comply with anti-money laundering record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission or from the date of Account closure, whichever is later.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction in accordance with applicable financial record-keeping regulations.
• Support correspondence: Retained for three (3) years from the date of the last interaction, unless the correspondence relates to a dispute or legal claim, in which case it is retained until the matter is fully resolved.
• Marketing preference records: Retained for the duration of your Account membership and for one (1) year following Account closure or the withdrawal of consent, whichever is earlier.
• Technical and usage logs: Typically retained for thirteen (13) months for analytics purposes, after which they are aggregated and anonymised.

When data is no longer required, we securely destroy or anonymise it in accordance with our data disposal procedures. Where anonymisation is not practicable, data is deleted from our systems and from those of any sub-processors we engage.

crs99 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your browser or device and the Platform is encrypted in transit using industry-standard Transport Layer Security (TLS) protocols.
• Encrypted data storage: Sensitive data at rest — including KYC documents, financial credentials, and Account passwords (stored as salted hashes) — is encrypted on our servers.
• Access controls: Access to Member data within our organisation is granted on a strict need-to-know basis. Staff are required to authenticate via multi-factor authentication before accessing systems containing personal data.
• Regular security assessments: We conduct periodic vulnerability assessments and penetration tests to identify and remediate security weaknesses in our infrastructure and application layer.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify you and any applicable supervisory authority without undue delay and within the timeframes required by applicable law.
• Staff training: All personnel with access to personal data receive regular training on data protection obligations, phishing awareness, and secure data handling practices.

crs99 uses cookies and similar tracking technologies to operate, maintain, and improve the Platform. A cookie is a small text file placed on your device by a web server. The following categories of cookies are used on the Platform:

• Strictly Necessary Cookies: These are essential for the Platform to function and cannot be disabled. They include session-management cookies that keep you logged in as you navigate between pages, and security cookies that help protect against cross-site request forgery.
• Functional Cookies: These remember your preferences — such as your preferred odds format, language settings, and responsible gaming limit configurations — so that you do not need to re-enter them each session.
• Performance & Analytics Cookies: These help us understand how Members interact with the Platform by collecting aggregated, anonymised data on page visits, session durations, and navigation paths. This information is used exclusively to improve Platform performance and user experience.
• Marketing Cookies: Where you have provided consent, these cookies enable us to deliver personalised promotional content and measure the effectiveness of our marketing campaigns. You may withdraw consent for marketing cookies at any time via your Account preferences or browser settings.

Most browsers allow you to control cookie behaviour through their settings. Disabling strictly necessary cookies may prevent the Platform from functioning correctly. Disabling functional or analytics cookies will not prevent access to the Platform but may degrade your experience. Instructions for managing cookies in common browsers are available through each browser's help documentation.

The Platform is strictly intended for adults aged 21 years and over. crs99 does not knowingly collect personal data from any person under the age of 21. If you are under 21, you must not register an Account or submit any personal data to us through the Platform.

If we become aware that we have inadvertently collected personal data from a person under 21, we will take immediate steps to delete that data from our records and to permanently close the associated Account. Any funds deposited by an underage individual will be refunded via the original payment method.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data that crs99 holds about you. To exercise any of these rights, please contact us using the details in Clause 14. We aim to respond to all valid requests within 30 days of receipt.

• Right of Access You have the right to request a copy of the personal data we hold about you, together with information about how it is used, where it came from, who it has been shared with, and how long it will be retained.
• Right to Rectification If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay. You may also update basic Account information (such as your email address or phone number) directly from your Account settings.
• Right to Erasure In certain circumstances — for example, where data is no longer necessary for the purpose it was collected, or where you withdraw consent and there is no other lawful basis for processing — you may request that we delete your personal data. Note that this right is subject to our legal retention obligations; we cannot delete data that we are required by law to retain.
• Right to Restriction of Processing You may ask us to restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested, or while an objection is being assessed.
• Right to Object Where we process your data on the basis of legitimate interests, you have the right to object to that processing at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Data Portability Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent Where processing is based solely on your consent (e.g., receiving promotional emails or marketing SMS messages), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To unsubscribe from marketing communications, use the unsubscribe link in any promotional email or contact our support team.

crs99 operates internationally and may store or process your personal data on servers located outside Indonesia. Where personal data is transferred to a country that does not provide a level of data protection equivalent to that available in Indonesia, we implement appropriate safeguards to ensure your data remains protected to the same standard. These safeguards may include:

• Standard contractual clauses approved by the applicable data protection authority, incorporated into our agreements with sub-processors and data recipients in third countries.
• Selection of service providers that hold recognised international privacy certifications or that operate under binding corporate rules.
• Supplementary technical measures (such as encryption) applied to data before it crosses international boundaries, where the standard contractual framework alone does not provide sufficient protection.

You may request further information about the specific safeguards in place for any international transfer of your personal data by contacting us at the address in Clause 14.

The Platform may contain links to third-party websites or services (for example, the websites of game studios or payment providers) that are not operated by crs99. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party website you visit via a link from our Platform, as we have no control over the data-handling practices of those sites and accept no responsibility or liability for them.

crs99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will notify you by email or by posting a prominent notice on the Platform at least 7 days before the changes take effect. The "Effective Date" at the top of this page will be updated to reflect the date of the most recent revision.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the revised Policy, you must discontinue use of the Platform and may close your Account by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about our data practices, please contact the crs99 Data Privacy team through the following channels. All contact details are provided as plain reference information and must not be used to initiate financial transactions.

• Email: [email protected]
• WhatsApp: +62 811 9876 5432
• Support Hours: 24/7 — Indonesian-speaking agents available during WIB business hours

We aim to acknowledge all data-rights requests within 5 business days and to provide a substantive response within 30 calendar days of receipt. Where a request is complex or where we receive a high volume of requests simultaneously, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with our response, or if you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent data protection supervisory authority in the jurisdiction in which you reside or work, or in which the alleged infringement took place.