Privacy Policy — sugih4

1 Introduction

sugih4 ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who accesses or uses the sugih4 platform at https://sugih4.org (the "Platform"). This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you register an account, make deposits or withdrawals, participate in games, or otherwise interact with our services.

sugih4 operates as an internationally licensed online betting and casino platform serving Members primarily located in Indonesia. All transactions are conducted in Indonesian Rupiah (IDR) via local payment channels including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja. Our handling of personal data reflects both international data protection best practice and the expectations of our Indonesian Member base.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated herein by reference. By registering an Account or continuing to use the Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein.

2 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings assigned to them below:

3 Data We Collect

sugih4 collects Personal Data through several channels: directly from you when you register or interact with the Platform; automatically through technical systems as you use the Platform; and, in limited circumstances, from trusted third-party verification partners. The categories of data we collect are as follows:

3.1 Registration & Account Data

• Full legal name as it appears on your Indonesian KTP (Kartu Tanda Penduduk) or passport.
• Date of birth (for age verification — you must be 21 or older).
• Indonesian national identity number (NIK from KTP).
• Email address and mobile phone number.
• Username and hashed password credentials.
• Residential address in Indonesia.

3.2 KYC & Identity Verification Data

• Scanned or photographed copies of government-issued photo identification (KTP or passport).
• Proof of address documents (bank statements, utility bills, or official correspondence dated within three months).
• Proof of payment method ownership (bank account statements confirming the account is in your name).
• Selfie or live facial image where enhanced identity confirmation is required.

3.3 Financial & Transaction Data

• Bank account numbers and registered account names for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, and Bank Permata transfers.
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Deposit and withdrawal history, including timestamps, amounts in IDR, and transaction reference numbers.
• Bonus claims, wagering activity, and win/loss records.

3.4 Technical & Usage Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, browser type and version.
• Session timestamps, pages visited, features used, and clickstream data.
• Cookie identifiers and similar tracking technology data (see Section 9).

3.5 Communications Data

• Records of live chat conversations with our support team.
• Email correspondence sent to or received from [email protected].
• Survey responses, feedback submissions, and promotional participation records.

4 Purpose of Processing

sugih4 processes your Personal Data only for specific, legitimate purposes. We do not use your data for any purpose that is incompatible with the purposes listed below:

5 Legal Basis for Processing

sugih4 relies on the following legal bases to process your Personal Data, consistent with internationally recognised data protection principles:

• Contractual necessity: Processing required to perform our contract with you — including account creation, transaction processing, bet settlement, and KYC verification — is carried out on the basis that it is necessary to deliver the Services you have requested.
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming oversight, and platform analytics is carried out on the basis of sugih4's legitimate interest in operating a safe, compliant, and commercially viable platform, provided those interests do not override your fundamental rights.
• Legal obligation: Processing required to comply with applicable anti-money-laundering, counter-terrorism-financing, and data retention obligations is carried out on the basis that it is necessary to meet our legal duties.
• Consent: Processing for direct marketing communications — including promotional emails, SMS alerts, and personalised on-site offers — is carried out on the basis of your freely given, informed, and specific consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing & Third Parties

sugih4 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. Data is shared only in the following limited and controlled circumstances:

• Identity verification providers: KYC document data is shared with regulated, third-party identity verification services to confirm the authenticity of identity documents and perform liveness checks. These providers act as Data Processors under written data processing agreements with sugih4.
• Payment processors and banking partners: Financial transaction data is shared with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) to the extent necessary to process deposits and withdrawals. Each partner is bound by its own regulatory obligations under Bank Indonesia oversight.
• Game studio providers: Usage and session data required for fair game operation is shared with licensed game studio providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. This data is limited to what is technically necessary to operate games and verify outcomes.
• IT infrastructure and cloud providers: Server infrastructure, content delivery, and backup services are provided by vetted technology partners operating under confidentiality obligations and data processing agreements with sugih4.
• Legal and regulatory authorities: sugih4 may disclose Personal Data to law enforcement agencies, financial intelligence units, regulatory bodies, or courts where required to do so by applicable law, court order, or a lawful request from a competent authority. sugih4 will, where legally permissible, notify you of such a disclosure request before complying.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of sugih4's business, Personal Data held at the time of the transaction may be transferred to the acquiring entity. Members will be notified of any such transfer and of any material changes to this Privacy Policy that result from it, with a minimum of 30 days' notice before the transfer takes effect.

7 Data Retention

sugih4 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our internal data disposal procedures. Anonymised, aggregated data may be retained indefinitely for statistical analysis without any retention limit.

8 Security Measures

sugih4 employs a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, disclosure, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption: All data in transit between your device and sugih4's servers is encrypted using industry-standard TLS 1.2 or higher protocols.
• Encryption at rest: Sensitive data stored on sugih4's servers — including KYC documents, financial records, and hashed credentials — is encrypted at rest using AES-256 encryption.
• Access control: Access to Personal Data is restricted to authorised sugih4 personnel on a strict need-to-know basis. All staff with access to personal data undergo background screening and receive mandatory data protection training.
• Two-factor authentication (2FA): 2FA is available and strongly encouraged for all Member accounts. Internal staff systems require 2FA as a mandatory control.
• Penetration testing and vulnerability assessments: sugih4's infrastructure undergoes regular third-party penetration testing and automated vulnerability scanning. Critical findings are remediated within defined SLA windows.
• Incident response plan: sugih4 maintains a documented data breach response plan. In the event of a security incident that poses a risk to Members' rights, affected Members will be notified promptly and without undue delay.
• Third-party security audits: Key Data Processors, including KYC verification providers and payment partners, are required to demonstrate compliance with recognised security standards (such as ISO 27001 or PCI DSS where applicable) as a condition of their engagement with sugih4.

9 Cookies & Tracking Technologies

sugih4 uses cookies and similar tracking technologies to ensure the Platform operates correctly, to maintain your session state, and to deliver a personalised experience. A cookie is a small text file placed on your device by your browser when you visit the Platform. The following categories of cookies are in use:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use core platform features. Disabling analytics or marketing cookies will not affect your ability to access games or process transactions.

sugih4 does not deploy cross-site tracking pixels, social media tracking scripts, or third-party advertising network cookies. Our analytics implementation uses first-party data collection only.

10 Your Data Rights

As a Member of sugih4, you are entitled to exercise the following rights with respect to your Personal Data at any time. To exercise any of these rights, submit a written request to [email protected]. We will acknowledge your request within 3 business days and provide a substantive response within 14 business days.

• Right of access: You have the right to request a copy of all Personal Data sugih4 holds about you, along with information about how it is used and with whom it has been shared.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to erasure ("right to be forgotten"): You may request that sugih4 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing was unlawful. Note that certain data must be retained to comply with AML and regulatory obligations even after an erasure request is received; we will inform you of any such retention.
• Right to restriction of processing: You may request that sugih4 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested, or while you await the outcome of an objection to processing.
• Right to data portability: You may request that Personal Data you have provided to sugih4 be delivered to you in a structured, commonly used, machine-readable format (such as JSON or CSV) so that it can be transferred to another service provider.
• Right to object: You have the right to object to processing of your Personal Data carried out on the basis of legitimate interests, including profiling for marketing purposes. sugih4 will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time via your Account settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

11 Minors & Age Restriction

The sugih4 Platform is strictly restricted to individuals aged 21 years and over. We do not knowingly collect, process, or store Personal Data belonging to individuals under the age of 21. Age verification is a mandatory component of the KYC process, and accounts where the verified age falls below 21 will be immediately suspended and any wallet balance returned.

If you are a parent or guardian and you believe that a minor in your care has registered an account on sugih4, please contact us immediately at [email protected] with the relevant account details. We will investigate the matter promptly, close the account, and securely delete any Personal Data collected from the minor, subject to any mandatory retention obligations.

sugih4 strongly recommends that parents and guardians install age-appropriate parental control software to prevent minors from accessing online gambling platforms. Responsible gaming begins with protecting those who are most vulnerable.

12 International Data Transfers

sugih4's primary server infrastructure is hosted in data centres designed to provide low-latency access for Indonesian Members. In certain circumstances, Personal Data may be transferred to, stored in, or processed in jurisdictions outside Indonesia — for example, where a Data Processor operates infrastructure in another country.

Where such transfers occur, sugih4 ensures that appropriate safeguards are in place to protect your Personal Data to a standard consistent with this Privacy Policy. Safeguards may include:

• Data processing agreements incorporating internationally recognised standard contractual clauses.
• Transfer to processors that hold certifications under internationally recognised security frameworks (e.g., ISO 27001, SOC 2).
• Binding corporate rules where data is transferred within a corporate group.

By using the sugih4 Platform, you acknowledge that your Personal Data may be transferred internationally and consent to such transfer subject to the safeguards described above.

13 Changes to This Privacy Policy

sugih4 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform operations. The effective date at the top of this document will be updated whenever a revision is made.

Where changes are material — for example, changes to the categories of data collected, new sharing arrangements with third parties, or changes to Members' data rights — sugih4 will provide at least 14 days' advance notice by publishing the revised Policy on the Platform and, where reasonably practicable, by sending a notification to the email address registered to your Account.

Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree to a revised Policy, you should close your Account before the revised Policy takes effect and contact support to request deletion of your Personal Data to the extent permitted by our retention obligations.

14 Contact & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a suspected data security incident, please contact the sugih4 data protection team through the following channels:

• Live chat support: Available 24 hours a day, 7 days a week, directly within the Platform. For general privacy queries, our support agents can provide initial guidance and escalate to the data protection team where required.
• Email (data subject requests and formal privacy enquiries): [email protected] — please include "Privacy Request" in the subject line along with your registered username and a clear description of your request.
• Operating hours for escalated privacy queries: 08:00 – 24:00 WIB (UTC+7), seven days a week including Indonesian public holidays.

sugih4 is committed to resolving all privacy-related enquiries promptly and professionally. We acknowledge all data subject requests within 3 business days and provide a full response within 14 business days of receipt. Where a request requires additional time to process — for example, large-scale data access requests — we will notify you of the extended timeline and the reason for it.