Privacy Policy

1.1 sm608 ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access or use the sm608 Platform at https://sm608.net. This Privacy Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data in connection with your use of the Platform.

1.2 This Privacy Policy applies to all players, visitors, and registered account holders who interact with the Platform, regardless of the device or browser used. It covers data collected through the website, via email, via live chat support, and through any other communication channel operated by sm608.

1.3 This Privacy Policy should be read in conjunction with the sm608 Terms & Conditions, which govern your use of the Platform as a whole. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a data-privacy matter, this Privacy Policy shall prevail.

1.4 sm608 operates primarily for players based in Indonesia. Accordingly, this Policy is drafted with the Indonesian player context in mind, including references to local payment channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja), local identity documentation (KTP — Indonesian National Identity Card), and time-zone references to WIB (Western Indonesia Time, UTC+7).

2.1 Registration Data. When you open an Account with sm608, we collect the personal information you provide during the registration process. This includes your full legal name, date of birth, residential address in Indonesia, email address, and mobile phone number.

2.2 Identity Verification (KYC) Data. To comply with our international gaming licence obligations and anti-money laundering requirements, we may request and collect copies of government-issued identity documents, including your Indonesian National Identity Card (KTP) or current passport, proof of residential address (such as a recent utility bill or bank statement), and in some cases a selfie or liveness-check photograph for identity verification purposes.

2.3 Financial Data. We collect transaction records related to deposits and withdrawals, including your chosen payment method, bank account name and number (for Indonesian banks such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, and Bank Permata), e-wallet identifiers (for OVO, DANA, GoPay, ShopeePay, and LinkAja), transaction amounts in IDR, and transaction timestamps. We do not store full card numbers or CVV data.

2.4 Gaming Activity Data. We log detailed records of your gaming activity on the Platform, including game sessions played, bet amounts, winnings, game type (slots, live casino, sportsbook, Scratch Card, Crash Game), session duration, and bonus usage history. This data is used for account management, fraud detection, and responsible gaming monitoring.

2.5 Technical & Device Data. When you access the Platform, we automatically collect certain technical data, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited within the Platform, session duration, and clickstream data. This information is collected via server logs and cookies.

2.6 Communication Data. If you contact sm608 support via live chat, email, or any other channel, we retain records of those communications, including the content of messages, timestamps, and the identity of the support agent who handled your query.

2.7 Marketing Preference Data. Where you have opted in to receiving promotional communications, we record your marketing consent, preferred communication channel (email or SMS), and interaction history (e.g., email opens and clicks) to tailor future communications to your interests.

sm608 uses the personal data we collect for the following purposes:

4.1 Contractual Necessity. The majority of personal data processing carried out by sm608 is necessary for the performance of the contract between sm608 and the Player — namely, the provision of online gaming services as described in the Terms & Conditions. This basis covers Account creation, payment processing, game delivery, and customer support.

4.2 Legal Obligation. Certain processing activities — in particular, KYC identity verification, AML/CFT transaction monitoring, and record-keeping — are required by our international gaming licence conditions and applicable international financial regulations. sm608 has a legal obligation to conduct these activities regardless of whether a player consents.

4.3 Legitimate Interests. sm608 processes some data on the basis of its legitimate interests as a gaming operator, where those interests are not overridden by your privacy rights. This includes fraud detection, Platform security, and internal analytics. We apply a proportionality test to all legitimate-interest processing and document our findings in our internal privacy impact assessments.

4.4 Consent. Where we rely on consent — principally for marketing communications and non-essential cookies — we will ask for your explicit consent at the point of collection. You may withdraw your consent at any time by contacting support or updating your Account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

5.1 Third-Party Service Providers. sm608 engages a limited number of vetted third-party service providers to assist in the operation of the Platform. These providers process personal data solely on sm608's behalf and under our instructions, pursuant to a written data-processing agreement that requires them to maintain confidentiality and apply appropriate security measures. Categories of such providers include:

• Identity verification and KYC services;
• Payment processors and banking partners (for Indonesian bank transfers and e-wallets);
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft — these providers receive anonymised session data only, not full account details);
• Fraud detection and cybersecurity services;
• Cloud hosting and IT infrastructure providers;
• Customer support platform providers.

5.2 Regulatory & Law Enforcement Authorities. sm608 may be required to disclose personal data to regulatory bodies, law-enforcement agencies, or courts of competent jurisdiction in response to a lawful request, warrant, or court order. Where permitted by law, sm608 will notify the affected Player prior to disclosure.

5.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or substantially all of sm608's assets, personal data held by sm608 may be transferred to the successor entity as part of that transaction. Players will be notified of any such transfer and of any material change to this Privacy Policy that results from it, with at least 30 days' advance notice.

5.4 What We Do Not Do. sm608 will not sell, rent, trade, or otherwise commercially exploit your personal data to third-party advertisers, data brokers, or any other entity for their independent use. Data is shared only as described in this Section 5.

6.1 What Are Cookies? Cookies are small text files placed on your device when you visit a website. They allow the website to remember your preferences, maintain your login session, and collect analytical data about how you use the Platform. sm608 uses only the categories of cookies described below.

6.2 Managing Cookies. You can control and manage cookies through your browser settings. Most modern browsers allow you to block, delete, or receive notifications about cookies. Please note that disabling strictly necessary cookies may prevent certain Platform features from functioning correctly, including login and payment flows. Detailed browser-specific guidance is available from the respective browser's help documentation.

7.1 Active Accounts. Personal data associated with an active Account is retained for the duration of the account relationship and for a period of five years following the closure of the Account, in order to meet our legal, regulatory, and contractual obligations.

7.2 KYC & Financial Records. Identity verification documents and financial transaction records are retained for a minimum of five years from the date of the last transaction, as required by our international gaming licence and applicable AML/CFT standards.

7.3 Marketing Data. Marketing preferences and communication records are retained for as long as you remain opted in to marketing communications, and for a period of three years following opt-out, for compliance and dispute-resolution purposes.

7.4 Support Communications. Records of live chat and email support interactions are retained for three years from the date of the interaction, for quality assurance and dispute resolution purposes.

7.5 Anonymised Data. sm608 may retain anonymised or aggregated data — from which individual identity cannot be reasonably reconstructed — indefinitely for research, analytics, and platform improvement purposes. Such data does not constitute personal data under applicable privacy frameworks.

7.6 Deletion. Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with sm608's data lifecycle management policy. Secure deletion methods used include cryptographic erasure for cloud-hosted data and certified overwrite procedures for physical storage media.

As a player whose personal data is processed by sm608, you hold the following rights with respect to your personal data. All requests should be submitted in writing to [email protected]. sm608 will acknowledge all data subject requests within 5 business days and provide a substantive response within 30 calendar days.

9.1 Technical Safeguards. sm608 employs a comprehensive suite of technical security measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between client and server;
• AES-256 encryption for sensitive data at rest, including KYC documents and financial records;
• Multi-factor authentication (MFA) requirements for all administrative access to player data systems;
• Web application firewall (WAF) and DDoS mitigation infrastructure;
• Real-time intrusion detection and prevention systems (IDS/IPS);
• Regular third-party penetration testing and vulnerability assessments;
• Automated session timeout for inactive user accounts to prevent unauthorised access from shared devices.

9.2 Organisational Safeguards. Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data receive mandatory privacy and data security training. sm608 maintains a formal data breach response procedure, which includes notification to affected players within 72 hours of a confirmed breach where there is a high risk to their rights and freedoms.

9.3 Player Responsibilities. While sm608 takes all reasonable steps to protect your data, you are also responsible for maintaining the security of your own Account. You must keep your login credentials confidential, use a strong and unique password for your sm608 Account, and notify support immediately if you suspect any unauthorised activity. sm608 cannot be held liable for breaches resulting from a player's failure to protect their own credentials.

10.1 As an internationally licensed gaming platform, sm608 may transfer personal data to, or process it in, countries outside of Indonesia. This may occur when data is stored on servers located in the jurisdiction of our gaming licence, or when processed by third-party service providers with operations in other countries.

10.2 Where such international transfers occur, sm608 ensures that appropriate safeguards are in place to protect the transferred data to a standard at least equivalent to that applied within Indonesia. Safeguards may include:

• Contractual clauses binding the recipient to adequate data protection standards;
• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection;
• Binding corporate rules where transfers occur within a group of affiliated companies.

10.3 You may request further information about the specific safeguards applied to any given international transfer of your personal data by contacting sm608's data protection contact at [email protected].

11.1 The sm608 Platform is strictly intended for adults aged 21 and over. sm608 does not knowingly collect, process, or retain personal data from individuals under the age of 21.

11.2 If sm608 becomes aware that personal data has been submitted by or on behalf of a person under 21 years of age, that data will be deleted immediately and the associated Account will be permanently closed. Any deposits received from such an Account will be returned to the originating payment source.

12.1 The sm608 Platform may reference third-party services such as game providers, payment processors, and sports leagues. While we take care to partner only with reputable organisations, sm608 is not responsible for the privacy practices of any third-party service, and this Privacy Policy does not apply to any third-party website or service.

12.2 We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of the Platform, including your bank, e-wallet provider, or payment gateway. sm608 has no visibility into or control over how these third parties handle your personal data beyond the data-processing agreements described in Section 5.1.

13.1 sm608 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or Platform features. Material changes will be communicated to registered players via email or a prominent on-Platform notification at least 7 calendar days prior to the changes taking effect.

13.2 The "Last Updated" date at the top of this document will be revised with each material amendment. We recommend that you review this page periodically to stay informed of how sm608 collects and uses your personal data.

13.3 Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you must cease using the Platform and may request closure of your Account in accordance with the Terms & Conditions.

14.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the sm608 privacy team through the following channels:

• Email: [email protected] (plain text — not a clickable link). Use the subject line "Privacy Request" to ensure your message is routed to the correct team.
• Live Chat: Available 24 hours a day, 7 days a week via the Platform. For privacy-specific matters, please state "Privacy Request" at the start of your message so the agent can escalate appropriately.
• Response Times: Acknowledgement within 5 business days; substantive response within 30 calendar days (WIB). Complex requests may require up to 60 calendar days, in which case you will be notified of the extension.

14.2 sm608 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection obligations. All formal data subject requests and privacy complaints should be directed to the DPO via the email address above, marked clearly as a DPO matter.