Privacy Policy

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably identify a living individual, directly or indirectly, including name, identification number, location data, online identifiers, or factors specific to that individual's physical, financial, or social identity.
• "Processing" means any operation performed on Personal Data, whether by automated or manual means, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, sp212.
• "Data Processor" means any third party that processes Personal Data on behalf of sp212, such as payment service providers, KYC verification providers, and cloud hosting partners.
• "Player" or "You" means any individual who has registered an account on sp212 or who accesses the platform, whether as a registered user or a visitor.
• "Platform" means the sp212 website at https://sp212.lat, including all associated subdomains, mobile-optimised views, and any native application sp212 may publish in the future.
• "KYC" means Know Your Customer — the identity and age verification process required under anti-money laundering (AML) obligations before a Player may withdraw funds.
• "Cookies" means small text files placed on your device by the Platform for purposes of session management, analytics, and personalisation, as further described in Section 9.

sp212 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, sp212 is responsible for determining what data is collected, the purposes for which it is used, and the measures taken to protect it.

For all privacy-related enquiries, data access requests, or complaints, you may contact our Data Protection Officer (DPO) directly:

sp212 collects the following categories of Personal Data from Players. We collect only what is necessary for the specific purpose indicated.

sp212 collects Personal Data through the following channels:

• Direct Interactions: Data you provide when creating an account, completing KYC verification, making a deposit or withdrawal, contacting support, or submitting a feedback form.
• Automated Technologies: Technical and usage data collected automatically when you interact with the Platform, via cookies, web beacons, server logs, and similar tracking technologies (see Section 9).
• Third-Party KYC Providers: Identity and address verification data returned by our third-party KYC partners when you submit your government-issued ID documents.
• Payment Processors: Confirmation data (transaction reference numbers, payment status) returned by bank transfer intermediaries and e-wallet providers such as OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Fraud Prevention & AML Screening Services: Risk-scoring data and sanctions screening results provided by third-party compliance data providers, used to meet our legal AML and counter-terrorist financing obligations.
• Game Studios: Anonymised or pseudonymised session data from third-party game providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Spribe, used to resolve technical disputes and ensure fair play.

sp212 processes your Personal Data only where a valid legal basis exists. The primary legal bases we rely on are:

• Contractual Necessity: Processing required to perform the contract between you and sp212 — i.e., to operate your account, process your deposits and withdrawals, and deliver the gaming services you have requested.
• Legal Obligation: Processing required to comply with applicable laws, including AML regulations, age verification requirements (21+), KYC obligations, and tax reporting duties.
• Legitimate Interests: Processing carried out for sp212's legitimate business interests where those interests are not overridden by your fundamental rights — including fraud detection, platform security, responsible gaming monitoring, analytics, and product improvement.
• Consent: Processing based on your freely given, specific, informed consent — primarily in the context of optional marketing communications. You may withdraw consent at any time by updating your account preferences or emailing [email protected].

sp212 uses the Personal Data we collect for the following purposes:

• Account Management: Creating and maintaining your sp212 account, verifying your identity and age (21+ requirement), enabling login and two-factor authentication, and processing account updates.
• Payment Processing: Facilitating deposits and withdrawals via local Indonesian bank transfers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), verifying payment method ownership, and reconciling transaction records.
• KYC & Compliance: Conducting identity verification, age verification, sanctions screening, and politically exposed person (PEP) checks as required by our AML and responsible gaming obligations.
• Responsible Gaming: Monitoring betting patterns, deposit velocity, and session durations to identify players who may be at risk of problem gambling, and to enforce self-exclusion, deposit limits, and cooling-off periods that players have voluntarily activated.
• Fraud Prevention & Security: Detecting and preventing unauthorised account access, multi-accounting, bonus abuse, money laundering, and other fraudulent activity, including through automated risk-scoring systems.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance and regulatory purposes.
• Platform Analytics & Improvement: Analysing aggregated and pseudonymised usage data to understand how Players interact with the Platform, identify areas for improvement, and develop new features and game offerings.
• Personalisation: Customising the Platform experience based on your game preferences, deposit history, and location (e.g., displaying content relevant to players in Jakarta, Bali, or Surabaya), subject always to your privacy preferences.
• Marketing (with consent): Sending promotional offers, bonus notifications, and seasonal campaign communications relevant to the Indonesian market — including offers aligned with Ramadhan, Idul Fitri, and major sporting events such as BRI Liga 1 matches and Timnas Indonesia fixtures — where you have provided marketing consent.
• Legal & Regulatory: Fulfilling our obligations under applicable law, responding to lawful requests from Indonesian law enforcement or regulatory authorities, and exercising or defending legal claims.

sp212 does not sell, rent, or trade your Personal Data. We share data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: We share financial data with banks and e-wallet operators (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposits and withdrawals. These providers act as independent data controllers for their own services and are governed by their respective privacy policies.
• KYC & Identity Verification Providers: We share identity documents and personal details with third-party KYC verification partners to fulfil our legal age and identity verification obligations. These providers are contractually bound to process your data only for verification purposes and to maintain appropriate security standards.
• AML & Fraud Screening Providers: We share limited identity data with sanctions list providers and fraud-detection platforms to screen for prohibited individuals and detect suspicious activity, as required by law.
• Game Studio Providers: We share a pseudonymised player token (not your real name or contact details) with third-party game providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft to enable gameplay and resolve game-related disputes.
• Cloud & Infrastructure Partners: We use third-party cloud hosting and content delivery providers to operate the Platform. These providers access data only to the extent necessary to provide infrastructure services and are contractually bound by data processing agreements that require them to implement appropriate technical and organisational security measures.
• Professional Advisers: We may share data with our lawyers, auditors, and insurers under binding confidentiality obligations, where necessary for the provision of professional services.
• Law Enforcement & Regulatory Authorities: We may disclose Personal Data to Indonesian law enforcement agencies, financial intelligence units, or other competent authorities where required by law, court order, or where we have a good-faith belief that disclosure is necessary to prevent or report illegal activity, including fraud, money laundering, or underage gambling.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of sp212's business assets, Personal Data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer via prominent platform notice no less than 30 days in advance, and you will have the right to close your account and request data deletion before the transfer takes effect.

Some of the third-party providers with whom sp212 shares data (including cloud hosting partners, game studios, and KYC providers) may process Personal Data in jurisdictions outside of Indonesia. Where such transfers occur, sp212 takes steps to ensure that an appropriate level of protection is in place, including:

• Requiring the recipient to sign standard contractual clauses or equivalent data transfer agreements that impose GDPR-equivalent obligations on the receiving party.
• Transferring data only to providers located in jurisdictions that the relevant regulatory authority has determined offer an adequate level of data protection.
• Implementing supplementary technical measures (such as end-to-end encryption) where the legal framework of the destination country is assessed as providing a lower level of protection.

You may request details of any international transfer safeguards applicable to your data by contacting the sp212 DPO at [email protected].

sp212 uses cookies and similar tracking technologies on the Platform for the purposes described below. A cookie is a small text file stored on your device by your browser. Some cookies are essential for the Platform to function; others are optional and require your consent.

You may manage your cookie preferences at any time through your browser settings. Most browsers allow you to block or delete cookies; however, disabling strictly necessary cookies will prevent you from logging in to your sp212 account. Please refer to your browser's help documentation for instructions on managing cookie settings.

sp212 does not use fingerprinting technologies, ultrasonic tracking, pixel tracking beyond basic session analytics, or any cross-device tracking mechanism that would allow us to identify you across third-party websites.

sp212 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Account & KYC Data: Retained for a minimum of five (5) years following account closure. This period is mandated by AML regulations and is not negotiable, even if you request earlier deletion.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, in compliance with financial record-keeping obligations.
• Customer Support Correspondence: Retained for three (3) years following the resolution of the relevant matter, to support dispute resolution and quality assurance.
• Marketing Consent Records: Retained for the duration of your account, plus three (3) years thereafter, to demonstrate that we had valid consent for any marketing communications sent.
• Technical Logs (IP addresses, session data): Retained for twelve (12) months, after which they are automatically purged or anonymised.
• Analytics Data: Retained in aggregated, anonymised form indefinitely for product improvement purposes. Once anonymised, this data is no longer considered Personal Data.

When the applicable retention period expires, sp212 will securely delete or anonymise your Personal Data using industry-standard deletion procedures. Where deletion is not technically feasible within a shared infrastructure environment (for example, backup storage), the data will be isolated from active processing and deleted at the next scheduled purge cycle.

As a Player on sp212, you have the following rights in relation to your Personal Data. To exercise any of these rights, please contact our DPO at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 calendar days.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you, along with information about how it is processed and with whom it is shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. For name, date of birth, and identity document corrections, we may require supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Note that this right is subject to our legal obligation to retain AML and financial records for a minimum of five (5) years, which takes precedence.
• Right to Restriction of Processing: You have the right to request that sp212 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being considered.
• Right to Data Portability: You have the right to receive a copy of the Personal Data you provided to sp212 in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to request that we transmit that data directly to another data controller where technically feasible.
• Right to Object: You have the right to object to processing of your Personal Data based on legitimate interests, including profiling for personalisation purposes. You also have an absolute right to object to processing for direct marketing purposes, which we will honour without question.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects. sp212 uses automated tools to assist with fraud detection and responsible gaming monitoring; however, significant decisions (such as account suspension) are reviewed by a human agent before being enacted.

sp212 is an adult gaming platform. Access to and use of the Platform is strictly prohibited for individuals under the age of 21. sp212 does not knowingly collect Personal Data from anyone under the age of 21, and we will not knowingly permit a minor to create an account or place any wager on the Platform.

If sp212 discovers, through KYC verification or other means, that it has inadvertently collected data from a person under 21, it will immediately suspend the relevant account, void any transactions conducted during the minor's use of the Platform, return any deposited funds via the original payment method, and securely delete the minor's Personal Data without undue delay.

If you are a parent or guardian and believe that your child has accessed sp212 and provided personal information, please contact us immediately at [email protected] with the subject line "Minor Account — Urgent". We will investigate and take appropriate action within 24 hours of receiving your report.

sp212 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS/SSL Encryption: All data transmitted between your device and the sp212 Platform is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed on a continuous basis.
• Data Encryption at Rest: Sensitive personal data, including KYC documents and financial records, is encrypted at rest using AES-256 encryption on all storage systems.
• Access Controls: Access to personal data within sp212's systems is restricted on a strict need-to-know basis. All internal access is logged, audited, and subject to regular review. Multi-factor authentication is mandatory for all staff members who access production data systems.
• Network Security: sp212's infrastructure is protected by enterprise-grade firewalls, intrusion detection and prevention systems (IDS/IPS), and DDoS mitigation services. Regular penetration testing is conducted by independent third-party security firms.
• Incident Response: sp212 maintains a documented data breach response plan. In the event of a confirmed data breach that is likely to result in a risk to your rights and freedoms, we will notify you and any relevant regulatory authority within 72 hours of becoming aware of the breach.
• Staff Training: All sp212 employees who handle Personal Data receive mandatory data protection and security training on joining and on an annual refresher basis.

The sp212 Platform integrates third-party services to deliver its full range of gaming and payment products. These third-party providers operate under their own privacy policies, and sp212 is not responsible for their data practices beyond the contractual data processing obligations we impose on them. Key third-party categories include:

• Game Studios: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft, and other certified providers supply the game content available on sp212. Your in-game activity data is processed by these studios in pseudonymised form to enable gameplay and RNG certification.
• Payment Networks: Bank transfer intermediaries and e-wallet networks (OVO, DANA, GoPay, ShopeePay, LinkAja) process your payment data in accordance with their own terms and privacy policies. sp212 does not store your full bank account credentials.
• Analytics Providers: sp212 uses a self-hosted or privacy-focused analytics solution to monitor Platform performance and user behaviour. We do not use Google Analytics or any other analytics provider that shares data with advertising networks.

sp212 performs due diligence on all third-party providers before engagement, including reviewing their security certifications, data processing agreements, and privacy policies. Providers that do not meet our data protection standards are not engaged.

sp212 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. All amendments will be published on this page with an updated "Last Updated" date at the top.

Where an amendment is material — meaning it significantly affects how we process your Personal Data or reduces your rights — sp212 will provide you with at least fourteen (14) days' advance notice by email to your registered address before the change takes effect. Your continued use of the Platform after the effective date of a material amendment constitutes your acknowledgement of the updated Policy.

We encourage you to review this Privacy Policy periodically. The most current version is always available at https://sp212.lat/privacy-policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a privacy concern, please contact the sp212 Data Protection Officer using the details below. We are committed to addressing all legitimate privacy enquiries promptly and transparently.

If you are not satisfied with sp212's response to your privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. sp212 will cooperate fully with any such regulatory investigation.