Privacy Policy

This Privacy Policy ("Policy") is issued by sar288 ("we", "us", "our") and applies to all personal data collected from individuals ("you", "your", "Player") who access, register on, or interact with the sar288 online gaming and sports betting platform available at sar288.cam ("the Platform").

sar288 operates primarily to serve players in Indonesia, including but not limited to those located in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and Makassar. This Policy is written in English as the Platform's operational language, consistent with the international-brand standard that many Indonesian players in higher-income and digitally engaged segments expect when interacting with premium online gaming services.

This Policy covers:

• The categories of personal data we collect from you and about you.
• The specific purposes for which that data is used.
• The legal basis upon which each processing activity is conducted.
• The circumstances in which your data may be shared with third parties.
• How long we retain your data and how it is secured.
• The rights you hold in respect of your personal data and how to exercise them.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, ID number, phone number, location data, or online identifier.
• "Processing" means any operation performed on personal data, whether or not by automated means — including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
• "Controller" refers to sar288 as the entity that determines the purposes and means of processing your personal data.
• "Processor" refers to any third-party entity that processes personal data on sar288's behalf and under sar288's written instructions (e.g., payment gateway providers, hosting infrastructure partners).
• "Consent" means a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data.
• "Data Subject" means you, the natural person whose personal data is being processed by sar288.
• "KYC Data" means identity verification documents submitted as part of the Know Your Customer process, including copies of your KTP (Indonesian national identity card), passport, and payment account evidence.

sar288 collects personal data through the following channels: direct input by you during registration and use of the Platform; automatic collection through your device and browser as you navigate the Platform; and receipt from third-party payment providers when you make a deposit or withdrawal.

The following table sets out the specific categories of personal data we collect and the primary source of each:

We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs, health information, or political opinions unless directly relevant to a responsible gaming support case and provided voluntarily by you.

sar288 uses the personal data it collects for the following specific purposes. Each purpose is paired with the legal basis described in Section 5:

• Account Creation and Management: To register your account, authenticate your identity at login, maintain your account preferences, and communicate account-related notices with you.
• Age and Identity Verification: To confirm that you are at least 21 years of age and a resident of Indonesia or an eligible jurisdiction before granting access to real-money gaming features. This is a legal obligation we cannot waive.
• Payment Processing: To execute your deposit and withdrawal instructions in Indonesian Rupiah via your chosen bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OCBC NISP, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain an accurate financial record of all transactions.
• Fraud and Security Monitoring: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and any other prohibited conduct described in our Terms & Conditions. This includes automated monitoring of betting patterns, login locations, and transaction anomalies.
• Responsible Gaming Compliance: To apply and enforce deposit limits, session time reminders, cooling-off periods, and self-exclusion measures you have set, and to identify patterns of play that may indicate problem gambling requiring proactive outreach.
• Customer Support: To respond to your inquiries, resolve disputes, process complaints, and maintain records of support interactions for quality assurance and training purposes.
• Legal and Regulatory Compliance: To fulfil our obligations under applicable international gaming regulations, anti-money laundering requirements, and any lawful orders issued by competent authorities.
• Platform Improvement: To analyze aggregate usage patterns, identify technical issues, test new features, and improve the overall experience of the sar288 Platform — including the performance of sports betting markets for BRI Liga 1, EPL, La Liga, and other major competitions.
• Marketing Communications: To send you promotional offers, bonus notifications, and event-related communications (such as AFF Cup betting promotions or Ramadhan special offers) where you have provided explicit consent and have not subsequently opted out.

Every personal data processing activity carried out by sar288 rests on one or more of the following legal bases, consistent with internationally recognized data protection principles:

• Contractual Necessity: Processing required to fulfill our contractual obligations to you under the sar288 Terms & Conditions — including account management, payment execution, and KYC verification. Without this processing, we cannot provide the Services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering obligations, age verification mandates, and lawful requests from competent authorities. This processing cannot be refused or restricted by you.
• Legitimate Interests: Processing necessary to pursue sar288's legitimate business interests where those interests are not overridden by your fundamental privacy rights. This includes fraud prevention, platform security, network infrastructure management, and internal analytics. We conduct a balancing assessment for each legitimate-interest processing activity.
• Consent: Processing based on your freely given, specific, and informed agreement — applied exclusively to direct marketing communications. You may withdraw consent for marketing at any time through your account settings without affecting any other processing activity.

sar288 uses cookies and similar tracking technologies on the Platform to support core functionality, improve user experience, and gather analytics data. The following categories of cookies are deployed:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without preventing the Platform from operating correctly.
• Functional Cookies: Used to remember your preferences — such as your preferred language display, default deposit method (e.g., BCA or OVO), and last-visited game category. These improve convenience but are not mandatory.
• Analytics Cookies: Used to collect aggregated, anonymized data about how Players navigate the Platform — which pages are visited most frequently, how long sessions last, and where users drop off in registration or deposit flows. This data is used exclusively to improve the Platform.
• Marketing Cookies: Used only where you have explicitly consented to receive personalized promotional content. These cookies help ensure that promotional communications you receive — such as notifications about slot gacor jackpot events or BRI Liga 1 enhanced odds — are relevant to your demonstrated interests on the Platform.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will impair or prevent access to the Platform. Disabling analytics or marketing cookies will not affect your ability to use any core gaming or account feature.

sar288 does not permit third-party advertising networks to place cookies on the Platform for the purpose of serving advertisements on external websites.

sar288 does not sell your personal data. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Service Providers: Your financial data (name, bank account number, transaction amount in IDR) is shared with the relevant payment processor — for example, BCA, BRI, Mandiri, OVO, or DANA — solely to execute your authorized transaction. These providers are bound by their own regulatory obligations and do not receive any gaming-activity data.
• Identity Verification Partners: Your KYC documents may be processed by a third-party identity verification service acting as a data processor under sar288's instructions and subject to a written data processing agreement. These partners verify the authenticity of your submitted documents and return a pass/fail result; they do not retain copies of your documents beyond the period required for the verification task.
• Technology Infrastructure Providers: Hosting, cloud storage, and cybersecurity service providers that process data on sar288's behalf to maintain Platform availability and security. All such providers operate under contractual data processing terms that prohibit independent use of your data.
• Legal and Regulatory Authorities: Where required by a lawful court order, regulatory directive, or anti-money laundering investigation, sar288 will disclose the minimum personal data necessary to satisfy the legal requirement. Where permitted by law, sar288 will endeavor to notify you of such a disclosure in advance.
• Responsible Gaming Support Organizations: If you voluntarily request referral to an external problem gambling support service, the minimum necessary contact information may be shared with that organization with your explicit consent.

sar288 operates as an internationally hosted platform. As a result, your personal data may be transferred to, stored on, or processed by servers or service providers located outside Indonesia. We recognize that many of our players are residents of Indonesia, and we take our responsibilities regarding cross-border data transfers seriously.

Whenever personal data is transferred outside Indonesia to a jurisdiction that may not offer equivalent data protection standards, sar288 implements appropriate safeguards, which may include:

• Standard contractual data protection clauses incorporated into agreements with the receiving party.
• Binding corporate rules where applicable to intra-group transfers.
• Transfer only to jurisdictions that sar288 has assessed as offering an adequate level of personal data protection.

You may request details of the specific safeguards applied to any international transfer of your personal data by contacting the sar288 support team.

sar288 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a baseline:

• Account and Identity Data: Retained for the duration of your active account relationship with sar288, plus a minimum of 5 (five) years following account closure, to satisfy anti-money laundering record-keeping requirements and to support any legal claims that may arise within applicable limitation periods.
• Financial Transaction Records: Retained for a minimum of 5 (five) years from the date of each transaction, consistent with standard financial record-keeping obligations applicable in international gaming jurisdictions.
• KYC Documents: Retained for the duration of your account plus 5 (five) years post-closure. Upon expiry of this period, documents are securely and irreversibly destroyed.
• Customer Support Records: Chat transcripts and email correspondence are retained for 2 (two) years from the date of the final exchange in a given support case, after which they are anonymized or deleted.
• Analytics and Usage Data: Aggregated, anonymized analytics data may be retained indefinitely as it no longer constitutes personal data. Individual-level usage logs are retained for no more than 12 (twelve) months before aggregation or deletion.
• Marketing Preference Records: Opt-in and opt-out records are retained for the duration of your account relationship to ensure compliance with your stated preferences. These records are deleted following account closure.

When personal data is no longer required and no legal retention obligation applies, sar288 securely deletes or irreversibly anonymizes it. Anonymized data derived from your account activity may continue to be used for aggregate statistical analysis without identifying you.

sar288 applies a multi-layered technical and organizational security framework to protect your personal data against unauthorized access, accidental loss, alteration, or destruction. Key security measures include:

• Encryption in Transit: All data transmitted between your device and the sar288 Platform is encrypted using TLS 1.2 or higher (effectively 256-bit SSL). This applies to account logins, deposit and withdrawal requests, live chat sessions, and all API communications with payment providers including BCA, Mandiri, GoPay, and OVO.
• Encryption at Rest: Personal data stored in sar288's databases is encrypted using AES-256, the same standard used by leading Indonesian financial institutions.
• Access Controls: Internal access to personal data is governed by strict role-based permissions. Only personnel with a documented operational need may access identifiable player data. All access events are logged and subject to regular audit.
• Two-Factor Authentication: sar288 supports and strongly recommends two-factor authentication (2FA) for all player accounts. sar288 staff with access to player data systems are required to use 2FA without exception.
• Penetration Testing: sar288 engages independent security professionals to conduct regular penetration tests and vulnerability assessments of the Platform's infrastructure.
• Incident Response: In the event of a confirmed data breach that is likely to result in a risk to your rights and freedoms, sar288 will notify affected Players without undue delay and will document the incident, its scope, and the remediation measures applied.

As a data subject, you hold the following rights in respect of the personal data sar288 holds about you. These rights may be exercised free of charge by contacting our support team via live chat or by email. sar288 will respond to all valid data rights requests within 30 calendar days of receipt:

• Right of Access: You may request a copy of all personal data sar288 holds about you, together with information about how it is being used and on what legal basis.
• Right to Rectification: If any personal data sar288 holds about you is inaccurate or incomplete, you may request that it be corrected. Some changes (such as name changes) require supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where consent has been withdrawn and no other legal basis applies, or where processing is unlawful. This right is subject to sar288's legal retention obligations — data we are required by law to keep cannot be deleted before the mandatory retention period expires.
• Right to Restriction of Processing: You may request that sar288 temporarily pause all processing of your personal data — other than storage — while a rectification or objection request is under review.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that sar288 provide your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON).
• Right to Object: You may object to processing carried out on the basis of legitimate interests. sar288 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing communications), you may withdraw that consent at any time through your account settings. Withdrawal does not affect any processing that occurred prior to the withdrawal.

The sar288 Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect, store, or process personal data belonging to persons under the age of 21.

If you are a parent or guardian and have reason to believe that a person under the age of 21 has registered an account on sar288 or submitted personal data to the Platform, please contact our support team immediately. Upon verification, sar288 will take the following actions without delay:

• Immediately suspend and permanently close the underage account.
• Securely delete all personal data associated with the account to the extent permitted by legal retention obligations.
• Retain only the minimum data required to document the incident for compliance and audit purposes.

sar288 applies age verification at the point of registration and enforces mandatory KYC document checks before any withdrawal is processed. These controls are designed to prevent underage access and are reviewed and strengthened on a regular basis.

The sar288 Platform integrates with third-party service providers whose functionality is essential to delivering a complete gaming experience. These include game content providers such as Pragmatic Play, Evolution Gaming, Spribe, Microgaming, NetEnt, and Pocket Games Soft, whose game engines operate within the sar288 Platform environment.

While sar288 carefully selects all third-party technology partners and requires them to operate within contractually defined data protection standards, each provider is also subject to its own privacy and security framework. sar288 does not control, and is not responsible for, the independent privacy practices of third-party game studios or payment network operators beyond their contractual obligations to sar288.

Players are encouraged to review the privacy policies of payment providers they use — including the Indonesian e-wallet services OVO, DANA, GoPay, ShopeePay, and LinkAja, as well as local banks such as BCA, BRI, BNI, and Mandiri — to understand how those providers handle your financial data independently of sar288.

sar288 does not embed social media plugins, third-party advertising SDKs, or external analytics platforms that would share your personal data with unaffiliated parties without your knowledge.

sar288 reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, new processing activities, changes to our service offering, or improvements to our data governance practices. The date of the most recent revision is displayed prominently at the top of this page.

Where an amendment is material — meaning it substantively changes how we collect, use, share, or retain your personal data — sar288 will provide advance notice of no fewer than 14 (fourteen) calendar days via in-platform notification and, where possible, to your registered email address, before the revised Policy takes effect.

Your continued use of the sar288 Platform after the revised Policy takes effect constitutes your acceptance of the updated terms. If you do not agree with any amendment, you should cease using the Platform and request account closure in accordance with the process described in the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how sar288 is handling your personal data, please reach out through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly within your sar288 account. This is the fastest route for most data-related inquiries and is staffed by Indonesian-speaking agents who can assist in both English and Bahasa Indonesia.
• Email: Send a written request to [email protected] (plain text only — this address is not a clickable link). Include your full registered name and a clear description of your request or complaint. Email responses are provided within 48 hours for general inquiries and within 30 calendar days for formal data rights requests.

If you are not satisfied with sar288's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection or supervisory authority in the jurisdiction applicable to your circumstances.

For a comprehensive overview of all pages and resources available on the sar288 Platform, please visit our Sitemap. For answers to common questions about your account, payments, and security, see our FAQ page.