Privacy Policy — rr333

rr333 ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who accesses or uses the rr333 platform at https://rr333.vu. This Privacy Policy describes the types of personal information we collect from Members and visitors, the purposes for which we use that information, the circumstances under which we may share it with third parties, and the rights available to you regarding your own data.

This Privacy Policy applies to all products and services offered under the rr333 brand, including the sportsbook, live casino, slots, Bandar Ceme, and Sakong products, as well as all associated customer support channels, marketing communications, and account management tools.

By registering an account with rr333 or continuing to use the rr333 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with the terms of this Privacy Policy, you must not use the rr333 platform.

This Privacy Policy should be read in conjunction with rr333's Terms & Conditions and Responsible Gaming policy, both of which form part of the contractual agreement between you and rr333.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

rr333 collects the following categories of Personal Data, depending on the nature of your interaction with the platform:

• Identity Data: Full legal name, date of birth, gender, and nationality, as provided during account registration or KYC verification.
• Contact Data: Indonesian mobile phone number, email address, and residential address in Indonesia (including city — for example, Jakarta, Surabaya, Bandung, Medan, or Bali).
• Account Credentials: Username and encrypted password hash. rr333 does not store your raw password; it is hashed using an industry-standard one-way algorithm at the point of creation.
• Financial Data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), deposit and withdrawal transaction records, and IDR balance history.
• KYC Data: Scanned or photographed copies of government-issued identity documents (Indonesian KTP, passport, or driving licence), proof of address documents, and proof of payment method ownership.
• Wagering Data: Records of all bets placed, games played, odds accepted, winnings, and losses across all rr333 products including the sportsbook (covering BRI Liga 1, EPL, Champions League, Timnas Indonesia, AFF Cup fixtures), slots (Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft), live casino (Evolution Gaming), and card games (Bandar Ceme, Sakong).
• Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and session timestamps.
• Usage Data: Pages visited, features accessed, navigation paths, session duration, and click-stream data collected via server logs and analytics tools.
• Communications Data: Records of live chat conversations, email correspondence, and any other written or recorded communications you initiate with rr333 support.
• Marketing Preferences: Your stated preferences regarding promotional emails, SMS notifications, and in-platform messaging.

rr333 collects Personal Data through the following channels and mechanisms:

• Direct Submission: Information you provide voluntarily when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or respond to a survey or promotion.
• Automated Technical Collection: Data collected automatically as you interact with the rr333 platform, including IP address, device identifiers, browser characteristics, and session activity logs.
• Payment Processors: Transaction confirmation data received from Indonesian banking partners and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you make a deposit or withdrawal. rr333 receives transaction reference numbers and confirmation statuses but does not have direct access to your full bank account credentials.
• KYC Verification Providers: rr333 may use third-party identity verification service providers to assist in validating the authenticity of KYC documents submitted by Members. These providers return a verification outcome to rr333 but do not retain your documents beyond the scope of the verification task.
• Cookies and Tracking Technologies: Information collected via cookies, web beacons, pixel tags, and local storage, as described in detail in Clause 8 of this Privacy Policy.
• Fraud and Security Monitoring: Data collected by rr333's automated fraud detection systems, including login attempt patterns, unusual betting activity signals, and device fingerprint analysis, which help protect all Members from account compromise and platform abuse.

rr333 uses the Personal Data it collects for the following specific, legitimate purposes:

rr333 will never use your Personal Data for purposes that are incompatible with those listed above without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

rr333 processes your Personal Data on the basis of one or more of the following lawful grounds, applied on a purpose-by-purpose basis:

• Contractual Necessity: Processing required to fulfil the contract between you and rr333 — including operating your account, processing transactions in IDR, and delivering the games and services you have requested.
• Legal Obligation: Processing required for rr333 to comply with its anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer (KYC) obligations under the laws and regulations applicable to its international gaming licence.
• Legitimate Interests: Processing carried out for rr333's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing activities for which you have given clear, informed, and freely withdrawable consent — primarily the sending of optional promotional communications via email or SMS. You may withdraw this consent at any time by contacting support or using the unsubscribe mechanism in any marketing message.

rr333 does not sell your Personal Data. We share your data only in the following defined circumstances, and only to the minimum extent necessary for the specified purpose:

• Payment Processors and Banking Partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja receive the transactional data needed to process your deposits and withdrawals. These entities operate under their own privacy frameworks and regulatory obligations.
• KYC and Identity Verification Providers: Third-party verification partners receive your KYC documents solely for the purpose of authenticating your identity. Contracts with these providers require them to protect your data and restrict its use to the verification task only.
• Game Studio Content Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe receive session tokens and pseudonymised player identifiers to deliver their game content via rr333's platform. These studios do not receive your full name, financial data, or contact details.
• Analytics and Technology Partners: Providers of hosting, cloud infrastructure, data analytics, and security monitoring services may process Technical Data and Usage Data on rr333's behalf under strict data processing agreements.
• Legal and Regulatory Authorities: rr333 may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required to do so by a valid legal order, warrant, or statutory obligation. rr333 will notify affected Members of such disclosures to the extent permitted by law.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of rr333's business, Personal Data held by rr333 may be transferred to the acquiring or successor entity, subject to equivalent data protection commitments.

rr333 uses cookies and similar tracking technologies to operate the platform effectively, maintain your session, remember your preferences, and gather aggregate analytics data that helps us improve the user experience for Indonesian players. The following cookie categories are in use:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication tokens that keep you logged in to your rr333 account, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional Cookies: Used to remember your preferences such as preferred language display, currency format (IDR), and time zone (WIB). Disabling these cookies may result in a less personalised experience but will not prevent you from using the platform.
• Analytics Cookies: Used to collect aggregated, anonymised data on how visitors and Members interact with rr333 — which pages are visited most frequently, where users enter and exit the site, and how long sessions last. This data is used solely to improve the platform and is not linked to your personal identity.
• Security Cookies: Used by rr333's fraud detection systems to identify unusual or potentially fraudulent login and wagering patterns. These cookies process device fingerprint components that help distinguish legitimate Members from automated bots or bad actors.

Most web browsers allow you to control cookie behaviour through their settings, including blocking all cookies or deleting existing ones. Please note that blocking strictly necessary cookies will prevent you from logging in to your rr333 account. Instructions for managing cookies can be found in the help documentation of your browser.

rr333 does not use third-party advertising cookies or permit advertising networks to place tracking pixels on the rr333 platform for the purpose of building external advertising profiles based on your activity.

rr333 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual. Where anonymisation is not technically feasible within a reasonable timeframe, the data is instead placed under strict access restrictions until deletion is possible.

rr333 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Key security controls include:

• TLS/SSL Encryption in Transit: All data exchanged between your browser or app and rr333's servers is encrypted using TLS 1.2 or higher. No personal or financial data is transmitted in plain text.
• Encryption at Rest: Sensitive data fields — including KYC document files, financial identifiers, and password hashes — are encrypted at the database level using AES-256 or equivalent symmetric encryption.
• Access Control: Access to systems holding Personal Data is restricted to rr333 staff and contractors who have a legitimate operational need. Access is governed by role-based permissions and is logged and reviewed periodically.
• Multi-Factor Authentication (MFA): Administrative access to rr333's internal systems requires multi-factor authentication. Members are strongly encouraged to enable MFA on their own rr333 accounts.
• Penetration Testing & Vulnerability Management: rr333's platform undergoes periodic penetration testing by qualified security professionals. Identified vulnerabilities are triaged and remediated according to a risk-based priority schedule.
• Incident Response: rr333 maintains a documented data breach incident response plan. In the event of a breach affecting Member data, affected Members will be notified within a reasonable period and will receive guidance on protective steps they can take.

As a Member or Visitor whose Personal Data is processed by rr333, you have the following rights, which you may exercise at any time by contacting rr333 support via live chat or at the email address in Clause 15:

• Right of Access: You have the right to request a copy of the Personal Data rr333 holds about you, along with information about how that data is being used.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated promptly.
• Right to Erasure ("Right to Be Forgotten"): You may request that rr333 delete your Personal Data. This right is subject to limitations — we may be required to retain certain data for legal, regulatory, or fraud-prevention purposes even after an account closure request. We will inform you of any such limitations when responding to your erasure request.
• Right to Restrict Processing: You have the right to request that rr333 temporarily restrict the processing of your data — for example, while a dispute over accuracy is pending.
• Right to Data Portability: Where processing is based on your consent or a contract, and is carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format (such as CSV or JSON).
• Right to Object: You have the right to object to processing carried out on the basis of rr333's legitimate interests, including profiling for marketing purposes. Where you object to direct marketing, rr333 will cease that specific processing without delay.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

rr333 will respond to all verified data rights requests within 30 calendar days of receipt. If a request is complex or involves a high volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day window.

To submit a data rights request, please contact rr333 support via live chat and select the "Data & Privacy" topic, or send a written request to [email protected]. We may need to verify your identity before processing your request to protect against fraudulent access to other Members' data.

rr333 does not knowingly collect Personal Data from any person under the age of 21. Our registration process includes an age declaration step, and our KYC verification programme is specifically designed to identify and reject attempts by underage individuals to create accounts.

If rr333 becomes aware that Personal Data has been collected from an individual who is under 21 years of age, we will take the following steps without delay:

• Immediately suspend access to the account.
• Delete all Personal Data associated with the underage account from our active systems.
• Return any deposited funds to the originating payment method (net of any funds that may need to be withheld pending investigation under AML obligations).
• Report the incident to relevant authorities where required by applicable law.

If you are a parent or guardian and believe that a minor in your care has accessed rr333, please contact our support team immediately via live chat. We treat all such reports as a high-priority matter and will investigate and respond within 24 hours.

rr333 operates its platform internationally and may store or process your Personal Data on servers located outside of Indonesia. In the event that Personal Data is transferred to a country that does not provide an equivalent level of data protection to that available in Indonesia, rr333 will ensure that appropriate safeguards are in place before the transfer takes place. Such safeguards may include:

• Standard contractual clauses requiring the recipient to protect the data to an equivalent standard.
• Contractual representations and warranties from the recipient regarding their data security practices.
• Use of service providers who are certified under internationally recognised data protection frameworks.

rr333's third-party game studio partners — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe — are each subject to their own privacy and data security obligations under the terms of their licensing and content delivery agreements with rr333. Pseudonymised session data passed to these studios does not include your full name, contact details, or financial information.

If you would like further information about the specific safeguards rr333 applies to international data transfers, please contact our support team at the details provided in Clause 15.

rr333 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of our business. When we make material changes to this Privacy Policy, we will:

• Update the "Last Updated" date at the top of this page.
• Notify active Members via their registered email address at least seven (7) days before the revised policy takes effect.
• Display a prominent notice within the rr333 platform for a period of at least 14 days following publication of the revised policy.

For changes that are purely administrative or clarificatory in nature — and that do not materially affect the rights of Members or the purposes for which their data is used — rr333 may update the policy without advance notice, though the "Last Updated" date will still be revised.

Your continued use of the rr333 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must cease using the platform and request account closure before the revised policy takes effect. Upon closure, your data rights as described in Clause 11 remain fully available to you.

We encourage all Members to review this Privacy Policy periodically to stay informed about how rr333 is protecting their Personal Data. The most current version of this Privacy Policy is always available at https://rr333.vu/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way rr333 processes your Personal Data, our dedicated privacy support team is available to assist you. rr333 is committed to addressing all privacy-related enquiries promptly and transparently.

When submitting a data rights request, please provide your registered username and the email address associated with your rr333 account so that we can verify your identity and locate your data efficiently. rr333 will never charge a fee for handling legitimate data rights requests.

For responsible gaming concerns — including requests for self-exclusion, deposit limit adjustments, or account time-outs — please visit the Responsible Gaming page or ask to be connected with our responsible gaming specialists via live chat.