Privacy Policy — surat4

surat4 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every individual who interacts with our platform. This Privacy Policy sets out in clear, transparent terms the nature of the personal data we collect, the purposes for which it is processed, the parties with whom it may be shared, and the rights available to you as a data subject.

Our platform serves Indonesian players and operates in a regulated online gaming environment. The personal data we collect and process is necessary to verify your identity, facilitate secure financial transactions, deliver our gaming services, comply with applicable regulatory and compliance obligations, and continuously improve the quality and security of the surat4 experience.

We encourage you to read this Privacy Policy in full. If you have any questions, please contact us using the details set out in Section 15 of this document.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, either directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" means the individual to whom Personal Data relates — in most cases, a registered Member of surat4.
• "Controller" means surat4, which determines the purposes and means of processing Personal Data.
• "Processor" means any third-party organization that processes Personal Data on behalf of surat4, under contract and subject to data protection obligations.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data for a stated purpose.
• "Cookies" means small text files placed on your device by the surat4 platform or its authorized third-party service providers to track activity and store session preferences.

surat4 collects the following categories of personal data in connection with the operation of the platform:

We do not collect sensitive categories of personal data (such as health data, biometric data beyond identity verification photographs, or political opinions) unless expressly required for regulatory compliance.

surat4 collects your personal data through the following channels:

• Direct Submission. You provide data directly when you register an Account, complete KYC verification, make a deposit or withdrawal request, contact our support team, or respond to a promotional communication.
• Automated Collection. Technical and usage data is collected automatically when you access the Platform via cookies, server logs, and session tracking technologies. See Section 10 for full details.
• Third-Party Sources. We may receive identity and financial verification data from third-party KYC service providers and payment processors as part of our compliance and fraud prevention obligations.
• Game Providers. Aggregated and anonymized gameplay statistics may be provided by our certified game studios (such as Pragmatic Play, Evolution Gaming, and Spribe) to assist with dispute resolution and responsible gaming monitoring.

surat4 processes your personal data for the following purposes:

• Account Registration and Management: To create, maintain, verify, and secure your Member Account on the Platform.
• Identity Verification (KYC): To confirm that you meet the eligibility requirements set out in our Terms & Conditions, including that you are at least 21 years of age and a resident of Indonesia.
• Payment Processing: To process deposits and withdrawals via your nominated bank account or e-wallet in Indonesian Rupiah (IDR).
• Service Delivery: To provide access to sports betting markets (including BRI Liga 1, EPL, La Liga, mix parlay accumulators), live casino games, slot titles, and togel (Indonesia's traditional numbers lottery) markets.
• Fraud and Security Monitoring: To detect and prevent fraudulent activity, unauthorized account access, money laundering, and other forms of platform abuse.
• Responsible Gaming: To monitor betting patterns, enforce self-exclusion requests, apply deposit limits, and identify members who may be showing signs of problematic gambling behavior.
• Customer Support: To respond to your inquiries, process complaints, and resolve disputes in a timely and effective manner.
• Legal and Regulatory Compliance: To fulfill our obligations under applicable anti-money laundering regulations, data protection law, and any applicable gaming regulatory requirements.
• Marketing Communications: To send you relevant promotional offers and platform updates, subject to your expressed marketing preferences and the ability to opt out at any time.
• Platform Improvement: To analyze aggregated usage patterns and improve the performance, security, and user experience of the surat4 Platform.

surat4 processes your personal data only where a valid legal basis exists. The legal bases on which we rely are as follows:

• Contractual Necessity. Processing is necessary to perform the contract between you and surat4 — specifically, to operate your Account, process transactions, and deliver gaming services as described in our Terms & Conditions.
• Legal Obligation. Processing is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) rules, Know Your Customer (KYC) requirements, and data retention mandates.
• Legitimate Interests. Processing is carried out in pursuit of surat4's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your fundamental rights and freedoms.
• Consent. Where we rely on consent as the legal basis (primarily for marketing communications and non-essential cookies), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

surat4 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data only in the limited circumstances described below:

• Payment Processors. Your financial data is shared with your nominated bank (such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, or BSI) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit and withdrawal transactions.
• KYC and Identity Verification Partners. We work with certified third-party identity verification providers to confirm your identity and age during the KYC process. These providers are bound by strict data processing agreements and may not use your data for any independent purpose.
• Game Studios and Content Providers. Aggregated, non-identifiable gameplay data may be shared with our licensed game providers — including Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Pocket Games Soft — for the purposes of dispute resolution and game integrity monitoring.
• IT Infrastructure and Security Providers. We engage third-party providers for cloud hosting, cybersecurity monitoring, and platform maintenance. All such providers are contractually obligated to process your data only under our instruction and to maintain appropriate security standards.
• Legal and Regulatory Authorities. We may disclose personal data to law enforcement agencies, regulatory bodies, or other authorities when required to do so by law, court order, or in response to a legitimate legal process. We will notify you of such disclosures where permitted to do so.
• Business Transfers. In the event of a merger, acquisition, or sale of all or part of surat4's business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected members will be notified in advance of any such transfer.

All third-party processors with whom we share personal data are required to maintain confidentiality, implement appropriate technical and organizational security measures, and process data only in accordance with our documented instructions.

surat4 retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our internal data lifecycle management procedures. Anonymized or aggregated data that can no longer identify any individual may be retained indefinitely for analytical purposes.

surat4 implements a comprehensive suite of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and surat4's servers is encrypted using 256-bit TLS (Transport Layer Security) protocols.
• Encryption at Rest: Sensitive personal data and financial records stored on our servers are encrypted using AES-256 encryption standards.
• Access Controls: Personal data is accessible only to authorized surat4 personnel and vetted third-party processors who require access to perform their defined responsibilities. Role-based access controls and the principle of least privilege are applied throughout our systems.
• Multi-Factor Authentication: Internal systems handling personal data require multi-factor authentication for all staff access.
• Regular Security Audits: surat4 conducts periodic internal and external security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses.
• Incident Response: We maintain a documented data breach response procedure. In the event of a confirmed breach affecting your personal data, we will notify you promptly and take all reasonable steps to contain and remediate the incident.

While we apply robust security measures, no online system can guarantee absolute security. You are also responsible for maintaining the confidentiality of your Account credentials. If you believe your Account has been compromised, please contact us immediately at [email protected].

surat4 uses cookies and similar technologies to operate the Platform, ensure security, and improve your experience. The types of cookies we use are described below:

Strictly necessary and security cookies are essential to the operation of the Platform and cannot be disabled. You may manage your preferences for functional and analytics cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of the Platform.

surat4 does not use third-party advertising or retargeting cookies. We do not permit external advertising networks to place tracking cookies on our Platform.

As a Data Subject, you hold the following rights in relation to the personal data surat4 processes about you. To exercise any of these rights, please contact us using the details in Section 15.

• Right of Access. You have the right to request a copy of the personal data surat4 holds about you, along with information about how it is being processed.
• Right to Rectification. You have the right to request that inaccurate or incomplete personal data held about you be corrected or updated without undue delay.
• Right to Erasure. You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction. You have the right to request that processing of your personal data be restricted in certain circumstances, such as while a dispute over accuracy is being resolved.
• Right to Data Portability. Where processing is based on your consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object. You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis, including objecting to direct marketing at any time.
• Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to all verified data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by an additional 30 days, in which case we will notify you of the extension and the reason for it.

surat4 strictly prohibits access to its Platform by anyone under the age of 21. Our Services are designed exclusively for adults, and we do not knowingly collect personal data from individuals below this age threshold. The minimum age to register, deposit, or place any wager on surat4 is 21 years old.

If we become aware that personal data has been collected from a person under 21 — whether through misrepresentation during registration or any other means — we will immediately suspend the relevant Account, void any associated transactions, and delete the data in question as promptly as possible. Any funds associated with an underage account will be handled in accordance with applicable regulatory guidance.

If you have reason to believe that a minor is using or has registered on surat4, please report this to us immediately at [email protected] so that we can investigate and take appropriate action.

surat4 primarily processes and stores personal data on servers located within secure data center facilities. In some cases, the operation of our Platform — particularly in connection with game studio integrations, KYC verification services, and cloud infrastructure — may involve the transfer of personal data to processing entities located outside Indonesia.

Where such international transfers occur, surat4 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that require the recipient to apply equivalent data protection standards to those applied by surat4.
• Transfers only to third-party processors who operate under internationally recognized security certifications and compliance frameworks.
• Restriction of transferred data to the minimum necessary for the specific processing purpose.

By using the surat4 Platform, you acknowledge that your personal data may be transferred and processed in locations outside Indonesia. We will always take reasonable steps to ensure your data is handled securely wherever it is processed.

surat4 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. When material changes are made, we will notify registered Members by posting a prominent notice on the Platform or by sending a notification to your registered email address.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically. Continued use of the Platform following the publication of any revised Privacy Policy constitutes your acknowledgment of the updated terms.

If any proposed change to this Privacy Policy is unacceptable to you, you are entitled to close your Account in accordance with the account termination provisions set out in our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way surat4 handles your personal data, please contact our dedicated support and data team:

• Email: [email protected]
• Subject Line: Please use "Privacy Inquiry" or "Data Rights Request" in your email subject line for the fastest response.
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays such as Idul Fitri, Nyepi, and Indonesian Independence Day (17 August).
• Response Time: Privacy and data rights requests are handled within 30 calendar days of receipt of a verified request.
• Languages: Our support team is available in both English and Bahasa Indonesia.

For responsible gaming support, deposit limit requests, or self-exclusion inquiries, please visit our dedicated Responsible Gaming page.