spot63 Privacy Policy

For the purposes of this Privacy Policy, the following definitions apply:

spot63 acts as the Data Controller for all Personal Data collected through the platform at https://spot63.pro. As Data Controller, spot63 is responsible for determining the lawful basis for processing, ensuring data is used only for stated purposes, maintaining appropriate security measures, and facilitating Member data rights requests. For questions regarding data controllership or to submit a formal data rights request, please contact our Data Protection Officer using the details set out in Clause 16 of this Policy.

spot63 collects the following categories of Personal Data in the course of operating the platform and serving its Members:

spot63 collects Personal Data through the following channels:

• Account registration: When you create a spot63 account, you provide Identity Data and Contact Data directly via the registration form.
• KYC verification: When you submit identity documents for account verification or to process a withdrawal above the applicable threshold, spot63 collects Sensitive Data including copies of government-issued identity documents.
• Deposits and withdrawals: Financial Data is collected when you initiate a deposit or withdrawal transaction on the platform.
• Platform usage: Technical Data and Behavioral Data are collected automatically as you browse and use the spot63 website through cookies, server logs, and analytics tools.
• Customer support interactions: Communications Data is collected when you contact spot63 support via live chat, email at [email protected], or WhatsApp.
• Promotions and surveys: If you participate in spot63 promotions or complete optional feedback surveys, additional data may be collected as described in the specific promotion or survey terms.

spot63 processes your Personal Data only for specific, documented purposes. The legal basis for each processing activity is set out below:

spot63 will not use your Personal Data for purposes materially different from those listed above without providing prior notice and, where required, obtaining your consent.

spot63 does not sell your Personal Data. We share data only in the following limited circumstances, and only with parties bound by appropriate data protection obligations:

• Payment processors: Indonesian bank transfer intermediaries and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data required to process your transactions. These parties process data in their capacity as independent data controllers subject to their own privacy policies and applicable banking regulations.
• KYC and identity verification providers: Specialist third-party providers may assist spot63 in verifying identity documents and performing age checks. These providers act as Data Processors under formal data processing agreements with spot63.
• Game content providers: Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized session identifiers to facilitate game delivery and fair-play auditing. These providers do not receive your full identity or financial data.
• Analytics and platform security tools: Anonymized or pseudonymized Technical and Behavioral Data may be shared with analytics and cybersecurity service providers to help maintain platform integrity and performance.
• Legal and regulatory authorities: spot63 will disclose Personal Data to competent authorities, law enforcement agencies, or regulatory bodies when required to do so by law, court order, or in connection with the investigation of fraud, money laundering, or other criminal activity.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of the spot63 business, Member Personal Data may be transferred to the acquiring entity. Members will be notified of such a transfer and its implications prior to the transaction completing where practicable.

spot63 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including legal, regulatory, and audit obligations. The following standard retention periods apply:

• Active account data: Retained for the lifetime of your spot63 account and for a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction records: Deposit, withdrawal, and betting records are retained for a minimum of 5 years from the date of the transaction.
• KYC documents: Identity verification documents are retained for the duration of the account relationship and for 5 years following account closure.
• Customer support communications: Support records are retained for 2 years from the date of the interaction unless a longer period is required for an unresolved dispute.
• Marketing consent records: Records of your marketing opt-in or opt-out status are retained for as long as necessary to demonstrate compliance with consent obligations.
• Technical and analytics data: Server log data and anonymized behavioral analytics are typically retained for 13 months on a rolling basis.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in a manner that prevents reconstruction of the original data.

spot63 implements a layered approach to data security that includes technical, organizational, and procedural measures. Our security framework includes the following:

• Encryption in transit: All communications between your browser and the spot63 platform use TLS 1.2 or higher. The platform is HTTPS-only; unencrypted HTTP connections are redirected automatically.
• Encryption at rest: Sensitive Personal Data stored in spot63 databases is encrypted using AES-256. Cryptographic keys are managed via a dedicated key management system with role-based access controls.
• Access controls: Access to production systems and Member data is restricted to authorized personnel only, using multi-factor authentication and the principle of least privilege. All access is logged and audited.
• Vulnerability management: spot63 conducts regular penetration testing and vulnerability assessments of its platform infrastructure. Critical vulnerabilities are remediated within defined SLA timeframes.
• Incident response: spot63 maintains a documented security incident response plan. In the event of a data breach that may affect your rights, spot63 will notify affected Members and relevant authorities within the timeframes required by applicable regulations.
• Staff training: All spot63 personnel with access to Personal Data receive mandatory data protection and information security training upon onboarding and annually thereafter.

spot63 uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyze usage patterns, and maintain security. The categories of cookies used are as follows:

You may manage cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to log in and use core platform features. spot63 does not use third-party advertising or behavioral targeting cookies.

Know Your Customer (KYC) verification is a regulatory requirement that spot63 applies to all Members before processing withdrawals above defined thresholds and in other circumstances where identity verification is warranted. The KYC process at spot63 operates as follows:

• Documents accepted: Indonesian national identity card (KTP), Indonesian passport, or Indonesian driver's license (SIM). Documents must be valid, clearly photographed, and show the full name, date of birth, and document number.
• Submission method: KYC documents are submitted through your secure spot63 account portal. Submissions are encrypted in transit and stored in a restricted-access secure document vault.
• Review timeline: spot63 aims to complete KYC reviews within 24 hours of document submission during normal business hours (WIB). Members will be notified by email of the outcome.
• Data use: KYC documents are used exclusively for identity and age verification purposes. They are not used for marketing or shared with third parties other than authorized verification service providers acting as Data Processors.
• Refusal consequences: Failure to complete KYC verification when requested will result in withdrawal processing being paused until verification is completed. Repeated failure to provide requested documents may result in Account suspension under the spot63 Terms & Conditions.

spot63 sends marketing communications to Members who have explicitly opted in to receive them. Marketing communications may include promotional offers, bonus announcements, new game launches, seasonal events (such as Idul Fitri and Ramadhan promotions), and BRI Liga 1 and Champions League betting specials. The following terms govern marketing communications from spot63:

• Opt-in requirement: spot63 will only send direct marketing communications to Members who have affirmatively opted in to receive them during registration or via their Account settings.
• Channels used: Marketing communications may be delivered via email to your registered address, SMS to your registered Indonesian mobile number, or in-platform notifications when you are logged in.
• Opt-out: You may withdraw your consent to marketing communications at any time by clicking the "Unsubscribe" link in any marketing email, by replying STOP to any marketing SMS, or by updating your notification preferences in your Account settings. Opt-out requests are processed within 5 business days.
• Transactional communications: Opt-out from marketing does not affect transactional communications related to your account, such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts. These are sent regardless of marketing preference as they are necessary to fulfil our contractual obligations to you.

As a Member whose data is processed by spot63, you hold the following rights with respect to your Personal Data. These rights may be exercised by contacting our Data Protection Officer using the details in Clause 16:

spot63 will respond to all data rights requests within 30 days of receipt. Where a request is complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason. Data rights requests are free of charge for standard requests. Where requests are manifestly unfounded or excessive, spot63 reserves the right to charge a reasonable administrative fee.

The spot63 platform is strictly for adults aged 21 and above. spot63 does not knowingly collect or process Personal Data from any individual under 21 years of age. Age verification is conducted as part of both the registration process and the KYC verification process. If spot63 becomes aware that Personal Data has been collected from a person under 21 years of age, that data will be immediately deleted, the associated account will be closed, and any deposited funds will be returned to their source. If you are a parent or guardian and believe that your child has registered on the spot63 platform, please contact our support team immediately at [email protected].

spot63's primary data processing infrastructure is hosted in secure data centers in jurisdictions with robust data protection frameworks. In the course of operating the platform and working with third-party service providers, your Personal Data may be transferred to and processed in countries outside Indonesia. Where such transfers occur, spot63 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections described in this Policy. Safeguards may include standard contractual clauses, binding corporate rules, or adequacy decisions by relevant data protection authorities. By using the spot63 platform and accepting this Privacy Policy, you consent to such international transfers as described.

spot63 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. Where changes are material, spot63 will provide notice via a prominent announcement on the platform and/or by email to your registered address at least 14 days before the revised Policy takes effect. Your continued use of the spot63 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. The current version of this Privacy Policy, with its effective date, is always available at https://spot63.pro/privacy-policy. We encourage you to review this page periodically to stay informed about how spot63 protects your data.

If you have any questions about this Privacy Policy, wish to exercise a data right, or wish to raise a concern about how spot63 handles your Personal Data, please contact us through the following channels:

• Data Protection Officer (DPO): Email [email protected] with the subject line "Data Protection Request". The DPO is responsible for overseeing spot63's compliance with data protection obligations and will respond to all formal data rights requests within 30 days.
• 24/7 Live Chat: Available within the spot63 platform for all registered Members. Live chat is best suited for general privacy questions or account-level data corrections.
• WhatsApp: +62 812 0000 6363 — available during extended support hours for Members who prefer direct messaging.

If you are not satisfied with spot63's response to a data concern or rights request, you may have the right to escalate the matter to a relevant supervisory authority or data protection regulator in your jurisdiction. Please refer to our FAQ for further guidance on the complaint escalation process.