turu99 Privacy Policy

turu99 ("we", "us", "our", "the Platform") is committed to protecting the personal data of every individual who interacts with our online casino and sportsbook services at turu99.pro. This Privacy Policy sets out in full detail how we handle personal data belonging to registered players, prospective players who visit our website without registering, and individuals who contact our support team.

This policy applies to all personal data collected through any channel operated by turu99, including but not limited to: the turu99 website and all its sub-pages, the mobile-optimized browser interface, communications sent to or received from our customer support team via live chat or email, and data received from our payment processing and identity-verification partners.

turu99's services are designed for and directed exclusively at adults aged 21 and over who are residents of Indonesia. We do not knowingly target users in jurisdictions where our services are explicitly prohibited. If you access the Platform from outside Indonesia, you do so at your own risk and legal responsibility; this Privacy Policy still governs any personal data we collect in the process.

For the purposes of applicable data protection law, turu99 acts as the data controller in respect of all personal data collected and processed through the Platform. As data controller, turu99 determines the purposes for which personal data is processed and the means by which that processing takes place.

Where turu99 engages third-party service providers — such as payment processors, identity-verification providers, or cloud-hosting companies — to handle personal data on our behalf, those providers act as data processors under binding contractual agreements that restrict them from using your data for any purpose other than performing the specific services we have contracted them to provide. turu99 remains the data controller and retains full accountability for the lawful processing of your personal data by those providers.

All data-subject rights requests, privacy inquiries, and complaints should be directed to turu99 via the contact details provided in Clause 14 of this policy. We do not designate a third party to receive these requests on our behalf.

The personal data turu99 collects from you depends on your relationship with the Platform — whether you are a visitor browsing without an account, a newly registered player, a verified player who has completed KYC, or a player who has contacted our support team. The table below categorizes the data we collect by type and context:

turu99 collects personal data through the following channels and mechanisms:

• Directly from you: When you complete the account registration form, submit KYC documents, make a deposit or withdrawal, configure account settings, participate in a promotion, or contact our support team. All direct submission is voluntary; however, certain data is required to access Platform services — if you decline to provide mandatory data (such as registration details or KYC documents), we may be unable to open or maintain your account.
• Automatically via the Platform: Our web servers and analytics infrastructure automatically record technical and device data each time you access turu99.pro, regardless of whether you are logged in. This includes your IP address, session metadata, page views, click patterns, and error logs. This data is collected using server-side logging and first-party tracking technologies.
• Via cookies and similar technologies: As described in detail in Clause 6, turu99 uses cookies and local storage to maintain your login session, remember your preferences, detect fraudulent activity, and analyze Platform usage. You can manage cookie preferences via your browser settings; note that disabling essential cookies may impair Platform functionality.
• From payment and verification partners: When you initiate a bank transfer through BCA, BRI, BNI, Mandiri, or an e-wallet transaction through OVO, GoPay, DANA, ShopeePay, or LinkAja, those providers share transaction confirmation data with turu99 sufficient to credit your account. When you submit KYC documents, our verification partner returns a pass/fail result and a confidence score to turu99; the raw document images are retained by the verification provider under their own privacy policy for a limited period.
• From fraud-prevention systems: turu99 uses automated fraud-detection systems that analyze behavioral patterns, device fingerprints, and account activity to identify suspicious behavior. These systems may generate inferred data about your activity that is used solely for security and compliance purposes.

turu99 processes personal data only where a lawful basis exists for doing so. The table below maps each processing purpose to its legal basis:

Where turu99 relies on legitimate interests as the legal basis for processing, we have conducted a balancing assessment and concluded that our interests do not override your fundamental rights and freedoms, given the nature of the data involved and the reasonable expectations of players on a gaming platform.

turu99 uses cookies — small text files stored on your device by your browser — and related technologies (such as local storage and session storage) to enable core Platform functionality, maintain your login state, remember your preferences, and analyze how players interact with our services. We use only first-party cookies; we do not embed third-party advertising cookies from external ad networks.

Our cookies fall into three categories:

• Essential Cookies: These are required for the Platform to function. They maintain your authenticated session, prevent cross-site request forgery (CSRF), and enforce security controls. You cannot opt out of essential cookies without disabling the Platform entirely. Examples include your session token, CSRF protection token, and your cookie-preference record.
• Functional Cookies: These remember choices you have made — such as your preferred game lobby view, notification settings, or responsible gaming configurations — so you do not have to reconfigure them on every visit. Disabling functional cookies does not break the Platform but will reset your preferences on each session.
• Analytics Cookies: turu99 uses first-party analytics to understand which pages players visit, how long they spend on each section, and where errors or friction occur in user flows. This data is aggregated and anonymized before analysis; it is not used to build individual behavioral profiles for advertising. You may opt out of analytics cookies via your browser settings or by contacting support.

turu99 does not sell, rent, or trade your personal data with any third party for marketing or commercial purposes. We share your personal data only in the specific, limited circumstances described below:

• Payment Processing Partners: To process your deposits and withdrawals, we share the minimum necessary financial data with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) or e-wallet provider (OVO, GoPay, DANA, ShopeePay, LinkAja) required to execute the transaction. These providers are bound by their own financial-sector data-protection obligations.
• Identity Verification Providers: To fulfill KYC obligations, we share your submitted identity documents and associated data with our contracted verification partner. That partner is bound by a data-processing agreement prohibiting use of your data for any purpose other than identity verification on turu99's behalf.
• Fraud Prevention & Security Services: We share device fingerprint data, IP addresses, and behavioral signals with our fraud-detection infrastructure provider. This data is used exclusively to identify and block fraudulent account activity and protect the integrity of the Platform for all players.
• Cloud Infrastructure & Hosting Providers: turu99's Platform is hosted on cloud infrastructure. Our hosting provider has access to data stored on its servers only in the capacity of a technical service provider and is bound by strict data-processing contractual obligations. The hosting environment is secured to internationally recognized standards.
• Legal and Regulatory Authorities: turu99 may disclose personal data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where we are legally required or compelled to do so, or where disclosure is necessary to prevent, detect, or prosecute fraud, money laundering, or other criminal activity. We will, where legally permitted, notify you of any such disclosure request before complying.
• Business Succession: In the event of a merger, acquisition, or sale of substantially all of turu99's assets, player data may be transferred to the successor entity as part of that transaction. Affected players will be notified by email within 30 days of such a transfer, and the successor entity will be bound by the terms of this Privacy Policy with respect to previously collected data.

turu99 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply:

• Account and Registration Data: Retained for the duration of your active account plus 5 years following permanent account closure, to comply with financial record-keeping requirements and to resolve any post-closure disputes.
• Financial Transaction Records: All deposit, withdrawal, and wagering records denominated in IDR are retained for a minimum of 5 years from the date of the transaction, in compliance with applicable anti-money laundering record-keeping obligations.
• KYC Documents: Identity verification documents are retained for 5 years following account closure or the date of the last verified transaction, whichever is later. Raw document images held by our third-party verification partner are subject to that provider's own retention schedule, which is contractually limited to a maximum of 7 years.
• Support Communications: Live chat transcripts and email correspondence are retained for 3 years from the date of the interaction, to support dispute resolution and quality assurance.
• Technical & Device Logs: Server access logs and device fingerprint data are retained for 12 months from collection, after which they are automatically purged unless they form part of an active fraud investigation.
• Marketing Preference Records: Opt-in and opt-out records are retained indefinitely as evidence of consent status. The associated contact data is removed when your account is closed.

At the end of each applicable retention period, personal data is securely deleted or irreversibly anonymized such that it can no longer be attributed to any individual. Anonymized, aggregated data (e.g., aggregate deposit volumes, game popularity statistics) may be retained indefinitely for business analysis purposes.

As an individual whose personal data is processed by turu99, you have the following rights with respect to that data. To exercise any of these rights, please contact our support team via the details in Clause 14. We will respond to all valid rights requests within 30 calendar days of receipt, free of charge for reasonable requests.

• Right of Access: You have the right to request a copy of all personal data turu99 holds about you, together with information about the purposes of processing, the categories of data held, and the recipients to whom it has been disclosed. We will provide this in a structured, commonly used, machine-readable format on request.
• Right to Rectification: If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For certain data (such as your registered name or date of birth), correction may require submission of a supporting document.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where: it is no longer necessary for the purpose it was collected; you withdraw the consent on which processing was based and no other legal basis applies; or you object to processing based on legitimate interests and your interests override ours. This right is subject to turu99's legal obligations to retain financial and KYC records as described in Clause 8.
• Right to Restriction of Processing: You have the right to request that turu99 restrict active processing of your personal data — for example, while a rectification request is being assessed — without deleting the data itself.
• Right to Data Portability: Where processing is based on your consent or on contract performance, you have the right to receive your personal data in a structured, commonly used format and to transmit it to another service provider where technically feasible.
• Right to Object: You have the right to object at any time to processing of your personal data that is based on turu99's legitimate interests, including profiling for fraud-detection purposes. turu99 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests or that the processing is necessary for the establishment, exercise, or defense of legal claims.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., receiving promotional emails), you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

turu99 implements a comprehensive, layered security framework to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to, the following:

• Encryption in Transit: All communications between your browser or mobile device and turu99 servers are encrypted using TLS 1.2 or TLS 1.3 with strong cipher suites. Our SSL certificate is maintained at all times and is renewable on a regular cycle.
• Encryption at Rest: Sensitive data fields — including identity document references, bank account numbers, and e-wallet identifiers — are encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Control: Access to personal data within turu99's internal systems is restricted on a strict need-to-know basis using role-based access controls. Administrative access requires multi-factor authentication (MFA) and is subject to audit logging.
• Network Security: Our infrastructure is protected by enterprise-grade firewalls, DDoS mitigation services, and intrusion detection systems. Regular vulnerability assessments and penetration tests are conducted to identify and remediate security weaknesses before they can be exploited.
• Incident Response: turu99 maintains a documented data breach response procedure. In the event of a confirmed data breach that is likely to result in a risk to the rights and freedoms of affected players, we will notify those players without undue delay and, where required, will notify the relevant supervisory authority within the applicable regulatory timeframe.

While we apply rigorous security controls, no internet-connected system can guarantee absolute security. You are also responsible for maintaining the security of your own device and account credentials. If you suspect that your account has been accessed without your authorization, contact turu99 support immediately via live chat so that we can lock your account and investigate.

The turu99 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect, store, or process personal data belonging to individuals under the age of 21. Our registration process includes a date-of-birth field and our KYC verification process checks government-issued identity documents to confirm eligibility.

If turu99 discovers or has reason to believe that a person under the age of 21 has registered an account or provided personal data through the Platform, we will:

• Immediately suspend the account pending investigation
• Permanently close the account and delete or securely destroy all associated personal data as soon as practicable
• Void any financial transactions associated with the account and return any deposited funds via the original payment method where possible

If you are a parent or guardian and believe that a minor in your care has gained unauthorized access to a turu99 account, please contact our support team immediately via live chat or at [email protected]. We will treat the matter with urgency and confidentiality.

The turu99 Platform does not contain links to external third-party websites as a matter of policy. All navigation within the Platform remains within the turu99.pro domain. However, in the unlikely event that you navigate away from the turu99 Platform via a link shared in a support conversation or promotional communication, please be aware that turu99's Privacy Policy does not apply to external websites.

turu99 is not responsible for the privacy practices, content, or security of any website or service that is not operated by turu99. We encourage you to read the privacy policy of any third-party website before submitting personal information to it. The inclusion of any reference to a third-party service in our support materials does not constitute an endorsement of that service's privacy practices.

turu99 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable regulations, or the services we offer. All updates are categorized as either material or administrative:

• Material Changes: Changes that meaningfully alter how we collect or use your personal data, introduce new categories of data sharing, or significantly affect your rights as a data subject. Material changes will be communicated to all registered players by email at the address on file at least 7 days before the updated policy takes effect. The effective date and version number will be updated at the top of this page.
• Administrative Changes: Minor corrections such as typographical fixes, formatting improvements, clarifications of existing provisions, or updates to contact information that do not affect the substance of our data practices. These changes may be applied without advance notice, though the version number will be incremented and the "Last Updated" date will be revised.

Your continued use of the turu99 Platform after the effective date of any updated version of this Privacy Policy constitutes your acceptance of the changes. If you do not accept the updated policy, you must cease using the Platform and contact support to arrange account closure and data deletion where applicable.

All previous versions of this Privacy Policy are archived and available on request from our support team. If you have a question about how a specific version of the policy applied to data collected during a particular time period, please contact us with your request.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by turu99, please reach out to our support team through any of the following channels. All privacy-related inquiries are treated with priority and handled by team members who are specifically trained in data-subject rights and privacy compliance.

• Live Chat: Available 24/7 directly on the turu99 Platform — the fastest channel for urgent privacy or security concerns, including suspected unauthorized account access.
• Email: [email protected] — for formal data-subject rights requests, please include "Privacy Request" in the subject line, along with your registered username and a brief description of your request. Email responses are provided within 24 hours for general inquiries and within 30 days for formal rights requests.
• Support Hours: 24/7, 365 days a year, including Indonesian public holidays such as Idul Fitri, Nyepi, and Indonesian Independence Day (17 August). Our team provides support in both English and Bahasa Indonesia.

turu99 is committed to resolving all privacy inquiries fairly and transparently. If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant supervisory authority or dispute-resolution body designated by turu99's licensing jurisdiction.