spiv9 Privacy Policy

This Privacy Policy ("Policy") describes how spiv9 ("we", "us", "our") collects, uses, discloses, stores, and protects personal data provided by users ("you", "Player") of the spiv9 platform accessible at https://spiv9.net and any associated mobile interfaces. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy. This Policy forms an integral part of our Terms & Conditions.

1 Definitions

For the purposes of this Policy, the following terms have the meanings assigned below:

• "Account" — the registered user profile created by a Player on the spiv9 Platform.
• "Cookie" — a small text file placed on your device by the Platform to store session or preference data.
• "Data Controller" — the entity that determines the purposes and means of processing personal data; for spiv9 users, this is spiv9 as described in Section 2.
• "Data Processor" — any third party that processes personal data on behalf of spiv9 under a written data processing agreement.
• "KYC" — Know Your Customer; the identity and age verification process required before processing withdrawals or as otherwise required by our compliance programme.
• "Personal Data" — any information that identifies or could reasonably identify a living individual, including name, email address, phone number, date of birth, payment details, and device identifiers.
• "Platform" — the spiv9 website at https://spiv9.net, its mobile-optimised interface, and any associated tools or services.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Special Category Data" — sensitive personal data such as health information, biometric data, or financial crime indicators, processed only where strictly required by our responsible gaming or AML obligations.

2 Data Controller

spiv9 acts as the Data Controller for all personal data collected through the Platform. We are responsible for ensuring that personal data is processed lawfully, fairly, and transparently in accordance with internationally recognised data protection principles.

Our designated privacy contact can be reached at [email protected]. All privacy-related requests, including data subject rights requests, should be submitted to this address with the subject line "Privacy Request — [Your Account Username]".

3 Personal Data We Collect

spiv9 collects personal data across several categories depending on how you interact with the Platform. The table below summarises the data categories and specific data points we may hold:

We do not intentionally collect special category data except where required to assess problem gambling risk as part of our responsible gaming obligations, in which case any such data is processed with explicit consent and is used solely for the purpose of player protection.

4 How We Collect Your Data

spiv9 collects personal data through the following channels:

• Direct Submission: Data you provide when completing the registration form, submitting a KYC verification request, making a deposit or withdrawal, or contacting customer support.
• Automated Technologies: Technical and usage data collected automatically when you access the Platform via cookies, web beacons, server logs, and similar tracking technologies (see Section 7).
• Third-Party Sources: Where permitted, we may receive additional identity or fraud-risk information from our licensed KYC verification partners, payment processors, or fraud-prevention service providers to supplement the data you provide directly.
• Device Fingerprinting: Our fraud prevention systems may collect a composite device fingerprint — derived from technical attributes such as browser configuration, installed fonts, timezone, and hardware characteristics — to detect duplicate accounts and protect against unauthorised access. This data is processed for security purposes only.

5 Purposes & Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. The table below maps each processing purpose to the corresponding legal basis:

Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms. You may request a summary of any such assessment by contacting us at [email protected].

6 Sharing Your Personal Data

spiv9 does not sell, rent, or trade personal data. We share your data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment Processors & Banks: To process deposits and withdrawals, we share necessary financial data with our payment partners including the Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) you select.
• KYC & Identity Verification Providers: Licensed third-party KYC bureaus may receive copies of your identity documents to complete age and identity verification. These providers operate under contractual obligations equivalent to the protections in this Policy.
• Game Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive your account identifier and session token to load games. They do not receive your full identity data or financial details.
• Fraud & Security Providers: Specialist fraud-detection platforms may process technical and usage data to identify suspicious activity or duplicate accounts.
• Legal Authorities: We will disclose personal data to law enforcement, regulatory bodies, or courts when required by law, court order, or regulatory direction — without prior notice to you where notice is legally prohibited.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all assets of spiv9, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. Affected users will be notified in advance where practicable.

All third-party data processors are required to sign data processing agreements with spiv9 that bind them to process your data only on our documented instructions and to implement appropriate security measures.

7 Cookies & Tracking Technologies

spiv9 uses cookies and similar technologies to operate the Platform, personalise your experience, and analyse usage patterns. The categories of cookies we use are described below:

• Strictly Necessary Cookies: Essential for the Platform to function — for example, maintaining your login session, remembering your language preference, and securing your account from cross-site request forgery. These cannot be disabled.
• Functional Cookies: Store your preferences such as preferred game lobby view, deposit method, and notification settings to provide a more personalised experience across sessions.
• Analytical Cookies: Collect aggregated usage statistics that help us understand how Players navigate the Platform, identify performance bottlenecks, and improve page load times and user flows.
• Security & Fraud-Detection Cookies: Used in conjunction with our device-fingerprinting system to detect fraudulent login attempts, account takeovers, and duplicate account creation.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, but may reduce the quality of your personalised experience. Note that disabling security cookies may affect our ability to protect your account from fraud.

8 Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are as follows:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

9 Data Security

spiv9 implements a multi-layered security programme to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Transport Security: All data in transit is encrypted using TLS 1.2 or higher. Our SSL certificate is renewed regularly and monitored for validity.
• Data at Rest: Personal and financial data stored on our servers is encrypted using AES-256 encryption.
• Access Controls: Access to systems containing personal data is restricted to authorised personnel only, enforced through multi-factor authentication and role-based access control policies.
• Penetration Testing: spiv9 commissions regular third-party security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the incident, where technically and legally feasible.
• Staff Training: All spiv9 employees who handle personal data undergo mandatory privacy and security training upon joining and on a recurring annual basis.

10 International Data Transfers

spiv9 operates internationally and may transfer personal data to servers or service providers located outside Indonesia. When such transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard at least equivalent to that described in this Policy. Safeguards may include:

• Standard contractual clauses agreed with the receiving party;
• Binding corporate rules where the recipient is a member of our group;
• Transfers to countries that our licensing authority has recognised as providing an adequate level of data protection.

You may request details of the specific safeguards applicable to any international transfer of your data by contacting our privacy team at [email protected].

11 Your Data Protection Rights

Depending on your location and the applicable data protection framework, you may hold some or all of the following rights with respect to your personal data held by spiv9:

• Right of Access: You may request a copy of all personal data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that we may be required to retain certain data for legal compliance purposes even after an erasure request.
• Right to Restriction: You may request that we restrict processing of your data while a dispute over accuracy or lawfulness is being resolved.
• Right to Data Portability: You may request a machine-readable copy of personal data you have provided to us, for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease marketing communications immediately upon receipt of an opt-out request.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request". We will verify your identity before processing any request and will respond within 30 calendar days. Complex or multiple requests may be extended by a further 30 days with notice.

We do not charge a fee for handling data rights requests unless a request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply.

12 Children & Minors

If we become aware that personal data has been submitted by or on behalf of a person under 21 years of age, we will immediately suspend the associated account, delete the data, and return any deposited funds. Parents or guardians who believe their child has accessed spiv9 are urged to contact us immediately at [email protected].

We encourage parents and guardians to make use of parental control software and internet filtering tools to prevent underage access to online gambling platforms. Our Responsible Gaming page contains guidance on third-party filtering resources.

13 Marketing Communications

spiv9 sends promotional emails, SMS notifications, and in-platform messages only to Players who have explicitly opted in to receive them during registration or at any subsequent point in their Account settings.

Marketing communications from spiv9 may include information about new games, bonus offers, seasonal promotions (including campaigns tied to Indonesian national events such as Idul Fitri, Independence Day, and Ramadhan), and platform updates. All marketing content is directed exclusively at adults aged 21 and over.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link at the foot of any promotional email;
• Updating your communication preferences in the Account settings panel;
• Contacting our support team via live chat or at [email protected].

Opt-out requests are processed within 5 business days. Please note that opting out of marketing communications does not affect transactional messages such as deposit confirmations, withdrawal notifications, and security alerts — these are sent regardless of marketing preference as they are necessary for the operation of your Account.

14 Third-Party Links

The spiv9 Platform may contain references to or integrations with third-party services — for example, game providers, payment gateways, and responsible gaming information resources. This Policy applies solely to personal data processed by spiv9 and does not extend to any third-party website, application, or service that may be accessible from or integrated with the Platform.

spiv9 is not responsible for the privacy practices of third-party providers. We encourage you to review the privacy policy of any third-party service before submitting personal data to them directly.

15 Updates to This Policy

spiv9 reviews this Privacy Policy periodically and updates it to reflect changes in our data processing practices, applicable law, or regulatory guidance. When material changes are made, we will notify registered Players via email and/or an in-platform notification at least 7 calendar days before the changes take effect.

The "Last updated" date at the top of this Policy reflects when it was most recently revised. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

We encourage you to review this page periodically to remain informed about how spiv9 protects your personal data.

16 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by spiv9, please contact our privacy team using the details below:

Our support agents are fluent in both English and Bahasa Indonesia and are trained to handle privacy and data protection enquiries with the appropriate level of care and confidentiality.