csr99 Privacy Policy

csr99 ("we", "us", "our") operates the online betting and casino platform accessible at https://csr99.net (the "Platform"). This Privacy Policy describes how csr99 collects, uses, stores, shares, and protects the personal information of individuals who access or use the Platform ("you", "your", "Member").

By registering a csr99 account or using any part of the Platform, you acknowledge that you have read this Privacy Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you should not use the Platform.

This Policy applies to all personal data collected through the Platform, including data collected during account registration, deposits and withdrawals, customer support interactions, and routine browsing of the csr99 website. It does not apply to websites or services operated by third parties that may be linked from the Platform.

csr99 collects personal data across several categories depending on how you interact with the Platform:

2.1 Data You Provide Directly. The majority of personal data csr99 holds is provided by you at the point of registration, during KYC verification, or during contact with customer support. You are not obligated to provide this data; however, failure to provide mandatory registration or KYC data will prevent you from opening or continuing to use a csr99 account.

2.2 Data Collected Automatically. When you access the Platform, csr99 and its service providers automatically collect Technical Data via server logs, cookies, and device identification technologies. This data is used for fraud prevention, security monitoring, and platform optimization. See Section 6 (Cookies & Tracking) for more detail.

2.3 Data from Third Parties. csr99 may receive supplementary identity or financial verification data from licensed KYC service providers used to confirm the accuracy of information you have provided during registration. Where this occurs, you will be notified of the verification process.

csr99 uses the personal data it collects for the following purposes:

• Account Management: Creating, maintaining, and securing your csr99 Member account, including login authentication and password reset.
• Service Delivery: Processing deposits and withdrawals in Indonesian Rupiah (IDR) via your chosen payment channel; settling bets and game outcomes; delivering bonuses and promotional rewards.
• Identity Verification (KYC): Confirming that you meet the minimum age requirement of 21 years and verifying your identity and payment method ownership as required for withdrawal processing.
• Fraud Prevention and Security: Detecting and preventing unauthorized account access, bonus abuse, money laundering, multi-accounting, and other prohibited conduct described in the csr99 Terms & Conditions.
• Responsible Gaming: Monitoring betting patterns that may indicate problem gambling behavior; administering deposit limits, self-exclusion, and cooling-off periods requested by Members.
• Customer Support: Responding to inquiries, complaints, and technical issues submitted via live chat or email ([email protected]).
• Legal Compliance: Meeting obligations under applicable anti-money laundering (AML) regulations, responding to lawful requests from competent authorities, and retaining records as required by law.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve the Platform's features, performance, and user experience. No individual Member is identified in this analysis.
• Marketing Communications: Sending promotional offers, deposit bonus notifications, and seasonal promotions to Members who have opted in to marketing communications. You may opt out at any time by contacting support or adjusting your account notification settings.

csr99 processes your personal data on one or more of the following lawful bases:

• Contractual Necessity: Processing is necessary to perform the contract between csr99 and the Member — i.e., to operate your account, process transactions, and deliver the services you signed up for.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including KYC, AML record-keeping, and responses to lawful authority requests.
• Legitimate Interests: Processing is carried out in pursuit of csr99's legitimate business interests — fraud prevention, platform security, and service improvement — where those interests are not overridden by the Member's privacy rights.
• Consent: For marketing communications and optional data uses beyond those described above, csr99 relies on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5.1 Service Providers. csr99 shares personal data with the following categories of third-party service providers, strictly on a need-to-know basis and subject to written data processing agreements:

• Payment Processors: Indonesian bank transfer networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to process your transactions.
• KYC Verification Providers: Licensed identity verification services that confirm your name, date of birth, and document authenticity against official records.
• Game Studios: Providers such as Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Habanero, and Microgaming receive anonymized session tokens sufficient to deliver game content and record outcomes. They do not receive your full identity data.
• Hosting and Infrastructure Providers: Cloud infrastructure and server hosting providers that store Platform data in secured data centers. These providers operate under strict confidentiality obligations and may not use csr99 data for their own purposes.
• Customer Support Platforms: Live chat and ticketing system providers that facilitate your communications with csr99 support staff.

5.2 Legal Disclosures. csr99 will disclose personal data to competent authorities, courts, or regulators where required by law, where necessary to enforce the csr99 Terms & Conditions, or where required to protect the rights, property, or safety of csr99, its Members, or the public.

5.3 No Sale of Data. csr99 does not sell, rent, exchange, or otherwise transfer personal data to any third party for that party's independent commercial use. This prohibition applies regardless of the monetary value of the data or the nature of the commercial arrangement offered.

6.1 What Are Cookies. Cookies are small text files placed on your device when you visit the csr99 Platform. They allow csr99 to recognize your browser, remember your preferences, maintain your login session, and analyze Platform usage patterns.

6.2 Types of Cookies Used by csr99:

• Essential Cookies: Required for the Platform to function. These include session cookies that maintain your logged-in state and security cookies that help detect fraudulent activity. Disabling these cookies will prevent you from using the Platform.
• Functional Cookies: Store your preferences such as language settings and preferred payment method to improve your experience on return visits.
• Analytical Cookies: Collect aggregated, anonymized data about how Members navigate the Platform — which pages are visited, how long sessions last, and which features are used. This data informs Platform improvement decisions.
• Security Cookies: Support fraud detection and device fingerprinting systems used to identify suspicious login attempts and multi-account behavior.

6.3 Managing Cookies. You may manage or delete cookies through your browser settings. Note that disabling essential cookies will impair Platform functionality. Analytical cookies may be declined without affecting access to csr99 services.

7.1 Retention Periods. csr99 retains personal data for as long as is necessary to fulfill the purposes for which it was collected, as follows:

7.2 Post-Retention Deletion. Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be attributed to an identifiable individual. Anonymized data may be retained indefinitely for statistical and analytical purposes.

8.1 Technical Measures. csr99 implements industry-standard technical security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These include:

• 256-bit SSL/TLS encryption on all data in transit between your device and csr99 servers.
• Encryption of sensitive data at rest within csr99 databases, including financial data and identity documents.
• Automated intrusion detection and real-time security monitoring across csr99 infrastructure.
• Regular third-party security audits and penetration testing.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.

8.2 Organizational Measures. All csr99 employees and contractors who handle personal data are subject to confidentiality obligations and receive regular data protection training. Access logs are maintained for all interactions with sensitive Member data.

8.3 Member Responsibilities. csr99's security measures protect data on our end, but you are also responsible for the security of your account. You must choose a strong, unique password for your csr99 account, enable any available two-factor authentication, and never share your login credentials. csr99 will never ask for your password.

Depending on your location and applicable law, you may have the following rights in respect of your personal data held by csr99. To exercise any of these rights, contact csr99 at [email protected] with the subject line "Data Subject Request":

9.1 Response Timeframe. csr99 will respond to all data subject requests within 30 calendar days of receipt. Complex or high-volume requests may require up to an additional 60 days, in which case csr99 will notify you of the extended timeframe.

9.2 Identity Verification. To protect your data, csr99 will verify your identity before processing any data subject request. This typically involves confirming the registered mobile number or email address associated with the account, or providing a copy of your ID where warranted.

The csr99 Platform is strictly for adults aged 21 years and over. csr99 does not knowingly collect, process, or store personal data relating to individuals under the age of 21.

If csr99 discovers or has reasonable grounds to believe that personal data has been collected from an individual under the age of 21 — whether through a misrepresentation during registration or by any other means — csr99 will immediately suspend the relevant account, delete all associated personal data to the extent possible under legal retention obligations, and return any deposited funds to the originating payment method, net of any winnings generated from those deposits.

If you are a parent or legal guardian and believe that your child has provided personal data to csr99, please contact [email protected] immediately so that appropriate action can be taken.

The csr99 Platform integrates third-party game content delivered by licensed studios including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Habanero, Microgaming, and Spribe. While csr99 has data processing agreements in place with all integrated studios, csr99's Privacy Policy does not extend to those studios' own data practices in respect of data collected independently on their own platforms or websites.

This Privacy Policy applies solely to the csr99 Platform at https://csr99.net. If you navigate away from csr99 to any external website — including through a link you may have encountered elsewhere — csr99 bears no responsibility for the privacy practices of that external site.

csr99 reviews and, where necessary, updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, or Platform features. The date of the most recent revision is shown at the top of this page.

Where an update is material — for example, a change to the categories of data collected, a new category of third-party recipient, or a change in the legal basis for processing — csr99 will provide advance notice to Members via account dashboard notification and/or by email or SMS to the contact details registered on the account.

Continued use of the csr99 Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a material revision, you may request account closure before the effective date of the change.

For any questions, concerns, or requests relating to this Privacy Policy or csr99's handling of your personal data, please use the following contact channel:

For questions about responsible gaming tools — deposit limits, self-exclusion, and cooling-off periods — please visit the Responsible Gaming page. For general questions about your account or our services, visit the FAQ page.