Privacy Policy — cun99 Platform

1 Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "cun99" — the online betting platform operated at cun99.cam and all associated sub-domains and services.
• "Operator" / "We" / "Us" — the international entity that owns and operates cun99 under its applicable international licences.
• "Member" / "You" / "User" — any individual who has registered an account with cun99 or who visits the Platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including name, date of birth, identification number, contact details, financial data, and behavioural data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. In respect of cun99 Members, the Operator is the Data Controller.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller, in accordance with written instructions.
• "Cookie" — a small text file placed on your device by the Platform to enable certain technical functions and to collect usage data.
• "KYC" — Know Your Customer verification procedures, including identity checks, age verification, and source-of-funds review.
• "UU PDP" — Indonesia's Personal Data Protection Law (Undang-Undang Perlindungan Data Pribadi), which establishes baseline rights for Indonesian data subjects.

2 Data Controller

The Data Controller responsible for the Personal Data of cun99 Members is the Operator — the international entity that operates the cun99 platform under its applicable licences. The Operator determines the purposes for which your Personal Data is collected and the means by which it is processed.

For all privacy-related enquiries, requests, and complaints, please contact our Data Protection team using the details provided in Section 16 of this Policy. All written requests submitted to the Data Protection team will be acknowledged within 3 business days and resolved within 30 calendar days, or such shorter period as required by applicable law.

3 Personal Data We Collect

cun99 collects the following categories of Personal Data from Members and Platform visitors:

We do not collect sensitive Personal Data (such as racial origin, political opinions, health data, or biometric data) beyond what is strictly required for mandatory identity verification under applicable KYC regulations.

4 How We Collect Your Data

cun99 collects Personal Data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or completing any form on the Platform.
• Automated collection: Technical and usage data collected automatically as you interact with the Platform, via cookies, server logs, and similar technologies. See Section 9 for details.
• Third-party sources: Identity verification data from KYC service providers; fraud and sanctions screening data from compliance databases; payment confirmation data from payment processors (BCA, BRI, BNI, OVO, DANA, etc.).
• Publicly available sources: In limited circumstances, the Operator may verify information against publicly available records to confirm identity or detect fraud.

5 Purposes of Processing

cun99 processes your Personal Data for the following purposes:

• Account creation and management — to register your account, authenticate your identity, and manage your ongoing relationship with cun99.
• Payment processing — to process deposits and withdrawals via your chosen Indonesian bank or e-wallet, and to maintain accurate financial records.
• KYC and regulatory compliance — to verify your identity and age, screen against sanctions and politically exposed persons (PEP) lists, and comply with anti-money-laundering (AML) obligations.
• Customer support — to respond to your enquiries, resolve disputes, and improve the quality of our support services.
• Responsible gaming — to monitor your gaming behaviour, enforce deposit limits and self-exclusion settings, identify potential problem gambling indicators, and provide appropriate interventions.
• Security and fraud prevention — to detect, investigate, and prevent unauthorised access, fraudulent activity, collusion, and other prohibited conduct.
• Platform improvement — to analyse usage patterns, optimise product features, and develop new services in a manner consistent with your interests.
• Legal obligations — to comply with applicable laws, regulatory requirements, court orders, and requests from law enforcement or regulatory bodies.
• Marketing communications — where you have given explicit consent, to send you information about promotions, bonuses, and platform updates. You may withdraw consent at any time by contacting our support team.

6 Legal Basis for Processing

The Operator relies on the following legal bases when processing your Personal Data:

• Contractual necessity: Processing required to fulfil the Terms & Conditions you agreed to when registering a cun99 account, including operating your account, processing payments, and providing gaming services.
• Legal obligation: Processing required to comply with applicable law, including AML/CTF obligations, KYC requirements, and regulatory reporting.
• Legitimate interests: Processing for fraud prevention, platform security, internal analytics, and responsible gaming monitoring, where these interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies, where you have given your explicit and informed consent. You may withdraw consent at any time without detriment to your account.

7 Data Sharing & Disclosure

cun99 does not sell, rent, or trade your Personal Data to any third party. We share your data only in the following limited circumstances:

• Payment processors: Your financial data is shared with the relevant Indonesian bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit or withdrawal transaction.
• KYC and compliance providers: Identity and address verification data is shared with accredited third-party KYC service providers for the purpose of mandatory identity verification. These providers are bound by strict confidentiality and data processing agreements.
• Game software providers: Limited technical data may be shared with licensed game content providers (such as Evolution Gaming, Pragmatic Play, Microgaming, Pocket Games Soft) to operate specific games. These providers act as Data Processors under contractual instructions and do not have independent access to your account or financial data.
• Regulatory and law enforcement bodies: cun99 may disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts when required by applicable law, a binding legal order, or to protect the safety of persons.
• Group entities: Personal Data may be shared within the Operator's group of companies for internal administrative purposes, subject to the same level of protection as described in this Policy.
• Business transfers: In the event of a merger, acquisition, or sale of assets, Personal Data held by cun99 may be transferred to the relevant successor entity. Members will be notified of any material change in the Data Controller's identity.

8 International Data Transfers

cun99 is an internationally operated platform. Your Personal Data may be processed and stored on servers located outside Indonesia, including in the jurisdiction where the Operator holds its international operating licence and in other countries where our Data Processors maintain infrastructure.

Whenever Personal Data is transferred internationally, the Operator ensures that appropriate safeguards are in place, which may include:

• Contractual clauses requiring the recipient to apply a standard of protection equivalent to that described in this Policy.
• Transfers to jurisdictions that provide an adequate level of data protection as recognised by applicable standards.
• Other legally recognised transfer mechanisms as required by applicable law.

By registering a cun99 account, you acknowledge and consent to the international transfer of your Personal Data as described above.

9 Cookies & Tracking Technologies

cun99 uses cookies and similar tracking technologies to enable the Platform to function correctly, to improve your experience, and to collect usage analytics. The types of cookies used on the Platform include:

• Strictly necessary cookies: Required for the Platform to operate. These include session authentication cookies, security tokens, and load-balancing cookies. These cookies cannot be disabled without impairing your use of the Platform.
• Functional cookies: Used to remember your preferences, such as your chosen language or display settings, to provide a more personalised experience.
• Analytics cookies: Used to collect aggregated, anonymised data about how Members interact with the Platform — pages visited, session duration, features used. This data is used to improve the Platform and is not linked to your identity.
• Marketing cookies: Where you have given consent, these cookies allow cun99 to measure the effectiveness of its promotional campaigns. No third-party advertising cookies are placed without your explicit consent.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. For details on specific cookies in use, please contact our support team.

10 Data Retention

cun99 retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of your account membership and for a period of 5 years following account closure, to satisfy AML, KYC, and financial record-keeping obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial compliance requirements.
• KYC documents: Retained for a minimum of 5 years following the completion of the KYC review or account closure, whichever is later.
• Support communications: Retained for 2 years following resolution of the relevant support interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for as long as you remain opted in, plus 1 year following withdrawal of consent, as evidence of the consent.
• Technical and usage data: Retained in aggregated, anonymised form for platform analytics. Identifiable technical data (e.g., IP logs) is retained for up to 12 months.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction of your identity.

11 Security Measures

cun99 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, disclosure, or destruction:

• Transport encryption: All data transmitted between your device and cun99 servers is encrypted using TLS 1.2 or higher (256-bit SSL). Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Data-at-rest encryption: Sensitive data stored on our servers — including passwords (hashed with bcrypt), payment credentials, and identity documents — is encrypted using AES-256 or equivalent standards.
• Access controls: Access to Personal Data within cun99's systems is restricted on a strict need-to-know basis. All internal access is logged and subject to regular audit.
• Two-factor authentication: cun99 recommends and supports two-factor authentication (2FA) for Member accounts to protect against unauthorised login.
• Penetration testing: The Platform is subject to regular independent security testing and vulnerability assessments.
• Incident response: In the event of a confirmed data breach that poses a risk to your rights and freedoms, cun99 will notify affected Members and, where required by applicable law, the relevant regulatory authority within the timeframe prescribed by law.

12 Your Rights as a Data Subject

As a Member of cun99 and a resident of Indonesia or another jurisdiction with applicable data protection laws, you have the following rights in respect of your Personal Data:

To exercise any of these rights, submit a written request to our Data Protection team via the contact details in Section 16. We will not charge a fee for reasonable requests. We reserve the right to verify your identity before processing any rights request to protect against unauthorised disclosure.

13 Minors & Age Restriction

cun99 is strictly an adult platform. No person under the age of 21 may register an account or use any cun99 service. The Platform does not knowingly collect Personal Data from individuals under 21 years of age.

All registration submissions are subject to mandatory age verification as part of the KYC process. If the Operator discovers that Personal Data has been collected from a person under 21, the relevant account will be immediately closed, any balance held will be returned minus any Bonus funds, and the associated Personal Data will be deleted in accordance with applicable legal obligations.

14 Third-Party Links & Services

The cun99 Platform may reference or integrate with third-party services, including game software providers (such as Evolution Gaming, Pragmatic Play, and Pocket Games Soft) and payment processors. These third parties operate under their own privacy policies, which govern the data they collect and process in the course of providing their services.

cun99 is not responsible for the privacy practices of third-party service providers beyond the contractual data processing agreements it maintains with them. We encourage you to review the privacy policies of any third-party service with which you interact.

15 Policy Amendments

cun99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will:

• Update the "Last Reviewed" date at the top of this Policy.
• Notify registered Members by email to their registered address at least 14 days before the amended Policy takes effect.
• Display a prominent notice on the Platform for a period of at least 14 days prior to the changes taking effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the amended Policy, you should cease using the Platform and request account closure by contacting our support team.

16 Contact & Complaints

For all privacy-related enquiries, to exercise your data subject rights, or to raise a complaint about our data practices, please contact our Data Protection team through the following channels:

• Email: support at cun99.cam — mark your message with the subject line "Privacy / Data Request" for priority routing.
• Live Chat: Available 24 hours a day, 7 days a week via the in-platform chat function.
• WhatsApp: +62 811 0000 9900 — available 08:00–22:00 WIB daily.
• In-App Messaging: Submit a ticket from within your account dashboard, selecting "Privacy / Data" as the category.

All requests are acknowledged within 3 business days and resolved within 30 calendar days. If you are not satisfied with our response to your privacy complaint, you may be entitled to escalate your complaint to the relevant data protection authority in your jurisdiction, or to Indonesia's Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital) in its capacity as the supervisory body under the UU PDP framework.

For general questions about your account or our services, please visit our FAQ page or review our Terms & Conditions.