Privacy Policy

Definitions

The following terms carry the meanings assigned below throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, including but not limited to full name, date of birth, national identity number, email address, phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, storage, retrieval, use, disclosure, erasure, and destruction.
• "Data Controller" means pt909, the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means any third party that Processes Personal Data on behalf of pt909 under a written data processing agreement.
• "Member" means any natural person who has completed registration on the pt909 Platform and holds an active or suspended Account.
• "Platform" means the pt909 website accessible at https://pt909.net, including all subdomains, mobile-optimized versions, and any associated applications.
• "Services" means all gaming products, payment services, customer support channels, and promotional programs made available on the Platform.
• "KYC" means Know Your Customer — the identity and document verification process required by pt909 before a Member may process withdrawals or access certain platform features.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by which a Member signifies acceptance of the Processing of their Personal Data for a stated purpose.

Personal Data We Collect

pt909 collects Personal Data across several categories, depending on how you interact with the Platform. The table below summarizes the categories of data we collect and the specific data points within each category:

How We Collect Your Data

pt909 collects Personal Data through the following channels:

1. Direct Registration: When you complete the pt909 account registration form, you provide your identity, contact, and initial payment details directly. This data is transmitted over an encrypted connection and stored immediately in our secure database.
2. KYC Submissions: When you upload identity documents through the Platform's KYC portal, those documents and associated metadata are collected and processed by our compliance team and, where applicable, a third-party identity verification provider.
3. Financial Transactions: Every deposit and withdrawal request on the Platform generates a transaction record that includes payment method details, transaction timestamp, amount in IDR, and processing outcome.
4. Automated Technical Collection: Our Platform automatically collects certain technical data every time you access the site — including your IP address, device fingerprint, and session duration — through standard web server logs and first-party analytics tools.
5. Cookies and Tracking Technologies: pt909 uses first-party cookies and similar tracking technologies to maintain your login session, remember your Platform preferences, and analyze usage patterns. See Section 9 for full details.
6. Customer Support Interactions: When you contact our support team via live chat or email at [email protected], the content of those communications is recorded and associated with your Account for quality assurance and dispute resolution purposes.
7. Promotional Interactions: When you opt in to a promotion or respond to a marketing communication, we record your opt-in preference, the specific offer involved, and your subsequent wagering activity related to that offer.

Purposes of Processing

pt909 processes your Personal Data for the following clearly defined purposes. We do not process your data for any purpose that is incompatible with the ones listed here without first obtaining your explicit consent:

Legal Basis for Processing

pt909 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

1. Contract Performance: The majority of our processing — including account management, transaction processing, and customer support — is necessary for the performance of the contract between you and pt909 (i.e., our Terms & Conditions). Without this processing, we cannot provide you with the Services.
2. Legal Obligation: Processing related to KYC, AML/CTF compliance, record-keeping for financial audits, and responses to lawful regulatory requests is carried out to fulfil legal obligations applicable to pt909 as an internationally licensed gaming operator.
3. Legitimate Interests: Fraud detection, Platform security monitoring, anonymized analytics for service improvement, and responsible gaming behavioral monitoring are conducted on the basis of pt909's legitimate interest in operating a safe, fair, and commercially viable gaming platform. These interests are balanced against your privacy rights and do not override them.
4. Consent: Marketing communications — including promotional emails, SMS notifications about bonus offers, and seasonal campaign messages related to Indonesian events such as Idul Fitri, Ramadhan, and Indonesian Independence Day (17 August) — are sent only where you have explicitly opted in. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

pt909 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We share your data only in the following limited and controlled circumstances:

1. Game Studios and Technology Partners: Third-party game studios (including Evolution Gaming, Pragmatic Play, Pocket Games Soft, NetEnt, Microgaming, and Spribe) receive limited technical identifiers (anonymized player session tokens) necessary to run their games within the pt909 Platform environment. These studios do not receive your full identity or financial details.
2. Payment Processing Partners: Where Indonesian bank transfers or e-wallet transactions are processed through third-party payment gateway providers, those providers receive the minimum transaction data necessary to complete the payment — specifically your registered account or phone number and the transaction amount in IDR. All payment partners are contractually bound to process this data only for payment facilitation purposes.
3. Identity Verification Providers: pt909 may use third-party KYC verification technology providers to perform automated document checks. These providers process your submitted identity documents and return a verification result to pt909. They are not permitted to retain your documents beyond the verification process.
4. Analytics and Security Providers: Anonymized and aggregated usage data may be shared with Platform analytics and cybersecurity service providers to support fraud detection, DDoS protection, and service performance monitoring. No personally identifiable data is included in these transfers.
5. Legal and Regulatory Authorities: pt909 will disclose Personal Data to competent authorities where required by a lawful order, warrant, or regulatory obligation. Where legally permitted, pt909 will notify the affected Member of such a disclosure.
6. Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of pt909's assets, your Personal Data may be transferred to the successor entity as part of the transaction. You will be notified of any such transfer and the privacy terms applicable to your data under the new ownership.

Data Retention

pt909 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and audit obligations. The table below sets out our standard retention periods by data category:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized using industry-standard data destruction methods. Anonymized data that can no longer be linked to any individual may be retained indefinitely for statistical and research purposes.

Security Measures

pt909 implements a comprehensive, layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security program includes the following measures:

1. Encryption in Transit: All data transmitted between your device and the pt909 Platform is protected by 256-bit Transport Layer Security (TLS 1.3). Our SSL certificate is renewed and monitored continuously to ensure no lapses in coverage.
2. Encryption at Rest: Sensitive data stored in our database — including identity document scans, financial account references, and KYC records — is encrypted at rest using AES-256 symmetric encryption.
3. Password Security: Member passwords are stored as salted, one-way cryptographic hashes using bcrypt. Plain-text passwords are never accessible to pt909 staff or systems. In the event of a security breach, hashed passwords cannot be reversed to recover original values.
4. Access Controls: Access to Personal Data within pt909 is governed by a strict role-based access control (RBAC) policy. Only staff with a legitimate operational need to access specific data categories are granted access, and all access events are logged and audited.
5. Infrastructure Security: Our Platform infrastructure is hosted on enterprise-grade cloud servers with automated DDoS mitigation, Web Application Firewall (WAF) protection, intrusion detection systems, and regular penetration testing by independent security firms.
6. Vulnerability Management: pt909 conducts regular security audits and code reviews. Critical vulnerabilities are patched within 24 hours of identification; medium-severity issues are addressed within 7 days.

Cookies & Tracking Technologies

pt909 uses cookies and similar tracking technologies (including local storage and session storage) to ensure the Platform functions correctly and to deliver a personalized experience. We use the following categories of cookies:

You may manage your cookie preferences at any time through your browser settings. Please note that disabling Strictly Necessary cookies will prevent you from logging in to your pt909 account. Disabling Functional cookies may affect your Platform experience. Disabling Analytics and Marketing cookies will not impact Platform functionality.

Your Data Rights

As a Member of the pt909 Platform, you have the following rights with respect to your Personal Data. These rights are subject to applicable legal limitations — for example, we may be unable to delete certain data that we are legally required to retain for AML compliance purposes:

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". pt909 will acknowledge your request within 3 business days and respond substantively within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 30 days with prior notification.

Children's Privacy

The pt909 Platform is strictly intended for adults aged 21 and over. pt909 does not knowingly collect Personal Data from individuals under the age of 21. Our registration process requires all applicants to declare their date of birth, and our KYC program verifies age against government-issued identification before any withdrawal is processed.

If pt909 becomes aware that Personal Data has been collected from an individual under the age of 21 — whether through a false declaration or a system error — that account will be immediately suspended, all associated data will be securely deleted, and any deposited funds will be returned to the originating payment method after investigation.

Third-Party Links & Embedded Content

The pt909 Platform may contain links to third-party websites and may embed content served by third-party game studios. This Privacy Policy applies solely to Personal Data collected by pt909 through the Platform. pt909 is not responsible for the privacy practices, data collection methods, or security standards of any third-party website or service provider accessed through links on our Platform.

When a game launches within the pt909 interface using technology supplied by a studio such as Evolution Gaming, Pragmatic Play, or Spribe, that studio's software may collect anonymized technical session data in accordance with its own privacy policy. pt909 does not share your full identity or financial data with game studios. We recommend reviewing the privacy policies of any third-party service you interact with directly.

International Data Transfers

pt909 operates as an internationally licensed platform. Some of our Data Processors — including certain cloud infrastructure providers and KYC verification technology partners — may process data on servers located outside Indonesia. Where such cross-border data transfers occur, pt909 ensures that adequate safeguards are in place, including:

• Contractual data protection clauses binding the receiving party to standards equivalent to those in this Privacy Policy
• Use of processors domiciled in jurisdictions recognized as providing adequate data protection standards for international gaming operators
• Technical safeguards (encryption in transit and at rest) that protect your data regardless of the geographic location of the processing server

If you would like further information about the specific safeguards applied to any cross-border transfer of your Personal Data, please contact our Data Protection Officer at [email protected].

Policy Amendments

pt909 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made — meaning changes that significantly affect your rights or the way your data is used — we will:

1. Post a prominent notice on the Platform homepage for a minimum of 14 days;
2. Send a notification to your registered email address summarizing the key changes; and
3. Update the "Last Updated" date and version number at the top of this document.

Your continued use of the pt909 Platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated terms, you must discontinue use of the Platform and may request account closure by contacting our support team.

For minor, non-material changes — such as typographical corrections, clarifications that do not alter the substance of any clause, or updates to contact details — we will update the document silently and reflect the new version number without a formal notification campaign.

Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the way pt909 processes your Personal Data, you may contact our Data Protection Officer (DPO) using the details below. All privacy-related inquiries are handled by our dedicated compliance team and will receive a substantive response within 5 business days.