Privacy Policy — soda68

Section 1 Introduction & Scope

soda68 ("we", "us", "our", or "the Platform") is committed to protecting the privacy and security of personal data belonging to our members and website visitors. This Privacy Policy describes our practices with respect to the collection, use, storage, sharing, and protection of personal data in connection with the operation of the soda68 online betting platform.

This policy applies to:

• All registered members of soda68, including those based in Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Palembang, Makassar, and other locations across Indonesia.
• Visitors to the soda68 website who have not yet registered an account.
• Individuals who contact soda68 via customer support channels.
• Prospective members who have commenced but not completed the registration process.

This policy does not apply to third-party websites, services, or platforms that may be linked to or from soda68. We encourage you to review the privacy policies of any third-party services you choose to use.

Section 2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or indirectly — including name, date of birth, residential address, email address, phone number, national identity number, bank account details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, alteration, or deletion.
• "Data Controller" means soda68, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of soda68 pursuant to a contractual arrangement — for example, a KYC verification provider or payment gateway.
• "Member" or "User" means any individual who has registered or is using a soda68 account.
• "KYC" means Know Your Customer — the identity verification process mandated by soda68's licensing authority and anti-money-laundering obligations.
• "Cookies" means small data files placed on a user's device by the Platform to enable certain functionality and to collect usage analytics.

Section 3 Personal Data We Collect

soda68 collects the following categories of personal data, depending on the context of your interaction with the Platform:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond identity document photographs required for KYC purposes.

Section 4 How We Collect Your Data

soda68 collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser fingerprint, session logs, and usage analytics via cookies and similar tracking technologies.
• Third-Party Sources: Data received from KYC verification services (where we engage third-party identity verification providers), payment processors (confirming transaction status), and fraud prevention databases (for risk screening purposes).
• Inferred Data: Information we derive from other data we hold — for example, inferring your preferred betting category from your wagering history for the purpose of responsible gaming monitoring.

Section 5 Legal Basis for Processing Your Data

soda68 processes personal data only where we have a lawful basis to do so. Under applicable data protection law, the legal bases we rely on are:

• Contractual Necessity: Processing is necessary to perform our contract with you — i.e., to provide betting services, process your deposits and withdrawals, and manage your account in accordance with our Terms & Conditions.
• Legal Obligation: Processing is required to comply with legal obligations imposed on soda68, including identity verification, age verification, anti-money-laundering checks, and regulatory reporting to our licensing authority.
• Legitimate Interests: Processing is necessary for soda68's legitimate interests or those of a third party, provided those interests do not override your fundamental rights and freedoms. Examples include fraud prevention, Platform security, service optimization, and responsible gaming monitoring.
• Consent: Where required by law, we obtain your explicit consent before processing personal data — for example, when placing optional marketing cookies on your device or sending promotional communications beyond transactional account management emails.

You may withdraw consent at any time where consent is the legal basis for processing, without affecting the lawfulness of processing carried out prior to withdrawal. However, withdrawal of consent may prevent you from accessing certain Platform features.

Section 6 How We Use Your Personal Data

soda68 uses your personal data for the following purposes:

• Account Management: Creating and maintaining your account, authenticating your login, and providing access to betting services.
• Identity & Age Verification: Verifying that you are at least 21 years of age and confirming your identity via KYC procedures as required by our licensing authority.
• Payment Processing: Processing deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, and ShopeePay; reconciling transactions; and preventing duplicate or fraudulent payments.
• Regulatory Compliance: Meeting obligations under anti-money-laundering regulations, reporting suspicious transactions, maintaining records for audit purposes, and responding to lawful requests from regulatory authorities.
• Fraud Prevention & Platform Security: Detecting and preventing fraud, account takeover, bonus abuse, collusion, match-fixing, and other prohibited activities; monitoring for duplicate accounts; and protecting the Platform from cyberattacks.
• Responsible Gaming: Monitoring betting patterns to identify members who may be at risk of problem gambling; enforcing deposit limits, cooling-off periods, and self-exclusion; and complying with player protection obligations.
• Customer Support: Responding to inquiries, resolving disputes, processing complaints, and providing technical assistance via email and live chat.
• Service Improvement: Analyzing usage data to optimize Platform performance, improve user experience, test new features, and fix bugs or errors.
• Marketing Communications: Sending promotional offers, bonus announcements, and product updates via email or SMS where you have consented to receive such communications. You may opt out at any time.

Section 7 Data Sharing & Disclosure

soda68 does not sell, rent, or trade your personal data to third-party marketers or data brokers. However, we may share your data with the following categories of recipients under strict contractual data protection obligations:

• Payment Processors: Banks, e-wallet providers, and payment gateway operators (including those servicing BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, and ShopeePay transactions) receive the data necessary to process deposits and withdrawals.
• KYC & Identity Verification Providers: Third-party services that verify identity documents, age, and address on our behalf in compliance with licensing requirements.
• Fraud Prevention Services: Specialized providers that screen transactions, IP addresses, and behavioral patterns against fraud databases to protect soda68 and its members from fraudulent activity.
• Cloud Hosting & Infrastructure Providers: Secure data centers and cloud service providers that host the Platform and store encrypted backups of member data.
• Customer Support Tools: Live chat and email ticketing platforms used to deliver customer service (all communications are encrypted and access-restricted).
• Regulatory Authorities: Our licensing authority and relevant Indonesian regulatory bodies where required by law or in response to a valid legal request — for example, in connection with anti-money-laundering investigations.
• Legal & Professional Advisors: Lawyers, auditors, and compliance consultants where necessary to obtain professional advice, defend legal claims, or comply with audit obligations.
• Successors in Business: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity subject to equivalent data protection obligations.

All third-party data processors engaged by soda68 are bound by written data processing agreements that require them to process personal data only in accordance with our instructions, implement appropriate security measures, and comply with applicable data protection law.

Section 8 International Data Transfers

soda68 is licensed and operates internationally. Your personal data may be transferred to, stored in, and processed by soda68 and its service providers in jurisdictions outside Indonesia where our servers, payment processors, or third-party vendors are located.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect your data, including:

• Transferring data only to jurisdictions recognized as providing adequate data protection under applicable law.
• Entering into Standard Contractual Clauses approved by relevant data protection authorities with third-party processors in jurisdictions without adequate protection laws.
• Implementing technical and organizational security measures to protect data in transit and at rest.

By using the soda68 Platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

Section 9 Data Retention Periods

soda68 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Accounts: Personal data is retained for the duration of your membership and for as long as your account remains active.
• Closed Accounts: Following voluntary or involuntary account closure, most personal data is retained for a minimum of five (5) years to comply with anti-money-laundering regulations and licensing obligations. Transaction records, betting history, and KYC documents fall within this category.
• Self-Excluded Accounts: Data relating to members who have requested self-exclusion is retained indefinitely (or for the maximum period permitted by law) to prevent circumvention of self-exclusion measures through re-registration.
• Marketing Consent Records: Records of your marketing consent preferences are retained for three (3) years following withdrawal of consent or account closure.
• Technical & Usage Data: Logs, IP addresses, and session data are typically retained for twelve (12) months unless required for longer periods in connection with fraud investigations or legal proceedings.
• Support Communications: Customer support email and chat transcripts are retained for three (3) years for quality assurance and dispute resolution purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer identify you.

Section 10 Cookies & Tracking Technologies

soda68 uses cookies and similar tracking technologies to enable Platform functionality, enhance user experience, and collect usage analytics. A cookie is a small text file placed on your device by your web browser when you access the Platform.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential cookies required for the Platform to function — for example, to maintain your login session, remember your language preference, and enable secure transactions. These cookies cannot be disabled.
• Performance Cookies: Analytics cookies that collect anonymous usage statistics to help us understand how visitors interact with the Platform and identify areas for improvement. Examples include Google Analytics, which we use in anonymized mode.
• Functional Cookies: Cookies that remember your preferences (such as odds format, time-zone, or previously visited pages) to provide an enhanced and personalized experience.
• Marketing Cookies: Optional cookies used to deliver targeted promotional content. These are only placed with your explicit consent and can be disabled at any time via your browser settings or account preferences.

You may configure your browser to refuse cookies or to alert you when cookies are being placed. However, disabling strictly necessary cookies will impair core Platform functionality and may prevent you from accessing your account.

Section 11 Security Measures

soda68 implements robust technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. These measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and soda68 servers is encrypted using industry-standard 256-bit SSL/TLS protocols.
• Encrypted Data Storage: Personal data stored on our servers is encrypted at rest using AES-256 encryption.
• Access Controls: Strict role-based access controls ensure that only authorized personnel can access personal data, and only to the extent necessary for their role. All access is logged and audited.
• Multi-Factor Authentication: Critical systems and administrative accounts require multi-factor authentication to prevent unauthorized access.
• Regular Security Audits: soda68 undergoes regular independent security audits and penetration testing to identify and remediate vulnerabilities.
• Employee Training: All staff with access to personal data receive mandatory training on data protection principles and security best practices.
• Secure Development Practices: Our software development processes incorporate security-by-design principles, including code review, vulnerability scanning, and patch management.

Section 12 Your Rights

Under applicable data protection law, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of the personal data soda68 holds about you. We will provide this free of charge in a structured, commonly used, and machine-readable format within thirty (30) days of your request.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or completed. You can update most information directly via your account settings.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent. Note that this right is not absolute and may be restricted by legal obligations requiring soda68 to retain data (e.g., anti-money-laundering record-keeping requirements).
• Right to Restriction of Processing: You may request that we temporarily suspend processing of your personal data in certain circumstances — for example, while we investigate a complaint about data accuracy.
• Right to Data Portability: You may request a portable copy of the personal data you have provided to soda68, which you can then transmit to another service provider.
• Right to Object: You may object to processing of your personal data that is based on legitimate interests or for direct marketing purposes. Where you object to marketing, we will cease such communications immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.
• Right to Lodge a Complaint: If you believe soda68 has breached data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority in Indonesia or in soda68's licensing jurisdiction.

To exercise any of these rights, please contact soda68 at the email address provided in Section 16 below. We may require verification of your identity before responding to rights requests.

Section 13 Children & Minors Under 21

soda68 strictly prohibits the use of the Platform by individuals under 21 years of age. We do not knowingly collect personal data from minors, and registration by anyone under 21 is a material breach of our Terms & Conditions.

If we become aware that we have inadvertently collected personal data from an individual under 21, that data will be deleted immediately, the account will be closed, and any associated funds will be returned to the source payment method following parental or guardian confirmation.

Parents and guardians in Indonesia should monitor their children's internet use and ensure that minors do not access gambling platforms. If you believe a minor has registered an account on soda68, please contact us immediately at the address in Section 16.

Section 14 Third-Party Websites & Services

The soda68 Platform may contain links to third-party websites, services, or social media platforms. This Privacy Policy does not apply to those third-party sites, and soda68 is not responsible for the privacy practices or content of external platforms.

We encourage you to review the privacy policies of any third-party services you interact with. soda68 does not control and cannot be held responsible for third-party data collection, use, or sharing practices.

Section 15 Updates to This Privacy Policy

soda68 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform functionality. Where material changes are made, we will provide notice to members via email or by displaying a prominent notice on the Platform.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised policy.

We encourage you to review this Privacy Policy periodically to remain informed about how we collect, use, and protect your data.

Section 16 Contact & Data Protection Inquiries

If you have any questions, concerns, or complaints regarding this Privacy Policy or soda68's data protection practices, or if you wish to exercise any of the rights described in Section 12, please contact us:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Inquiry" or "Data Rights Request" in the subject line of your email to ensure prompt routing to our data protection team.
• Response Time: We will acknowledge data rights requests within 72 hours and provide a substantive response within thirty (30) days. Where requests are complex or numerous, we may extend this period by a further sixty (60) days with explanation.
• Language: Inquiries may be submitted in English or Indonesian. Our data protection team is fluent in both languages.

For urgent privacy or security concerns — such as suspected unauthorized access to your account or a data breach notification — please mark your email "URGENT: Security Issue" to ensure immediate escalation.