Privacy Policy

Throughout this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, kuro99.
• "Data Processor" means a third party that processes personal data on behalf of kuro99 under a contractual data processing agreement.
• "Player" / "You" / "Your" means any individual who has registered an account on kuro99 or who accesses the Platform in any capacity.
• "Platform" means the kuro99 website at https://kuro99.cam and all associated services, applications, and interfaces.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, analytics, and personalization.
• "KYC" (Know Your Customer) means the identity verification procedures required to comply with anti-money laundering obligations.
• "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or financial account credentials, which warrants enhanced protection under applicable data protection law.

kuro99 acts as the Data Controller for all personal data collected through the Platform. As Data Controller, kuro99 is responsible for determining the purposes for which your personal data is processed and for ensuring that such processing is carried out lawfully, fairly, and transparently.

kuro99 serves players primarily located in Indonesia, including major urban centers such as Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, Palembang, and Makassar. Where applicable, kuro99 complies with Indonesian data protection regulations and international best-practice standards for data security in the online gaming industry.

For all data protection inquiries, please contact us via the details provided in Section 16 of this policy.

kuro99 collects personal data across several categories. The table below provides an overview of the data types collected and their primary purpose:

kuro99 does not intentionally collect Sensitive Data beyond what is required for KYC compliance (e.g., a copy of a national ID card which may incidentally reveal ethnicity or religion). Such data is processed solely for the purpose of identity verification and is not used for any other purpose.

kuro99 collects personal data through the following channels:

• Direct Collection: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically when you access the Platform, including via cookies, server logs, and analytics tools. See Section 10 for full details on cookies.
• Third-Party Sources: Identity verification data cross-checked against third-party KYC databases where permitted; fraud-risk signals from payment processors and financial institutions; geolocation data from IP intelligence providers.
• Payment Processors: Transaction confirmation data from banking partners including BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and Bank Permata, and e-wallet providers.
• Game Providers: Aggregated gameplay data from licensed studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft. These providers process only the minimum data required for game delivery and are bound by contractual data processing agreements.

kuro99 processes your personal data for the following specific purposes:

1. Account Registration and Management: Creating, maintaining, and administering your player account, including verifying your identity and eligibility to use the Platform.
2. KYC and AML Compliance: Verifying your identity and age in accordance with anti-money laundering obligations and our responsible gaming commitments. All Players must be 21 or older.
3. Payment Processing: Facilitating deposits and withdrawals via your registered pa yment methods, verifying that withdrawal destinations match your registered identity, and maintaining transaction records for regulatory compliance.
4. Fraud Prevention and Security: Detecting and preventing unauthorized account access, multi-accounting, identity fraud, money laundering, bonus abuse, and other prohibited activities described in our Terms & Conditions.
5. Customer Support: Responding to your inquiries, resolving disputes, and maintaining records of communications for quality assurance and compliance purposes.
6. Responsible Gaming: Monitoring gameplay patterns to identify potential signs of problem gambling, administering self-exclusion requests and deposit limits, and reaching out proactively where our systems flag a concern.
7. Platform Personalization: Tailoring your experience on kuro99 based on your game preferences, betting history, and usage patterns to surface relevant content and promotions.
8. Marketing Communications: Sending promotional offers, bonus notifications, and platform updates where you have provided explicit consent. You may withdraw this consent at any time.
9. Legal and Regulatory Compliance: Fulfilling obligations imposed by applicable law, responding to lawful requests from government authorities, and maintaining records required for audit purposes.
10. Platform Improvement: Analyzing aggregated, anonymized usage data to identify technical issues, optimize performance, and develop new product features.

kuro99 does not use your personal data for any purpose that is materially incompatible with the purposes listed above without first obtaining your explicit consent or establishing an appropriate legal basis under applicable data protection law.

kuro99 relies on the following legal bases when processing your personal data:

• Contractual Necessity: Processing that is necessary to perform the contract between kuro99 and you — specifically, providing the gambling services you have registered to access, processing your transactions, and maintaining your account.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering rules, KYC obligations, and the retention of financial transaction records.
• Legitimate Interests: Processing carried out in pursuit of kuro99's legitimate business interests, including fraud prevention, security monitoring, platform optimization, and responsible gaming intervention, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and for any optional personalization features that go beyond what is required to deliver the core service. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

kuro99 does not sell or rent your personal data. We may share your data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment Service Providers: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the transaction data required to process your deposits and withdrawals.
• KYC and Identity Verification Providers: Third-party identity verification services that check your submitted documents against authoritative databases to confirm your identity and age.
• Game Content Providers: Licensed game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft) receive a pseudonymous player identifier and the minimum data required to load and log your gameplay sessions.
• Fraud and Risk Management Providers: Specialist services that analyze transaction patterns and device fingerprints to detect fraud, money laundering, and multi-account abuse. These providers act as Data Processors under binding agreements with kuro99.
• Customer Support Infrastructure: Live chat, ticketing, and email platform providers that facilitate our 24/7 support operations. These providers process communication content solely on kuro99's behalf.
• Analytics Providers: Anonymized or pseudonymized usage data may be shared with analytics partners to support platform performance monitoring and product development. No directly identifiable personal data is shared for analytics purposes.
• Law Enforcement and Regulatory Authorities: kuro99 will disclose personal data to competent authorities when legally required to do so — for example, in response to a valid court order, a regulatory investigation, or a statutory anti-money laundering reporting obligation. kuro99 will, where permitted by law, notify the affected Player of such a request.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of kuro99's business, Player data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and of any material change to the data controller's identity before the transfer takes effect.

All third-party Data Processors engaged by kuro99 are required to process personal data only on kuro99's documented instructions, to implement appropriate technical and organizational security measures, and to delete or return data upon termination of the processing relationship.

kuro99 operates as an internationally regulated platform and some of our service providers, including game studios and cloud infrastructure providers, may process personal data outside of Indonesia. Where personal data is transferred to a jurisdiction that does not offer an equivalent level of data protection to that applicable in Indonesia, kuro99 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses or equivalent contractual data protection obligations binding the recipient.
• Binding corporate rules where the recipient is part of the same corporate group as kuro99.
• Reliance on a recognized adequacy decision or equivalent mechanism where available.

By using the kuro99 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Indonesia in the circumstances described above. kuro99 will always ensure that such transfers are subject to appropriate protection measures consistent with this Privacy Policy.

kuro99 retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, and for as long as required to comply with applicable legal and regulatory obligations. The following retention periods apply as a general guide:

Where retention beyond these periods is required for an ongoing legal proceeding, regulatory investigation, or dispute, kuro99 will retain the relevant data until the matter is fully resolved. Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our data destruction procedures.

kuro99 uses cookies and similar tracking technologies on the Platform to support core functionality, measure performance, and improve your experience. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable session management, authentication, fraud prevention, and the maintenance of your login state. They cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Collect anonymized or pseudonymized data about how Players navigate and use the Platform — for example, which pages are visited most frequently and where errors occur. This data is used exclusively to improve Platform performance and user experience.
• Functional Cookies: Remember your preferences such as language settings, preferred game category, and notification settings, so that you do not need to re-configure these on each visit.
• Marketing Cookies: Used only where you have provided explicit consent. These cookies track your interaction with promotional content so that kuro99 can measure the effectiveness of marketing campaigns. No marketing cookies are shared with third-party advertising networks.

You may manage your cookie preferences at any time via your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your kuro99 account. For browsers that support it, you can also use the "Do Not Track" signal; kuro99 will honor this signal by disabling all non-essential cookies for your session.

Specific security measures in place include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and kuro99 servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive personal data fields — including payment account details and identity document data — are encrypted at the database level using AES-256 or equivalent.
• Access Controls: Personal data is accessible only to kuro99 personnel and Data Processors who require it to perform their designated functions. Role-based access controls and multi-factor authentication are enforced for all internal systems.
• Regular Security Audits: kuro99 engages independent security specialists to conduct penetration testing and vulnerability assessments of our platform infrastructure on a regular scheduled basis.
• Incident Response: kuro99 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights, we will notify affected players and relevant authorities within the timeframe required by applicable law.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their kuro99 accounts. 2FA adds an additional layer of protection against unauthorized account access even if your password is compromised.

While kuro99 takes all reasonable steps to secure your personal data, no system is completely immune to attack. You share responsibility for protecting your account by maintaining a strong, unique password and by not disclosing your login credentials to any other person.

As a Player whose personal data is processed by kuro99, you hold the following rights, subject to applicable law and certain legitimate exceptions:

• Right of Access: You have the right to request a copy of the personal data kuro99 holds about you, along with information about how it is being processed. We will provide this within 30 calendar days of a verified request.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected. Minor updates such as a change of email address or phone number can be made directly within your Account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that certain data must be retained to comply with AML and financial record-keeping obligations regardless of an erasure request.
• Right to Restrict Processing: You may request that kuro99 temporarily suspend the processing of your personal data — for example, while you contest its accuracy or while a complaint is being investigated.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You may object at any time to processing based on kuro99's legitimate interests, including profiling for responsible gaming or personalization purposes. kuro99 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal. Marketing communications opt-out is available in your Account dashboard or via support.
• Right to Lodge a Complaint: If you believe that kuro99 has processed your personal data in violation of applicable law, you have the right to lodge a complaint with the competent data protection authority in your jurisdiction.

To exercise any of the above rights, please contact kuro99's support team using the details in Section 16. We may request proof of identity before processing a data rights request to ensure we do not disclose personal data to an unauthorized party. We will respond to all valid requests within 30 calendar days; where a request is complex or voluminous, we may extend this period by a further 30 days with prior notice.

kuro99 takes the protection of minors seriously. Our KYC verification process is designed to confirm that every registered player meets the minimum age requirement of 21 years. Any account found to belong to a person under 21 will be immediately suspended, all balances forfeited, and the relevant personal data deleted as promptly as permitted by our legal retention obligations.

Account holders are responsible for ensuring that minors within their household do not gain access to their kuro99 login credentials. If you have reason to believe that a person under the age of 21 has registered an account on kuro99, please contact our support team immediately using the details in Section 16 so that we can investigate and take appropriate action without delay.

The kuro99 Platform may include integrations with or links to third-party services, including game studio interfaces, payment gateways, and customer support tools. This Privacy Policy applies exclusively to personal data collected and processed by kuro99. It does not apply to the data practices of any third-party service, even where that service is accessible through the kuro99 Platform.

kuro99 is not responsible for the privacy practices or the content of third-party services. We encourage you to review the privacy policies of any third-party service you interact with. In particular, players using local Indonesian bank or e-wallet services (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) should refer to those providers' own privacy documentation for information on how they handle your financial data.

kuro99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. When material changes are made, kuro99 will notify registered Players by email at least 7 days before the revised Policy takes effect, except where immediate amendment is required for urgent legal or security reasons.

The most current version of this Privacy Policy is always available at https://kuro99.cam/privacy-policy and displays the "Last Updated" date at the top of the document. We recommend that you review this Policy periodically to stay informed of how kuro99 handles your personal data. Your continued use of the Platform following notification of a material change constitutes your acknowledgment of the revised Policy.

Where an amendment materially affects your rights or the way in which kuro99 processes data that is subject to your consent, we will seek fresh consent before the new processing commences.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact the kuro99 data protection team through the following channels:

• Email: [email protected] — please include "Privacy Request" in your subject line and your registered account username to help us respond efficiently.
• Live Chat: Available 24 hours a day, 7 days a week via the kuro99 Platform. For data rights requests, please ask to be connected to the data protection team.
• WhatsApp: Available 08:00–24:00 WIB. Contact number is displayed within the Platform's support section.

kuro99 aims to acknowledge all data rights requests within 5 business days and to provide a full response within 30 calendar days. Where a request is unusually complex, we will inform you of the extended timeline before the initial 30-day period expires. We do not charge a fee for standard data rights requests; however, we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

If you are not satisfied with kuro99's response to a data rights request or complaint, you have the right to escalate the matter to the competent data protection supervisory authority in your jurisdiction.