Privacy Policy

Section 1

Introduction

This Privacy Policy ("Policy") describes how sm607 ("sm607", "we", "us", "our"), operator of the online gaming platform at https://sm607.cam, collects, processes, stores, and protects the personal data of individuals who access the Platform, register an Account, or otherwise interact with our services.

This Policy applies to all members and visitors, regardless of the device or network through which they access the Platform. It should be read together with our Terms & Conditions, which govern the broader relationship between you and sm607.

By creating an Account on sm607, you confirm that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

Section 2

Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

"Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or in combination with other data — including but not limited to a full name, national identity number (KTP), email address, phone number, IP address, or payment account number.

"Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.

"Data Controller" means sm607, the entity that determines the purposes and means of processing your Personal Data.

"Data Processor" means a third party that processes Personal Data on behalf of sm607 under a written data-processing agreement — for example, a payment gateway provider or identity-verification service.

"Member" / "you" means any individual who has registered an Account on the Platform or who accesses the Platform as a visitor.

"KYC Data" means the identity documents and supporting materials submitted by a Member during the Know Your Customer verification process, including government-issued photo ID (KTP, SIM, or passport), selfie images, and proof of address.

"Sensitive Data" means a subset of Personal Data that warrants heightened protection, including financial account details, identity document numbers, and biometric likenesses captured in KYC selfie images.

Section 3

Data We Collect

sm607 collects Personal Data through several channels: directly from you when you register or interact with the Platform, automatically when you browse the site, and from third-party verification services during the KYC process. The categories of data we collect are set out in the table below.

sm607 does not intentionally collect Personal Data from individuals under the age of 21. If we become aware that data has been collected from an underage individual, we will delete that data immediately and close the associated Account (see Section 11).

Section 4

How We Use Your Data

sm607 uses your Personal Data only for the purposes described in this Policy. We do not repurpose data in ways that are incompatible with the original purpose of collection without first notifying you and, where required, obtaining your fresh consent.

(a) Account management: We use your Registration Data to create and maintain your Account, authenticate your identity at login, and manage your security settings, including two-factor authentication.

(b) Payment processing: We use your Financial Data to process deposits and withdrawals in IDR through your selected local bank or e-wallet. Transaction records are retained to reconcile accounts and handle payment disputes.

(c) Identity verification (KYC): We use your KYC Data to verify your age (must be 21+), confirm your Indonesian residency, and fulfil our anti-money-laundering and counter-terrorism-financing obligations.

(d) Platform delivery: We use your Technical and Behavioural Data to serve the correct version of the Platform to your device, personalise your gaming experience, and maintain session continuity.

(e) Fraud prevention and security: We analyse Transaction Data and Technical Data to detect and prevent fraudulent activity, account takeovers, collusion, bonus abuse, and other prohibited conduct described in the Terms & Conditions.

(f) Responsible gaming monitoring: We monitor gameplay patterns and session frequency to identify potential signs of problem gambling. Where patterns trigger our responsible gaming thresholds, our team may proactively reach out to offer support tools.

(g) Customer support: We use your Communications Data to respond to queries, resolve disputes, process complaints, and improve the quality of our support service. Support interactions may be recorded for quality assurance.

(h) Marketing communications: Where you have opted in, we use your contact details and Preference Data to send you promotional offers, bonus notifications, and platform updates by email or in-platform message. You may withdraw consent at any time through your Account settings or by contacting support.

(i) Legal and regulatory compliance: We retain and disclose Personal Data as required to comply with applicable laws, respond to lawful requests from competent authorities, and enforce our contractual rights under the Terms & Conditions.

Section 5

Legal Basis for Processing

sm607 processes your Personal Data on one or more of the following legal grounds, depending on the purpose of the specific processing activity:

Contract performance: Processing necessary to enter into or perform the member agreement with you — for example, processing deposits, settling bets, and operating your Account.

Legal obligation: Processing required to comply with applicable law, including anti-money-laundering regulations, KYC obligations, and responses to lawful orders from regulatory or law enforcement authorities.

Legitimate interests: Processing we carry out in pursuit of our legitimate business interests — such as fraud prevention, platform security, analytics, and service improvement — where those interests are not overridden by your fundamental rights and freedoms.

Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Section 6

Data Sharing & Disclosure

sm607 does not sell, rent, or trade your Personal Data to any third party. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the specific purpose.

(a) Payment processors: Your financial account details are shared with our approved Indonesian banking and e-wallet partners — including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja — solely for the purpose of processing your deposit or withdrawal transaction.

(b) KYC and identity verification providers: Your KYC Data is shared with our contracted identity-verification service provider for the purpose of document authentication and age verification. These providers are bound by strict data-processing agreements and are prohibited from using your data for any other purpose.

(c) Game content providers: When you play games delivered by third-party studios — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft — a session token and minimal technical data (e.g., currency, language preference) are exchanged with the relevant provider to deliver the game. These providers do not receive your full Account profile or financial data.

(d) Analytics and technology providers: We use third-party analytics tools to understand how Members use the Platform. These tools receive anonymised or pseudonymised Behavioural and Technical Data. No directly identifying Personal Data is transmitted to analytics providers.

(e) Legal and regulatory authorities: We may disclose Personal Data to law enforcement agencies, courts, regulators, or other competent public authorities where we are legally required to do so, or where disclosure is necessary to protect the safety of individuals or prevent serious harm.

(f) Corporate transactions: In the event of a merger, acquisition, or sale of assets involving sm607, your Personal Data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and of any change in the applicable privacy policy.

Section 7

Cookies & Tracking Technologies

sm607 uses cookies and similar technologies to operate the Platform, maintain your session, and gather analytics data. We do not use cross-site tracking cookies, behavioural advertising networks, or fingerprinting technologies.

Most web browsers allow you to control cookies through their settings. Disabling strictly necessary cookies will prevent the Platform from functioning correctly. Disabling analytics or functional cookies will not affect your ability to play, but may reduce the quality of your personalised experience. Detailed cookie-management instructions are available in the help section of each major browser (Chrome, Firefox, Safari, Edge).

Section 8

Data Retention

sm607 retains your Personal Data only for as long as necessary to fulfil the purposes set out in this Policy or to comply with applicable legal obligations. The retention periods below represent our standard practice; individual circumstances (such as an ongoing legal dispute) may require longer retention.

Active Account data: Retained for the full duration of your Account's active status, plus a minimum of 5 years after Account closure. This includes Registration Data, Transaction Data, and KYC records, which may be required to meet anti-money-laundering record-keeping obligations.

KYC documents: Retained for a minimum of 5 years from the date of verification, in line with standard international AML/CFT requirements. After this period, documents are securely deleted or anonymised.

Transaction records: Retained for a minimum of 5 years from the date of the transaction for financial audit and dispute resolution purposes.

Support communications: Chat transcripts and email correspondence are retained for 2 years from the date of the interaction, unless they form part of a formal dispute that requires longer retention.

Analytics and technical logs: Server logs and anonymised analytics data are retained for up to 24 months, after which they are automatically purged or permanently anonymised.

Marketing preference records: Opt-in and opt-out records are retained indefinitely so we can honour your preferences and demonstrate compliance with consent requirements.

When your data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. Deletion requests submitted under Section 9 will be processed within 30 days, subject to any overriding legal retention requirements.

Section 9

Your Rights Over Your Data

As a member of sm607, you hold the following rights in relation to your Personal Data. These rights may be exercised free of charge by submitting a written request to [email protected]. We will acknowledge your request within 3 business days and fulfil it within 30 calendar days.

To exercise any of these rights, please write to [email protected] with the subject line "Data Rights Request" and include your full name and registered email address. We may ask you to verify your identity before fulfilling the request to prevent unauthorised disclosure.

Section 10

International Data Transfers

sm607 operates as an internationally licensed platform. Some of our Data Processors — such as game content providers, cloud infrastructure providers, and KYC verification services — may be located outside Indonesia. Where your Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to Indonesia, sm607 implements one or more of the following safeguards:

(a) Contractual safeguards: We enter into data-processing agreements with all offshore processors that include standard data-protection clauses requiring the processor to maintain confidentiality, implement appropriate security measures, and process data only on our documented instructions.

(b) Technical safeguards: Data transferred internationally is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption, limiting exposure in the event of any infrastructure compromise.

(c) Minimisation: Where international transfers are necessary, we transmit only the minimum data required for the specific processing purpose, using pseudonymisation or tokenisation wherever feasible.

You may request information about the specific safeguards in place for any international transfer of your data by contacting [email protected].

Section 11

Children's Privacy (Under 21)

sm607 operates a strict 21+ age policy. The Platform is not directed at, and is not intended for use by, any person under the age of 21. We do not knowingly collect Personal Data from individuals under 21 years of age.

If you are a parent or guardian and believe that a minor has registered on the Platform or submitted Personal Data without your knowledge, please contact us immediately at [email protected]. Upon verification, we will suspend the Account, delete all associated data, and — where applicable — return net deposits as described in our Terms & Conditions.

Where our automated systems or KYC verification processes indicate that an Account holder may be under 21, we will suspend that Account and request additional age-verification documentation before any further access is permitted.

Section 12

Security Measures

sm607 takes the security of your Personal Data seriously. We implement a layered security architecture combining technical, organisational, and procedural controls to protect against unauthorised access, disclosure, alteration, and destruction of your data.

Encryption: All data in transit between your device and sm607 servers is protected by TLS 1.3 encryption. Stored Personal Data — particularly KYC documents, financial records, and password hashes — is encrypted at rest using AES-256.

Access controls: Access to Personal Data within sm607's systems is restricted on a strict need-to-know basis. Staff who handle member data are subject to background checks, confidentiality agreements, and regular data-protection training.

Two-factor authentication (2FA): sm607 offers 2FA for all member Accounts. We strongly recommend enabling 2FA to protect against unauthorised login attempts. 2FA may be required for high-value withdrawal requests at our discretion.

Intrusion detection and monitoring: Our security operations team monitors Platform infrastructure 24/7 for anomalous activity, DDoS attempts, and suspicious login patterns. Automated alerts trigger rapid incident response procedures.

Penetration testing: sm607 conducts regular third-party penetration tests of our Platform and infrastructure to identify and remediate vulnerabilities before they can be exploited.

Data breach response: In the event of a data breach that poses a risk to your rights and freedoms, sm607 will notify affected members without undue delay — and within 72 hours of becoming aware of the breach — with details of what occurred, what data was affected, and the steps we are taking to address it.

While sm607 takes all reasonable measures to secure your data, no online system can guarantee absolute security. You also bear responsibility for maintaining the confidentiality of your own login credentials and for notifying us promptly if you suspect any unauthorised access to your Account.

Section 13

Amendments to This Policy

sm607 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, business operations, or the technical architecture of the Platform. The "Last Updated" date at the top of this page will be revised whenever a material change is made.

When we make material changes — for example, introducing a new category of data collection or a new purpose for processing — we will notify registered Members by email or in-platform notification at least 14 days before the change takes effect. Continued use of the Platform after that date constitutes acceptance of the revised Policy.

If you disagree with a proposed change, you may request Account closure and deletion of your Personal Data (subject to legal retention requirements) before the amendment comes into force. To do so, contact [email protected] with the subject line "Account Closure Request".

Previous versions of this Privacy Policy are available on request.

Section 14

Contact & Data Rights Requests

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy concern, please contact the sm607 Privacy Team through any of the following channels. All privacy enquiries are handled with strict confidentiality.

Email (preferred for formal requests): [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" to ensure your message is routed to the correct team member.

WhatsApp: +62 811 0607 607 — available 24/7. For formal data rights requests, a follow-up email confirmation may be requested to create a verifiable record.

Live Chat: Available at any time via the Platform homepage. Average first-response time is under 90 seconds. Our agents are fluent in both English and Indonesian, so you may communicate in whichever language you prefer.

Response commitment: We acknowledge all privacy enquiries within 3 business days (WIB) and commit to resolving them within 30 calendar days of identity verification. Complex erasure or portability requests may require up to an additional 30 days; we will notify you if this extension is necessary.