Privacy Policy

1. Information We Collect

roma99 collects several categories of personal information to operate your account, process transactions, comply with legal requirements, and improve our services. The specific data we collect includes:

1.1 Account Registration Information

When you create a roma99 account, you provide the following mandatory information:

• Full Legal Name: Your name as it appears on your government-issued identification document.
• Date of Birth: Required to verify you meet the minimum age requirement of 21 years.
• Residential Address: Your complete home address in Indonesia, used for KYC verification and compliance purposes.
• Email Address: Your primary contact email for account notifications, security alerts, and customer support communications.
• Mobile Phone Number: Used for two-factor authentication (2FA), account recovery, and important account alerts.
• Username and Password: Your self-created login credentials. Passwords are stored using industry-standard bcrypt hashing and are never visible to roma99 staff.

1.2 Identity Verification (KYC) Documents

To comply with Indonesian anti-money laundering (AML) regulations and age verification requirements, all Members must submit the following documents:

• Government-Issued Photo ID: Indonesian National ID Card (KTP Nasional), passport, or driver's license. We extract and store your full name, date of birth, ID number, and photo for verification purposes.
• Proof of Address: A recent utility bill, bank statement, or official correspondence dated within the last three months confirming your residential address.
• Selfie with ID: A photograph of you holding your ID document next to your face, used to confirm identity through facial recognition technology.

KYC documents are stored securely in encrypted form and are accessible only to authorized compliance personnel. We do not share KYC documents with third parties except when legally required by Indonesian authorities or international law enforcement agencies.

1.3 Financial and Transaction Data

When you deposit or withdraw funds, we collect the following financial information:

• Bank Account Details: Bank name, account number, and account holder name for processing withdrawals to Indonesian banks (BCA, BRI, BNI, Mandiri, etc.).
• E-Wallet Information: Account ID or phone number associated with OVO, DANA, GoPay, ShopeePay, or LinkAja.
• Transaction History: A complete record of all deposits, withdrawals, wagers, winnings, bonus claims, and account adjustments, including timestamps, amounts, and transaction methods.
• Payment Metadata: IP address at the time of transaction, device ID, and geolocation data (where permitted) to detect fraudulent activity and comply with payment processor security requirements.

We do not store your full credit/debit card numbers or CVV codes. Payment card processing is handled by PCI-DSS compliant third-party payment processors who tokenize card data. roma99 retains only the last four digits of the card number and expiration date for display purposes in your account history.

1.4 Gameplay and Betting Data

To operate the gaming platform and comply with responsible gaming requirements, we collect detailed gameplay data including:

• Bet History: All wagers placed, including sport/event, market type, stake amount, odds, bet status (pending/won/lost), and settlement details.
• Game Sessions: Records of casino game sessions including game name, session duration, total wagered, total won/lost, and RTP percentage.
• Bonus Activity: Bonus claims, wagering progress toward bonus requirements, and bonus forfeitures or expirations.
• Responsible Gaming Tool Usage: Records of deposit limits, loss limits, session time limits, reality-check settings, and self-exclusion requests you have activated.

1.5 Technical and Device Information

roma99 automatically collects technical data when you access our platform:

• Device Information: Operating system, browser type and version, screen resolution, device model, unique device identifiers (IMEI, Android ID, IDFA).
• IP Address and Geolocation: Your public IP address and approximate geographic location (city/province level) derived from IP geolocation databases. This helps us detect multi-accounting, prevent fraud, and comply with jurisdictional restrictions.
• Cookies and Tracking Technologies: Session cookies, persistent cookies, local storage, and device fingerprints used for authentication, fraud prevention, and analytics. See Section 8 for detailed cookie information.
• Usage Logs: Pages visited, features used, time spent on each page, click paths, search queries, and error logs. This data is used to improve platform performance and user experience.

2. How We Use Your Information

roma99 uses your personal information for the following legitimate business purposes:

2.1 Account Management and Service Delivery

• Creating and maintaining your roma99 account
• Processing deposits and withdrawals
• Verifying your identity and age through KYC procedures
• Providing customer support and responding to your inquiries
• Sending account notifications, transaction confirmations, and security alerts
• Managing bonuses, promotions, and VIP rewards

2.2 Legal and Regulatory Compliance

• Complying with Indonesian anti-money laundering (AML) and counter-terrorism financing (CTF) regulations
• Verifying you meet the minimum age requirement of 21 years
• Responding to lawful requests from Indonesian authorities, law enforcement agencies, and regulatory bodies
• Maintaining records required by gaming licenses and financial regulations
• Conducting internal audits and compliance reviews

2.3 Fraud Prevention and Security

• Detecting and preventing fraudulent transactions, money laundering, and account takeovers
• Identifying multi-accounting, bonus abuse, and collusion
• Monitoring for irregular betting patterns and potential match-fixing involvement
• Protecting the integrity of our games and sports betting markets
• Securing the platform against cyberattacks, DDoS attacks, and unauthorized access

2.4 Responsible Gaming and Player Protection

• Implementing deposit limits, loss limits, and session time limits you have requested
• Processing self-exclusion and cooling-off period requests
• Monitoring for signs of problem gambling behavior
• Providing reality-check reminders and responsible gaming resources
• Restricting marketing communications for self-excluded players

2.5 Platform Improvement and Analytics

• Analyzing user behavior to improve website and app performance
• Optimizing game selection and betting markets based on popularity
• Testing new features and conducting A/B tests
• Generating aggregated, anonymized reports for business intelligence (no individual identification)

2.6 Marketing and Promotional Communications (With Your Consent)

• Sending promotional offers, bonus announcements, and VIP program updates via email or SMS (only if you have opted in)
• Personalizing marketing messages based on your gaming preferences
• Inviting you to participate in tournaments, leaderboard competitions, or special events

You can opt out of marketing communications at any time by clicking the "unsubscribe" link in any promotional email or by updating your communication preferences in your Account Settings. Opting out of marketing does not affect transactional emails (account notifications, withdrawal confirmations, security alerts), which are necessary for account operation.

3. Information Sharing and Disclosure

roma99 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share your data only in the following limited circumstances:

3.1 Service Providers and Business Partners

We engage trusted third-party service providers to support our operations. These providers have access to your personal information only to the extent necessary to perform their services and are contractually bound to protect your data:

• Payment Processors: Handle deposit and withdrawal transactions with Indonesian banks and e-wallets. They process your bank account number, transaction amounts, and payment metadata.
• KYC and Identity Verification Services: Third-party identity verification platforms that confirm your ID document authenticity and perform facial recognition matching.
• Game Studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Spribe, and other game providers receive limited session data (user ID, bet amounts, game outcomes) necessary to operate their games. They do not receive your name, email, or contact information.
• Customer Support Platform: Live chat and ticketing software providers that store customer support conversations to maintain service quality.
• Cloud Hosting and Data Storage: Secure cloud infrastructure providers (AWS, Google Cloud, or similar) that host our databases and application servers.
• Marketing and Communication Platforms: Email service providers (e.g., SendGrid, Mailchimp) and SMS gateways used to deliver transactional and promotional messages (if you have opted in).

3.2 Legal and Regulatory Authorities

We may disclose your personal information to government agencies, law enforcement, or regulatory bodies when:

• Required by Indonesian law, court order, subpoena, or regulatory investigation
• Necessary to comply with anti-money laundering (AML) or counter-terrorism financing (CTF) reporting obligations
• Requested by international law enforcement agencies through proper legal channels (mutual legal assistance treaties)
• Needed to protect roma99's legal rights, enforce our Terms and Conditions, or defend against legal claims

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or part of roma99's assets, your personal information may be transferred to the acquiring entity. You will be notified via email and/or prominent notice on the platform before your data is transferred and becomes subject to a different Privacy Policy.

3.4 Aggregated and Anonymized Data

roma99 may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. This includes statistical reports on user demographics, betting trends, popular game categories, and platform performance metrics. Anonymized data may be shared with business partners, industry analysts, or published publicly without restriction.

4. Data Security Measures

roma99 employs industry-leading security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction:

4.1 Encryption

• In Transit: All data transmitted between your device and roma99 servers is protected with 256-bit SSL/TLS encryption, the same standard used by banks.
• At Rest: All personal data stored in our databases is encrypted using AES-256 encryption. Encryption keys are rotated regularly and stored separately from the data they protect.
• Passwords: User passwords are hashed using bcrypt with per-user salts. roma99 staff cannot view or retrieve your password in plaintext.

4.2 Access Controls

• Personal data is accessible only to authorized roma99 personnel on a need-to-know basis
• All staff access is logged and audited regularly
• Multi-factor authentication (MFA) is required for all internal administrative systems
• Background checks are conducted on all employees with access to sensitive data

4.3 Infrastructure Security

• Web application firewall (WAF) to block malicious traffic and attacks
• DDoS protection to maintain platform availability during attacks
• Regular security vulnerability scanning and penetration testing by independent third parties
• Automated intrusion detection systems (IDS) to identify suspicious activity
• Secure software development practices including code review and security testing

4.4 Payment Security

• PCI-DSS Level 1 compliance for payment card processing
• Tokenization of payment card data — we never store full card numbers
• 3D Secure authentication for online card transactions
• Automated fraud detection algorithms monitoring transactions in real time

4.5 Data Breach Response

In the unlikely event of a data breach that compromises your personal information, roma99 will:

• Notify affected users via email within 72 hours of breach discovery
• Provide details about what data was compromised and what actions you should take
• Report the breach to relevant Indonesian regulatory authorities as required by law
• Conduct a full investigation and implement additional security measures to prevent future breaches

5. Data Retention

roma99 retains your personal information only as long as necessary to fulfill the purposes described in this Privacy Policy and to comply with legal obligations:

Data Category	Retention Period	Reason
Account Registration Data	Duration of account + 7 years	Legal compliance, dispute resolution
KYC Documents	Duration of account + 7 years	AML/CTF regulations, regulatory audits
Transaction History	Duration of account + 7 years	Financial audits, tax compliance, dispute resolution
Bet History	Duration of account + 5 years	Regulatory requirements, dispute resolution
Customer Support Conversations	3 years	Quality assurance, training, legal claims
Marketing Consent Records	Duration of consent + 3 years	Demonstrating compliance with consent requirements
Technical Logs (IP, Device)	12 months	Security monitoring, fraud prevention

After the retention period expires, personal data is securely deleted or anonymized such that it can no longer identify you. Anonymized data may be retained indefinitely for statistical and research purposes.

6. Your Privacy Rights

Under Indonesian data protection principles and international privacy standards, you have the following rights regarding your personal information:

6.1 Right to Access

You have the right to request a copy of all personal data roma99 holds about you. We will provide this information in a structured, commonly used, machine-readable format (e.g., JSON, CSV) within 30 days of your request.

6.2 Right to Rectification

If any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most information directly through your Account Settings, or contact customer support for assistance.

6.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data under certain circumstances, such as when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds

However, we may be legally required to retain certain data for specified periods (e.g., transaction records for 7 years under Indonesian financial regulations). In such cases, we will restrict processing to the minimum necessary for compliance.

6.4 Right to Data Portability

You have the right to receive your personal data in a portable format and transmit it to another service provider. We will provide data in JSON or CSV format upon request.

6.5 Right to Object

You have the right to object to processing of your personal data for direct marketing purposes at any time. You can opt out of marketing emails via the unsubscribe link or by updating your communication preferences. You may also object to other types of processing (e.g., profiling) on grounds relating to your particular situation.

6.6 Right to Restrict Processing

You may request that we temporarily restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing while we verify our legitimate grounds.

6.7 How to Exercise Your Rights

To exercise any of these rights, contact our Data Protection Officer:

• Email: [email protected] or [email protected]
• Subject Line: "Privacy Rights Request"
• Required Information: Your full name, registered email address, account username, and specific right you wish to exercise

We will respond to all legitimate requests within 30 days. For security purposes, we may ask you to verify your identity before processing your request (e.g., by confirming account details or providing a copy of your ID).

7. International Data Transfers

roma99 primarily stores and processes data within Indonesia. However, some of our service providers (cloud hosting, payment processors, game studios) may operate data centers outside Indonesia. When your data is transferred internationally, we ensure adequate protection through:

• Contractual data processing agreements that impose strict data protection obligations on service providers
• Standard contractual clauses (SCCs) approved by international data protection authorities
• Selection of service providers in jurisdictions with adequate data protection laws

By using roma99, you consent to such international transfers as necessary to provide our services. We will never transfer data to jurisdictions that do not provide adequate protection without additional safeguards.

8. Cookies and Tracking Technologies

roma99 uses cookies and similar technologies to enhance your experience, analyze platform usage, and deliver personalized content. A cookie is a small text file stored on your device that allows us to recognize you when you return.

8.1 Types of Cookies We Use

• Essential Cookies: Necessary for platform operation, including authentication, security, and load balancing. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language, currency, and display settings.
• Analytics Cookies: Collect aggregated data on how users interact with our platform to improve design and functionality.
• Marketing Cookies: Track your activity to deliver personalized promotions and measure campaign effectiveness. Used only if you have consented to marketing communications.

8.2 Managing Cookies

You can control cookie settings through your browser preferences. Disabling essential cookies may affect platform functionality. Most browsers allow you to:

• View and delete cookies
• Block all cookies
• Block third-party cookies only
• Receive notifications when cookies are set

9. Children's Privacy

roma99 services are strictly prohibited for individuals under 21 years of age. We do not knowingly collect personal information from minors. If we discover that a user is under 21, we will immediately:

• Suspend the account permanently
• Delete all personal information associated with the account
• Forfeit any remaining account balance
• Report the matter to relevant authorities if legally required

If you believe a minor has created an account on roma99, please contact us immediately at [email protected].

10. Changes to This Privacy Policy

roma99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. All changes will be effective immediately upon posting to the platform.

If we make material changes that significantly affect your privacy rights (e.g., new categories of data collection, new third-party sharing arrangements), we will notify you via:

• Email to your registered email address
• In-platform notification banner
• Prominent notice on the homepage

We encourage you to review this Privacy Policy periodically. Continued use of roma99 after changes have been posted constitutes acceptance of the updated policy.

11. Contact Our Data Protection Officer

If you have any questions, concerns, or complaints about this Privacy Policy or how roma99 handles your personal data, please contact our Data Protection Officer:

• Email: [email protected] or [email protected]
• Response Time: We aim to respond to all privacy inquiries within 5 business days

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with the Indonesian data protection authority or relevant supervisory body in your jurisdiction.