Privacy Policy — sm188

sm188 is Indonesia's premier online gaming platform, offering sports betting, live casino, slots, poker, and video poker to members across Jakarta, Surabaya, Medan, Bandung, Bali, and beyond. As a platform that processes financial transactions and verifies member identities, sm188 necessarily handles personal data — and we take that responsibility seriously.

This Privacy Policy ("Policy") sets out in clear, accessible terms: what categories of personal data we collect; the purposes for which that data is used; the legal bases on which processing rests; how long we retain data; the circumstances in which data may be shared with third parties; the security measures we apply; and the rights available to every sm188 member with respect to their personal information.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming page, both of which contain additional provisions relevant to your use of the Platform.

sm188 is committed to maintaining the highest practicable standards of data privacy and security. We review this Policy at least annually and update it whenever our data practices change in a material way. The effective date of the current version is noted at the top of this document.

The following defined terms are used throughout this Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or indirectly — including name, email address, date of birth, Indonesian national identity number (NIK), IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Member" means any registered user who holds an active sm188 account.
• "Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, sm188.
• "Processor" means a third party that processes Personal Data on behalf of sm188 under a contractual data-processing agreement (e.g., a payment gateway or identity verification provider).
• "KYC" means Know Your Customer — the identity and age verification process applied by sm188 in accordance with our compliance obligations.
• "Sensitive Data" means a subset of Personal Data that warrants additional protection, including government-issued identity document numbers, financial account credentials, and any health information provided in the context of responsible gaming self-exclusion requests.
• "Cookies" means small text files placed on your device by the Platform, used to maintain session state, remember preferences, and collect anonymised usage analytics.

sm188 collects Personal Data across several categories, depending on how you interact with the Platform. The table below summarises what we collect and why:

sm188 collects Personal Data through the following channels:

4.1 Directly from You. The majority of Personal Data we hold is provided directly by you during the account registration process, when completing a KYC submission, when making a deposit or withdrawal request, when contacting our support team via live chat or email, and when configuring responsible gaming settings on your account dashboard.

4.2 Automatically via the Platform. When you access sm188, our servers and analytics systems automatically collect Technical Data and Usage Data. This includes your IP address (which may indicate your approximate geographic location within Indonesia), device and browser identifiers, the pages and game sections you navigate, timestamps of activity, and session duration. This data is collected using server logs, Cookies, and similar tracking technologies (see Section 8).

4.3 From Third-Party Processors. Where you make a deposit or withdrawal via a third-party payment processor (such as a bank virtual account gateway or e-wallet provider), that processor may transmit to sm188 a transaction confirmation reference and the name associated with the payment instrument. sm188 does not receive full account credentials from payment processors.

4.4 From Identity Verification Partners. Where sm188 engages a third-party identity verification service to assist with KYC document review, that service provider processes the documents you submit and returns a verification outcome to sm188. The identity verification partner is bound by strict data-processing agreements and is not permitted to use your data for any purpose other than the specific verification task.

4.5 From Publicly Available Sources. In connection with fraud prevention and responsible gaming compliance, sm188 may cross-reference publicly available information — such as self-exclusion registers maintained by international gaming regulators — against submitted member data. sm188 does not profile members using social media data.

sm188 processes Personal Data on the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between sm188 and the Member — including account creation, processing deposits and withdrawals, settling bets, and providing customer support. Without this processing, sm188 cannot deliver the agreed services.
• Legal Obligation: Processing required to comply with applicable international gaming regulations, anti-money laundering (AML) requirements, and Know Your Customer (KYC) obligations under sm188's international operating licence. This includes retention of transaction records and identity verification documents for defined regulatory periods.
• Legitimate Interests: Processing carried out for sm188's legitimate business interests, provided those interests are not overridden by the Member's rights. This includes fraud detection and prevention, security monitoring, platform analytics, responsible gaming monitoring (including automated detection of problem gambling indicators), and defence of legal claims. sm188 has conducted legitimate interest assessments for each processing activity in this category.
• Consent: Where sm188 relies on consent as the legal basis for a specific processing activity — for example, sending optional marketing communications — that consent will be sought explicitly and separately, and may be withdrawn at any time without affecting the legality of processing carried out before withdrawal. Note that withdrawal of marketing consent does not affect your account or your ability to use the Platform.

sm188 uses collected Personal Data for the following purposes. We do not use your data for any purpose incompatible with these stated uses without first obtaining your explicit consent or establishing a separate legal basis:

6.1 Account Management. To create, maintain, and administer your sm188 account; to verify your identity and age (21+) at registration and during KYC reviews; to authenticate your login sessions; and to apply account-level settings including responsible gaming limits you have configured.

6.2 Payment Processing. To receive and credit deposits from your nominated Indonesian bank accounts or e-wallets (BCA, BRI, BNI, Mandiri, CIMB Niaga, DANA, OVO, GoPay, ShopeePay, LinkAja); to verify payment method ownership; and to process withdrawal requests to your verified payment method in IDR.

6.3 Game and Betting Services. To record and settle wagers placed across the sportsbook (covering BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, and other markets), live casino tables, slot games, poker tables, and video poker variants; to manage your real-money and bonus fund balances; and to generate transaction histories accessible from your account dashboard.

6.4 Security and Fraud Prevention. To monitor account activity for signs of fraud, collusion, multi-accounting, bonus abuse, and money laundering; to verify that deposits originate from payment methods registered in the Member's own name; and to investigate and respond to reported security incidents.

6.5 Responsible Gaming. To enforce deposit limits, loss limits, session time-out preferences, cooling-off periods, and self-exclusion orders that you have applied to your account; to monitor usage patterns for indicators of problem gambling behaviour; and to contact you proactively if our responsible gaming systems flag a concern under our duty-of-care obligations.

6.6 Customer Support. To receive, investigate, and respond to support requests submitted via live chat or email; to resolve payment disputes and game-outcome queries; and to retain communication records for quality assurance and dispute resolution purposes.

6.7 Legal and Regulatory Compliance. To meet our obligations under sm188's international operating licence, including the preparation and submission of reports required by regulatory authorities; to respond to lawful data requests from competent authorities; and to retain transaction and identity records for mandatory regulatory retention periods.

6.8 Platform Improvement. To analyse aggregate, anonymised usage patterns to improve the Platform's interface, game selection, payment flows, and support quality; and to test new features before broad release. Analytics used for this purpose are processed in aggregated or pseudonymised form and do not single out individual members.

6.9 Marketing Communications (Consent-Based Only). Where you have opted in to receive marketing communications, to send you notifications about promotions relevant to your gaming preferences — such as reload bonuses during Idul Fitri, Ramadhan cashback offers, or Champions League enhanced odds events. You may unsubscribe from marketing communications at any time via the link in any marketing email or by contacting support.

sm188 does not sell, rent, or trade your Personal Data. We share data only in the following defined circumstances:

7.1 Payment Processors. We share the minimum necessary financial data with Indonesian banking partners and e-wallet platforms (DANA, OVO, GoPay, ShopeePay, LinkAja) strictly to execute deposit and withdrawal transactions. These providers act as independent data controllers for their own platform operations and are subject to their own privacy policies.

7.2 Identity Verification Providers. Where a third-party KYC verification service is engaged, we transmit the identity documents you submit directly to that provider for verification processing. The provider is contractually prohibited from using your documents for any unrelated purpose.

7.3 Game Technology Providers. Game studios and technology partners (including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, and Spribe) may receive anonymised session tokens necessary to render game content within the Platform. These providers do not receive your full personal profile.

7.4 Legal and Regulatory Authorities. sm188 may disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where required by law, court order, or the conditions of sm188's international operating licence. Where permitted by law, we will notify affected Members of such disclosures.

7.5 Business Transfers. In the event of a merger, acquisition, or sale of all or a substantial part of sm188's assets, Personal Data held by sm188 may be transferred to the acquiring entity. Affected Members will be notified of any change of data controller and provided with the opportunity to request deletion of their data before the transfer, where operationally practicable.

7.6 Fraud Prevention Networks. sm188 participates in industry-standard fraud prevention networks and may share pseudonymised fraud signals (such as device fingerprints associated with confirmed fraudulent activity) with other gaming operators for the purpose of protecting the industry's integrity. No Personal Data identifying individual members is shared in this context without a specific legal basis.

sm188 uses Cookies and similar client-side technologies to operate the Platform effectively and to improve the member experience. The categories of Cookies we use are described below:

8.1 No Third-Party Advertising Cookies. sm188 does not deploy third-party advertising cookies or cross-site tracking pixels. We do not participate in behavioural advertising networks or retargeting programmes that would place advertising trackers on your device for use on other websites.

8.2 Managing Cookies. You may manage Cookie preferences through your browser settings. Blocking essential Cookies will impair or prevent your ability to log in and use the Platform. Blocking analytics or functional Cookies will not prevent you from using core Platform features, but may result in a less personalised experience. Browser-level Cookie controls are described in the help documentation of your browser provider.

sm188 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable regulatory obligations. The following retention schedules apply:

• Active Account Data: Retained for the full duration of your membership and for a period of five (5) years following permanent account closure, in accordance with standard international gaming regulatory requirements for transaction and identity record-keeping.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, to satisfy anti-money laundering record-keeping obligations.
• Financial Transaction Records: All deposit, withdrawal, and wagering transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Support Communications: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction, or for the duration of any related open dispute, whichever is longer.
• Marketing Consent Records: Records of your consent to receive marketing communications are retained for the duration of your membership and for two (2) years following withdrawal of consent, to provide an audit trail of lawful processing.
• Technical / Log Data: Server log and access log data is retained for a maximum of 12 months from the date of generation, unless a specific security investigation requires retention for a longer period.
• Anonymised Analytics Data: Aggregate anonymised usage data (from which no individual can be identified) may be retained indefinitely for historical platform performance analysis.

When Personal Data reaches the end of its applicable retention period, it is securely deleted or anonymised using processes that prevent reconstruction of the original data.

sm188 implements a layered security architecture designed to protect Personal Data against unauthorised access, accidental loss, alteration, and unlawful disclosure. Key security measures include:

• Transport Layer Security: All data transmitted between your device and sm188's servers is encrypted using TLS 1.2 or higher (256-bit SSL certificates). This applies to login sessions, payment flows, KYC document uploads, and live chat communications.
• Access Control: Internal access to Personal Data is restricted on a strict need-to-know basis using role-based access control (RBAC). Employees and contractors with authorised data access are bound by confidentiality obligations and undergo regular security awareness training.
• Database Encryption: Personal Data held in sm188's databases — including KYC documents, financial account details, and account credentials — is stored in encrypted form. Encryption keys are managed separately from the encrypted data stores they protect.
• Multi-Factor Authentication: Administrative access to systems containing Personal Data requires multi-factor authentication (MFA). Members are also strongly encouraged to enable MFA on their own sm188 accounts for additional login security.
• Vulnerability Management: sm188 conducts regular security assessments, including penetration testing by qualified third-party security firms. Critical and high-severity vulnerabilities are remediated on a priority basis following responsible disclosure protocols.
• Incident Response: sm188 maintains a documented data breach incident response plan. In the event of a confirmed breach that poses a risk to Member rights, sm188 will notify affected Members and relevant regulatory authorities within the timeframes required by applicable standards.

As a Member of sm188, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and a description of your request:

11.1 Right of Access. You have the right to request confirmation of whether sm188 holds Personal Data about you, and to receive a copy of that data together with information about how it is being used. We will respond to access requests within 30 days of receipt.

11.2 Right to Rectification. If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For name and date of birth corrections, supporting documentation consistent with your KYC record will be required.

11.3 Right to Erasure. You may request deletion of your Personal Data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent and no other legal basis applies; or processing is unlawful. Note that erasure requests cannot be fulfilled in relation to data that sm188 is legally required to retain under its regulatory obligations (see Section 9).

11.4 Right to Restriction of Processing. You may request that sm188 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data you have contested is being verified, or where you have objected to processing and a determination of competing interests is pending.

11.5 Right to Data Portability. You may request a copy of Personal Data you have provided to sm188 in a structured, commonly used, machine-readable format (CSV or JSON), suitable for transmission to another service provider, where the processing is based on your consent or on contractual necessity and is carried out by automated means.

11.6 Right to Object. You have the right to object to processing of your Personal Data where that processing is based on sm188's legitimate interests. sm188 will cease the processing unless it can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

11.7 Right to Withdraw Consent. Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without detriment to your account status or access to Platform services. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal.

sm188 is strictly an adults-only platform. Access to and use of the Platform is limited to individuals who are at least 21 years of age. sm188 does not knowingly collect Personal Data from individuals under the age of 21.

Age verification is applied during the account registration process and may be reinforced through KYC document checks at any subsequent stage. Where sm188 becomes aware that Personal Data has been collected from a person under 21, that data will be permanently deleted, the associated account will be closed immediately, and any funds — including any apparent winnings — will be forfeited.

If you are a parent or guardian and believe that a minor in your care has registered an account on sm188, please contact us immediately at [email protected] with the subject line "Underage Account — Urgent". We will investigate and act on all such reports as a priority matter.

sm188 strongly encourages parents and guardians to use parental control and internet filtering software to prevent minors from accessing online gambling websites. A number of free-to-use parental control tools are available for this purpose and can be applied at the router or device level.

13.1 Game Providers. Games available on sm188 are powered by third-party studios including Pragmatic Play, Evolution Gaming, PG Soft (Pocket Games Soft), NetEnt, Microgaming, and Spribe. When you play a third-party game, the game client may be served from the provider's own infrastructure. These providers may collect limited technical data (such as session identifiers) necessary to render the game. sm188 selects game providers that operate under internationally recognised regulatory frameworks and that have committed to appropriate data protection standards.

13.2 Payment Partners. When you make a deposit or withdrawal via a bank transfer gateway or an e-wallet platform (DANA, OVO, GoPay, ShopeePay, LinkAja), you are interacting with that payment provider's own systems. Those providers operate under their own privacy policies, which govern the data they collect in connection with your transactions. sm188 recommends that you review the privacy policies of your payment provider before transacting.

13.3 No External Links. The sm188 platform does not contain links to third-party websites or services outside of those necessary to deliver Platform functionality. This Policy applies solely to data processed by sm188 in connection with the Platform at sm188.one.

14.1 Right to Update. sm188 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable regulatory standards. The most current version of this Policy will always be published at sm188.one/privacy-policy, with the effective date clearly noted at the top of the document.

14.2 Notification of Material Changes. Where a proposed amendment is material — for example, introducing a new category of data collection, changing the purposes for which existing data is used, or adding a new category of third-party data recipient — sm188 will notify registered Members by email to the address on file at least 14 days before the change takes effect.

14.3 Continued Use as Acceptance. Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must stop using the Platform and may request account closure and data deletion before the effective date of the changes.

For all privacy-related enquiries, rights requests, or data protection concerns, please contact sm188 through the following channels:

• Email: [email protected] — use the subject line "Privacy Rights Request" for formal data rights submissions
• Live Chat: Available 24/7 on the Platform — our Indonesian-speaking support agents can assist with general privacy queries and can escalate formal requests to our data protection team

When submitting a privacy rights request, please include your registered email address and, where applicable, your Account ID to enable efficient processing. sm188 may need to verify your identity before actioning a data access, rectification, or erasure request — this is a security measure to ensure we do not disclose or delete data in response to an unauthorised request.