Privacy Policy — cun999

In this Privacy Policy, the following terms carry the meanings assigned below unless context requires otherwise:

cun999 collects the following categories of personal data in connection with your use of the platform:

cun999 does not collect sensitive personal data (such as biometric data, health records, religious affiliation, or political opinion) unless this is expressly contained in a document you submit for KYC purposes, in which case it is stored and handled under the same security protocols as all other KYC data and used solely for identity verification.

cun999 collects personal data through the following mechanisms:

• Direct submission: Information you provide when creating an account, completing KYC, making a deposit or withdrawal, contacting our support team, or submitting feedback.
• Automatic collection: Technical and Usage Data collected automatically via server logs, cookies, pixel tags, and similar tracking technologies each time you access the platform.
• Third-party sources: Identity verification data returned by our licensed KYC provider; fraud risk scores returned by our fraud-prevention partner; payment verification data from local bank and e-wallet gateways (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja).

Where data is collected from third-party sources, cun999 will only use data that the third party is contractually and legally authorised to share with us. We do not purchase consumer data lists or engage in unsolicited outreach based on data acquired from sources unrelated to your interaction with cun999.

cun999 processes your personal data only for specific, legitimate purposes. The table below sets out each processing purpose and the corresponding legal basis:

cun999 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following strictly defined circumstances:

• Payment processors: Financial data is shared with the relevant local payment gateway (e.g., BCA transfer service, OVO, DANA) solely to the extent necessary to process the specific transaction you have initiated.
• KYC and fraud-prevention providers: Identity and document data is shared with our contracted KYC verification partner and fraud-screening service to fulfil our legal obligations under our gaming licence. These providers are bound by strict data-processing agreements.
• Games suppliers: Where a game is provided by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), minimum necessary usage data (session token, bet amount, game outcome) is shared with that provider for game delivery and integrity monitoring purposes. No personally identifiable information beyond a pseudonymised player ID is shared with games suppliers.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so — for example, in connection with an anti-money-laundering investigation or a court order. In all such cases, cun999 will disclose only the minimum data required by the applicable order or obligation.
• Corporate transactions: In the event of a merger, acquisition, or sale of the Operator's assets, personal data held by cun999 may be transferred to the acquiring entity, provided that the acquiring entity agrees in writing to handle that data in accordance with a privacy policy no less protective than this one. Affected users will be notified of any such transfer.

All third parties with whom cun999 shares personal data are required to process that data only for the specified purpose, to maintain appropriate technical and organisational security measures, and to comply with applicable data protection law.

cun999 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, and in any event for no longer than is required by applicable law or our gaming licence conditions. The following retention periods apply as default:

• Account data and transaction history: Retained for a minimum of 5 years from the date of account closure, in line with standard AML record-keeping requirements applicable to licensed gaming operators.
• KYC documents: Retained for a minimum of 5 years from the date of verification. Expired or superseded KYC documents are securely deleted upon expiry of the retention period.
• Support communications: Retained for 3 years from the date of the last communication in a given thread, or until the underlying matter is conclusively resolved, whichever is later.
• Technical and usage data: Retained for 13 months in identified form for analytics and security purposes, after which it is aggregated or anonymised.
• Marketing consent records: Retained for the duration of the account plus 3 years after closure as evidence of the consent status at the time of any given communication.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Users who close their accounts may request confirmation of deletion within 30 days of the applicable retention period's end.

The security of your personal data is a foundational concern at cun999. We implement and maintain the following technical and organisational measures:

• 256-bit SSL/TLS encryption across all data in transit between your browser or device and the cun999 servers.
• Encryption at rest for all stored personal and financial data, using industry-standard encryption algorithms.
• Access controls: Personal data is accessible only to cun999 staff who require it for their specific job function. Role-based access controls are enforced, and all access is logged and auditable.
• Two-factor authentication (2FA) is available for all player accounts and is mandatory for internal staff accounts with access to personal data systems.
• Regular penetration testing conducted by independent third-party security firms on a scheduled basis.
• Intrusion detection systems and 24/7 security monitoring by our operations team.
• Incident response plan: In the event of a data breach that poses a risk to individual rights and freedoms, cun999 will notify affected users and the relevant supervisory authority within 72 hours of becoming aware of the breach, consistent with international best-practice standards.

cun999 uses cookies and similar technologies to operate the platform, maintain your session, remember your preferences, and gather aggregate analytics that help us improve the user experience. The following cookie categories are in use on cun999:

Most modern browsers allow you to manage, restrict, or delete cookies through your browser settings. Disabling strictly necessary cookies will prevent you from using the cun999 platform entirely. Disabling analytics or marketing cookies has no effect on your ability to place bets, play games, or manage your account.

Subject to applicable law and our legitimate operational obligations (including AML retention requirements), you hold the following rights in relation to the personal data that cun999 holds about you:

• Right of access: You may request a copy of all personal data we hold about you, along with information about how it is processed. cun999 will respond to access requests within 30 days.
• Right to rectification: If any personal data we hold is inaccurate or incomplete, you may request that it be corrected. You may update basic contact information directly through your account settings; for KYC data, please contact support.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and there is no overriding legitimate ground. Erasure requests will be assessed against our legal retention obligations — data we are required to retain by law (e.g., AML records) cannot be deleted before the mandated retention period expires.
• Right to restrict processing: You may request that we restrict the processing of your data in certain circumstances — for example, while a rectification request is being assessed.
• Right to data portability: For data you have provided to us under a consent or contract basis and that we process by automated means, you may request a copy in a commonly used machine-readable format.
• Right to object: You may object at any time to processing carried out on the basis of our legitimate interests, including any direct marketing on that basis. We will cease processing unless we can demonstrate compelling overriding grounds.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact our data support team at the email address listed in the Contact section of this policy. We will verify your identity before processing any data access, correction, or deletion request and will not charge a fee for reasonable requests.

The cun999 registration process includes a date-of-birth declaration, and all accounts are subject to age verification as part of KYC. Where the Operator has reason to believe that an account belongs to an individual under 21 years of age, that account will be immediately suspended, all transactions will be reviewed, and any deposits will be returned without processing. The Operator may refer the matter to relevant authorities where required by law.

If you are a parent or guardian and believe that a person under your care has registered on cun999 without authorisation, please contact our support team immediately at the contact details provided in this policy. We will act on credible reports as a priority.

cun999 operates as an international platform and, as a result, your personal data may be transferred to and processed in countries outside of Indonesia. These countries may include the Operator's licensing jurisdiction and the jurisdictions in which our games suppliers and technical infrastructure providers are located.

Wherever personal data is transferred outside of Indonesia, cun999 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to or exceeding the protections afforded under the Indonesian Personal Data Protection Law (UU PDP, Law No. 27 of 2022). These safeguards may include:

• Standard contractual clauses incorporated into data-processing agreements with third-party processors.
• Transfer to jurisdictions that maintain adequately protective data-processing frameworks recognised by the Operator's licensing authority.
• Binding operational rules within the Operator's corporate group.

You may request information about the specific transfer mechanisms applicable to your data by contacting our support team.

cun999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the structure of our platform. When material changes are made, we will display a prominent notice on the cun999 platform for a minimum of 14 days before the updated policy takes effect. The "Last updated" date at the top of this document will be revised accordingly.

Your continued use of cun999 after the effective date of any amendment constitutes your acknowledgement of the revised Privacy Policy. If you do not agree with any amendment, please stop using the platform and contact our support team to request account closure before the amendment takes effect.

For any question, request, or complaint relating to this Privacy Policy or the way in which cun999 handles your personal data, please reach out through the following channel. All data-related requests will be acknowledged within 24 hours and fully addressed within 30 days:

When submitting a data rights request, please include your registered account email address, your full name as it appears on your account, and a clear description of the right you wish to exercise or the concern you wish to raise. cun999 will verify your identity before acting on any request that involves access to, modification of, or deletion of personal data.