Privacy Policy

The following terms are used throughout this Privacy Policy with the meanings set out below.

sea789 collects only the Personal Data that is necessary to provide you with a safe, personalised, and compliant online gaming experience. The categories of data we collect are as follows:

2.1 Registration Data

When you create a sea789 account, we collect your full legal name, date of birth, email address, chosen username, and the password you set (stored as a one-way cryptographic hash — we never store your plain-text password). You may also provide a mobile phone number for two-factor authentication (2FA) via SMS OTP.

2.2 Identity Verification (KYC) Data

To comply with our AML and age-verification obligations, sea789 may request copies of government-issued identity documents — such as an Indonesian national ID card (KTP), driving licence (SIM), or passport — together with a proof-of-address document. Biometric selfie data may be requested by our third-party KYC provider solely for liveness-detection purposes and is not retained by sea789 beyond the verification process.

2.3 Financial Data

When you make a deposit or withdrawal, sea789 collects the payment account details you provide, including Indonesian bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja). sea789 does not store full card numbers or CVV codes on its own servers; card data is tokenised by our payment processor.

2.4 Transactional Data

We maintain records of all deposits, withdrawals, bets placed, games played, bonus claims, and account-balance changes. This transactional history is essential for dispute resolution, audit trail maintenance, and AML monitoring.

2.5 Technical and Device Data

When you access the Platform, our servers automatically collect your IP address, browser type and version, operating system, device type, screen resolution, referral URL, session timestamps, and pages visited. This data is collected via standard server logs and analytics tools.

2.6 Communication Data

If you contact sea789 support via live chat, email, or any other channel, we retain the content of those communications together with your username, the date and time of the interaction, and the outcome or resolution. This is used for quality assurance, staff training, and to maintain a record of commitments made to you.

2.7 Responsible Gaming Data

If you activate any responsible gaming tool — such as deposit limits, session time reminders, cooling-off periods, or self-exclusion — we record those elections and the dates on which they were made. This data is treated with heightened sensitivity and is used exclusively to enforce the protections you have requested.

sea789 collects Personal Data through the following channels:

• Directly from you: Registration forms, KYC document uploads, deposit and withdrawal requests, live chat conversations, email correspondence, and responsible gaming tool activations all involve you providing data to sea789 directly and knowingly.
• Automatically via the Platform: Server logs, session management systems, and analytics tools collect technical and device data passively as you navigate the Platform. Cookies and similar technologies record session state and browsing behaviour on the site.
• From third-party partners: KYC verification providers may return identity-match scores and document-validity flags to sea789. Payment processors confirm transaction status and may flag transactions for AML review. Fraud-prevention services may provide risk scores associated with your device or IP address.
• From publicly available sources: In limited circumstances related to fraud prevention and AML compliance, sea789 may cross-reference your data against publicly available sanctions lists, politically exposed persons (PEP) databases, and adverse media sources.

sea789 processes your Personal Data for the following specific and documented purposes:

sea789 processes your Personal Data on the following legal bases, depending on the purpose of the processing activity in question:

• Contractual necessity: Processing that is required to perform our contract with you — delivering gaming services, processing payments, and managing your account — is carried out on the basis that it is necessary for the performance of the agreement between you and sea789.
• Legal obligation: KYC identity verification, AML transaction monitoring, and cooperation with lawful authority requests are carried out because sea789 is legally required to do so under applicable international regulations.
• Legitimate interests: Fraud prevention, platform security, abuse detection, and internal analytics are carried out on the basis of sea789's legitimate interests in operating a safe, commercially viable platform, provided those interests do not override your fundamental rights.
• Consent: Marketing communications and the use of non-essential cookies are carried out only where you have given us your explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

sea789 does not sell, rent, or trade your Personal Data to any third party for their own commercial or marketing purposes. Data is shared only in the following limited, documented circumstances:

• Payment processors: Your bank account or e-wallet details and transaction amounts are shared with our payment processing partners (including the networks supporting BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) solely to execute the financial transaction you have requested.
• KYC verification providers: Identity document images and verification requests are transmitted to our contracted KYC service provider under a data processing agreement that prohibits any secondary use of your data by that provider.
• Fraud and AML screening services: Technical data (IP address, device fingerprint, transaction patterns) may be shared with fraud-prevention and AML screening tools to generate risk assessments. These providers act as data processors under binding contractual arrangements.
• Game studio providers: When you play a live casino game powered by Evolution Gaming or Pragmatic Play Live, a session token and your chosen display name may be transmitted to the studio's gaming servers. Game studios do not receive your financial data or full identity documents.
• Legal and regulatory authorities: sea789 will disclose Personal Data to law enforcement, regulatory bodies, or courts when required to do so by a lawful court order, subpoena, or applicable legal obligation. sea789 will, where legally permitted, notify you of any such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of sea789's business, your Personal Data may be transferred to the acquiring entity, which will be required to honour this Privacy Policy or provide you with a materially equivalent level of protection.

sea789 uses cookies and similar technologies on the Platform. The following table explains the categories of cookies we use and the purpose of each:

You may manage your cookie preferences at any time through your browser's settings. Please note that disabling cookies beyond the strictly necessary category may affect certain Platform features. Clearing all cookies will log you out of your current session.

sea789 retains your Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the duration of your account's active status plus a minimum of 5 years after account closure, to satisfy AML record-keeping requirements and to resolve any outstanding disputes or regulatory inquiries.
• KYC documents: Retained for a minimum of 5 years from the date of the last transaction on your account, in compliance with international AML standards. Documents are stored in encrypted form with access restricted to compliance personnel.
• Transaction records: All deposit, withdrawal, and wagering records are retained for a minimum of 5 years from the date of each transaction.
• Support communications: Live chat transcripts and email correspondence are retained for 2 years from the date of the interaction, after which they are anonymised or deleted unless retention is required for an ongoing dispute.
• Marketing consent records: Records of your consent to receive marketing communications — including the date, channel, and specific consent text presented — are retained for the duration of the consent period and for 3 years thereafter.
• Technical logs: Server access logs are retained for 90 days for security monitoring purposes and then deleted unless a specific security investigation requires extended retention.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Sea789 conducts periodic data audits to ensure retention schedules are being applied consistently.

sea789 implements industry-standard technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• TLS Encryption: All data transmitted between your browser or device and sea789's servers is encrypted using TLS 1.2 or higher. This includes login credentials, payment details, and account management actions.
• At-Rest Encryption: Sensitive data stored in sea789's databases — including KYC documents, payment account details, and password hashes — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted to sea789 employees and contractors who have a demonstrable need to process that data in the course of their role. Access is managed via role-based permission systems and reviewed quarterly.
• Two-Factor Authentication: sea789 strongly recommends that all Members enable 2FA on their accounts via SMS OTP. Internal staff accessing member data systems are required to authenticate with 2FA.
• Intrusion Detection: sea789's infrastructure is monitored 24/7 by automated intrusion detection and anomaly alerting systems. Security incidents are escalated and responded to in accordance with our documented incident response procedure.
• Data Breach Notification: In the event of a personal data breach that poses a risk to your rights and freedoms, sea789 will notify affected Members without undue delay, and no later than 72 hours after becoming aware of the breach, where technically and legally feasible.

As a Member of sea789, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact our Data Protection team via live chat or at support@sea789.app. Requests are acknowledged within 72 hours and fulfilled within 30 days unless complexity requires an extension.

• Right of Access: You may request a copy of all Personal Data that sea789 holds about you, together with information about how it is being processed. We will provide this in a structured, machine-readable format where technically feasible.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor updates (such as a phone number change) can be made directly from your account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and we have no overriding legitimate grounds. Note that legal retention obligations (such as AML record-keeping) may prevent complete erasure in some cases.
• Right to Restriction: In certain circumstances — such as where you contest the accuracy of data or have objected to processing pending a determination of our legitimate grounds — you may request that we restrict processing to storage only.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You may object at any time to processing carried out on the basis of legitimate interests, including profiling. You may also object to direct marketing communications at any time by using the unsubscribe link in any marketing email or by contacting support.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

sea789 operates a strict 21+ policy. The Platform is not intended for, and must not be accessed by, any person under the age of 21. sea789 does not knowingly collect Personal Data from anyone under 21 years of age.

If sea789 discovers or has reason to believe that a Member is under 21, the account will be immediately suspended, all Personal Data associated with it will be reviewed, and any funds will be held pending investigation. If the age violation is confirmed, the account will be permanently closed and the funds may be forfeited in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a person under your care has registered a sea789 account, please contact us immediately at support@sea789.app so that we can take appropriate action.

sea789 operates as an international online gaming platform and as such, your Personal Data may be transferred to and processed in countries outside Indonesia. Such transfers may occur when:

• Our KYC verification provider processes your identity documents on servers located outside Indonesia.
• Live casino game sessions are processed on Evolution Gaming or Pragmatic Play Live servers, which may be hosted in the European Union or other jurisdictions.
• Our cloud infrastructure provider replicates data to geographically distributed data centres for disaster recovery and high-availability purposes.

Where Personal Data is transferred internationally, sea789 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under applicable data protection principles. These safeguards include binding contractual clauses with data processors and, where applicable, transfers to jurisdictions that maintain adequate data protection standards.

sea789 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify you by posting a prominent notice on the Platform and, where we hold a valid email address for you, by sending a notification to that address at least 7 days before the changes take effect.

The "Last Updated" date at the top of this page indicates when the current version was published. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated policy. We encourage you to review this Privacy Policy periodically to stay informed about how your data is being protected.

For any questions, concerns, or requests related to this Privacy Policy or the processing of your Personal Data, please reach out to the sea789 Data Protection team through the following channels:

• Live Chat: Available 24/7 within the sea789 Platform. Select "Privacy / Data Request" from the support menu for priority routing to our data protection team. Indonesian-speaking agents are available during WIB business hours (08:00–22:00 WIB).
• Email: support@sea789.app — please use the subject line "Privacy Policy Query" or "Data Subject Request" to ensure prompt handling. Responses are provided within 72 hours of receipt.
• Data Subject Requests: When submitting a data subject request (access, rectification, erasure, portability, or objection), please include your registered username and a clear description of the specific right you wish to exercise. We may request identity verification before fulfilling the request to protect against fraudulent access to third-party data.