Privacy Policy — turu99

1. Introduction & Scope

This Privacy Policy applies to all personal data collected, processed, and stored by turu99 (referred to as "turu99," "we," "us," or "our") in connection with the turu99 platform, accessible at https://turu99.cam, and any associated mobile applications or services.

turu99 is committed to protecting the privacy and personal data of all users, including registered players, prospective registrants, and visitors who interact with the turu99 website without creating an account. This policy is designed to be clear, complete, and straightforward — we want you to understand exactly what happens with your data, without having to parse impenetrable legal language.

By accessing the turu99 Platform or creating an Account, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with any part of this policy, you should not use the turu99 Platform.

This Privacy Policy should be read alongside turu99's Terms & Conditions and Responsible Gaming Policy, all of which together constitute the full framework governing your relationship with the turu99 Platform.

2. Definitions

In this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" — any information relating to an identified or identifiable natural person. This includes your name, email address, date of birth, national identity number, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, modification, retrieval, use, disclosure, transmission, deletion, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For data processed in connection with the turu99 Platform, turu99 is the Data Controller.
• "Data Processor" — a third party that processes Personal Data on behalf of turu99, under contractual obligations and turu99's instructions.
• "Consent" — a freely given, specific, informed, and unambiguous indication by the data subject of their agreement to the processing of their Personal Data.
• "KYC Data" — identity verification documents and associated personal information submitted by a Player in fulfilment of turu99's Know Your Customer obligations.
• "Cookies" — small text files placed on your device by the turu99 Platform to support functionality, performance analysis, and where consented to, behavioral profiling.
• "Platform" — the turu99 website at https://turu99.cam and all associated pages, subdomains, and applications.

3. Data We Collect

turu99 collects Personal Data through multiple channels. The categories of data collected, and the specific data points within each category, are detailed in the table below.

turu99 does not knowingly collect Sensitive Personal Data (such as racial or ethnic origin, religious beliefs, or health information) except where specifically required by regulatory or responsible gaming obligations — for example, collecting information about a player's problem gambling history in connection with a self-exclusion request.

4. How We Use Your Data

turu99 uses Personal Data collected from Players and Platform users for the following purposes:

• Account Administration: Creating, maintaining, and securing your turu99 Account; processing registration; facilitating login and session management.
• Identity Verification (KYC): Verifying your identity and age in compliance with our licensing authority's requirements and applicable anti-money laundering (AML) obligations.
• Transaction Processing: Processing deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, and others) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja); reconciling payment records; investigating and resolving payment disputes.
• Platform Delivery: Serving game content, sports betting markets, live casino streams, and all other platform features to your device; maintaining and improving platform performance and reliability.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, bonus abuse, multi-accounting, money laundering, and other prohibited activities as defined in the turu99 Terms & Conditions.
• Responsible Gaming: Monitoring account activity for patterns consistent with problem gambling; applying self-exclusion orders, deposit limits, cooling-off periods, and other responsible gaming controls requested by the Player or mandated by our licensing obligations.
• Customer Support: Responding to support queries, investigating complaints, and improving our customer service quality based on interaction records.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to Players who have opted in to receive such communications. Players may withdraw marketing consent at any time via account settings.
• Legal Compliance: Fulfilling obligations under applicable laws and regulations, responding to lawful requests from regulatory authorities, and maintaining records as required by our licensing framework.
• Analytics & Product Development: Aggregated, anonymized analysis of platform usage patterns to inform product improvements, new feature development, and market strategy. No individually identifiable data is used for these analytics.

5. Legal Basis for Processing

turu99 processes Personal Data only where a valid legal basis exists. The legal bases on which turu99 relies are as follows:

• Contract Performance: Processing necessary to perform the contract between you and turu99 — including account registration, transaction processing, and platform service delivery. This is the primary legal basis for most data processing activities on the turu99 Platform.
• Legal Obligation: Processing required to comply with turu99's legal and regulatory obligations, including KYC verification, AML monitoring, data retention requirements, and responses to lawful regulatory requests.
• Legitimate Interests: Processing for purposes that serve turu99's legitimate business interests, where those interests are not overridden by your rights — including fraud detection, platform security, network monitoring, and aggregated product analytics.
• Consent: Processing based on your explicit consent, specifically for the receipt of direct marketing communications. You may withdraw consent for marketing communications at any time without affecting your account or the lawfulness of prior processing.

6. Third-Party Data Sharing

turu99 does not sell, rent, or trade your Personal Data to any third party. Data is shared externally only in the following strictly defined circumstances:

• Payment Processors: Financial transaction data is shared with the Indonesian banks and e-wallet providers (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) necessary to process your deposit and withdrawal instructions. Data is shared to the minimum extent required to complete the transaction.
• KYC / Identity Verification Providers: Identity documents and verification data are processed by turu99's contracted KYC verification service provider(s). All such providers are contractually bound to process data solely for verification purposes and to meet security standards consistent with this policy.
• Fraud Detection & AML Services: Transaction and account activity data may be shared with third-party fraud prevention and anti-money laundering service providers. These services help turu99 identify and act on suspicious activity in real time.
• Game Software Providers: Game session data and, where technically necessary, limited account identifiers may be shared with turu99's licensed game software suppliers (including Pragmatic Play, Evolution Gaming, Spribe, and similar providers) to facilitate game delivery, resolve in-game disputes, and ensure RNG integrity.
• Licensing Authority: turu99's regulatory licensing authority has the right to request player data as part of its regulatory oversight function. turu99 will comply with all such lawful requests.
• Law Enforcement and Legal Proceedings: Personal Data may be disclosed to law enforcement agencies, courts, or regulators where turu99 is required to do so by applicable law, or where disclosure is necessary to protect the legal rights of turu99 or its users.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of turu99's assets, Personal Data held by turu99 may be transferred to the acquiring entity. Players will be notified via email if their data is to be transferred to a new controller as a result of such a transaction.

7. International Data Transfers

turu99's platform infrastructure and some of its third-party service providers operate in jurisdictions outside Indonesia. As a result, your Personal Data may be transferred to, stored in, and processed in countries other than Indonesia, including countries within the European Economic Area (EEA), Singapore, Malta, or other jurisdictions where turu99 or its processors maintain data centers or operational offices.

Where Personal Data is transferred outside Indonesia, turu99 ensures that appropriate safeguards are in place to protect your data to a standard consistent with this Privacy Policy. These safeguards may include:

• Transfers to jurisdictions with an adequacy determination or equivalent legal framework recognized by applicable Indonesian data protection standards.
• Standard contractual clauses binding the recipient to process data securely and in accordance with applicable data protection principles.
• Binding corporate rules applicable within turu99's corporate group, where relevant.

You may request further information about the specific safeguards in place for any international data transfer by contacting turu99's data protection contact at the address set out in Section 14.

8. Data Retention

turu99 retains Personal Data for as long as is necessary for the purpose for which it was collected, subject to any applicable legal minimum retention obligations. The following retention schedule applies as a general guide:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with any individual.

9. Cookies & Tracking Technologies

turu99 uses cookies and similar tracking technologies on its Platform to support the following functions:

• Strictly Necessary Cookies: These are essential for the Platform to function. They manage your login session, maintain your account state, enforce security controls, and enable core platform features. These cookies cannot be disabled without fundamentally impairing your ability to use the turu99 Platform.
• Functional Cookies: These remember your preferences — including language settings, preferred game lobby view, and notification settings — to provide a more personalized experience on return visits.
• Analytics Cookies: These collect aggregated, anonymized data about how visitors use the turu99 Platform, including which pages are visited most frequently, how long sessions last, and which features are used. This data informs platform improvements and does not identify you personally.
• Security Cookies: Used to detect and prevent fraud, bot activity, and other unauthorized access attempts. These are classified as strictly necessary due to their security function.

turu99 does not use third-party advertising or behavioral tracking cookies on its Platform. You will not be tracked across other websites for advertising retargeting purposes based on your activity on turu99.

10. Data Security

turu99 implements a comprehensive, layered security architecture to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. Security measures in place include:

• Encryption in Transit: All data transmitted between your browser or application and turu99's servers is encrypted using TLS 1.2 or higher, with 256-bit SSL certificates issued by a trusted certificate authority. The padlock icon in your browser confirms an active encrypted connection.
• Encryption at Rest: Sensitive Personal Data fields — including passwords (stored as salted hashes), financial account identifiers, and identity document data — are encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. turu99 staff members can only access the data categories necessary for their specific role. All data access is logged and subject to regular audit.
• Two-Factor Authentication: All administrative systems handling Personal Data require two-factor authentication for staff access. turu99 also offers 2FA to Players for their own Account security.
• Network Security: turu99's infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and regular third-party penetration testing.
• Vulnerability Management: turu99 conducts regular security audits, vulnerability scans, and penetration tests to identify and remediate potential weaknesses before they can be exploited.

Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. turu99 cannot guarantee the absolute security of data transmitted to or from the Platform, and you acknowledge that you transmit data at your own risk. In the event of a security breach affecting your Personal Data, turu99 will notify you and the relevant regulatory authority promptly and in accordance with applicable legal requirements.

11. Your Data Rights

As a turu99 Platform user, you hold the following rights in respect of your Personal Data. These rights may be exercised by submitting a written request to turu99's data contact as described in Section 14:

turu99 will respond to all valid data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, in which case you will be notified of the extension and the reason for it. Where turu99 is unable to fulfil a request — for example because legal retention obligations prevent erasure — the reason will be clearly explained in writing.

12. Children's Privacy

The turu99 Platform is strictly for adults aged 21 and above. turu99 does not knowingly collect Personal Data from any person under the age of 21. Registration requires submission of government-issued identification to verify age compliance.

If turu99 becomes aware that Personal Data has been collected from a person under 21 — whether through a registration bypass, identity fraud, or any other means — turu99 will immediately suspend the relevant Account, delete all associated data to the extent permitted by law, and report the incident to the relevant regulatory authority where required.

Parents or guardians who believe a minor may have registered on the turu99 Platform should contact our support team immediately at [email protected]. We take these reports seriously and will act swiftly to investigate and remediate.

13. Changes to This Privacy Policy

turu99 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. All changes will be published on this page with an updated "Last Updated" date.

Where changes are material — meaning they significantly affect how we collect or use your Personal Data, or the rights available to you — turu99 will provide advance notice via email to your registered address, or via a prominent notification within the turu99 Platform, at least 14 days before the change takes effect.

Your continued use of the turu99 Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree with the revised policy, please discontinue use of the Platform and contact our support team to discuss Account closure and data handling options.

14. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a data protection concern, please contact turu99 using the details below. The email address is provided as plain text only and is not a clickable link.

If you are dissatisfied with turu99's response to a privacy concern or data rights request, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. turu99 will cooperate fully with any such authority in the resolution of your complaint.

For all other platform-related queries — including account questions, payment issues, and responsible gaming support — please visit our FAQ page or contact the turu99 customer support team via live chat, available 24 hours a day, 7 days a week.