Privacy Policy

Introduction

sm650 operates an online casino and sportsbook platform accessible at https://sm650.onl, providing services including live casino games, slot gacor (high-performing slot games), sports betting — including football markets referred to locally as bandar bola — online poker, baccarat, and togel (Indonesia's traditional numbers lottery) draws, among other entertainment products.

In delivering these services, sm650 necessarily collects and processes personal data relating to its members. This Privacy Policy is designed to be transparent about those data practices, helping you make an informed decision about using the sm650 platform. We take our obligations as a data processor seriously and maintain data governance standards aligned with internationally recognized best practices.

This policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which contain additional provisions relevant to your account and your personal data.

Data Controller

For the purposes of this Privacy Policy, sm650 acts as the data controller — the entity that determines the purposes and means of processing your personal data. sm650 is an internationally licensed online gaming operator. Enquiries relating to the processing of your personal data may be directed to our support team as detailed in Section 16 of this policy.

Where sm 650 engages third-party service providers — such as game studios, payment processors, or fraud prevention vendors — those providers act as data processors operating under contractual obligations that require them to handle your data only as directed by sm650 and in accordance with applicable data protection standards.

Data We Collect

sm650 collects only the personal data that is necessary to provide our services, comply with legal obligations, and maintain platform security. The categories of personal data we collect include:

sm650 does not collect sensitive personal data categories — such as racial or ethnic origin, political opinions, religious beliefs, or health data — except where voluntarily disclosed by a member in the context of a responsible gaming self-disclosure or a legally mandated KYC requirement.

How We Collect Data

sm650 collects personal data through the following channels:

• Direct Submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting our support team, or participating in a promotion.
• Automated Collection: Technical and usage data collected automatically when you access and interact with the sm650 platform, including via cookies and similar tracking technologies (see Section 11).
• Third-Party Sources: Identity and fraud-screening data received from KYC verification partners, payment processors (e.g., bank transaction confirmation data from BCA, BRI, Mandiri), and anti-money laundering (AML) screening databases.
• Publicly Available Sources: Where permitted and relevant to fraud prevention or AML compliance, information from public records or regulatory watchlists.

How We Use Your Data

sm650 processes your personal data for the following purposes. Each purpose is matched to a legal basis described in Section 6:

• Account Management: Creating, maintaining, and managing your sm650 member account, including processing login requests, password resets, and account settings changes.
• Payment Processing: Facilitating deposits and withdrawals in IDR/Rp through approved payment channels including Indonesian bank transfers and e-wallets. Verifying that payment method ownership matches account identity.
• KYC & AML Compliance: Verifying your identity and age (21+) in compliance with our licensing obligations and applicable international anti-money laundering standards. Screening transactions for suspicious activity and filing reports where legally required.
• Platform Security: Detecting and preventing fraudulent access, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions. Monitoring IP addresses and device fingerprints to identify suspicious login patterns.
• Service Delivery: Providing access to our full game portfolio — including slots from Pragmatic Play, NetEnt, and Microgaming; live casino from Evolution Gaming; sportsbook markets; and crash games from Spribe — in a stable, personalized experience.
• Responsible Gaming: Monitoring usage patterns to identify potential indicators of problem gambling and proactively offering responsible gaming tools. Processing self-exclusion and deposit limit requests entered by members via Account Settings.
• Customer Support: Responding to queries, resolving disputes, and maintaining records of communications for quality assurance purposes.
• Marketing Communications: Sending promotional offers, bonus notifications, and relevant product updates to members who have opted in to marketing communications. You may opt out at any time via your Account Settings or by contacting support.
• Legal Compliance: Meeting reporting obligations to licensing authorities, responding to lawful requests from competent authorities, and enforcing our Terms & Conditions.

Legal Basis for Processing

sm650 processes your personal data on one or more of the following legal bases, consistent with internationally recognized data protection principles:

• Contractual Necessity: Processing required to fulfill our contractual obligations to you as a registered member — including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws, our licensing conditions, AML regulations, and lawful authority requests — including mandatory KYC verification and suspicious transaction reporting.
• Legitimate Interests: Processing that serves sm650's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Processing for which you have given explicit consent — principally, the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing

sm650 does not sell your personal data to third parties. We share your data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized or pseudonymized session data necessary to deliver their games through our platform. These providers do not receive your full identity or financial data.
• Payment Processors: Bank partners and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the transaction data necessary to process your deposits and withdrawals. This is limited to the financial and identity data required to complete the transaction.
• KYC & Fraud Prevention Vendors: Identity verification and AML screening providers receive the identity documents and personal data you submit during the KYC process, processed under strict data processing agreements.
• Legal and Regulatory Authorities: We may be required to disclose your personal data to regulatory bodies, law enforcement agencies, tax authorities, or courts where we receive a lawful request or are legally obligated to do so. Where legally permitted, we will notify you of such disclosures.
• Corporate Transactions: In the event of a merger, acquisition, or asset sale, your personal data may be transferred to the successor entity. You will be notified of any such transfer and the privacy implications prior to any change in data controller.

International Data Transfers

As an internationally licensed gaming operator, sm650 may transfer your personal data to servers or service providers located outside of Indonesia. Wherever such transfers occur, sm650 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Privacy Policy. Safeguards may include contractual data processing agreements, standard contractual clauses, or transfers to jurisdictions recognized as providing an adequate level of data protection.

By registering a member account with sm650 and accepting our Terms & Conditions, you acknowledge that your personal data may be processed outside Indonesia in connection with the delivery of our services.

Data Retention

sm650 retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, comply with legal obligations, or resolve disputes. The following general retention periods apply:

• Active Account Data: Retained for the duration of your membership and for a minimum period of 5 years following account closure, in compliance with AML record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later, as required by international AML standards.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction for AML, audit, and dispute resolution purposes.
• Support Communications: Retained for up to 3 years from the date of the communication for dispute resolution and quality assurance purposes.
• Marketing Preference Data: Retained until you withdraw consent or request deletion, and for up to 2 years following opt-out to maintain a suppression record.
• Technical & Usage Logs: Retained for up to 12 months for security and fraud analysis purposes, then anonymized or deleted.

When personal data is no longer required, sm650 will delete or anonymize it using secure methods. Where data is anonymized, it may be retained indefinitely for statistical and analytical purposes without identifying you.

Data Security

sm650 applies a comprehensive set of technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. Our security framework includes:

• 256-Bit SSL Encryption: All data transmitted between your device and sm650's servers is protected by industry-standard 256-bit SSL/TLS encryption. Look for the padlock icon and "https://" in your browser address bar when using the sm650 platform.
• Encrypted Data Storage: Financial data — including bank account numbers and e-wallet identifiers — is stored in encrypted form at rest. Passwords are hashed using modern cryptographic algorithms and are never stored in plain text.
• Access Controls: Access to personal data within sm650 is restricted to authorized personnel on a strict need-to-know basis. All staff with access to member data undergo data protection training and are bound by confidentiality obligations.
• Intrusion Detection: sm650 employs continuous network monitoring, intrusion detection systems, and automated anomaly alerts to identify and respond to potential security incidents in real time.
• Regular Security Audits: Our platform infrastructure and data handling processes are subject to regular independent security assessments and penetration testing.

Cookies & Tracking Technologies

sm650 uses cookies and similar tracking technologies on the sm650 platform to ensure functionality, improve performance, and deliver a personalized experience. The following types of cookies may be set when you use the sm650 website:

• Strictly Necessary Cookies: Essential for the platform to function. These include session cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cannot be disabled without affecting core platform functionality.
• Performance & Analytics Cookies: Used to collect anonymized data about how members use the platform — including which pages are visited most frequently, session durations, and error reports. This data helps sm650 improve platform stability and user experience.
• Functional Cookies: Used to remember your preferences — such as preferred language, display settings, and last-visited game category — to provide a more personalized experience on return visits.
• Responsible Gaming Cookies: Used to store session duration and activity data locally to support the delivery of session time reminders and other responsible gaming prompts within your account settings.

sm650 does not use third-party advertising cookies or behavioral tracking cookies that build profiles for cross-site advertising purposes. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in or use core platform features.

Your Data Rights

As a sm650 member, you have the following rights in respect of your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "DATA RIGHTS REQUEST":

sm650 will respond to verified data rights requests within 30 calendar days of receipt. We may request proof of identity before processing a request to protect your data from unauthorized third-party access. Where a request is refused, sm650 will provide written reasons and advise on available avenues for escalation.

Minors

sm650 strictly enforces a minimum age requirement of 21 years for all registered members. The sm650 platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. All members are required to verify their age during the KYC process.

If sm650 discovers or is notified that personal data has been collected from a person under 21 years of age, we will take immediate steps to close the relevant account, delete the associated personal data, and — where legally required — report the incident to the appropriate authority. If you believe a minor has registered on the sm650 platform, please notify us immediately at [email protected].

Third-Party Links

The sm650 platform may contain references to third-party services — such as game studios or payment providers — whose own privacy practices govern the data they independently collect. sm650 is not responsible for the privacy practices of third-party entities. We encourage you to review the privacy policies of any third-party service you interact with directly.

Changes to This Policy

sm650 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform services. Material changes will be communicated to registered members via email or a prominent notice on the platform no fewer than 7 calendar days before the updated policy takes effect.

The "Last Reviewed" date at the top of this document reflects the most recent revision. Your continued use of the sm650 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated policy, you must cease using the platform and may request account closure by contacting support.

Contact & Complaints

For questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data, please contact the sm650 Data Support team using the details below. All formal data rights requests and privacy complaints must be submitted in writing via email.

sm650 is committed to resolving all privacy-related queries and complaints promptly and fairly through our internal process. If you are not satisfied with the outcome of sm650's internal review, you may escalate your complaint to the relevant data protection authority or supervisory body under the laws applicable to you.