Privacy Policy — Your Data, Protected

1 Introduction

scgwin ("we", "us", "our", "the Platform") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, store, share, and protect personal data in compliance with internationally recognized data protection principles, including standards aligned with the General Data Protection Regulation (GDPR) framework, even though our primary service area is Indonesia.

We recognize that online gambling involves the processing of sensitive personal and financial information. Our privacy practices are designed to ensure that your data is handled with the highest level of care, transparency, and security at every stage of your relationship with scgwin.

This Privacy Policy should be read in conjunction with our Terms & Conditions and Responsible Gaming policy, which together form the complete contractual and operational framework governing your use of the Platform.

2 Data Controller

For the purposes of applicable data protection law, the data controller responsible for your personal information is:

As the data controller, scgwin determines the purposes for which and the manner in which your personal data is processed. We are responsible for ensuring that all processing activities comply with applicable data protection laws and the terms of this Privacy Policy.

3 Data We Collect

scgwin collects and processes several categories of personal data depending on your interaction with the Platform. The types of data we collect include:

3.1 Account Registration Data

• Full legal name as it appears on your government-issued identification
• Date of birth (to verify you meet the 21+ age requirement)
• Email address (primary account communication channel)
• Mobile phone number (for account security and verification purposes)
• Residential address (city, province, postal code)
• Username and encrypted password

3.2 Identity Verification (KYC) Data

• Government-issued identity document (KTP or passport) including photo and document number
• Proof of address documents (utility bills, bank statements dated within 3 months)
• Selfie photograph holding your identity document
• Payment method verification documents (bank account ownership proof, e-wallet screenshots)

3.3 Financial Transaction Data

• Bank account details (account number, bank name, account holder name) for BCA, BRI, BNI, Mandiri, and other supported banks
• E-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja
• Deposit and withdrawal transaction history, amounts, timestamps, and status
• Bonus claim records and wagering requirement progress

3.4 Behavioral and Usage Data

• Betting history including game type, stake amounts, odds, outcomes, and timestamps
• Login timestamps and session duration
• Device information (device type, operating system, browser type and version)
• IP address and approximate geolocation (city/region level)
• Pages visited, features used, and navigation patterns within the Platform

3.5 Communication Records

• Customer support correspondence via email, live chat, or other communication channels
• Records of promotional preferences and marketing consent status
• Feedback and survey responses

4 Purpose of Processing

scgwin processes your personal data for the following specific, explicit, and legitimate purposes:

5 Legal Basis for Processing

Under data protection law, scgwin must have a valid legal basis to process your personal data. Our processing activities are based on one or more of the following lawful grounds:

5.1 Contractual Necessity

Processing is necessary to perform our contract with you (the Terms & Conditions) when you register an account, place bets, or request withdrawals. We cannot provide our services without processing your account and transaction data.

5.2 Legal Obligation

Processing is required to comply with legal obligations imposed on scgwin, including Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations, tax reporting requirements, and licensing conditions set by our regulatory authority.

5.3 Legitimate Interests

Processing is necessary for our legitimate business interests, including fraud prevention, platform security, customer support quality assurance, and business analytics, provided these interests do not override your fundamental rights and freedoms.

5.4 Consent

Where required by law, we obtain your explicit consent before processing certain data categories, particularly for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6 Data Sharing & Third Parties

scgwin does not sell, rent, or trade your personal data to third parties for marketing purposes. However, we may share your data with the following categories of recipients where necessary to operate the Platform and comply with legal obligations:

6.1 Payment Processors

We share necessary financial data with trusted payment service providers (banks and e-wallet operators including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) to process your deposits and withdrawals. These providers are contractually obligated to handle your data securely and only for transaction processing purposes.

6.2 Game Content Providers

When you play games from third-party studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft), certain session data (username, bet amounts, game outcomes) is shared with these providers to deliver the game experience. These providers operate under strict data protection agreements.

6.3 Regulatory and Compliance Bodies

We may disclose personal data to licensing authorities, law enforcement agencies, and financial intelligence units when required by law or regulatory obligations, including suspicious transaction reporting under AML regulations.

6.4 Professional Advisors

We may share data with external legal counsel, auditors, and compliance consultants who assist scgwin in meeting regulatory obligations, provided they are bound by confidentiality agreements.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of scgwin's business assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this policy.

7 Security Measures

scgwin implements comprehensive technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard protocols.
• Encrypted Data Storage: Sensitive data (passwords, payment details, identity documents) is stored in encrypted format using AES-256 encryption.
• Access Controls: Personal data is accessible only to authorized personnel on a need-to-know basis, protected by multi-factor authentication and role-based access restrictions.
• Regular Security Audits: Our systems undergo periodic penetration testing and vulnerability assessments conducted by independent security firms.
• Secure Infrastructure: Data is hosted in ISO 27001-certified data centers with 24/7 monitoring, physical security controls, and redundant backup systems.
• Incident Response: We maintain a documented data breach response plan to ensure rapid detection, containment, and notification in the unlikely event of a security incident.

8 Data Retention Periods

scgwin retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve disputes. Specific retention periods include:

• Active Account Data: Retained for the duration of your active account plus any applicable limitation period for legal claims.
• Transaction Records: Retained for a minimum of 5 years following account closure in compliance with anti-money laundering and tax reporting obligations.
• KYC Documentation: Retained for 5 years following account closure as required by regulatory compliance standards.
• Marketing Consent Records: Retained for 3 years following withdrawal of consent to demonstrate compliance with marketing regulations.
• Support Communications: Retained for 2 years following case closure for quality assurance and dispute resolution purposes.
• Responsible Gaming Records: Self-exclusion requests and deposit limit history are retained for 7 years to prevent premature account reactivation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our data deletion procedures.

9 Cookies & Tracking Technologies

scgwin uses cookies and similar tracking technologies to enhance your browsing experience, analyze platform usage, and deliver personalized content. A cookie is a small text file stored on your device that allows us to recognize your browser across sessions.

9.1 Types of Cookies We Use

• Essential Cookies: Strictly necessary for platform operation, including session management, account authentication, and security features. These cannot be disabled.
• Functional Cookies: Remember your preferences (language, display settings) to provide a more personalized experience.
• Analytics Cookies: Collect aggregated usage statistics to help us understand how players interact with the platform and identify areas for improvement.
• Marketing Cookies: Track your interaction with promotional content to deliver relevant bonus offers (only used with your consent).

9.2 Managing Cookies

You can control cookie preferences through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Note that disabling essential cookies may impair platform functionality, including your ability to log in or place bets. For detailed instructions on managing cookies, consult your browser's help documentation.

10 Your Privacy Rights

Under applicable data protection law, you have the following rights concerning your personal data:

10.1 Right of Access

You may request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format within 30 days of your request.

10.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most account details directly through your account settings.

10.3 Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent. This right is subject to our legal obligation to retain certain data (transaction records, KYC documents) for regulatory compliance.

10.4 Right to Restrict Processing

You may request that we temporarily restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have challenged.

10.5 Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you may request that we transfer your personal data to another service provider in a structured, machine-readable format.

10.6 Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.

10.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

11 International Data Transfers

scgwin operates an international platform, and your personal data may be transferred to, stored in, and processed in countries outside Indonesia, including jurisdictions that may have different data protection laws than your country of residence. We ensure that all international data transfers are protected by appropriate safeguards:

• Data Processing Agreements incorporating standard contractual clauses approved by international data protection authorities
• Transfers only to jurisdictions with adequate data protection frameworks or to entities certified under recognized data protection standards
• Technical and organizational measures equivalent to those required under GDPR-aligned standards

By using the scgwin platform, you acknowledge and consent to the international transfer of your personal data as described in this Privacy Policy.

12 Children's Privacy

scgwin's services are strictly intended for individuals aged 21 years or older. We do not knowingly collect personal data from anyone under the age of 21. Our age verification processes are designed to prevent underage access.

If we become aware that we have inadvertently collected personal data from an individual under 21, we will take immediate steps to delete that data, close the associated account, void all bets, and return deposited funds (net of any bonuses claimed). Parents or guardians who believe their child has provided personal information to scgwin should contact us immediately at [email protected].

13 Changes to This Privacy Policy

scgwin reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated to you via email to the address registered to your account and by prominent notice on the Platform, with a minimum of 14 days' notice before the changes take effect.

The "Last Updated" date at the top of this policy indicates when the most recent revisions were made. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Your continued use of the Platform after changes take effect constitutes your acceptance of the revised Privacy Policy. If you do not agree to the changes, you must cease using the Platform and may request account closure.

14 Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact our Data Protection Officer:

You also have the right to lodge a complaint with a supervisory data protection authority if you believe our processing of your personal data violates applicable law. We would, however, appreciate the opportunity to address your concerns directly before you approach a supervisory authority.