sbo28 Privacy Policy

sbo28 operates the online gaming and sportsbook platform accessible at https://sbo28.app (the "Platform"). This Privacy Policy describes how sbo28 ("we", "us", "our") collects, uses, stores, shares, and protects personal data belonging to individuals who visit, register on, or otherwise interact with the Platform ("you", "your").

This policy applies to all sbo28 Services, including but not limited to the Sportsbook, Live Casino, Slots lobby, Poker Tournaments, Baccarat tables, customer support channels, and any promotional communications we send. It applies regardless of whether you access the Platform via a desktop browser, a mobile browser, or any other compatible interface.

This Privacy Policy must be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy. By creating an account or continuing to use the Platform, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions apply:

• Personal Data: Any information relating to an identified or identifiable natural person. This includes, but is not limited to, your name, date of birth, email address, mobile number, bank account details, IP address, and device identifiers.
• Processing: Any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• Data Controller: sbo28, as the entity that determines the purposes and means of processing your Personal Data.
• Data Processor: Any third-party organisation that processes Personal Data on behalf of sbo28, pursuant to a written data processing agreement.
• Member: Any individual who has completed account registration on the sbo28 Platform and whose account remains active, suspended, or pending verification.
• KYC Data: Identity verification documentation submitted by a Member as part of the Know Your Customer process, including government-issued identification and proof of address.
• Cookies: Small text files placed on your device by the Platform to facilitate session management, preference storage, and analytics.
• Sensitive Data: A subset of Personal Data warranting enhanced protection, including financial account information, government identity numbers, and biometric identifiers.

sbo28 collects Personal Data in the categories described below. We collect only the data that is necessary for the specified purpose and retain it no longer than required under Section 9 of this Policy.

sbo28 collects Personal Data through the following mechanisms:

Data you provide directly when you complete the account registration form on the sbo28 Login page, submit a KYC verification request, contact our support team via live chat or email, opt into promotional communications, or submit a withdrawal or deposit request through the Cashier.

Data collected automatically when you interact with the Platform, including Technical Data and Usage Data gathered via cookies, web beacons, server logs, and session-tracking technology. This data is collected whether or not you are a registered Member — it applies to all visitors to https://sbo28.app.

In limited circumstances, sbo28 may receive data about you from third-party sources, including:

• Identity verification and KYC service providers who confirm the authenticity of documents you submit.
• Payment processors and banking partners (such as BCA, BRI, Mandiri, OVO, GoPay) who provide transaction confirmation data.
• Fraud prevention and anti-money-laundering (AML) screening services.
• Licensed game studios (such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, Spribe) who may share anonymised session data for RTP auditing and dispute resolution purposes.

sbo28 uses the Personal Data it collects for the following purposes, each of which is grounded in a legitimate legal basis described in Section 6:

• Account Registration & Management: To create and maintain your sbo28 account, verify your identity, enforce the 21+ age restriction, and manage your account settings and preferences.
• Transaction Processing: To process deposits in IDR via local bank transfers (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and to process withdrawal requests to your registered payment method.
• Customer Support: To respond to your queries, resolve disputes, and provide 24/7 support through our live chat and WhatsApp channels, including routing to Indonesian-speaking agents during WIB business hours.
• Security & Fraud Prevention: To monitor for suspicious activity, detect unauthorised account access, prevent multi-accounting, and enforce our Terms & Conditions — including our prohibition on the use of VPNs and automation tools.
• Regulatory & AML Compliance: To meet our international licensing obligations, conduct KYC verification, monitor transactions for signs of money laundering, and maintain records as required by our licensor.
• Responsible Gaming: To identify patterns of play that may indicate problem gambling, to enforce self-exclusion and cooling-off requests, and to administer deposit limits and session timers requested by Members.
• Platform Improvement: To analyse usage patterns, test new features, optimise game lobby layouts, and improve the overall sbo28 member experience — using aggregated, anonymised data wherever possible.
• Marketing Communications: To send promotional offers, bonus notifications, and product updates to Members who have actively opted in to receive marketing messages. You may withdraw your consent at any time by contacting support.

Every instance of Personal Data processing by sbo28 is grounded in at least one of the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and sbo28 — specifically, to provide the gaming and sportsbook services you have registered to use. This basis applies to account management, transaction processing, and support services.
• Legal Obligation: Processing is necessary for sbo28 to comply with its international licensing obligations, including KYC/AML requirements, age verification, and record-keeping mandates imposed by our licensor.
• Legitimate Interests: Processing is necessary for sbo28's legitimate interests, including platform security, fraud detection, responsible gaming monitoring, and product improvement — provided those interests are not overridden by your privacy rights. We conduct a balancing assessment before relying on this basis.
• Consent: For marketing communications and non-essential cookies, processing is based on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

sbo28 does not sell your Personal Data to third parties. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

We engage trusted third-party service providers to perform specific functions on our behalf. These providers act as Data Processors under written agreements that bind them to process your data only on our documented instructions and to maintain appropriate security measures. Current categories of Data Processor include:

• Payment gateway and banking partners (facilitating IDR transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja).
• KYC and identity verification providers.
• Fraud prevention and AML screening platforms.
• Licensed game studios providing certified game software (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe).
• Cloud infrastructure and hosting providers operating data centres with enterprise-grade physical and logical security controls.
• Customer support platform providers powering our live chat function.

sbo28 may disclose your Personal Data to law enforcement agencies, regulatory authorities, or other competent bodies when required to do so by applicable law, court order, or in response to a lawful request from our international licensor. We will notify you of such disclosures where legally permitted to do so.

In the event of a merger, acquisition, restructuring, or sale of assets involving sbo28, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy protections that apply to your data under the new entity's ownership before the transfer takes effect.

sbo28 uses cookies and similar tracking technologies to provide a functional, secure, and personalised platform experience. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during an active session, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without impairing basic platform functionality.
• Functional Cookies: Remember your preferences — such as your preferred game lobby view, language, and notification settings — to improve your experience on return visits. These are enabled by default but can be disabled in your browser settings.
• Analytics Cookies: Collect anonymised data about how Members navigate the Platform — which game categories are most popular, which pages have high exit rates, and how different features are used. This data informs product decisions. Analytics cookies are activated only with your consent.
• Security Cookies: Support our fraud detection and account security systems by recording session fingerprint data, including IP address and device characteristics. These are strictly necessary and cannot be disabled.

You may control non-essential cookies through your browser settings. Note that disabling functional or analytics cookies will not affect your ability to place bets, make deposits, or use core platform features. sbo28 does not use third-party advertising cookies or retargeting pixels.

sbo28 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by our international licensing obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised. Where deletion is technically impractical in the short term (for example, data held in encrypted backup archives), sbo28 will isolate the data from active processing until deletion can be completed.

sbo28 implements a layered security architecture designed to protect your Personal Data against unauthorised access, accidental loss, destruction, and disclosure. Key security measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the sbo28 Platform is encrypted in transit using industry-standard TLS 1.2 or higher. This is the same encryption standard used by major international banks and financial institutions.
• Encryption at Rest: Sensitive Personal Data — including financial account details and KYC documents — is encrypted at rest using AES-256 encryption on our secure cloud infrastructure.
• Access Controls: Access to Personal Data within sbo28's internal systems is restricted on a strict need-to-know basis. All staff with access to Member data are bound by confidentiality obligations and undergo regular security training.
• Multi-Factor Authentication (MFA): MFA is triggered automatically when your account is accessed from an unrecognised device or geographic location, providing an additional layer of protection against unauthorised access.
• Intrusion Detection & Monitoring: sbo28's infrastructure is monitored around the clock by automated intrusion detection systems. Anomalous activity triggers immediate alerts to our security team for investigation.
• Regular Security Audits: sbo28 commissions periodic third-party security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited.

As a Member of sbo28, you have the following rights in relation to the Personal Data we hold about you. To exercise any of these rights, contact our support team at [email protected]. sbo28 will respond to verified requests within thirty (30) calendar days.

sbo28 will not charge a fee for processing a rights request unless the request is manifestly unfounded or excessive. In such cases, we reserve the right to charge a reasonable administrative fee or to decline the request, with written explanation.

The sbo28 Platform is strictly for adults aged 21 and over. We do not knowingly collect Personal Data from individuals under the age of 21. The registration process requires users to confirm their date of birth, and age verification is enforced as part of the KYC process described in our Terms & Conditions.

If sbo28 discovers that Personal Data has been collected from a person under the age of 21 — whether through a misrepresentation during registration or any other means — we will immediately suspend the relevant account, delete all associated Personal Data to the extent not required for regulatory retention purposes, and forfeit any balance held in that account.

If you believe that a minor has registered on the sbo28 Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

The sbo28 Platform integrates certified game content from licensed third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe. When you play a game provided by one of these studios, a game session is initiated within the studio's certified game client, which may collect limited technical data (such as session ID and anonymised gameplay statistics) for RTP auditing and provably fair certification purposes.

sbo28 does not control the privacy practices of third-party game studios beyond the data processing agreements in place. We recommend reviewing the privacy policies of any third-party services you interact with. However, no identifiable Personal Data (such as your name, bank details, or contact information) is shared with game studios — only anonymised session identifiers are passed for game initialisation purposes.

This Privacy Policy does not govern external websites that may be linked from, or that may link to, sbo28. sbo28 is not responsible for the privacy practices of any external website, and users who follow links to external sites do so at their own discretion.

sbo28 operates under an international gaming licence and uses cloud infrastructure and service providers that may process data in data centres located outside Indonesia. Where Personal Data is transferred internationally, sbo28 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding the protections described in this Privacy Policy.

Safeguards for international transfers include:

• Written data processing agreements with all Data Processors that incorporate binding data protection obligations aligned with internationally recognised privacy standards.
• Contractual clauses requiring Data Processors to implement technical and organisational security measures equivalent to those described in Section 10 of this Policy.
• Restrictions on onward transfer by Data Processors to sub-processors without prior written authorisation from sbo28.

By registering an account on the sbo28 Platform, you acknowledge that your Personal Data may be transferred to, stored in, and processed in jurisdictions outside Indonesia, subject to the safeguards described above.

sbo28 reserves the right to update or amend this Privacy Policy at any time. When material changes are made — for example, changes to the categories of data we collect, the purposes for which we use data, or the third parties with whom we share data — we will notify registered Members by email to the address on record and/or by displaying a prominent notice on the Platform for a period of not less than seven (7) days before the changes take effect.

Minor, non-material changes (such as corrections of typographical errors or clarifications that do not alter the substance of our data practices) may be made without prior notice. The "Effective Date" and "Last Reviewed" date in the page header will be updated on every revision.

Your continued use of the sbo28 Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree to an amendment, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions. The most current version of this Privacy Policy is always available at https://sbo28.app/privacy-policy.

If you have any questions, concerns, or formal requests relating to this Privacy Policy or to the processing of your Personal Data, please contact the sbo28 privacy and compliance team through the following channel:

• Email (plain text — not a clickable link): [email protected]
• Live Chat: Available 24/7 via the in-app live chat function on the sbo28 Platform.
• WhatsApp Support: Available during WIB business hours (09:00–22:00 WIB, UTC+7) via the contact details provided within the Platform.

We aim to acknowledge all privacy-related enquiries within one (1) business day and to provide a substantive response within thirty (30) calendar days. For general queries, our FAQ page covers the most common questions from Indonesian Members regarding data, security, and account management.