sora36 Privacy Policy

1. Introduction

This Privacy Policy applies to all personal information collected by sora36 through our website (sora36.cam), mobile applications, and any related services (collectively, the "Platform"). This policy should be read in conjunction with our Terms and Conditions, which govern your use of sora36.

sora36 is an online betting platform licensed and regulated internationally, providing sports betting, live casino, togel (Indonesia's traditional numbers lottery), and slot gaming services to players in Indonesia. We are committed to operating in full compliance with applicable data protection laws and regulations.

If you have any questions or concerns about how we handle your personal data, please contact our Data Protection Officer using the contact details provided at the end of this policy.

2. Data Controller

For the purposes of applicable data protection legislation, the data controller responsible for your personal information is sora36, operating under the jurisdiction of our international gaming license. We determine the purposes and means of processing your personal data in accordance with this Privacy Policy.

Our registered contact for data protection matters is: [email protected]

3. Information We Collect

sora36 collects and processes the following categories of personal information:

3.1 Information You Provide Directly

• Account Registration Data: Full legal name, date of birth, gender, residential address, email address, mobile phone number, and chosen username and password.
• Identity Verification Documents (KYC): Government-issued photo identification (Indonesian KTP, passport, or driver's license), proof of address documents (utility bills, bank statements), and proof of payment method (bank account details, e-wallet screenshots).
• Payment and Transaction Data: Bank account details, e-wallet registration information, deposit and withdrawal transaction records, payment method preferences, and transaction history.
• Communication Data: Records of your communications with our customer support team via live chat, email, or phone, including the content of messages, timestamps, and resolution outcomes.
• Marketing Preferences: Your consent status for receiving promotional communications, newsletters, and bonus offers via email, SMS, or push notifications.

3.2 Information Collected Automatically

• Device and Technical Data: IP address, device type and model, operating system, browser type and version, screen resolution, device identifiers (IMEI, advertising ID), and mobile network information.
• Usage Data: Pages visited, features accessed, games played, bet history, win/loss records, session duration, clickstream data, referral source, and time spent on specific pages or features.
• Location Data: Approximate geographic location derived from IP address to verify that you are accessing sora36 from within Indonesia, as required by our licensing terms.
• Cookies and Similar Technologies: Data collected through cookies, web beacons, local storage, and similar tracking technologies. See Section 10 for detailed information on our cookie practices.

3.3 Information from Third Parties

• Payment Processors: Transaction confirmation data from BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja to verify deposits and process withdrawals.
• Identity Verification Providers: Age verification and identity authentication results from third-party KYC service providers.
• Game Providers: Gameplay data, bet outcomes, and RNG results from our licensed game studio partners including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and others.
• Fraud Detection Services: Risk scores, device fingerprints, and behavioral analytics from anti-fraud and anti-money-laundering service providers.

4. How We Use Your Data

sora36 processes your personal information for the following purposes:

4.1 Service Provision and Account Management

• Creating and maintaining your user account
• Verifying your identity and age to comply with 21+ restrictions
• Processing deposits, withdrawals, and other financial transactions
• Enabling gameplay across sports betting, live casino, togel, and slot gaming
• Recording bet history and calculating winnings
• Providing customer support and responding to your inquiries

4.2 Legal and Regulatory Compliance

• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Preventing fraud, money laundering, and other financial crimes
• Detecting and preventing underage gambling
• Cooperating with law enforcement and regulatory authorities when legally required
• Maintaining records for audit and licensing compliance purposes
• Enforcing our Terms and Conditions and protecting our legal rights

4.3 Platform Security and Integrity

• Detecting and preventing fraud, cheating, collusion, and bonus abuse
• Identifying suspicious activity and protecting against cyber attacks
• Monitoring for unauthorized account access and security breaches
• Maintaining platform stability and preventing technical disruptions

4.4 Marketing and Communications

• Sending promotional offers, bonuses, and VIP rewards (with your consent)
• Delivering newsletters and platform updates
• Personalizing marketing communications based on your gameplay preferences
• Conducting market research and customer satisfaction surveys

4.5 Platform Improvement and Analytics

• Analyzing user behavior to improve platform features and user experience
• Conducting A/B testing and product optimization
• Developing new games, features, and services
• Generating aggregated and anonymized statistical reports

4.6 Responsible Gaming

• Implementing deposit limits, loss limits, and session time restrictions
• Monitoring gambling behavior for signs of problem gambling
• Processing self-exclusion and cooling-off requests
• Providing access to responsible gaming tools and resources

5. Legal Basis for Processing

Under applicable data protection laws, sora36 relies on the following legal bases for processing your personal information:

• Contractual Necessity: Processing is necessary to perform our contract with you (the Terms and Conditions) and to provide the betting services you have requested.
• Legal Obligation: Processing is required to comply with KYC, AML, age verification, and other legal obligations imposed by our gaming license and applicable regulations.
• Legitimate Interests: Processing is necessary for our legitimate business interests, including fraud prevention, security, platform optimization, and direct marketing, provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: For certain processing activities such as optional marketing communications and non-essential cookies, we rely on your explicit consent, which you may withdraw at any time.

6. Data Sharing and Disclosure

sora36 does not sell your personal information to third parties. However, we may share your data with the following categories of recipients for the purposes described in this policy:

6.1 Service Providers

We share your information with trusted third-party service providers who perform services on our behalf, including:

• Payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, LinkAja)
• Identity verification and KYC providers
• Cloud hosting and data storage providers
• Customer support platform providers
• Marketing and email service providers (only with your consent)
• Fraud detection and anti-money-laundering service providers
• Analytics and platform performance monitoring services

All service providers are contractually obligated to protect your data and use it only for the specific purposes we authorize.

6.2 Game Providers

We share necessary gameplay data with our licensed game studio partners (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others) to enable game functionality and settle bets. Game providers process data in accordance with their own privacy policies and applicable gaming regulations.

6.3 Regulatory and Legal Authorities

We may disclose your information to regulatory authorities, law enforcement agencies, courts, or government bodies when required by law or when necessary to:

• Comply with legal obligations, court orders, or regulatory requests
• Protect our legal rights and enforce our Terms and Conditions
• Investigate suspected fraud, money laundering, or other illegal activity
• Protect the safety and security of our users and the public

6.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, your personal information may be transferred to the acquiring entity or successor organization. You will be notified of any such change in ownership or control of your personal data.

7. Data Retention

sora36 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: We retain your account data and transaction history for the duration of your active account and for a period after account closure as required by our licensing obligations and applicable regulations.
• Closed Accounts: After account closure, we retain essential records (identity documents, transaction history, KYC data) for a minimum of 5 years to comply with AML regulations, tax laws, and licensing requirements.
• Marketing Data: If you withdraw consent for marketing communications, we will retain a suppression record to ensure we do not contact you again, but we will delete other marketing-related data.
• Legal Claims: We may retain data for longer periods if necessary to establish, defend, or exercise legal claims.

After the applicable retention period expires, we will securely delete or anonymize your personal information in accordance with our data retention and destruction policies.

8. Data Security Measures

sora36 takes the security of your personal information seriously and implements robust technical and organizational measures to protect your data against unauthorized access, loss, destruction, alteration, or disclosure:

• Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL (Secure Socket Layer) encryption, the same standard used by banks and financial institutions.
• Access Controls: Personal data is accessible only to authorized sora36 personnel and service providers who require access to perform their duties. All access is logged and monitored.
• Secure Storage: Personal data is stored on secure servers located in data centers that maintain industry-standard physical security, environmental controls, and redundancy systems.
• Regular Audits: We conduct regular security audits and vulnerability assessments to identify and address potential security risks.
• Employee Training: All sora36 staff members receive mandatory data protection and security training.
• Incident Response: We maintain an incident response plan to quickly detect, contain, and remediate any data breach or security incident.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect unauthorized access to your account.

9. Your Data Protection Rights

Under applicable data protection laws, you have the following rights regarding your personal information:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format.

9.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data. You can update most account information directly through your account settings.

9.3 Right to Erasure ("Right to Be Forgotten")

You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or when you withdraw consent. However, we may be required to retain certain data to comply with legal obligations (KYC, AML, licensing requirements).

9.4 Right to Restriction of Processing

You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when you object to processing.

9.5 Right to Data Portability

You have the right to receive your personal data in a portable format and to transmit it to another data controller, where technically feasible.

9.6 Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will cease processing your data for those purposes.

9.7 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

9.8 Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. sora36 uses automated fraud detection and risk assessment tools, but significant decisions (account suspension, withdrawal denials) are reviewed by human personnel.

Exercising Your Rights: To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to your request within 30 days. You also have the right to lodge a complaint with the data protection authority in your jurisdiction if you believe we have violated your data protection rights.

10. Cookies and Tracking Technologies

sora36 uses cookies and similar tracking technologies to enhance your experience, analyze platform usage, and deliver personalized content. A cookie is a small text file stored on your device that allows us to recognize you when you return to our platform.

10.1 Types of Cookies We Use

• Essential Cookies: Necessary for the platform to function properly. These include session management, authentication, and security cookies. You cannot opt out of essential cookies.
• Performance Cookies: Collect information about how you use the platform, such as pages visited and errors encountered. This data helps us improve platform performance.
• Functional Cookies: Remember your preferences and settings, such as language preference and display options, to provide a more personalized experience.
• Targeting/Advertising Cookies: Track your browsing activity to deliver personalized marketing content and measure the effectiveness of advertising campaigns. These cookies require your consent.

10.2 Managing Cookies

You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, disabling essential cookies may prevent you from using certain features of the sora36 platform. For more information on managing cookies, consult your browser's help documentation.

11. International Data Transfers

sora36 operates under an international gaming license and may transfer your personal data to service providers and partners located outside of Indonesia. When we transfer data internationally, we ensure that appropriate safeguards are in place to protect your information in accordance with applicable data protection laws, including:

• Standard Contractual Clauses approved by regulatory authorities
• Data Processing Agreements with all service providers
• Adequacy decisions recognizing equivalent data protection standards
• Binding Corporate Rules for transfers within multinational organizations

All international data transfers are conducted in compliance with the requirements of our licensing jurisdiction and applicable data protection regulations.

12. Changes to This Privacy Policy

sora36 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated to you via email notification or prominent notice on the platform at least 30 days before the changes take effect.

Your continued use of sora36 after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your personal information.

The "Last Updated" date at the top of this policy indicates when it was most recently revised.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact our Data Protection Officer:

• Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 via your account dashboard

We will respond to all privacy-related inquiries within 30 days. For urgent security concerns, please use the live chat feature for immediate assistance.