sm603 Privacy Policy

sm603 ("we", "us", "our") operates the online gaming platform accessible at sm603.net, providing casino games, sports betting, slot games, Andar Bahar, Mahjong, and related entertainment services primarily to players in the Indonesian market and other permitted international markets.

As an online gaming platform that processes account registrations, financial transactions, identity verifications, and ongoing gameplay activity, sm603 necessarily collects and processes personal data. We take that responsibility seriously. This Privacy Policy sets out, with full transparency, the categories of data we collect, the purposes for which it is processed, the lawful basis for that processing, and the rights available to you as a data subject.

This Privacy Policy applies to all personal data collected through the sm603 website at sm603.net, the sm603 mobile-optimized platform, and all communication channels operated by sm603 including live chat and email support. It should be read alongside the sm603 Terms & Conditions.

For the purposes of this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or erasure.
• "Data Controller" means sm603, the entity that determines the purposes and means of processing personal data collected through the sm603 platform.
• "Data Processor" means any third party that processes personal data on behalf of sm603 under a contractual data processing agreement.
• "Player" / "User" / "You" means any individual who registers for or uses the sm603 platform.
• "KYC" (Know Your Customer) means the identity and age verification procedures sm603 conducts to comply with its anti-money laundering obligations and age restriction requirements.
• "Cookies" means small data files placed on your device by the sm603 website to enable functionality, analyze usage, and personalize your experience.

sm603 collects the following categories of personal data:

sm603 does not collect or process special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where a liveness photograph is required as part of KYC identity verification, in which case it is processed solely for that verification purpose and retained only for the period described in Section 8.

The majority of personal data sm603 holds about you is information you provide to us directly during:

• Account registration — including your name, date of birth, email address, and chosen credentials.
• KYC identity verification — including submission of government-issued identity documents and proof of address.
• Deposit and withdrawal requests — including your bank account details or e-wallet identifiers.
• Support interactions — including the content of live chat conversations and email correspondence with our support team.
• Promotional participation — including bonus claim forms and survey responses.

When you access the sm603 platform, certain technical data is collected automatically by our servers and analytics systems, including your IP address, the device and browser you are using, session duration, pages visited, and the URL from which you arrived. This data is collected using server logs and cookies as described in Section 10.

sm603 may receive personal data about you from the following third-party sources:

• KYC verification partners: Third-party identity verification services that cross-reference documents you submit against authoritative identity databases.
• Payment processors: Confirmation data from banks and e-wallet providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) confirming that a transaction has been completed.
• Fraud and AML screening services: Third-party services that flag accounts or transactions associated with known fraudulent activity or money laundering patterns.

sm603 processes your personal data for the following purposes:

• Account management: Creating, maintaining, and administering your sm603 Account, including authenticating your login sessions and applying your responsible gaming preferences.
• Identity and age verification (KYC): Confirming that you are at least 21 years of age and verifying your identity in accordance with our anti-money laundering obligations. You must be at least 21 years old and, where applicable, a resident of Indonesia or another permitted market to hold an sm603 Account.
• Payment processing: Processing deposits and withdrawals in Indonesian Rupiah (IDR) through your nominated bank account or e-wallet, and maintaining accurate financial transaction records.
• Fraud prevention and AML compliance: Monitoring account and transaction activity to detect and prevent fraud, money laundering, collusion, bonus abuse, and other prohibited conduct.
• Platform delivery and improvement: Providing access to all gaming products on the sm603 platform, diagnosing technical issues, improving platform performance, and developing new features.
• Customer support: Responding to your inquiries, resolving disputes, processing responsible gaming requests such as self-exclusion, and maintaining records of support interactions.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behavior and reaching out proactively where our responsible gaming systems flag a concern.
• Marketing communications: Sending promotional offers, bonus announcements, and seasonal campaign notifications — but only where you have given explicit consent and have not subsequently withdrawn it.
• Legal compliance: Fulfilling sm603's obligations under applicable international gaming regulations, anti-money laundering legislation, and any lawful orders from competent authorities.

sm603 processes your personal data on the following legal bases:

• Contractual necessity: Processing your identity data, contact data, financial data, and gaming activity data is necessary to perform the contract between you and sm603 — specifically, to provide you with access to the sm603 platform, process your transactions, and administer your Account.
• Legal obligation: KYC verification, AML transaction monitoring, and certain record-keeping obligations are required by applicable regulations under which sm603 operates its international gaming license. sm603 must process this data to comply with those obligations regardless of your consent.
• Legitimate interests: Processing technical data for platform security, fraud prevention, and service improvement is carried out on the basis of sm603's legitimate interests in protecting the integrity of the platform and the security of all Players' accounts, provided those interests are not overridden by your fundamental rights.
• Consent: Processing your data for marketing communications is carried out solely on the basis of your freely given, specific, informed consent. You may withdraw this consent at any time by updating your notification preferences in your sm603 Account settings or by contacting support.

sm603 shares personal data with carefully selected third-party service providers who process data on our behalf as Data Processors, strictly for the purposes described in this Privacy Policy. These include:

• Identity verification and KYC service providers
• Payment processing partners — including Indonesian banking infrastructure partners and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Anti-fraud and AML screening technology providers
• Game content providers (Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, Spribe, and others) — who receive session tokens but not full identity data
• Cloud hosting and infrastructure providers that store sm603 platform data
• Customer support platform providers that host our live chat and ticketing systems

All third-party Data Processors engaged by sm603 are bound by contractual data processing agreements that require them to process data only on sm603's documented instructions, to maintain appropriate security standards, and to delete or return data upon termination of the service relationship.

sm603 may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other public bodies where we are legally required to do so — for example, in response to a valid court order, a regulatory investigation, or a legally mandated report under anti-money laundering legislation. sm603 will not disclose data beyond the minimum necessary to comply with such an obligation.

sm603 does not sell, rent, or lease your personal data to any third party for their own independent marketing or commercial purposes. Data sharing is limited strictly to what is necessary for sm603 to operate the platform and fulfill its legal obligations.

sm603 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with any identified individual. Anonymized aggregate data (for example, platform usage statistics) may be retained indefinitely as it no longer constitutes personal data.

sm603 implements a layered set of technical and organizational security measures designed to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the sm603 platform — look for the padlock icon and "https" in your browser address bar.
• Encryption at rest for stored personal data and financial records on sm603 servers.
• Access controls and role-based permissions — sm603 staff access to personal data is restricted on a strict need-to-know basis, and all access to sensitive data is logged and audited.
• Multi-factor authentication options for sm603 Account login, strongly recommended for all Players.
• Regular security assessments including vulnerability scanning and penetration testing of the sm603 platform infrastructure.
• Staff training — all sm603 personnel who handle personal data receive regular data protection and security awareness training.

While sm603 takes every reasonable precaution to protect your personal data, no internet-based platform can guarantee absolute security. In the event that sm603 suffers a data breach that is likely to result in a risk to your rights and freedoms, sm603 will notify affected Players without undue delay in accordance with applicable notification obligations.

You are responsible for maintaining the security of your own sm603 Account credentials. Do not share your password with anyone. sm603 support staff will never ask for your password.

Cookies are small text files placed on your device when you visit the sm603 website. They allow the platform to recognize your browser across sessions, remember your preferences, and collect analytical data about how the site is used. sm603 also uses similar technologies including web beacons and local storage objects for comparable purposes.

• Strictly necessary cookies: Essential for the sm603 platform to function. These enable login session management, security token handling, and platform navigation. They cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies: Collect anonymized information about how Players use the sm603 platform — such as which pages are visited most frequently and where users encounter errors — to help us improve the experience.
• Functional cookies: Remember your preferences such as language setting, display preferences, and responsible gaming reminder intervals so you do not need to reconfigure them on every visit.
• Marketing cookies: Used only where you have given consent, to track the effectiveness of sm603 promotional campaigns and to avoid serving you repeated offers you have already seen.

You can control which non-essential cookies sm603 places on your device through the cookie preference settings accessible via the sm603 platform. You may also configure your browser to block or delete cookies, though doing so may affect the functionality of the sm603 platform — in particular, strictly necessary cookies cannot be blocked without impacting your ability to log in and use account features.

As a data subject, you hold the following rights with respect to the personal data sm603 processes about you. sm603 will respond to any valid rights request within 30 days of receipt, and will notify you if additional time is required for complex requests.

• Right of Access: You have the right to request a copy of the personal data sm603 holds about you, along with information about how it is processed.
• Right to Rectification: You have the right to request correction of any personal data sm603 holds that is inaccurate or incomplete.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is subject to exceptions where sm603 is required to retain data under applicable law (for example, AML record-keeping obligations described in Section 8).
• Right to Restrict Processing: You have the right to request that sm603 limits the processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive a structured, machine-readable copy of the personal data you have provided to sm603.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of sm603's legitimate interests. You also have an unconditional right to object to processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact sm603 at [email protected] with the subject line "Data Rights Request" and a description of your request. sm603 may require you to verify your identity before processing a data rights request to prevent unauthorized access to another person's data.

The sm603 platform is strictly for individuals aged 21 years or older. sm603 does not knowingly collect personal data from anyone under the age of 21. The KYC verification procedures described in Section 3 are specifically designed to confirm that every registered Player meets this minimum age requirement before real-money gaming activity is permitted.

If sm603 becomes aware that personal data has been collected from a person under the age of 21, that data will be promptly deleted, the associated Account will be permanently closed, and any funds in the Account will be handled in accordance with the procedures set out in the sm603 Terms & Conditions.

If you are a parent or guardian and you believe your child has registered on the sm603 platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

sm603 operates as an international gaming platform. Personal data collected from Players in Indonesia and other markets may be transferred to, stored, and processed in countries other than the country in which it was originally collected — specifically, to the jurisdiction where sm603's cloud hosting infrastructure and key service providers are located.

When personal data is transferred internationally, sm603 ensures that appropriate safeguards are in place to protect that data. These safeguards include:

• Contractual data transfer clauses incorporated into agreements with Data Processors located in third countries, requiring those processors to apply data protection standards equivalent to those applied by sm603.
• Transfer only to service providers that maintain independently certified information security management systems (e.g., ISO 27001 certified infrastructure providers).
• Where required, additional technical safeguards such as pseudonymization of personal data prior to transfer.

By using the sm603 platform, you acknowledge that your personal data may be processed in jurisdictions outside Indonesia. sm603 ensures this processing is carried out with the same level of care and security as described in this Privacy Policy regardless of where the processing occurs.

sm603 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, the services we offer, or applicable legal requirements. The "Last Updated" date displayed at the top of this page will be revised whenever a material change is made.

Where a change is material — meaning it significantly affects how we use your personal data or the rights available to you — sm603 will notify registered Players by email to the address associated with their Account at least seven (7) days before the change takes effect. For minor or clarifying amendments, the updated policy will simply be published at sm603.net/privacy-policy without individual notification.

Your continued use of the sm603 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated policy, you should stop using sm603 and request account closure in accordance with the procedure in the sm603 Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise a data protection right, or have a concern about how sm603 handles your personal data, please contact the sm603 Data Protection team through any of the following channels:

• Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Rights Request" for prompt routing to the correct team.
• Live Chat: Available 24/7 through the sm603 platform dashboard after login, staffed by Indonesian-speaking support agents (WIB, UTC+7).

sm603 aims to acknowledge all privacy-related inquiries within 24 hours and to provide a substantive response within 30 days. Complex data rights requests may take up to 60 days in exceptional circumstances; if this applies to your request, sm603 will notify you within the initial 30-day window with an explanation and an updated timeline.