Privacy Policy — sura11

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including full name, date of birth, national identity number, email address, mobile number, IP address, and payment account details.
• "Processing" means any operation performed on Personal Data, whether automated or manual — including collection, recording, storage, alteration, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Controller" means sura11, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means a third-party entity that processes Personal Data on behalf of sura11 under a written contractual agreement and strictly in accordance with our instructions.
• "Member" means any individual who has completed registration and holds an active or previously active account on the sura11 Platform.
• "KYC" means Know Your Customer — the identity verification process conducted to confirm a Member's identity, age, and eligibility.
• "Cookies" means small data files placed on your device by the Platform to enable functionality, session management, and analytics.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including government-issued identity document numbers and financial account information.

This Policy applies to:

• All current and former Members of the sura11 Platform, including registered accounts that are inactive, suspended, or closed.
• All visitors to the sura11 website at sura11.cam, regardless of whether they have completed registration.
• Any individual whose Personal Data is submitted to sura11 in the context of a customer support interaction, KYC submission, or promotional application.

This Policy does not apply to third-party websites or services that may be referenced or linked from the sura11 Platform. sura11 is not responsible for the privacy practices of third-party operators.

sura11 primarily serves players residing in Indonesia, including major cities such as Jakarta, Surabaya, Bandung, Medan, Bali, Semarang, and Yogyakarta. Where applicable, this Policy reflects data-handling practices consistent with internationally recognised privacy principles relevant to the Indonesian market context.

sura11 collects Personal Data through the following channels and in the following categories:

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, gender, residential address, email address, and mobile phone number.
• KYC documents: Government-issued photo identification (Indonesian KTP, passport, or SIM), selfie photographs, and proof of payment method ownership.
• Payment data: Bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction reference numbers. Full card numbers and CVVs are not stored by sura11 — these are handled exclusively by certified payment processors.
• Support correspondence: The content of Live Chat conversations, emails to [email protected], and WhatsApp messages sent to our support number.
• Promotional submissions: Any information provided when applying for a bonus, entering a competition, or responding to a promotional offer.

3.2 Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, and time zone.
• Usage data: Pages visited, features accessed, betting and gaming activity logs, session duration, and navigation paths within the Platform.
• Transaction logs: Deposit and withdrawal records, bet placement timestamps, game session data, and bonus activation history.
• Cookie data: Session identifiers, preference settings, and aggregated analytics data — see Section 9 for full details.

3.3 Data from Third Parties

• Identity verification results and fraud-risk scores from accredited KYC verification service providers.
• Payment status confirmations from bank and e-wallet processing partners.
• Sanctions list screening results from compliance data providers used to meet anti-money-laundering obligations.

3.4 Data Overview Table

sura11 processes your Personal Data on the following legal grounds:

• Contractual necessity: Processing is required to perform the contract between you and sura11 under our Terms & Conditions. This includes account management, payment processing, bet settlement, and delivery of platform features.
• Legal obligation: Processing is necessary to comply with applicable laws and regulations, including anti-money-laundering obligations, KYC requirements, responsible gaming duties, and regulatory reporting obligations.
• Legitimate interests: Processing is necessary for sura11's legitimate business interests — including fraud prevention, security monitoring, platform improvement, network integrity, and customer support — provided those interests do not override your fundamental rights and freedoms.
• Consent: Where we process Personal Data for optional purposes (e.g., sending promotional marketing emails), we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

sura11 processes Personal Data for the following purposes:

1. Account management: Creating and maintaining your Member account, authenticating login sessions, and enabling password recovery.
2. KYC and age verification: Verifying your identity, age (minimum 21 years), and residential address to comply with platform eligibility rules and responsible gaming obligations.
3. Payment processing: Crediting deposits to your account balance, processing withdrawal requests to your verified bank account or e-wallet, and generating transaction receipts.
4. Betting and gaming services: Accepting bets, settling wagers, updating account balances, tracking bonus wagering requirements, and delivering game content.
5. Customer support: Responding to queries submitted via Live Chat, email, or WhatsApp; investigating complaints; and resolving account or technical issues.
6. Fraud prevention and security: Detecting and preventing multi-accounting, bonus abuse, collusion, payment fraud, and unauthorised account access. This includes IP tracking, behavioral pattern analysis, and cross-referencing against known fraudster databases.
7. Responsible gaming: Monitoring betting patterns for signs of problem gambling; enforcing deposit limits, loss limits, and session limits; administering self-exclusion and time-out requests; and providing support resources where needed.
8. Regulatory compliance: Fulfilling anti-money-laundering obligations, maintaining transaction audit trails, and producing records for regulatory authorities where legally required.
9. Platform improvement: Analysing aggregated usage data to identify popular features, diagnose technical issues, improve user experience, and optimise platform performance.
10. Marketing communications: Where you have opted in, sending promotional emails about new games, deposit bonuses, VIP rewards, and seasonal campaigns. You may opt out at any time via the unsubscribe link in any marketing email.

sura11 does not sell, rent, or trade Personal Data to third parties. Data is shared only in the following limited circumstances, under strict contractual data-protection obligations:

6.1 Service Providers (Processors)

• KYC verification partners: Accredited identity verification service providers who confirm the authenticity of government-issued documents and perform fraud checks on our behalf.
• Payment processors: Bank and e-wallet partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay) who execute deposit and withdrawal transactions. Payment processors receive only the minimum data required to complete a specific transaction.
• Game content providers: Third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) receive session and bet data required to deliver game content and determine outcomes. These providers do not receive your identity documents or full personal profile.
• Infrastructure and hosting partners: Data centre and cloud hosting providers that store Platform data and ensure system availability. All hosting partners are contractually bound to implement industry-standard security controls.
• Analytics and support tools: Customer service software providers who assist with ticket management and Live Chat functionality. Chat logs are encrypted and accessible only to authorised sura11 support personnel.

6.2 Legal Disclosure

sura11 may disclose Personal Data where required or permitted by law, including:

• In response to a valid court order, subpoena, or law enforcement request issued by a competent authority.
• To investigate, prevent, or take action regarding suspected illegal activity, fraud, or threats to the safety of any person.
• To protect sura11's legal rights, enforce our Terms & Conditions, or defend against legal claims.
• To comply with anti-money-laundering reporting obligations or regulatory instructions issued by the relevant licensing authority.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of sura11's assets, Personal Data may be transferred to the acquiring entity. You will be notified via email and/or a prominent notice on the Platform of any such transfer and any choices you may have regarding your data.

Personal Data is retained only for as long as necessary to fulfil the purposes for which it was collected, or to comply with legal obligations. The following retention periods apply:

• Active accounts: Account data, transaction history, and KYC documents are retained in full for the duration of account activity and for five (5) years following account closure or permanent suspension.
• Transaction records: Deposit, withdrawal, and betting logs are retained for a minimum of five (5) years from the transaction date to satisfy financial audit and anti-money-laundering obligations.
• Support correspondence: Chat logs and email communications are retained for three (3) years from the date of the last interaction to allow for complaint investigation and dispute resolution.
• Marketing data: Contact details for marketing purposes are retained until you withdraw consent, at which point they are suppressed from future campaigns but retained in a "do not contact" suppression list indefinitely to ensure we honour your opt-out.
• Security logs: IP address logs, session logs, and fraud detection data are retained for two (2) years from the date of collection to support ongoing security investigations.

At the end of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

sura11 implements a comprehensive suite of technical and organisational security measures to protect Personal Data from unauthorised access, alteration, disclosure, or destruction:

• 256-bit SSL/TLS encryption: All data transmitted between your device and sura11's servers is encrypted using SSL/TLS protocols. Look for the padlock icon in your browser's address bar to verify a secure connection.
• Data encryption at rest: Sensitive Personal Data stored in sura11's databases — including KYC documents, payment details, and password hashes — is encrypted using AES-256 encryption.
• Access controls: Access to Personal Data is restricted to authorised personnel on a need-to-know basis, governed by role-based access policies. Multi-factor authentication is required for administrative access.
• Secure password storage: User passwords are hashed using industry-standard algorithms (bcrypt) with unique per-account salts. sura11 personnel cannot view or retrieve your password in plain text.
• Firewall and intrusion detection: sura11's infrastructure is protected by enterprise-grade firewalls and intrusion detection systems that monitor for suspicious activity and attempted breaches in real time.
• Regular security audits: sura11 conducts periodic internal security reviews and engages third-party cybersecurity firms to perform penetration testing and vulnerability assessments.
• Incident response plan: In the event of a data breach that poses a risk to your rights and freedoms, sura11 will notify affected Members and relevant authorities within 72 hours of becoming aware of the breach, in accordance with internationally recognised breach notification standards.

sura11 uses cookies and similar tracking technologies to enable core functionality, enhance security, and improve the Member experience. The following types of cookies are deployed:

9.1 Essential Cookies

These cookies are strictly necessary for the Platform to function and cannot be disabled:

• Session cookies: Maintain your logged-in state as you navigate the Platform. These cookies expire when you close your browser.
• Security cookies: Detect suspicious login patterns, rate-limit API requests, and prevent automated attacks.
• Load balancing cookies: Route your requests to the correct server to ensure consistent performance and session continuity.

9.2 Functional Cookies

These cookies enhance your experience by remembering your preferences:

• Language and currency preferences
• Display settings (e.g., odds format for sports betting)
• Favourite games and recent activity shortcuts

You may disable functional cookies via your browser settings, though this may reduce the convenience of using the Platform.

9.3 Analytical Cookies

These cookies help us understand how Members use the Platform:

• Pages visited and features accessed
• Session duration and bounce rates
• Error messages encountered and technical issues experienced

Analytical data is aggregated and anonymised. sura11 does not use this data to identify individual Members. We do not use third-party advertising networks or cross-site tracking cookies.

9.4 Managing Cookies

You may control and delete cookies through your browser settings. Be aware that disabling essential cookies will prevent you from logging in and using core Platform features. For instructions on managing cookies in popular browsers:

• Google Chrome: Settings > Privacy and security > Cookies and other site data
• Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Microsoft Edge: Settings > Cookies and site permissions > Cookies and site data

As a data subject, you hold the following rights over your Personal Data processed by sura11:

10.1 Right of Access

You have the right to request confirmation of whether sura11 is processing your Personal Data and, if so, to receive a copy of that data along with details of the processing purposes, data categories, and recipients. To exercise this right, submit a written request to [email protected]. sura11 will respond within 30 calendar days.

10.2 Right to Rectification

You have the right to request correction of inaccurate Personal Data and completion of incomplete data. Account details (excluding username) may be updated by contacting sura11 support and providing supporting documentation.

10.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your Personal Data where:

• The data is no longer necessary for the purposes for which it was collected.
• You withdraw consent (where consent was the legal basis for processing) and there is no other legal ground for processing.
• You object to processing and there are no overriding legitimate grounds for continued processing.
• The data has been unlawfully processed.

This right is not absolute. sura11 may retain data where required to comply with a legal obligation, establish or defend legal claims, or fulfil regulatory retention obligations (see Section 7).

10.4 Right to Restriction of Processing

You may request that sura11 restrict processing of your Personal Data while a dispute regarding accuracy or lawfulness of processing is resolved, or while we verify whether our legitimate grounds override your objection to processing.

10.5 Right to Data Portability

You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format (CSV or JSON) and to transmit that data to another controller, where technically feasible.

10.6 Right to Object

You have the right to object to processing of your Personal Data where the legal basis is legitimate interests. Upon receipt of an objection, sura11 will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

10.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal. To withdraw consent for marketing communications, click the "unsubscribe" link in any promotional email.

10.8 Exercising Your Rights

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Subject Request". Include your registered account username and specify the right you wish to exercise. sura11 will verify your identity before processing the request and will respond within 30 calendar days. No fee is charged for legitimate requests; however, we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

sura11 services are strictly limited to individuals aged 21 years or older. We do not knowingly collect Personal Data from, or provide services to, persons under the age of 21.

All Members are subject to mandatory age verification during the KYC process. If we become aware that a person under 21 has registered an account, that account will be immediately suspended, all pending bets voided, and deposits returned to the source payment method, subject to verification.

Parents and guardians are responsible for monitoring their children's internet activity. If you become aware that a minor has accessed the sura11 Platform or provided Personal Data to us, contact [email protected] immediately.

sura11 operates under an international gaming licence and engages service providers located in various jurisdictions. As a result, your Personal Data may be transferred to, stored in, and processed in countries outside Indonesia.

Where Personal Data is transferred internationally, sura11 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that require the recipient to implement data protection standards equivalent to those applied within the Platform's primary operational jurisdiction.
• Selection of service providers certified under recognised international security and privacy frameworks (e.g., ISO 27001, SOC 2).
• Implementation of technical measures such as encryption during transit and at rest to protect data throughout the transfer process.

You acknowledge and consent to such international data transfers as a necessary component of receiving the services provided by sura11.

The sura11 Platform may contain links to third-party websites or references to third-party services (including payment providers such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft).

sura11 is not responsible for the privacy practices or content of these third-party operators. When you navigate to a third-party site or interact with a third-party service, you are subject to that entity's own privacy policy. We encourage you to review the privacy policies of any third-party service before providing Personal Data to them.

sura11's inclusion of a link to a third-party site does not constitute an endorsement of that site's privacy practices or data-handling standards.

sura11 may send promotional marketing communications to Members who have opted in to receive such communications. Marketing content includes:

• New game launches and featured titles
• Deposit bonus offers and reload promotions
• VIP rewards programme updates
• Seasonal campaigns tied to Indonesian holidays (Idul Fitri, Indonesian Independence Day, Chinese New Year)
• Sports betting specials for major events (EPL, Champions League, BRI Liga 1, World Cup)

How to Opt Out:

• Click the "unsubscribe" link at the bottom of any promotional email to be removed from the marketing list immediately.
• Log in to your sura11 account and update your communication preferences in the account settings panel.
• Contact [email protected] and request removal from marketing communications. Your request will be processed within 48 hours.

Opting out of marketing communications does not affect essential account-related communications, such as transaction confirmations, security alerts, and regulatory notices.

sura11 reserves the right to amend this Privacy Policy at any time to reflect changes in our data-handling practices, legal obligations, or operational requirements. Material changes to this Policy will be communicated to Members via:

• Email notification sent to your registered email address at least 14 days before the revised Policy takes effect.
• A prominent notice displayed on the Platform homepage and at next login.

Continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you must cease using the Platform and contact support to close your account.

The version of this Policy bearing the most recent "Last Updated" date at the top of this page is the version currently in force. Previous versions are available upon request to [email protected].

For any questions, concerns, or requests regarding this Privacy Policy or sura11's data-handling practices, please contact our Data Protection team:

• Email: [email protected] (Subject line: "Privacy Enquiry")
• Live Chat: Available 24/7 within the sura11 Platform
• WhatsApp: +62 811 9876 5432 (08:00–24:00 WIB)

sura11 aims to respond to all privacy-related enquiries within five (5) business days. For data subject access requests and other formal rights requests, the statutory response period is 30 calendar days from receipt of a complete and verified request.

Complaints: If you believe sura11 has processed your Personal Data in a manner inconsistent with this Policy or applicable data protection law, you have the right to lodge a complaint with us directly. We take all privacy complaints seriously and will investigate and respond to your concerns promptly. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction, though we encourage you to contact us first so we may attempt to resolve the matter directly.