Privacy Policy — hgi909

Definitions

In this Privacy Policy, the following terms have the meanings assigned below:

• "hgi909" — The operator of the hgi909 platform accessible at hgi909.net, including its parent entities, subsidiaries, officers, employees, agents, and data processors acting on its behalf.
• "Platform" — The hgi909 website and all associated services, including the sportsbook, live casino, slot games, roulette, bingo, account management interfaces, and payment facilities.
• "Member" / "You" — Any individual who has registered an account on the Platform or who accesses the Platform as a visitor.
• "Personal Data" — Any information that identifies or can reasonably identify a natural person, directly or in combination with other data. This includes name, contact details, financial information, device identifiers, and behavioral data.
• "Processing" — Any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, and deletion.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, hgi909 acts as Data Controller in respect of all Member data.
• "Data Processor" — A third party that processes Personal Data on behalf of hgi909 under a data processing agreement, for example a payment gateway provider or identity verification service.
• "KYC" — Know Your Customer — the identity and age verification process conducted by hgi909 as part of its anti-money-laundering compliance obligations.

Scope & Controller

This Privacy Policy applies to all Personal Data collected by hgi909 in connection with the operation of the Platform, regardless of whether you access the Platform via a desktop browser, a mobile browser, or any other interface made available by hgi909 from time to time.

hgi909 acts as the Data Controller for the Personal Data of all registered Members and Platform visitors. This Policy governs hgi909's data practices for users located in Indonesia and any other territory from which the Platform is accessed.

This Policy should be read alongside hgi909's Terms & Conditions, which set out the broader contractual relationship between hgi909 and its Members. By registering an account or continuing to use the Platform, you confirm that you have read and understood this Privacy Policy.

Data We Collect

hgi909 collects the following categories of Personal Data in connection with your use of the Platform:

How Data Is Collected

hgi909 collects Personal Data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, submitting a support request, or communicating with our team via live chat or email.
• Automated collection: Technical Data collected automatically each time you visit the Platform, including via server logs, session cookies, and analytics tools that record how you interact with the interface.
• Third-party sources: Identity and address verification data received from licensed KYC service providers where you have authorised us to conduct verification checks. Financial transaction data received from payment processors and banking partners including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Device and browser signals: Device fingerprint data, IP geolocation (used to detect access from restricted jurisdictions and to support responsible gaming controls), and browser language settings.

Purposes & Legal Basis for Processing

hgi909 processes your Personal Data only where a valid legal basis exists. The primary purposes and their corresponding legal bases are as follows:

• Account creation and management — Processing is necessary for the performance of a contract with you (the Member Agreement formed when you register). We process Identity Data and Contact Data to create and maintain your account.
• Payment processing — Processing is necessary for the performance of a contract. Financial Data is processed to facilitate deposits and withdrawals in Indonesian Rupiah via local banking and e-wallet channels.
• Identity verification (KYC) and anti-money-laundering compliance — Processing is required to comply with legal obligations under applicable anti-money-laundering standards. We process Identity Data and Verification Documents to confirm your age (21+), your identity, and the legitimacy of your funds.
• Fraud prevention and platform security — Processing is necessary for the legitimate interests of hgi909 and its Members in maintaining a secure, fair, and fraud-free gaming environment. Technical Data and Gaming Activity Data are monitored for anomalous patterns indicative of multi-accounting, collusion, or financial crime.
• Customer support — Processing is necessary for the performance of a contract. Communications Data is processed to respond to your support requests and resolve account issues efficiently.
• Responsible gaming monitoring — Processing is in hgi909's legitimate interest and that of its Members to identify signs of problem gambling and to comply with its duty of care obligations. Gaming Activity Data is reviewed to support early intervention and activation of protective tools.
• Direct marketing communications — Where you have given your explicit consent, Contact Data may be used to send you promotional offers, bonus notifications, and platform updates. You may withdraw this consent at any time via your account settings or by contacting [email protected].
• Platform analytics and improvement — Processing is in hgi909's legitimate interest to improve the functionality, speed, and user experience of the Platform. Technical Data is aggregated and anonymised before use in analytics reporting wherever possible.

Sharing & Disclosure of Personal Data

hgi909 does not sell Personal Data. We share Personal Data only in the following limited circumstances, and only to the extent strictly necessary for the stated purpose:

• Payment service providers: Financial Data is shared with banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute deposits and withdrawals. These providers act as independent data controllers for their own services and are governed by their respective privacy policies.
• KYC and identity verification partners: Identity Data and Verification Documents are shared with licensed third-party KYC service providers for age and identity verification purposes. All such providers are contractually bound to use the data only for verification and to maintain security standards equivalent to those applied by hgi909.
• Game content providers: Aggregated, pseudonymised gameplay data may be shared with licensed game studios — including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, and Spribe — for the purpose of game integrity monitoring, RTP auditing, and jackpot seed management. Individually identifiable data is not shared with game studios.
• Regulatory and law enforcement authorities: hgi909 will disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or lawful regulatory demand. hgi909 will, where legally permitted, notify affected Members of such disclosure.
• Professional advisers: Personal Data may be shared with hgi909's legal, audit, and compliance advisers on a strictly need-to-know basis and subject to professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or a material part of hgi909's business, Member Personal Data may be transferred to the acquiring entity as part of that transaction. Affected Members will be notified in advance of any such transfer and of any change in data controller identity.

Data Retention

hgi909 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, subject to minimum retention periods imposed by legal and regulatory obligations:

• Account and identity data: Retained for a minimum of five (5) years following the date of account closure. This period reflects standard anti-money-laundering record-keeping requirements.
• Financial transaction data: Retained for a minimum of five (5) years from the date of each transaction, in line with AML compliance standards.
• KYC documentation: Retained for a minimum of five (5) years from the completion of the verification process or the date of account closure, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the most recent support interaction, unless the interaction forms part of an ongoing dispute or legal proceeding.
• Technical and analytics data: Anonymised or aggregated analytics data may be retained indefinitely. Non-anonymised Technical Data such as IP logs is retained for thirteen (13) months and then deleted or anonymised.
• Marketing consent records: Records of your consent to, or withdrawal of consent from, direct marketing communications are retained for the duration of your account plus three (3) years to enable us to demonstrate compliance.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with hgi909's internal data disposal procedures.

Security Measures

hgi909 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, alteration, disclosure, and destruction:

• Encryption in transit: All data exchanged between your device and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL). The Platform is served exclusively over HTTPS.
• Encryption at rest: Sensitive Personal Data — including identity documents, financial account details, and authentication credentials — is encrypted at rest using industry-standard symmetric encryption algorithms.
• Access controls: Access to Personal Data within hgi909's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, and all access events are logged and auditable.
• Two-factor authentication: hgi909 offers two-factor authentication (2FA) for Member accounts. We strongly encourage all Members to enable 2FA via their account security settings to reduce the risk of unauthorised account access.
• Penetration testing: The Platform undergoes regular third-party security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident response: hgi909 maintains a documented data breach response procedure. In the event of a personal data breach that poses a material risk to affected Members, hgi909 will notify those Members without undue delay and will report the breach to the appropriate authority where required by applicable law.

Cookies & Tracking Technologies

hgi909 uses cookies and similar client-side storage technologies to operate the Platform and to understand how Members use it. The following cookie categories are deployed:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your visit, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without preventing access to the Platform.
• Functional cookies: Used to remember your preferences such as language settings, preferred deposit method, and responsible gaming limit configurations. Disabling these cookies will not prevent Platform access but may reduce convenience.
• Analytics cookies: Used to collect aggregated, anonymised data about how visitors navigate the Platform — for example, which pages are most visited and where users encounter errors. This data is used exclusively to improve the Platform and is not linked to individual Member identities.

hgi909 does not deploy advertising cookies, behavioural tracking pixels, or any technology that shares your browsing data with third-party advertising networks. Your cookie preferences for non-essential cookies can be managed through your browser settings. Note that disabling all cookies may impair Platform functionality.

Your Privacy Rights

As a Member of hgi909, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request" and include your registered username and a description of your request.

• Right of access: You have the right to request a copy of the Personal Data hgi909 holds about you, together with information about how it is being processed.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Many contact details can be updated directly through your account dashboard.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the processing has no other lawful basis. Note that erasure requests are subject to our legal retention obligations — data required for AML compliance cannot be deleted during the mandatory retention period.
• Right to restriction: You may request that we restrict processing of your Personal Data in certain circumstances, for example while the accuracy of data is being contested or where processing is unlawful but you prefer restriction over deletion.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, you may request that we provide your Personal Data in a structured, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling for responsible gaming purposes. hgi909 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent — for example, for direct marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

hgi909 will respond to all valid privacy rights requests within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case you will be notified of the extension and the reason for it.

Minors — 21+ Policy

The hgi909 Platform is strictly intended for individuals who are 21 years of age or older. hgi909 does not knowingly collect Personal Data from persons under the age of 21. If we become aware that an account has been registered by or on behalf of a person under 21, that account will be immediately suspended, all associated data will be flagged for review, and any deposits will be returned to the verified payment source.

If you are a parent or guardian and believe that a person under 21 in your care has registered an hgi909 account, please contact [email protected] immediately with the relevant details. hgi909 will investigate and take appropriate action without undue delay.

International Data Transfers

hgi909's primary data infrastructure is hosted on servers located within secure, internationally certified data centers. In some circumstances — particularly where third-party service providers such as KYC verification partners or game content providers are based outside Indonesia — your Personal Data may be transferred to and processed in a jurisdiction other than Indonesia.

Where such transfers occur, hgi909 ensures that appropriate safeguards are in place to protect your Personal Data to a standard at least equivalent to that applied within Indonesia. Safeguards include:

• Data processing agreements with contractual clauses requiring equivalent data protection standards.
• Transfer only to jurisdictions that maintain recognised data protection frameworks.
• Regular review of third-party compliance with contractual data protection obligations.

Changes to This Privacy Policy

hgi909 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory guidance. When material changes are made, hgi909 will:

• Update the "Last updated" date at the top of this page.
• Display a notice within the Platform notifying logged-in Members of the update.
• Where the change materially affects how we process your data, provide at least 14 days' advance notice before the new terms take effect, giving you the opportunity to review the changes and, where applicable, to withdraw consent.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the changes. We encourage you to revisit this page periodically to stay informed of how hgi909 protects your information.

Contact & Complaints

For any privacy-related queries, requests to exercise your data rights, or concerns about how hgi909 processes your Personal Data, please contact us using the details below:

• Email: [email protected] (subject line: "Privacy Rights Request")
• Live chat: Available 24 hours a day, 7 days a week, directly within the Platform — average response under 2 minutes during WIB business hours.
• Response time: Written requests are acknowledged within 5 business days and fully resolved within 30 calendar days.

If you are not satisfied with hgi909's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction or to seek resolution through independent arbitration as described in the Terms & Conditions.