Privacy Policy

st789 is committed to protecting the privacy and personal data of every individual who interacts with its platform. This Privacy Policy sets out the principles and practices we follow when collecting, using, storing, and sharing your personal information — and the rights and controls available to you at every stage of your membership.

We operate the st789 platform primarily for Indonesian players, with all financial transactions processed in Indonesian Rupiah (IDR) and all customer communications conducted through channels optimized for the Indonesian market, including WhatsApp and live chat with native Indonesian-speaking support agents available 24/7 across WIB, WITA, and WIT time zones. The data practices described in this policy reflect that specific operational context.

This policy should be read alongside the st789 Terms & Conditions, which together form the complete legal framework governing your membership. Where this policy uses capitalized terms without defining them here, those terms carry the meanings assigned in the Terms & Conditions.

For the purposes of applicable data protection legislation, the data controller responsible for the personal information collected via the st789 platform is the operating entity behind https://st789.ws. Details of the registered operator are available upon written request submitted to [email protected].

When you contact st789 support through live chat, Wh atsApp, or email, you are communicating directly with the data controller's support team. Any data protection queries or formal subject access requests may be directed to the same contact points listed in Section 15 of this policy.

st789 collects only the personal data that is genuinely necessary for the operation of the platform, the fulfilment of regulatory obligations, and the delivery of a secure, personalized member experience. The categories of data we collect are set out in the table below:

We do not collect sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond identity verification images), health data, or criminal records, except where expressly required to satisfy a legal obligation.

st789 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide voluntarily when registering an account, completing KYC verification, submitting a deposit or withdrawal request, or contacting customer support.
• Automated platform activity: Technical and usage data collected automatically as you navigate the platform, including through server logs and session-tracking systems built into the platform infrastructure.
• Cookies and similar technologies: First-party cookies and local storage tokens used to maintain session state, remember login preferences, and collect aggregated analytics. See Section 9 for full details.
• Payment processors and e-wallet providers: Transaction confirmation data returned by payment gateways processing deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC and identity verification providers: Third-party identity verification services may return data attributes (e.g., document authenticity signals, age confirmation flags) as part of the KYC review process.
• Fraud and security monitoring systems: Automated systems that analyze behavioral and technical signals to detect suspicious activity, account compromise, or patterns consistent with bonus abuse or multi-account operation.

st789 processes personal data only where a clear and legitimate purpose exists. The primary purposes for which we process Member data, together with the corresponding legal basis for each, are described below:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent may, in some cases, limit the services st789 is able to provide to you.

st789 does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. We share data only where strictly necessary for platform operations or where required by law, and only with the categories of recipient described below:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP, and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to process deposit and withdrawal transactions.
• KYC and identity verification providers: Third-party KYC service providers receive identity document images and personal details solely for the purpose of age and identity verification. These providers are contractually bound to process data only for that stated purpose.
• Game content providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe may receive anonymized session and gameplay data for technical purposes, such as game round resolution and RTP calculation. No directly identifiable personal data is shared with game studios without explicit necessity.
• Fraud detection and cybersecurity services: Specialist third-party services that assist in identifying fraudulent account activity, multi-accounting, and security threats may process technical data attributes (IP address, device fingerprint) under strict data processing agreements.
• Legal and regulatory authorities: st789 will disclose personal data to competent legal authorities, courts, or regulatory bodies where required to do so by applicable law or valid legal process, including anti-money laundering (AML) reporting obligations.
• Professional advisors: Legal counsel, auditors, and financial advisors may access data on a need-to-know basis, subject to professional confidentiality obligations.

All third parties with whom st789 shares personal data are required to handle that data in accordance with applicable data protection standards and are prohibited from using it for purposes other than those for which it was shared.

st789 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. Our standard retention periods are as follows:

• Active account data: Retained for the full duration of your membership and for a period of 5 years following account closure, to meet anti-money laundering record-keeping requirements and to handle any post-closure disputes or regulatory inquiries.
• Transaction records: Deposit and withdrawal records, including associated financial data, are retained for a minimum of 5 years from the date of each transaction.
• KYC documentation: Identity documents and verification records are retained for the duration of membership plus 5 years following account closure.
• Customer support communications: Live chat transcripts, WhatsApp message logs, and email correspondence are retained for 2 years from the date of the last interaction in a given support thread.
• Technical and usage logs: Server logs, session data, and IP address records are retained for a maximum of 12 months from the date of collection, after which they are anonymized or deleted.
• Cookie and tracking data: Retention periods vary by cookie type and are set out in the cookie table in Section 9.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where anonymization is not technically feasible within a given system, the data will be securely archived with access controls preventing routine operational use.

st789 applies a layered set of technical and organizational security measures to protect Member data against unauthorized access, accidental loss, alteration, or disclosure. Key measures include:

• Transport encryption: All data transmitted between your device and the st789 platform is encrypted using TLS 1.3, the current industry standard for secure web communications. Connections using older, insecure protocols are rejected at the server level.
• Password security: Member passwords are never stored in plain text. They are hashed using the adaptive bcrypt algorithm with a cost factor calibrated to current hardware capabilities, making brute-force attacks computationally impractical.
• Two-factor authentication (2FA): Members may enable 2FA from their account security settings. We strongly encourage all Members to activate this feature, particularly those with significant balance history.
• Access controls: Internal access to Member data is restricted on a strict need-to-know basis. Support agents, finance staff, and technical personnel are granted only the minimum level of data access required to perform their duties. All internal access is logged and periodically audited.
• Intrusion detection: Automated systems continuously monitor the platform for anomalous access patterns, brute-force login attempts, and other indicators of unauthorized access. Detected incidents trigger immediate alerts and escalation procedures.
• Data minimization: Systems are designed to collect and store only the minimum personal data required for each processing purpose, reducing the potential impact of any security incident.

st789 uses cookies and similar browser-based storage technologies to operate the platform correctly, maintain your session while logged in, and gather aggregated usage analytics that help us improve the platform experience. We use only first-party cookies; we do not deploy third-party advertising or cross-site tracking cookies.

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging in and using the platform. Disabling functional or analytics cookies will not affect your ability to play but may reduce the personalization of your experience.

As a Member of the st789 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact the support team using the details in Section 15. st789 will respond to all valid requests within 30 calendar days of receipt.

• Right of access: You may request a copy of the personal data we hold about you, together with information about how it is being processed and for what purpose.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it without undue delay. Certain account data (such as your registered full name and date of birth) may require re-submission of KYC documentation before changes are applied.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and no overriding legitimate interest exists. This right is subject to our legal retention obligations — transaction and KYC records, for example, must be retained for the periods stated in Section 7 regardless of an erasure request.
• Right to restriction of processing: In certain circumstances — for example, while a rectification request is being verified — you may request that we restrict processing of your data to storage only, without using it for other purposes.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you may request a copy of the personal data you provided to us in a structured, commonly used, machine-readable format.
• Right to object: You may object at any time to processing of your personal data that is based on our legitimate interests. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights relating to automated decision-making: Where any decision that significantly affects you is made solely by automated means (without human review), you have the right to request human review of that decision and to contest the outcome.

st789 will never charge a fee for exercising any of the above rights in good faith. However, where requests are manifestly unfounded, repetitive, or excessive, we reserve the right to charge a reasonable administrative fee or decline to act.

The st789 platform is strictly for adults aged 21 and over. We do not knowingly collect, store, or process personal data relating to individuals under the age of 21. Our KYC verification process is specifically designed to confirm that every Member meets the age requirement before any real-money activity is permitted.

If st789 discovers or has reason to believe that an Account is held by a person under the age of 21, the Account will be suspended immediately. Any balance associated with the Account will be withheld pending an age verification review, and any winnings accrued will be forfeited. The personal data associated with the underage Account will be deleted as soon as the investigation is concluded, subject only to any mandatory legal retention obligations.

If you believe that a minor in your household has registered an account on the st789 platform, please contact us immediately at [email protected] so that we can take appropriate action without delay.

The st789 platform does not contain outbound links to third-party websites for advertising or affiliate purposes. Any game studio branding visible within game interfaces (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe) is displayed in the context of licensed game content delivered directly within the st789 platform environment — it does not constitute a link to or endorsement of any external website.

If you navigate away from the st789 platform to any third-party website through means outside the platform itself (e.g., through a browser bookmark or external search result), st789 is not responsible for the privacy practices or content of that external site. We encourage you to review the privacy policy of any website you visit independently.

In some circumstances, personal data collected by st789 may be transferred to, stored in, or processed by systems located outside Indonesia — for example, where cloud infrastructure providers, KYC verification services, or game studio technical systems are hosted in other jurisdictions.

Where such international transfers occur, st789 takes all reasonable steps to ensure that your data receives an equivalent level of protection to that afforded within Indonesia, through the use of standard contractual clauses, data processing agreements with equivalent safeguards, or transfers to jurisdictions recognized as providing adequate data protection standards.

You may request further information about the specific safeguards applied to any international transfer of your data by contacting the support team at the details provided in Section 15.

st789 may update this Privacy Policy from time to time to reflect changes in our data practices, platform functionality, or applicable legal requirements. Where changes are material — for example, where we begin processing a new category of personal data or share data with a new category of third party — we will provide notice to affected Members via a platform notification or email to the registered address on file, no less than 7 calendar days before the updated policy takes effect.

For minor or administrative changes that do not materially affect the way we process your data, we may update the policy without specific advance notice, updating the "Effective" date at the top of the page to reflect the change.

Continued use of the platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you may close your Account before the change takes effect by contacting customer support. The current version of this policy is always accessible at https://st789.ws/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way st789 handles your personal data — including requests to exercise any of your rights under Section 10 — please reach out through any of the following channels:

• Email: [email protected] — for written data protection queries and formal subject access requests. We aim to acknowledge all written requests within 24 hours WIB and provide a substantive response within 30 calendar days.
• WhatsApp: +62 811 0789 789 — available 24 hours a day, 7 days a week, with native Indonesian-speaking agents for immediate assistance.
• Live Chat: Accessible directly from the platform dashboard after logging in — ideal for quick queries about your account data or cookie preferences.

For formal data protection complaints that have not been resolved to your satisfaction through the above channels, you may escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. Details of the applicable authority are available upon request from the support team.