Privacy Policy

Introduction

lego99 ("we," "us," "our") is committed to protecting the privacy and personal data of every individual who visits, registers with, or uses the services available at https://lego99.cam (the "Platform"). This Privacy Policy explains — in plain, transparent language — exactly what personal information we collect from you, why we collect it, how we process and store it, who may receive it, how long we keep it, and what rights you have over your own data.

This Policy applies to all users of the lego99 Platform, including visitors who browse without registering, registered players who hold an account, and any individual who contacts our customer support team. By accessing the Platform or creating an account, you confirm that you have read this Privacy Policy in full and consent to the practices described herein.

If you have questions about this Policy at any time, you are welcome to contact our dedicated Data Privacy team at [email protected]. We aim to respond to all privacy-related enquiries within 48 hours.

1. Definitions

The following terms carry specific meanings throughout this Privacy Policy:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living natural person, including name, email address, telephone number, national identity number, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, or any combination thereof.
• "Controller" — lego99, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" — a third party that processes Personal Data on behalf of lego99 under a binding data-processing agreement.
• "User" / "you" / "your" — any individual who accesses or uses the lego99 Platform.
• "KYC" — Know Your Customer, the identity and age-verification process required under our Terms and Conditions before a User may make their first withdrawal.
• "IDR / Rp" — Indonesian Rupiah, the sole currency supported on the lego99 Platform.

2. Information We Collect

2.1 Information You Provide Directly

When you register for an account or interact with lego99 services, we collect the information you voluntarily provide, which may include:

• Registration data: full legal name, date of birth, email address, telephone number, residential address, and a password you create.
• Identity verification documents (KYC): photographs or scans of your Indonesian national identity card (KTP), passport, or other government-issued identity document; proof-of-address documents such as a recent bank statement or utility bill.
• Payment information: Indonesian bank account details (bank name, account number, account holder name) for BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, or other registered banks; e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja. We do not store full credit card numbers; payment-card data is handled exclusively by our PCI-DSS-compliant payment processors.
• Customer support communications: messages, chat transcripts, email correspondence, and attachments you share with our support team.
• Responsible gaming data: self-exclusion requests, deposit and loss limits you set, session time limits, and self-assessment quiz responses.

2.2 Information Collected Automatically

When you access the lego99 Platform, we automatically collect certain technical and behavioral data through server logs, cookies, and similar tracking technologies:

• Device and technical data: IP address, browser type and version, operating system, device type (desktop / mobile / tablet), screen resolution, language settings.
• Usage and behavioral data: pages visited, features accessed, games played (including game type, bet amounts in IDR, session duration, win/loss outcomes), search queries, click-through paths, and time stamps.
• Transaction data: deposit amounts, withdrawal amounts, payment methods used, transaction dates and times, and transaction reference numbers.
• Location data: approximate geographic location inferred from your IP address (typically accurate to city level — Jakarta, Surabaya, Bandung, Medan, Bali, etc.). We do not use GPS-level precision location tracking.

3. How We Collect Information

We collect Personal Data through the following means:

• Direct input: registration forms, KYC document uploads, deposit and withdrawal requests, customer support contact forms, responsible gaming tool configuration, and account settings updates.
• Automated technologies: first-party cookies, session tokens, web beacons, server-side logging, and device fingerprinting for fraud prevention. See Section 7 (Cookies) for full details.
• Payment service providers: transaction confirmation data and fraud-screening signals from payment processors integrated with Indonesian banking networks (BCA, BRI, BNI, Mandiri) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Game providers: game session data (game ID, provider ID, bet and payout amounts, round duration) from licensed game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and others operating on our Platform.
• Third-party identity verification services: for KYC compliance, we may work with specialized providers to verify the authenticity of identity documents submitted by users.

4. Purposes of Processing

lego99 processes your Personal Data for the following specific purposes:

• Account creation and management: to set up, operate, and maintain your lego99 player account.
• Identity verification and KYC compliance: to confirm you are at least 21 years of age, to verify your identity as required for responsible gaming and fraud prevention, and to comply with applicable regulatory obligations.
• Transaction processing: to process your deposits and withdrawals in IDR via your chosen Indonesian bank or e-wallet and to maintain accurate financial records.
• Customer support: to respond to your enquiries, resolve complaints, and provide assistance with account, payment, and game-related matters.
• Fraud prevention and platform security: to detect, investigate, and prevent fraudulent transactions, money laundering, account takeover attempts, collusion, bonus abuse, and other prohibited activities.
• Responsible gaming: to monitor gaming behavior for signs of problem gambling, to enforce self-exclusion and limit settings you have configured, and to proactively reach out when concerning patterns are detected.
• Legal and regulatory compliance: to comply with applicable Indonesian law and international gaming regulations, including anti-money laundering (AML) obligations, and to respond to lawful requests from governmental or regulatory authorities.
• Service improvement: to analyze usage patterns, identify technical issues, test new features, and continuously improve the lego99 Platform experience.
• Marketing communications (with your consent): to send you promotional offers, bonus notifications, and platform news. You may opt out of marketing emails at any time by contacting support or updating your account notification preferences.

5. Legal Basis for Processing

We rely on the following legal bases when processing your Personal Data:

• Contractual necessity: Processing required to perform our contract with you — including account registration, transaction processing, and customer support.
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, age-verification requirements, and lawful requests from authorities.
• Legitimate interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, and service analytics, where those interests are not overridden by your privacy rights.
• Your consent: Processing based on your explicit consent, such as for marketing communications. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

6. Disclosure and Data Sharing

We may share your Personal Data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

6.1 Payment Processors and Banking Partners

To process your deposits and withdrawals, we share relevant payment details (account number, transaction amounts) with Indonesian banking institutions (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, etc.) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). These parties process your financial data solely to facilitate the requested transaction.

6.2 Identity Verification Providers

For KYC compliance, we work with specialized identity verification service providers who process your identity documents to confirm authenticity and extract verification data. These providers act as Processors under binding data-processing agreements and are prohibited from using your data for any other purpose.

6.3 Licensed Game Providers

Game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and others) receive limited session data (anonymized user token, bet amounts, game outcomes) necessary to operate their games on our Platform. Game providers do not receive your full identity information, contact details, or banking data.

6.4 Legal and Regulatory Authorities

We may disclose Personal Data to Indonesian governmental authorities, law enforcement agencies, regulatory bodies, or courts when required to do so by law, court order, or other binding legal process. We will notify you of such disclosure where we are legally permitted to do so.

6.5 Corporate Transactions

In the event of a merger, acquisition, asset sale, or business restructuring, your Personal Data may be transferred to the acquiring or successor entity. We will notify you by email and/or prominent notice on our website before your data becomes subject to a materially different privacy policy.

7. Cookies and Tracking Technologies

lego99 uses cookies and similar tracking technologies to operate our Platform, authenticate your session, prevent fraud, and analyze usage patterns. We use exclusively first-party cookies; we do not use third-party advertising cookies or tracking pixels from social media companies.

Types of Cookies We Use

• Strictly necessary cookies: Essential for core Platform functionality including user authentication, session management, and security token validation. Cannot be disabled.
• Functional cookies: Store your preferences (e.g., language, odds format, display settings) to personalize your experience. Can be disabled; doing so may impair some Platform features.
• Analytics cookies: Collect anonymized and aggregated data about how visitors use our Platform (pages visited, error rates, load times) to help us identify improvements. These cookies do not track individual identifiers.
• Security and fraud-prevention cookies: Help us detect and prevent fraudulent account activity, bot traffic, and unauthorized access attempts by analyzing behavioral patterns.

Most web browsers allow you to control cookies through their settings. Disabling strictly necessary cookies will prevent you from logging in or using core Platform features. Disabling analytics or functional cookies will not prevent you from accessing the Platform but may reduce personalization.

8. Data Retenti on

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account data: Retained for the duration of your active account relationship with lego99, plus a minimum of five (5) years following account closure to satisfy AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable regulatory obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction in compliance with financial record-keeping requirements.
• Customer support communications: Retained for two (2) years from the date of last interaction, unless the communication relates to an ongoing dispute or legal matter, in which case it is retained until the matter is fully resolved.
• Marketing consent records: Retained for the duration of your account plus three (3) years to demonstrate compliance with consent obligations.
• Technical and usage logs: Retained for up to twelve (12) months for security monitoring and fraud analysis purposes, after which they are deleted or irreversibly anonymized.

When Personal Data is no longer required for any legitimate purpose and no legal retention obligation applies, we securely delete or irreversibly anonymize it so that it can no longer be attributed to you.

9. Security Measures

lego99 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser and our servers is encrypted using industry-standard TLS 1.2 or higher, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Data encryption at rest: Sensitive Personal Data — including identity documents and payment account details — is stored using AES-256 encryption on secured servers with strict access controls.
• Access control and authentication: Internal access to Personal Data is restricted to authorized personnel on a strict need-to-know basis. All staff with data access privileges are required to use multi-factor authentication (MFA) and undergo regular security training.
• Penetration testing and vulnerability assessments: Our infrastructure undergoes regular third-party penetration testing and automated vulnerability scanning to identify and remediate security weaknesses before they can be exploited.
• Intrusion detection and monitoring: We operate 24/7 security monitoring systems that alert our security team to suspicious access patterns, unusual transaction activity, and potential data breach indicators.
• Incident response plan: In the event of a confirmed data breach affecting your Personal Data, we will notify affected users and relevant authorities within the timeframes required by applicable law.

10. Your Privacy Rights

As a user of the lego99 Platform, you have the following rights with respect to your Personal Data. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request." We will respond within 30 days of receiving your request.

Right of Access

You have the right to request a copy of the Personal Data we hold about you, including the categories of data, the purposes for which it is processed, and any third parties with whom it has been shared. We will provide this information free of charge in a commonly used electronic format.

Right to Rectification

If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. You may update most of your account information directly through your account settings page; for changes to identity-verified data (such as legal name or date of birth), please contact our support team.

Right to Erasure

You may request the deletion of your Personal Data in certain circumstances — for example, if the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent and no other legal basis applies. Please note that we may be unable to delete data that we are legally obliged to retain (such as transaction records required for AML compliance).

Right to Restriction of Processing

You have the right to request that we restrict the processing of your Personal Data in certain circumstances, such as while the accuracy of your data is being verified or while an objection to processing is being assessed.

Right to Data Portability

Where processing is based on your consent or on a contract with you, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format, and to request that we transmit it directly to another service provider where technically feasible.

Right to Object

You have the right to object to the processing of your Personal Data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defense of legal claims.

Right to Withdraw Consent

Where we process your Personal Data based on your consent (for example, for marketing communications), you may withdraw that consent at any time by contacting us or updating your account notification preferences. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

11. Protection of Minors

As part of our KYC process, lego99 verifies the age of every user before permitting financial transactions. Any account found to belong to an individual under 21 years of age will be immediately suspended, all balances will be forfeited, and the account will be permanently closed. If you believe a minor has registered on our Platform using false information, please notify us immediately at [email protected].

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gaming platforms. For guidance on responsible gaming tools and age-restriction resources, please visit our Responsible Gaming page.

12. International Data Transfers

lego99 primarily stores and processes Personal Data on servers located in secure data centers within the Asia-Pacific region. In limited circumstances, data may be processed by our service providers in other jurisdictions — for example, by cloud infrastructure providers or licensed game studios based in Europe or other regions.

Whenever Personal Data is transferred outside Indonesia, we take appropriate steps to ensure that the receiving party provides an adequate level of data protection, including through:

• Contractual data-protection clauses incorporated into agreements with all international Processors.
• Selecting third-party partners that maintain internationally recognized security certifications (such as ISO/IEC 27001) and, where applicable, comply with recognized data-protection frameworks.
• Conducting due-diligence assessments of the data-protection practices of all third-party Processors before onboarding them.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send a notification email to your registered email address summarizing the key changes.
• Display a prominent notice on the lego99 Platform for at least 14 days following publication of the updated Policy.

Your continued use of the lego99 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the Platform and request account closure.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way lego99 handles your Personal Data, please contact our Data Privacy team:

By continuing to use the lego99 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your information as described herein. Thank you for trusting lego99 with your personal data.