SCOPE OF THIS POLICY: This Privacy Policy applies to all personal data processed by sapu4 in connection with the website https://sapu4.cam and all associated services, mobile interfaces, and customer support channels. It covers data belonging to registered Players, prospective registrants, and any individual who contacts sapu4 through any of our support channels. By creating an Account or continuing to use the sapu4 Platform, you acknowledge that you have read and understood this Policy.
1 Definitions
The following capitalized terms carry the meanings set out below throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably be used to identify a living individual, directly or indirectly. Includes name, national ID number, email address, IP address, device identifiers, and financial account details. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction. |
| "Data Controller" | sapu4, the entity that determines the purposes and means of processing your Personal Data. |
| "Data Processor" | A third party that processes Personal Data on sapu4's behalf under a binding data-processing agreement — for example, a payment gateway or KYC verification provider. |
| "Platform" | The sapu4 website (https://sapu4.cam), related mobile interfaces, applications, and all associated gaming and payment services. |
| "KYC" | Know Your Customer — the identity verification process that confirms a Player's legal name, age, and address using government-issued documents. |
| "Cookies" | Small text files stored on your device by a web browser that record information about your visit, preferences, and session state. |
2 Data We Collect
sapu4 collects only the Personal Data that is necessary for the purposes described in this Policy. The categories of data we process are set out below:
2.1 Account Registration Data
- Full legal name (as it appears on your government-issued identity document)
- Date of birth (used to verify the 21+ age requirement)
- Email address (primary communication and account-recovery channel)
- Mobile phone number (used for two-factor authentication and transaction alerts)
- Residential address in Indonesia (city, province, postal code)
- Preferred language and currency (IDR)
2.2 Identity Verification (KYC) Data
- Indonesian National Identity Card (KTP) image — front and back
- Selfie photograph of the Player holding their KTP
- Proof of address document (utility bill, bank statement, or equivalent)
- Source-of-funds declaration (required for high-volume accounts)
2.3 Financial Data
- Bank account details (bank name, account number) for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, or BSI accounts
- E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja accounts
- Transaction history (deposits, withdrawals, Wager amounts, Winnings)
2.4 Technical and Usage Data
- IP address and approximate geographic location (city/region level)
- Device type, operating system, and browser version
- Session timestamps, page-visit logs, and feature-usage patterns
- Game history and betting patterns (used for responsible gaming monitoring)
2.5 Communications Data
- Content of messages sent to sapu4 via email or live chat support
- Records of promotional communications you have received and whether you opened or acted on them
3 How We Collect Data
3.1 Directly from You
The majority of your Personal Data is provided directly by you when you register an Account, complete KYC verification, submit a deposit or withdrawal request, contact our support team, or participate in a promotion. You are always informed of the purpose at the point of collection.
3.2 Automatically via Technical Systems
When you access the sapu4 Platform, our servers automatically record certain technical data including your IP address, device identifiers, browser type, and session activity. This data is collected via server logs, cookies, and similar tracking technologies described in Section 9.
3.3 From Third-Party Service Providers
sapu4 may receive data about you from carefully selected third-party providers including KYC verification platforms, fraud-detection services, and payment processors. All such providers are bound by contractual obligations that restrict their use of your data to the specific services they perform for sapu4.
sapu4 does not purchase marketing lists or acquire Personal Data from data brokers. All Personal Data we hold was either provided by you directly or received from a service provider acting on our behalf.
4 Purposes of Processing
sapu4 processes your Personal Data for the following clearly defined purposes:
| Purpose | Data Categories Used |
|---|---|
| Account creation and management | Registration data, technical data |
| Age and identity verification (KYC) | KYC documents, registration data |
| Processing deposits and withdrawals | Financial data, KYC data |
| Anti-money-laundering (AML) compliance | Financial data, KYC data, transaction history |
| Fraud prevention and platform security | Technical data, financial data, betting patterns |
| Responsible gaming monitoring | Betting history, session data, registration data |
| Customer support and dispute resolution | Communications data, account data, transaction history |
| Promotional communications (opt-in only) | Registration data, game-preference data |
| Platform analytics and performance improvement | Technical data, usage data (anonymized where possible) |
5 Legal Basis for Processing
5.1 Contract Performance
Processing your Account registration data, KYC documents, and financial data is necessary for sapu4 to deliver the services you have contracted for — including account access, game participation, and payment processing. Without this data, sapu4 cannot legally or operationally provide its services.
5.2 Legal Obligation
sapu4 is required by its operating license and applicable international anti-money-laundering regulations to verify the identity of all Players, monitor transactions for su spicious activity, and maintain transaction records for a defined retention period. This processing is not optional — it is mandated by law.
5.3 Legitimate Interests
sapu4 processes certain data on the basis of legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and analytics to improve user experience. In each case, sapu4 has conducted a balancing assessment to confirm that the processing does not override your fundamental rights and freedoms.
5.4 Consent
Where sapu4 processes data for marketing communications or non-essential cookies, we do so only with your explicit consent. You may withdraw consent at any time by adjusting your Account preferences or contacting our support team.
6 Data Sharing and Third-Party Disclosure
6.1 Service Providers (Data Processors)
sapu4 shares Personal Data with trusted third-party service providers who perform essential functions on our behalf. These providers are contractually obligated to process data only according to our instructions and to implement appropriate security measures. Categories of service providers include:
- KYC and identity verification platforms
- Payment gateways and financial-transaction processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay integrations)
- Fraud-detection and AML-screening services
- Cloud hosting and infrastructure providers
- Customer support platforms
- Email service providers (for transactional and promotional emails)
6.2 Game Providers
When you play a game provided by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, or Spribe), limited technical data (Player ID, Wager amounts, game outcomes) is shared with that provider to enable game functionality. These providers operate under their own privacy policies; sapu4 selects only providers with strong data-protection standards.
6.3 Legal and Regulatory Authorities
sapu4 may disclose Personal Data to law enforcement, regulatory bodies, or courts when required by law, court order, subpoena, or to protect the legal rights and safety of sapu4, its users, or the public. Such disclosures are made only to the extent necessary and lawfully required.
6.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your Personal Data may be transferred to the acquiring entity as part of the transaction. You will be notified via email of any such transfer, and the acquiring entity will be required to honor this Privacy Policy.
sapu4 does not sell, rent, or trade Personal Data to third parties for their marketing purposes. Any data sharing is limited to the operational and legal purposes described in this section.
7 Data Retention
7.1 Active Account Data
Personal Data associated with active Accounts is retained for as long as your Account remains open and for a period thereafter as required by applicable legal and regulatory obligations.
7.2 Post-Closure Retention
After you close your Account, sapu4 retains your Personal Data for a period of seven (7) years to comply with anti-money-laundering record-keeping requirements, tax obligations, and to defend potential legal claims. After this period, data is securely deleted or anonymized.
7.3 Marketing Data
If you have consented to receive marketing communications and subsequently withdraw that consent, sapu4 will cease processing your data for marketing purposes immediately. However, your email address will be retained on a suppression list to ensure you do not receive further marketing messages.
7.4 Technical and Analytics Data
Aggregated and anonymized analytics data (which cannot identify you personally) may be retained indefinitely for statistical and business-intelligence purposes.
8 Data Security
8.1 Technical and Organizational Measures
sapu4 implements industry-standard security measures to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. These measures include:
- 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
- Encrypted storage of sensitive data fields including passwords, KYC documents, and financial account details
- Multi-factor authentication (MFA) for Account access
- Regular security audits and penetration testing by independent third-party firms
- Access controls ensuring that only authorized personnel can access Personal Data, strictly on a need-to-know basis
- Staff training on data-protection principles and secure handling procedures
8.2 Your Security Responsibilities
While sapu4 implements robust technical safeguards, security is a shared responsibility. You must:
- Choose a strong, unique password and never share it with anyone
- Enable two-factor authentication (2FA) on your Account
- Log out of your Account when using shared or public devices
- Notify sapu4 immediately if you suspect unauthorized Account access
In the unlikely event of a data breach affecting your Personal Data, sapu4 will notify you via email within 72 hours of becoming aware of the breach, in accordance with applicable data-protection regulations.
9 Cookies and Tracking Technologies
9.1 What Are Cookies?
Cookies are small text files stored on your device when you visit the sapu4 Platform. They enable the website to remember your preferences, keep you logged in across sessions, and provide analytics data that helps us improve the user experience.
9.2 Types of Cookies We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential Cookies | Required for login, session management, and security features. Cannot be disabled without breaking core functionality. | Session or up to 30 days |
| Functional Cookies | Remember your language preference, display settings, and previously entered data to enhance usability. | Up to 1 year |
| Analytics Cookies | Collect anonymized data on page visits, session duration, and user-flow patterns to help us optimize the Platform. | Up to 2 years |
| Marketing Cookies | Track your interaction with promotional campaigns (only with explicit consent). Used to deliver relevant offers. | Up to 1 year |
9.3 Managing Cookies
You can control or delete cookies through your browser settings. Note that disabling essential cookies will prevent you from logging in to your Account. Most browsers allow you to block third-party cookies while still accepting first-party cookies from sapu4.
10 Your Rights Over Your Personal Data
As a data subject, you hold the following rights under applicable data-protection laws. sapu4 is committed to honoring these rights without undue delay.
Right of Access
You may request a copy of all Personal Data sapu4 holds about you. We will provide this in a structured, commonly used, and machine-readable format within 30 days of your request.
Right to Rectification
If any of your Personal Data is inaccurate or incomplete, you have the right to request that sapu4 correct or update it. Most Account details can be updated directly from your Account settings.
Right to Erasure (Right to be Forgotten)
You may request deletion of your Personal Data in certain circumstances — for example, if the data is no longer necessary for the purposes it was collected, or if you withdraw consent. This right is subject to sapu4's legal retention obligations.
Right to Restrict Processing
You may request that sapu4 temporarily suspend processing of your Personal Data in specific circumstances, such as while we verify the accuracy of disputed data.
Right to Data Portability
You have the right to receive your Personal Data in a portable format and request that it be transmitted directly to another service provider where technically feasible.
Right to Object
You may object to processing of your Personal Data based on legitimate interests (such as direct marketing). sapu4 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
To exercise any of the rights above, please email [email protected] with the subject line "Data Subject Request" and provide your full name, registered email address, and a description of the right you wish to exercise. We will respond within 30 days.
11 Minors and Age Verification
sapu4 does not knowingly collect or process Personal Data belonging to individuals under the age of 21. Our Platform is intended exclusively for adults who meet the legal gambling age in their jurisdiction. All Players must be at least 21 years of age to register an Account.
During the KYC process, sapu4 verifies each Player's date of birth against a government-issued identity document. If we discover that an Account belongs to an individual under 21 years of age, we will immediately close the Account, forfeit any Winnings, and delete all associated Personal Data except as required for regulatory record-keeping.
If you are a parent or guardian and believe your child has provided Personal Data to sapu4, please contact us immediately at [email protected]. We will take prompt action to delete the data and close the Account.
12 International Data Transfers
sapu4's primary operations and data-storage infrastructure are located in jurisdictions with robust data-protection frameworks. However, some of our service providers (such as cloud-hosting platforms, payment processors, and game studios) may be located outside Indonesia.
When Personal Data is transferred internationally, sapu4 ensures that appropriate safeguards are in place, including:
- Standard contractual clauses approved by relevant data-protection authorities
- Ensuring the receiving jurisdiction provides an adequate level of data protection
- Binding corporate rules where transfers occur within a multinational service provider
Your Personal Data will never be transferred to a jurisdiction with inadequate data-protection standards unless explicit consent is obtained or the transfer is necessary to fulfill a contract with you.
13 Policy Amendments
sapu4 reserves the right to update this Privacy Policy from time to time to reflect changes in our data-processing practices, regulatory requirements, or operational improvements. When material changes are made, we will notify you via email and display a prominent notification on the Platform.
The updated Privacy Policy will take effect on the date specified in the notification, which will be no less than 14 days after the notice is issued. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy. If you do not agree with the changes, you may close your Account as described in our Terms & Conditions.
We recommend reviewing this Privacy Policy periodically. The "Effective Date" displayed at the top of this page indicates when the current version came into force.
14 Contact and Complaints
14.1 Data Protection Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or how sapu4 processes your Personal Data, please contact our support team:
- Email: [email protected]
- Response Time: Within 48 hours for privacy-related inquiries
14.2 Filing a Complaint
If you believe sapu4 has processed your Personal Data in violation of applicable data-protection laws, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. We encourage you to contact us first so we can attempt to resolve the issue directly.
How sapu4 Protects Your Data
Privacy is not a technical footnote — it is a core commitment embedded in every layer of our platform.
End-to-End Encryption
All data transmitted between your device and sapu4 servers is protected by 256-bit SSL/TLS encryption — the same standard used by banks and financial institutions worldwide.
Minimal Data Collection
We collect only the data necessary to deliver our services, comply with legal obligations, and protect Platform security. No invasive tracking, no data sold to third parties.
Strict Access Controls
Personal Data is accessible only to authorized sapu4 staff who require it to perform their duties. All access is logged and audited regularly.
Third-Party Audits
sapu4 undergoes regular independent security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited.
Legal Retention Only
Your Personal Data is retained only as long as required by anti-money-laundering laws and tax regulations — typically seven years post-closure. After that, it is securely deleted.
Transparent Rights
You can access, correct, delete, or export your Personal Data at any time. sapu4 responds to all data-subject requests within 30 days — no bureaucracy, no hidden fees.
Questions About Your Privacy?
Our support team is available 24/7 to answer any questions about how your data is collected, used, or stored. You can also explore our FAQ or review our full Terms & Conditions.