Privacy Policy

sm605 is committed to responsible data stewardship. We recognize that the players who trust us with their personal information — predominantly Indonesian players depositing in Rupiah (IDR) and engaging with our casino, sportsbook, and gaming products — deserve transparency about exactly how their data is handled at every stage of the account lifecycle.

This Policy applies to all personal data processed by sm605 in connection with the operation of https://sm605.asia, including data collected via the main website, any mobile-optimized versions of the platform, live chat interactions, customer support communications, and payment processing flows. It does not apply to third-party websites, game providers, or payment processors that have their own independent privacy policies, which we encourage you to review separately.

This Policy should be read in conjunction with sm605's Terms & Conditions, which govern the overall relationship between sm605 and registered players.

For the purposes of this Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living natural person, directly or indirectly, including name, identification number, location data, online identifiers, or one or more factors specific to that person's identity.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means sm605, the entity that determines the purposes and means of processing personal data on this platform.
• "Data Processor" means a third party that processes personal data on behalf of sm605 under a written data processing agreement, such as payment processors and identity verification providers.
• "Player" / "User" / "you" means any individual who accesses the sm605 platform, whether as a registered account holder or an unregistered visitor.
• "KYC" (Know Your Customer) means the identity and address verification process required under applicable anti-money laundering obligations and platform policy prior to withdrawal approval.
• "Cookies" means small text files placed on your device by the sm605 website to enable certain platform functionality and to collect analytics data.

sm605 collects the following categories of personal data, depending on how you interact with the platform:

sm605 collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC, submitting a support request, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically as you navigate the platform via server logs, cookies, and similar tracking technologies (see Section 10).
• Payment processors: Transaction confirmation data received from our payment processing partners following a deposit or withdrawal instruction. This data is limited to transaction status, amount, and a reference identifier — not raw payment credentials.
• Identity verification providers: Results of automated or manual document verification checks performed by our KYC service providers, which may include a match score, a pass/fail determination, and flagged discrepancies.
• Fraud detection systems: Signals from third-party fraud intelligence services that help us identify account takeover attempts, bonus abuse patterns, and suspicious transaction behavior.
• Public sources: In limited circumstances related to AML (Anti-Money Laundering) compliance, we may cross-reference data against publicly available sanctions lists or politically exposed persons (PEP) databases.

sm605 processes your personal data only for defined, legitimate purposes. The table below maps each processing purpose to the data categories it involves:

sm605 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required for real-time fraud and AML screening, in which case a flagged account is reviewed by a compliance officer before any adverse action is taken.

sm605 processes personal data only where a valid legal basis exists. The primary bases are:

• Contractual necessity: Processing required to perform the contract between sm605 and the player, including account management, payment processing, and delivery of gaming services.
• Legitimate interests: Processing necessary for sm605's legitimate business interests, including fraud prevention, platform security, and analytics, where those interests are not overridden by the player's rights and freedoms.
• Legal obligation: Processing required to comply with applicable legal obligations, including KYC, AML record-keeping, and responses to lawful requests from competent authorities.
• Consent: Where consent is the chosen basis — for example, for non-essential cookies and for direct marketing communications — sm605 will request explicit consent and will provide a straightforward mechanism to withdraw it at any time without detriment to the player's account standing.

sm605 does not sell, rent, or trade personal data to unaffiliated third parties for their own marketing purposes. Data may be shared in the following limited circumstances:

• Payment processors: Financial data is shared with our certified payment partners (covering local bank transfers via BCA, BRI, BNI, Mandiri, and e-wallets including OVO, DANA, GoPay, ShopeePay, and LinkAja) solely to execute deposit and withdrawal instructions. These processors are bound by data processing agreements and are prohibited from using player data for any other purpose.
• Identity verification providers: Identity and KYC document data is transmitted to our third-party verification service for document authenticity checks and age verification. Results are returned to sm605; documents are not retained by the verification provider beyond the period necessary to complete the check.
• Fraud and AML screening services: Technical and financial data may be checked against third-party fraud intelligence and sanctions databases as part of our AML compliance obligations.
• Game providers: A pseudonymous player identifier (not your full name or financial details) is passed to game providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft to enable game session initialization and round history reconciliation.
• Legal authorities: sm605 will disclose personal data to competent governmental or regulatory authorities where required by a lawful order, subpoena, or equivalent legal process. Where permitted by law, we will notify the affected player of such a disclosure request before complying.
• Business transfers: In the event of a merger, acquisition, or asset sale involving sm605, player personal data may be transferred as part of the transaction. Players will be notified of any such transfer and any material change in data controller identity before it takes effect.

sm605 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. Key retention periods are as follows:

• Active account data (identity, contact, financial, gaming): retained for the duration of the account relationship and for a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• KYC documents: retained for a minimum of five (5) years following account closure, in compliance with applicable financial record-keeping obligations.
• Transaction records: retained for a minimum of five (5) years following each transaction, consistent with financial audit and AML obligations.
• Support communications: retained for three (3) years following the resolution of the relevant support interaction, for dispute resolution and quality assurance purposes.
• Technical and usage logs: retained for up to thirteen (13) months, then automatically purged or anonymized for aggregated analytics.
• Marketing consent records: retained for the duration of the consent and for two (2) years following its withdrawal, as evidence of the consent lifecycle.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized so that it can no longer be attributed to an identified individual.

sm605 implements a layered security architecture designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. Key security measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and sm605 servers. The padlock icon in your browser confirms that a secure connection is active during every session.
• Encryption at rest for sensitive data fields including identity numbers, bank account references, and KYC document files stored on sm605 servers.
• Access controls: personal data is accessible only to authorized sm605 personnel on a strict need-to-know basis. Administrative access to production databases requires multi-factor authentication (MFA).
• Regular security audits and penetration testing conducted by independent third-party security firms to identify and remediate vulnerabilities before they can be exploited.
• Incident response procedures: sm605 maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to the rights and freedoms of affected players, we will notify impacted individuals within 72 hours of becoming aware of the incident, to the extent technically feasible.

sm605 uses cookies and similar technologies (such as local storage and session tokens) to operate the platform, remember your preferences, and analyze how the site is used. The categories of cookies deployed are:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication tokens and security cookies. They cannot be disabled without rendering the platform inoperable. No consent is required for strictly necessary cookies.
• Functional cookies: Remember your preferences — such as language selection, remembered username, and responsible gaming limit settings — to provide a more personalized experience. These are activated based on your account preferences.
• Analytics cookies: Collect aggregated, anonymized data on how players navigate the platform (pages visited, session length, click paths). This data helps sm605 improve the platform's structure and performance. Analytics cookies are activated only with your consent.
• Security and fraud-detection cookies: Help sm605 identify unusual access patterns, bot activity, and account takeover attempts by fingerprinting device and session characteristics.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may impair platform functionality. sm605 does not deploy third-party advertising or behavioral tracking cookies.

As a player whose personal data is processed by sm605, you hold the following rights with respect to your information:

• Right of access: You may request a copy of the personal data sm605 holds about you, along with information about how it is processed.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data. For basic contact information, you may update your details directly within the Account settings panel.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations (see Section 8). Note that AML and KYC records cannot be erased during mandatory retention periods.
• Right to restriction: You may request that sm605 restrict processing of your data in certain circumstances, such as where you contest the accuracy of the data or have objected to processing pending verification of legitimate grounds.
• Right to data portability: You may request that sm605 provide your personal data in a structured, commonly used, machine-readable format, where the processing is based on consent or contractual necessity and is carried out by automated means.
• Right to object: You may object to processing based on legitimate interests or direct marketing at any time. sm605 will cease such processing unless compelling legitimate grounds override your objection.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, contact the sm605 data team via live chat or by emailing [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Identity verification may be required before any request is actioned.

sm605 strictly prohibits the registration and use of the platform by persons under the age of 21. We do not knowingly collect personal data from individuals under 21. Age verification is conducted as part of the KYC process, and accounts found to belong to underage individuals are immediately suspended and all associated data is handled in accordance with applicable child protection obligations.

sm605 primarily stores and processes player data on servers located in secure data center facilities within the Asia-Pacific region. In limited circumstances — for example, where a specialist KYC or fraud-screening service operates infrastructure outside this region — personal data may be transferred internationally.

Where such transfers occur, sm605 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. These safeguards may include contractual data protection clauses, vendor security certifications, or the recipient being subject to a jurisdiction recognized as providing an adequate level of data protection. Details of any specific international transfer arrangements can be provided upon request by contacting support.

sm605 may update this Privacy Policy from time to time to reflect changes in data processing practices, platform features, or applicable legal requirements. When material changes are made, we will notify registered players via a prominent notice displayed upon login, or by email to the address registered with your account, with a minimum of seven (7) days' notice before the revised Policy takes effect.

The current version of this Policy is always accessible at https://sm605.asia/privacy-policy. The "Last Reviewed" date at the top of this page indicates when the Policy was most recently updated. Your continued use of the sm605 platform following the effective date of a revised Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you must cease using the platform and may request voluntary account closure in accordance with the Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact sm605 through the following channels:

• Live Chat: Available 24/7 directly within the sm605 platform. Indonesian-speaking support agents are on hand at all times, operating on WIB (UTC+7) hours. Average first-response time is under 2 minutes.
• Email: [email protected] (plain text — not a clickable link). For data rights requests, use the subject line "Data Rights Request". For privacy concerns or breach notifications, use the subject line "Privacy Concern".