Privacy Policy

ls999 ("we", "us", "our") operates an online sports betting and casino platform accessible at ls999.cam. This Privacy Policy ("Policy") describes how ls999 collects, uses, discloses, stores, and protects personal data relating to individuals who visit or register on our platform ("you", "your", "Member").

This Policy applies to all personal data collected through the ls999 website, its mobile-optimised interface, and any communications sent by ls999 to its members — including email, live chat, and push notifications. It does not apply to the data practices of third-party websites that may be linked to from our platform, even where those links are provided for member convenience.

This Policy should be read alongside our Terms & Conditions, which govern the overall contractual relationship between ls999 and its members, and our Responsible Gaming Policy, which describes how we use certain data to support player welfare obligations.

ls999 is operated by an internationally registered entity (the "Operator"). The Operator acts as the data controller for all personal data collected and processed in connection with the ls999 platform. As data controller , the Operator determines the purposes and means by which personal data is processed.

For any data-related enquiries, requests, or complaints, members may contact the ls999 data team via the support channels listed in Section 14 of this Policy. All requests are handled in accordance with the timelines and procedures set out in this document.

ls999 collects the following categories of personal data:

ls999 does not collect any special categories of sensitive personal data (such as health data, biometric data, racial or ethnic origin, religious beliefs, or political opinions) unless specifically required to fulfil a responsible gaming obligation and with your explicit prior consent.

ls999 collects personal data through the following means:

• Direct submission: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting our support team.
• Automated technical collection: Data gathered automatically by our servers when your device connects to the platform, including IP address, device identifiers, and browser characteristics.
• Cookies and similar technologies: Session cookies, persistent cookies, and analytics pixels placed on your device when you visit ls999.cam. See Section 11 for full details.
• Third-party verification providers: Identity and age verification data returned by our KYC partners when you submit your identity documents for review.
• Payment processors: Confirmation data returned by payment providers such as BCA, BRI, BNI, Mandiri, or e-wallet processors when a transaction is initiated or completed. ls999 does not store full bank account numbers; only the masked account reference required for transaction matching is retained.
• Fraud prevention services: Risk-scoring data and device fingerprinting signals provided by our anti-fraud partners, used to detect and prevent account takeover, identity fraud, and money laundering.

ls999 processes your personal data on the following legal bases and for the following purposes:

Where ls999 relies on legitimate interests as a legal basis, we have assessed that our interests do not override your fundamental rights and freedoms. You may request a copy of that assessment by contacting our data team.

ls999 does not sell or rent your personal data. We share personal data only in the following circumstances and only to the minimum extent necessary:

• KYC and identity verification providers: To verify your identity, age, and the authenticity of the documents you submit as part of the KYC process.
• Payment processors and banking partners: To execute deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. Each processor receives only the data fields required to complete the transaction.
• Fraud prevention and AML screening services: To detect and prevent prohibited activity, including account fraud, identity theft, and money laundering.
• Platform technology providers: Cloud hosting, content delivery, and database providers who process data on our behalf under strict data processing agreements that prohibit independent use of member data.
• Legal and regulatory authorities: Where ls999 is required by applicable law, court order, or regulatory direction to disclose personal data. In such cases, ls999 will notify the affected member unless legally prohibited from doing so.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of ls999's assets, member data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

ls999 operates globally and some of the third-party service providers described in Section 6 may process your personal data in countries outside Indonesia. Where personal data is transferred internationally, ls999 takes appropriate steps to ensure that your data receives an equivalent level of protection to that afforded under applicable data protection principles, including through:

• Data processing agreements containing standard contractual clauses that impose binding data protection obligations on the recipient.
• Transfer only to processors that maintain ISO 27001 certification or an equivalent recognised information security standard.
• Regular audits of third-party data processors to verify ongoing compliance with their contractual and security obligations.

By using the ls999 platform, you acknowledge and consent to your personal data being transferred to and processed in countries outside Indonesia where ls999 or its service providers operate, subject to the safeguards described above.

ls999 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected. The following retention schedules apply:

At the end of the applicable retention period, personal data is securely deleted or permanently anonymised such that it can no longer be linked to an identifiable individual.

ls999 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser and ls999 servers is encrypted in transit using TLS 1.3 with 256-bit cipher suites.
• Data encryption at rest: Sensitive personal data and KYC documents stored on ls999 infrastructure are encrypted at rest using AES-256.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Employees and contractors with access to member data undergo background checks and annual data-security training.
• Two-factor authentication (2FA): All internal administrative systems that can access member data require multi-factor authentication. Members are also strongly encouraged to enable 2FA on their own accounts.
• Intrusion detection and monitoring: ls999's infrastructure is monitored continuously for unusual access patterns, intrusion attempts, and anomalous data queries.
• Penetration testing: Independent security assessments are conducted at least annually by a qualified third-party firm.
• Incident response: In the event of a confirmed data breach that affects member data, ls999 will notify affected members and relevant authorities within 72 hours of becoming aware of the breach, as required by applicable data protection standards.

As a member of ls999, you hold the following rights in respect of your personal data. These rights may be subject to certain limitations where compliance with a legal obligation or the legitimate interests of ls999 or a third party take precedence.

To exercise any of these rights, please contact our data team at [email protected] (plain text — not a clickable link), referencing "Data Rights Request" in your subject line. We will respond within 30 calendar days. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

ls999 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse how members interact with our services. The following cookie categories are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens and CSRF protection tokens. They cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings and display options. These enhance your experience but are not essential to the platform's operation.
• Analytics Cookies: Used to collect aggregated, anonymised data on how members navigate the platform — including page visits, time on site, and feature usage — to help us improve our services. No personally identifiable information is transmitted to our analytics provider.
• Fraud Detection Cookies: Short-lived cookies used by our fraud prevention systems to distinguish legitimate users from automated bots and to detect account takeover attempts. These are strictly necessary for platform security.

You may manage your cookie preferences through your browser settings. Please note that disabling cookies other than strictly necessary ones may affect the functionality of certain platform features. ls999 does not use third-party advertising cookies or cross-site tracking pixels.

ls999 is strictly a platform for adults aged 21 and over. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in the KYC process, and any account found to belong to a person under 21 years of age will be immediately closed.

If you believe that a minor has accessed ls999 or that we have inadvertently collected personal data from a person under 21, please contact our support team immediately at [email protected] (plain text only). We will investigate and take appropriate action, including the deletion of any data collected from the minor, within five (5) business days of notification.

ls999 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will notify registered members via email at least seven (7) days before the revised policy takes effect.

The current version of this Policy, together with the date on which it was last updated, is always available on this page. We encourage you to review this page periodically. Continued use of the ls999 platform after the effective date of any amendment constitutes your acceptance of the revised policy.

If you do not accept the revised Privacy Policy, you must stop using the platform and contact our support team to close your account. Any personal data collected prior to the effective date of the amendment will continue to be governed by the version of the policy in force at the time of collection, except where we are legally required to apply the new policy retroactively.

For any questions, requests, or concerns regarding this Privacy Policy or the way ls999 handles your personal data, please contact our data team through any of the following channels:

• Email: [email protected] (plain text — not a clickable link). Reference "Privacy Policy" or "Data Rights Request" in your subject line. Response time is typically within two (2) business days (WIB business hours).
• Live Chat: Available 24/7 via the support widget on the ls999 platform. Indonesian-speaking agents are available at all hours to assist with data-related enquiries.

If you are not satisfied with our response to a data-related complaint, you have the right to escalate the matter through the appropriate dispute resolution channels. ls999 is committed to resolving all data privacy complaints in good faith and within a reasonable timeframe.

For complaints that cannot be resolved directly with ls999, members may seek independent dispute resolution through a recognised arbitration body, consistent with the dispute resolution provisions set out in our Terms & Conditions.