Privacy Policy

sona4d ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who visits, registers with, or transacts on our online betting and gaming platform at sona4d.com. This Privacy Policy is part of our broader commitment to operating as a transparent, trustworthy, and responsible platform for players across Indonesia — from Jakarta and Surabaya to Bandung, Medan, Bali, and beyond.

This policy applies to all personal data processed by sona4d in connection with the use of our website, mobile web interface, customer support channels, payment systems, and any other services offered under the sona4d brand. It should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference.

By accessing the sona4d Platform or registering a sona4d Account, you acknowledge that you have read, understood, and agreed to the data practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the Platform and contact our support team to close your account.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably identify a living natural person, directly or indirectly — including name, identification number, location data, online identifiers, or factors specific to the physical, economic, or social identity of that person.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
• "Controller" refers to sona4d as the entity that determines the purposes and means of processing your personal data.
• "Processor" means any natural or legal person that processes personal data on behalf of sona4d — such as our payment gateway partners, KYC verification providers, and cloud infrastructure providers.
• "Member" means any registered user of the sona4d Platform who has created an Account in accordance with our Terms & Conditions.
• "Cookies" means small text files placed on your device by our website or third-party services to store and retrieve information about your browsing session and preferences.
• "KYC" means Know Your Customer — the identity verification process required before we process any withdrawal from your sona4d Account.
• "AML" means Anti-Money Laundering — the set of compliance procedures sona4d maintains to prevent the use of our Platform for financial crime.

sona4d collects only the personal data necessary to deliver our services, meet our legal obligations, and maintain the security and integrity of the Platform. The categories of personal data we collect are set out below.

When you create a sona4d Account, we collect:

• Full legal name as it appears on your government-issued identification document.
• Date of birth (to verify you are at least 21 years of age).
• Email address (personal, not shared with another registered user).
• Indonesian mobile phone number.
• City or region of residence within Indonesia (e.g., Jakarta, Surabaya, Bandung, Bali, Yogyakarta).
• Username and encrypted password credentials.

To process withdrawals and comply with AML obligations, we collect:

• Copies of government-issued photo identification (Indonesian KTP, SIM, or passport).
• Proof of address documentation where required.
• Selfie or liveness-check images for biometric identity confirmation.
• Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet details (OVO, DANA, GoPay, ShopeePay, LinkAja) registered in your name.

All deposits and withdrawals processed through the sona4d Platform generate transaction records, including:

• Transaction reference numbers, amounts (in Indonesian Rupiah / IDR), timestamps, and status.
• Payment method identifiers (masked bank account numbers or e-wallet IDs).
• Bonus redemption records, wagering history, and balance movements.

We record all Platform activity, including sports betting selections (BRI Liga 1, EPL, La Liga, Champions League, FIFA World Cup, esports MPL Mobile Legends), casino game sessions (baccarat, roulette, blackjack via Evolution Gaming), slot activity (Pragmatic Play, Microgaming, NetEnt, Spribe, Pocket Games Soft), togel (Indonesia's traditional numbers lottery) draw entries, and any mix parlay (accumulator/parlay) ticket submissions.

When you access the sona4d Platform, we automatically collect:

• IP address and approximate geolocation (country, province, city level).
• Device type, operating system, and browser version.
• Session start and end timestamps (WIB, UTC+7 as default time zone).
• Pages visited, clicks, scroll depth, and navigation path within the Platform.
• Referral source (the URL from which you arrived at sona4d.com).

If you contact our customer support team via live chat or email ([email protected]), we retain records of those communications, including the content of messages, timestamps, and any resolution notes added by our support agents.

sona4d collects personal data through the following channels:

sona4d processes your personal data for the following specific purposes:

To create and maintain your sona4d Account, authenticate your identity at login, enforce single-account policies, and communicate essential account notifications (security alerts, withdrawal confirmations, policy update notices).

To execute deposit credits and withdrawal disbursements to your verified Indonesian bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain the transaction records required for financial compliance.

To verify that all Members are real individuals aged 21 or over, to screen against sanctions lists and politically exposed persons (PEP) databases, and to monitor transaction patterns for indicators of money laundering, fraud, or other financial crime in accordance with internationally recognised AML standards.

To power our responsible gaming tools — deposit limits, session time limits, cooling-off periods, and self-exclusion — and to identify behavioural patterns that may indicate a Member is experiencing gambling-related harm, so that we can intervene proactively and in accordance with our duties as a licensed operator.

To detect and prevent account takeover attempts, credential stuffing, bonus abuse, multi-accounting, use of automated bots or scripts, and any other activity that threatens the integrity of the sona4d Platform or the interests of legitimate Members.

To analyse aggregated, pseudonymised usage data — page performance, navigation flows, game popularity, deposit conversion rates — for the purpose of improving the Platform's functionality, user experience, and product offering. Individual-level data is not used for this purpose without your consent.

To investigate and resolve enquiries, complaints, and disputes submitted to our 24/7 support team. Support communications are retained in accordance with our data retention schedule (see Section 8).

Where you have opted in to receive marketing communications, we may use your gameplay history and deposit behaviour to deliver personalised bonus offers — for example, targeted promotions during Idul Fitri, Ramadhan, or Indonesian Independence Day (17 August). You may withdraw consent for marketing communications at any time via your account settings or by contacting our support team.

sona4d processes your personal data on the following legal bases, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to perform our contract with you as a registered Member — including account creation, payment execution, and game delivery — is carried out on this basis.
• Legal Obligation: Processing necessary to comply with applicable law and regulatory requirements — including KYC identity verification, AML transaction monitoring, and data retention mandated by our licensing authority — is carried out on this basis.
• Legitimate Interests: Processing carried out to protect the Platform's security, prevent fraud, improve our services, and operate responsible gaming safeguards is carried out on the basis of sona4d's legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional marketing communications and personalised promotional offers is carried out on the basis of your freely given, specific, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

sona4d does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We share personal data only in the specific, limited circumstances described below.

We engage trusted third-party service providers — acting as data processors under our instruction — to support the technical operation of the Platform. These include payment gateway operators (for BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and other Indonesian payment methods), KYC and identity verification providers, cloud hosting and infrastructure providers, fraud prevention and device fingerprinting services, and customer support software vendors. All processors are bound by contractual data processing agreements that restrict their use of your data to the purposes for which it was shared.

We may disclose your personal data to law enforcement agencies, regulatory bodies, tax authorities, or courts where we are legally compelled to do so by a valid legal process — such as a court order, subpoena, or regulatory direction. We will, where legally permitted, notify you of such a disclosure request before complying.

In the event of a merger, acquisition, asset sale, or corporate restructuring involving sona4d, your personal data may be transferred to the successor entity. We will notify you of any such transfer and your rights in respect of your data before the transfer takes effect.

We may share your data with third parties where you have provided your explicit, informed consent to that specific sharing arrangement. You may withdraw such consent at any time.

sona4d retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or our licensing authority's record-keeping obligations. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

sona4d implements a comprehensive, layered information security framework designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our key security controls include:

• 256-bit TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard TLS protocols. Our SSL certificate status is publicly verifiable.
• Encryption at Rest: Sensitive personal data — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256 symmetric encryption on access-controlled, enterprise-grade cloud infrastructure.
• Password Hashing: Account passwords are never stored in plain text. We apply a modern, computationally expensive one-way hashing algorithm (bcrypt or Argon2) with per-user salts.
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA on their sona4d Accounts for an additional layer of login security.
• Access Controls: Internal access to Member personal data is strictly limited on a need-to-know basis. All internal access is logged, and privileged access is subject to multi-level approval.
• Penetration Testing & Vulnerability Scanning: Our Platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, sona4d will notify affected Members and relevant authorities within the timeframes required by applicable data protection law.

sona4d uses cookies and similar tracking technologies to operate and improve the Platform. The following types of cookies may be placed on your device:

These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens, CSRF protection tokens, load-balancer routing cookies, and language/currency preference storage. No consent is required for strictly necessary cookies as they are indispensable to service delivery.

These cookies collect pseudonymous data about how visitors interact with the Platform — which pages are most visited, where users drop off in the registration funnel, and how fast pages load. This data is used exclusively for internal performance optimisation. These cookies require your consent.

These cookies remember your preferences — such as your preferred sports league (e.g., BRI Liga 1 or EPL), game category, display settings, or notification preferences — so you do not need to reconfigure them on each visit. These cookies require your consent.

You may review and manage your cookie consent preferences at any time via your Account settings. You may also configure your browser to block or delete cookies; however, doing so may impair the functionality of the Platform — in particular, strictly necessary cookies cannot be disabled without preventing you from logging in. Most modern browsers (Chrome, Firefox, Safari, Edge) provide granular cookie management controls in their privacy settings.

As a Member of sona4d, you have the following rights in respect of your personal data. To exercise any of these rights, please contact our Data Protection Officer (DPO) using the details in Section 15. We will respond to all valid rights requests within thirty (30) calendar days.

• Right of Access: You have the right to request a copy of all personal data we hold about you, along with information about how it is processed, the legal basis for processing, and the categories of recipients with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Where corrections affect KYC-verified data, additional verification documents may be required.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to overriding legal retention obligations — for example, AML regulations require us to retain certain financial records for up to seven years regardless of an erasure request.
• Right to Restrict Processing: You may request that we limit the way we use your data — for example, while a disputed data accuracy issue is being resolved.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to processing based on legitimate interests or carried out for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

sona4d implements mandatory age verification at the point of registration. All Members are required to confirm that they are at least 21 years of age and to submit government-issued photo identification as part of the KYC verification process. Where our systems detect indicators that a registered user may be under 21 — including through KYC document review or behavioural analysis — the account is immediately suspended pending investigation.

If you are a parent or guardian and believe that a minor under your care has registered on the sona4d Platform using false date-of-birth information, please contact our support team immediately at [email protected]. We will investigate, close the minor's account, and delete all associated personal data that is not subject to mandatory legal retention.

sona4d strongly encourages parents and guardians to use internet filtering software to restrict minors' access to online gambling platforms. Responsible gaming begins with ensuring that only eligible adults participate.

The sona4d Platform integrates third-party services and technologies to deliver its full functionality. Each of these providers processes personal data in accordance with their own privacy policies, which you are encouraged to review. sona4d selects third-party partners based on their data security standards and contractually requires them to process Member data only as directed by us.

Third-party services integrated into the sona4d Platform include:

• Game Studios: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft deliver game content via APIs. These studios may receive pseudonymous game session data required to operate the games and verify outcomes.
• Payment Providers: Indonesian bank payment gateway partners and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) process payment transaction data necessary to execute deposits and withdrawals.
• KYC Providers: Identity verification and liveness-check providers process copies of your government-issued ID and selfie imagery solely for the purpose of verifying your identity. These documents are not retained by sona4d beyond the KYC verification period except as required by our AML obligations.
• Cloud Infrastructure: Our Platform is hosted on enterprise-grade cloud infrastructure with ISO 27001-certified data centre operations and geographic redundancy to ensure 99.9% uptime.

sona4d's Platform does not contain links to external third-party websites beyond those necessary for payment processing and game delivery. This Privacy Policy applies only to sona4d.com and its sub-domains. We are not responsible for the privacy practices of any external websites that may link to or from our Platform.

sona4d reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory requirements. When we make material changes, we will notify registered Members via the email address on file and/or via a prominent in-Platform notification at least seven (7) calendar days before the revised policy takes effect — unless immediate changes are required to comply with a legal obligation or to address an urgent security matter.

The date of the most recent revision is displayed at the top of this page ("Last updated"). Your continued use of the sona4d Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with any change, you must cease using the Platform and contact our support team to close your account. Historical versions of this policy are available from our support team upon request.

If you have any questions, concerns, or complaints about this Privacy Policy or about how sona4d processes your personal data, please contact our Data Protection Officer (DPO) using the details below. We take all privacy enquiries seriously and will respond within thirty (30) calendar days.

When submitting a data rights request (see Section 11), please include your registered email address and a description of your request. We may need to verify your identity before processing access, rectification, or erasure requests to ensure your data is not disclosed to an unauthorised third party.