Privacy Policy — km789 Data Commitment

km789 ("the Company", "we", "us", "our") operates the online gaming and sports betting platform accessible at https://km789.cam and all associated sub-domains and mobile applications (collectively, "the Platform"). As the operator of the Platform, km789 is the data controller responsible for the personal data of all registered players ("you", "the Player").

This Privacy Policy describes, in clear and transparent terms, the categories of personal data we collect from you, the purposes for which that data is used, the parties with whom it may be shared, and the rights you hold over your own information. It should be read alongside our Terms & Conditions and Responsible Gaming policy, both of which form part of your overall agreement with km789.

km789 is committed to handling all personal data responsibly and in accordance with internationally recognised data protection standards. Where Indonesian players' data is concerned, we apply data governance principles modelled on best-practice international frameworks to ensure that your information is treated with the highest level of care and diligence.

If you have any questions about this policy or about how km789 handles your data, please contact our Data Protection Officer at [email protected] before registering an Account.

The personal data km789 collects falls into the following categories. We collect only the data that is necessary and proportionate to the purpose for which it is needed.

2.1 Registration Data

When you open an Account on km789, we collect the information you provide during the registration process, which includes:

• Full legal name (as it appears on your government-issued identification document)
• Date of birth (for age verification — km789 enforces a strict 21+ policy)
• Email address
• Mobile phone number
• Residential address, including city (e.g., Jakarta, Surabaya, Bandung, Bali, Medan) and postal code
• Chosen username and encrypted password
• Preferred currency (Indonesian Rupiah, IDR / Rp)

2.2 Identity Verification (KYC) Data

To comply with our international licensing obligations and to prevent underage gambling, fraud, and money laundering, km789 may request the following documents:

• A scanned or photographed copy of a government-issued photo ID (Indonesian KTP, passport, or SIM)
• Proof of residential address (a recent utility bill, bank statement from BCA, BRI, BNI, Mandiri, or CIMB Niaga, or official correspondence dated within the last three months)
• Proof of ownership of the payment method used to deposit (e.g., confirmation that a bank account or e-wallet such as OVO, DANA, or GoPay is registered in your name)
• A selfie photograph holding your ID document, where enhanced verification is required

2.3 Financial Transaction Data

When you deposit or withdraw funds, we collect transaction data including: the payment method used (bank name, e-wallet provider), transaction reference number, transaction amount in IDR, timestamp, and transaction status. We do not store full bank account numbers or e-wallet credentials; these are handled directly and securely by the relevant payment processor.

2.4 Gaming Activity Data

We record all wagering activity on the Platform, including: game titles played, bet amounts, game outcomes, session duration, win/loss history, and sport or market selections. This data is used for account management, dispute resolution, bonus tracking, and responsible gaming monitoring.

2.5 Technical & Device Data

When you access the km789 Platform, our servers automatically log the following technical data:

• IP address and approximate geographic location (country, city)
• Device type, operating system, and browser version
• Referring URL and pages visited within the Platform
• Session timestamps, including login and logout times (reported in WIB / UTC+7 for Indonesian players)
• Error logs and performance diagnostic data

2.6 Communications Data

If you contact km789 customer support by email or live chat, we retain records of those communications — including your messages, our responses, and any attachments you send. This data is used to resolve your enquiry and to improve our support quality.

2.7 Marketing Preferences

Where you have opted in to receive promotional communications, we hold a record of that consent, including the date and channel on which it was given, along with your stated preferences regarding the types of promotions you wish to receive (e.g., sports betting offers, casino bonuses, slot promotions).

km789 collects personal data through the following channels:

km789 uses the personal data it holds for the following purposes, each of which is described together with the legal basis on which it relies (see Section 5 for the full legal basis analysis):

4.1 Account Management

We use your registration data to create and maintain your km789 Account, authenticate your identity at login, enforce our single-account policy, and manage your account preferences and settings. This is necessary for the performance of our contract with you.

4.2 Identity Verification & KYC Compliance

We use your KYC documentation to verify that you are who you claim to be, that you meet our 21+ age requirement, and that your payment methods are registered in your name. This processing is required by our international gaming licence and constitutes a legal obligation.

4.3 Payment Processing

We use your financial transaction data to process deposits and withdrawals in IDR (Rp) via your chosen payment method, to investigate and resolve disputed transactions, and to maintain accurate financial records as required by our licensing obligations.

4.4 Fraud Prevention & Security

We use technical, device, and gaming activity data to detect, investigate, and prevent fraudulent activity — including multi-account abuse, bonus exploitation, money laundering, and unauthorised account access. This processing is in km789's legitimate interest in maintaining a safe and fair gaming environment.

4.5 Responsible Gaming Monitoring

We use your gaming activity data to monitor for signs of problem gambling behaviour, to enforce self-imposed limits and cooling-off periods, and to comply with our responsible gaming obligations under our international licence. This processing serves both our legitimate interest and a legal obligation.

4.6 Customer Support

We use your communications data to handle your enquiries, resolve complaints, and improve our support processes. This is necessary for the performance of our contract with you.

4.7 Marketing & Promotions

Where you have given explicit consent, we use your registration data and gaming preferences to send you personalised promotional communications — including bonus offers, free-bet promotions, and news about new game releases from providers such as Pragmatic Play, Evolution Gaming, and Spribe. You can withdraw consent at any time by updating your preferences in your Account settings or by emailing [email protected].

4.8 Platform Improvement

We use aggregated, anonymised gaming activity and technical data to analyse platform performance, understand player behaviour trends, and guide product development decisions. This data is anonymised before use for analytical purposes and cannot be used to identify any individual player.

km789 processes personal data under one or more of the following lawful bases, consistent with internationally recognised data protection frameworks:

km789 does not sell, rent, or trade your personal data. We share data only where strictly necessary with the following categories of trusted recipients, each of whom is bound by appropriate contractual data protection obligations:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the transaction data necessary to process your deposit or withdrawal.
• KYC & identity verification providers: Our regulated third-party KYC partner receives a copy of your submitted identity documents solely for the purpose of conducting automated and manual identity verification checks.
• Game content studios: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive a pseudonymised player identifier to enable game session management and RNG certification auditing. They do not receive your name, address, or financial details.
• Fraud prevention and cybersecurity providers: Specialist vendors processing device fingerprint and risk-scoring data to protect the Platform and its players.
• Regulatory and licensing authorities: km789 may be required to disclose player data to its international licensing body or to law enforcement authorities where compelled by a lawful legal process or where there is a reasonable suspicion of criminal activity such as money laundering or fraud.
• Professional advisors: Lawyers, auditors, and accountants instructed by km789 on a confidential basis, where data access is necessary for the provision of their professional services.

km789 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device by your browser when you visit a website. We use the following categories of cookies:

You can manage your cookie preferences at any time through your browser settings. Blocking strictly necessary cookies may impair your ability to use the Platform. Blocking other cookie categories will not prevent you from accessing the Services but may reduce personalisation features.

km789 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by our international gaming licence or applicable law. The table below sets out our standard retention periods by data category:

Upon expiry of the applicable retention period, personal data is either securely deleted (digital records) or destroyed (physical documents). Anonymised or aggregated data derived from your personal data may be retained indefinitely for analytical purposes, as it can no longer be used to identify you.

km789 implements a comprehensive information security programme to protect your personal data against unauthorised access, loss, alteration, or disclosure. Key security measures in place include:

• 256-bit SSL/TLS encryption for all data in transit between your browser or mobile app and our servers.
• AES-256 encryption at rest for sensitive data fields stored in our databases, including passwords (hashed using bcrypt with a high work factor), payment references, and KYC document copies.
• Role-based access controls (RBAC) limiting internal access to personal data to only those employees and contractors whose job function requires it, on a strict need-to-know basis.
• Multi-factor authentication (MFA) for all internal staff accessing administrative systems that process player data.
• Regular penetration testing by independent third-party security firms, with findings remediated within defined service-level windows based on severity.
• Continuous intrusion detection and anomaly monitoring to identify and respond to potential security incidents in real time.
• Data breach response plan — in the event of a data breach that poses a risk to your rights, km789 will notify affected players and the relevant regulatory authority within the timeframe required by our licensing obligations, and no later than 72 hours after becoming aware of the breach.

As a player on the km789 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving a verifiable request.

km789 operates as an international platform and some of the third-party service providers with whom we share data (as described in Section 6) may be located in countries outside of Indonesia. When personal data is transferred internationally, km789 ensures that appropriate safeguards are in place to protect your information to a standard equivalent to that described in this policy.

Such safeguards may include contractual clauses that require the receiving party to handle your data in accordance with international data protection standards, or the use of service providers who are certified under recognised data protection frameworks.

In all cases, km789 carries out due diligence on international data recipients to ensure that the transfer does not expose your personal data to a materially lower level of protection than it receives within our own infrastructure.

km789 does not knowingly collect, store, or process personal data from any person under the age of 21. Our registration process includes an age declaration field and our KYC process verifies date of birth against government-issued identification. Where km789 discovers that personal data has been collected from a person who is under 21, the Account will be immediately closed, all associated funds will be returned to the originating payment method (after verification), and all personal data will be deleted from our systems.

If you believe that a minor has registered an Account on km789, please contact us immediately at [email protected] so that we can take prompt action.

The km789 Platform may, from time to time, contain references to or information about third-party services such as game studios, sports leagues (BRI Liga 1, EPL, La Liga, Champions League), or payment providers. This policy applies only to the km789 Platform itself. km789 has no control over and accepts no responsibility for the privacy practices of any third-party website or service.

We encourage you to review the privacy policy of any third-party service before providing your personal data to it. The inclusion of information about a third-party service on the km789 Platform does not constitute an endorsement of that service's privacy practices.

km789 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, updates to our licensing requirements, or developments in applicable data protection standards. When we make material changes to this policy, we will notify registered players by email to the address on file with their Account and by displaying a prominent notice on the Platform for a minimum of 14 days following the update.

The "Last Updated" date at the top of this page will always reflect the date on which the most recent version of the policy took effect. We encourage you to review this policy periodically. Your continued use of the Platform following the effective date of an updated policy constitutes your acknowledgement of the revised terms. If you do not agree with a material change, you should close your Account before the effective date of the change and contact us to exercise your data rights as described in Section 10.

Archived versions of this Privacy Policy are available on request by contacting our Data Protection Officer at [email protected].

If you have any questions, concerns, or requests regarding this Privacy Policy or the way km789 processes your personal data, please contact our Data Protection Officer (DPO) using the details below. We are committed to responding to all substantive data protection enquiries within 30 calendar days.