km778 Privacy Policy

1 Definitions

The following definitions apply throughout this Privacy Policy:

2 Data Controller

2.1 Identity. km778 operates as the Data Controller in respect of all Personal Data collected from Members through the Platform. As Data Controller, km778 determines the purposes for which, and the means by which, Personal Data is processed.

2.2 Contact. All data-related enquiries, access requests, correction requests, and deletion requests should be directed to km778's Data Protection contact at [email protected]. Please include "Data Privacy Request" in the subject line of your email to ensure prompt routing to the appropriate team.

2.3 Scope. This Privacy Policy applies to all Personal Data collected from Members resident in Indonesia or any other jurisdiction who access the km778 Platform. It covers data collected through account registration, gameplay, deposits and withdrawals, KYC verification, customer support interactions, and any marketing communications you have opted into.

3 Data We Collect

km778 collects several categories of Personal Data, each of which is described in the table below. We collect only data that is necessary for the specific purposes described in clause 5.

4 How We Collect Data

km778 collects Personal Data through the following channels:

• Direct Submission: Data you provide when completing the registration form, KYC document upload, deposit or withdrawal request, customer support contact, or any survey or feedback form on the Platform.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device fingerprint, browser characteristics, and session behaviour logs via server-side logging and first-party cookies.
• Payment Processors: Confirmation data returned by BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and other payment partners when a deposit or withdrawal transaction is processed — typically limited to transaction reference numbers, amounts, and status codes.
• Identity Verification Providers: Verification outcomes (pass/fail/refer) returned by km778's third-party KYC provider after document review. km778 receives the outcome and a confidence score; raw document images are handled by the KYC provider under its own data processing terms.
• Game Studios: Aggregated session data returned by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft via their respective game APIs — including round IDs, wager amounts, and RTP outcomes — for reconciliation and responsible gaming monitoring purposes.
• Fraud and Risk Platforms: Risk signals and device reputation scores from km778's anti-fraud partners, used to flag unusual access patterns or suspected account compromise.

5 Purposes & Legal Bases

km778 processes your Personal Data for the following purposes, each supported by a recognised legal basis:

• Account Creation and Management — to register your km778 account, authenticate your identity at login, and maintain your account settings. Legal basis: performance of contract.
• KYC and Age Verification — to verify that you are at least 21 years of age and to confirm the accuracy of the identity information you provided at registration. Legal basis: legal obligation and performance of contract.
• Payment Processing — to process IDR deposits and withdrawals via your chosen Indonesian bank or e-wallet, and to maintain transaction records. Legal basis: performance of contract.
• Anti-Money-Laundering (AML) and Fraud Prevention — to monitor transactions for suspicious patterns, perform enhanced due diligence on high-value withdrawals, and report to relevant authorities where legally required. Legal basis: legal obligation and legitimate interests.
• Responsible Gaming Monitoring — to identify usage patterns that may indicate problematic gambling behaviour and to apply voluntary limits, cooling-off periods, or self-exclusion as requested. Legal basis: legal obligation and legitimate interests.
• Customer Support — to respond to your enquiries, process complaints, and maintain a record of support interactions for quality assurance. Legal basis: performance of contract.
• Platform Security — to detect and prevent unauthorised access, account takeover attacks, botting, and multi-accounting. Legal basis: legitimate interests.
• Marketing Communications — to send you promotional emails, SMS, or in-platform notifications about km778 bonuses, new games, and sportsbook offers relevant to your interests (e.g., BRI Liga 1, MPL esports, Idul Fitri promotions). Legal basis: your explicit consent. You may withdraw consent at any time through your account settings or by contacting support.
• Analytics and Platform Improvement — to understand how Members use the Platform, which game categories are most popular, and where the user journey can be improved. Legal basis: legitimate interests. Analytics data is aggregated and anonymised wherever possible.
• Legal and Regulatory Compliance — to comply with km778's obligations under its international gaming licence, including record-keeping, audit cooperation, and regulatory reporting. Legal basis: legal obligation.

6 Data Sharing

6.1 General Principle. km778 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. Sharing is strictly limited to what is necessary to operate the Platform, comply with legal obligations, and protect Members.

6.2 Categories of Recipients. Your Personal Data may be shared with the following categories of recipients:

• Payment Partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja — limited to the data required to execute and reconcile your transaction (name, account identifier, amount, reference).
• KYC / Identity Verification Providers: Third-party document verification specialists who process your KTP or passport image to return a verification outcome to km778. These providers are contractually bound to handle your documents securely and to delete source images within a defined retention window.
• Game Content Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive a pseudonymous Member ID and session token to authenticate your access to their games. They do not receive your full name, bank account details, or contact information.
• Fraud and Risk Management Platforms: Providers that assess device reputation and transaction risk. They receive Technical Data and, where flagged, Identity Data sufficient to perform the risk assessment.
• Customer Support Infrastructure: Third-party help-desk and live-chat platform providers who process Communications Data on km778's behalf under strict data processing agreements.
• Legal and Regulatory Authorities: Courts, law enforcement agencies, gaming regulators, and financial intelligence units where km778 is legally required or compelled to disclose Personal Data. km778 will notify you of any such disclosure to the extent permitted by law.
• Corporate Successors: In the event of a merger, acquisition, or sale of substantially all of km778's assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7 International Data Transfers

7.1 Cross-Border Processing. km778 operates under an international gaming licence and engages technology partners whose data infrastructure may be located in jurisdictions outside Indonesia. As a result, your Personal Data may be transferred to and processed in countries other than Indonesia.

7.2 Safeguards. Where Personal Data is transferred internationally, km778 ensures that appropriate safeguards are in place, which may include:

• Contractual clauses equivalent to internationally recognised Standard Contractual Clauses (SCCs) between km778 and the receiving entity;
• Transfer to a jurisdiction that maintains data protection standards recognised as adequate by relevant regulatory bodies;
• Binding corporate rules where the recipient is part of km778's group of companies.

7.3 Member Rights in Transfers. Regardless of where your data is processed, km778 applies the same privacy standards and you retain the same rights described in clause 11 of this Policy.

8 Data Retention

8.1 Retention Periods. km778 retains Personal Data only for as long as necessary for the purpose for which it was collected, subject to any longer period required by law. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active membership plus 5 years following account closure, to satisfy AML record-keeping obligations under km778's gaming licence.
• Financial and Transaction Data: Retained for a minimum of 5 years from the date of the transaction, consistent with financial regulatory requirements.
• KYC Documents: Retained for 5 years from the date of successful verification or from account closure, whichever is later. Source document images held by km778's KYC provider are deleted within 90 days of the verification outcome being returned to km778.
• Technical and Usage Data (Logs): Retained for 12 months in active storage; then archived for up to 36 months for fraud investigation purposes before deletion.
• Customer Support Communications: Retained for 3 years from the date of the last interaction.
• Marketing Preferences: Retained until you withdraw consent. Evidence of your consent is retained for 5 years for compliance purposes even after withdrawal.

8.2 Deletion and Anonymisation. At the end of the applicable retention period, km778 will either securely delete your Personal Data or irreversibly anonymise it such that it can no longer be associated with you.

8.3 Retention Exceptions. km778 may retain Personal Data beyond the standard periods described above where retention is required to resolve an ongoing dispute, enforce outstanding legal claims, or comply with a regulatory or court order.

9 Security Measures

km778 applies a multi-layered security architecture to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction:

• 256-bit SSL/TLS Encryption: All data in transit between your browser or device and km778's servers is encrypted using TLS 1.2 or higher. HTTPS is enforced across the entire Platform with HSTS headers.
• Data Encryption at Rest: Sensitive data stored in km778's databases — including financial account identifiers and KYC document references — is encrypted at rest using AES-256.
• Password Security: Member passwords are stored as bcrypt hashes with a work factor commensurate with current hardware capabilities. km778 never stores passwords in plaintext.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable SMS OTP-based 2FA. km778 may require 2FA for high-value withdrawal requests regardless of Member preference.
• Access Controls: Access to Personal Data by km778 staff is governed by a role-based access control (RBAC) framework. No employee has access to Member financial data beyond what is required for their documented job function.
• Penetration Testing: km778's platform undergoes scheduled third-party penetration testing at least once per calendar year. Critical findings are remediated within 30 days of discovery.
• Incident Response: km778 maintains a documented data breach incident response plan. In the event of a breach that creates a risk to Members, km778 will notify affected Members within 72 hours of becoming aware of the incident, to the extent technically feasible.

10 Cookies & Tracking Technologies

10.1 What Are Cookies. Cookies are small text files placed on your device by a website you visit. km778 uses first-party cookies — cookies set directly by km778's domain — to enable core Platform functionality and improve your experience. km778 does not use third-party advertising cookies or cross-site tracking technologies.

10.2 Categories of Cookies km778 Uses:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without breaking the Platform. No consent is required for this category.
• Functional Cookies: Remember your preferences such as your preferred language (English or Bahasa Indonesia), last selected payment method, and responsible gaming limit settings. These persist across sessions for your convenience.
• Analytics Cookies: First-party analytics cookies that collect anonymised data on page views, session duration, device type, and navigation paths. This data is used to improve Platform performance and is not shared with advertising networks. These cookies are only set if you have not opted out via your account privacy settings.
• Security Cookies: Short-lived cookies used by km778's fraud and bot-detection layer to distinguish human users from automated scripts. These do not store Personal Data and expire at session end.

10.3 Managing Cookies. Most browsers allow you to view, block, or delete cookies through their privacy or settings menu. Blocking strictly necessary cookies will impair your ability to log in and use the Platform. Blocking analytics cookies will not affect your ability to play games, deposit, or withdraw.

10.4 No Cross-Site Tracking. km778 does not embed Facebook Pixel, Google Ads tags, or any third-party advertising SDK on the Platform. Your km778 browsing and betting activity is not shared with advertising platforms.

11 Your Rights

As a km778 Member, you hold the following rights in respect of your Personal Data. km778 will respond to all verifiable rights requests within 30 calendar days of receipt. Complex or voluminous requests may require up to 60 days, in which case km778 will notify you of the extension within the initial 30-day window.

To exercise any of these rights, email [email protected] with the subject line "Data Rights Request" and a description of your request. km778 may require identity verification before processing your request to protect against fraudulent access to another Member's data.

12 Minors & Age Verification

12.1 21+ Policy. The km778 Platform is strictly restricted to individuals aged 21 years or older. km778 does not knowingly collect Personal Data from anyone under the age of 21. Age is verified as part of the KYC process before any withdrawal is processed, and km778 reserves the right to conduct age verification checks at registration or at any subsequent time.

12.2 Discovery of Underage Data. If km778 discovers that Personal Data has been collected from an individual who was under 21 at the time of registration, km778 will immediately suspend the account, void all transactions, return any verified net deposits to the depositing payment method (where technically possible), and permanently delete the minor's Personal Data from all active systems within 30 days, subject to any retention obligations that may apply to transaction records under AML law.

12.3 Parental Guidance. Parents and guardians are advised to use internet filtering software to prevent minors from accessing gambling platforms. If you believe a minor has registered a km778 account, please contact [email protected] immediately with all available details.

13 Third-Party Services

13.1 Game Studios. Games hosted on km778 are provided by independent studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you launch a game, a session is established with the studio's game server. The studio receives a pseudonymous player token and session data but not your full identity or bank account information. Each studio maintains its own privacy policy governing the data it processes directly.

13.2 Payment Infrastructure. Deposit and withdrawal transactions are processed through km778's payment partners (banks and e-wallets listed in clause 6.2). km778 does not store full bank account numbers; it stores only the account alias or masked account reference returned by the payment partner after a successful transaction link.

13.3 No Responsibility for External Sites. The km778 Platform does not contain links to external third-party websites. However, if you navigate to any third-party site independently, km778 is not responsible for that site's privacy practices and encourages you to review its privacy policy before submitting any personal information.

14 Policy Amendments

14.1 Right to Amend. km778 reserves the right to update this Privacy Policy at any time to reflect changes in the Platform's data processing activities, applicable law, or regulatory guidance. The "Last Updated" date at the top of this page will be revised on every amendment.

14.2 Notification of Material Changes. Where a change materially affects how km778 processes your Personal Data — for example, introducing a new category of data sharing, changing retention periods, or altering consent mechanisms — km778 will notify registered Members by email to their registered address at least 14 calendar days before the change takes effect.

14.3 Continued Use. Your continued use of the km778 Platform after the effective date of an amended Privacy Policy constitutes your acknowledgement of the updated terms. If you do not accept the changes, you may request account closure in accordance with clause 10.3 of the km778 Terms & Conditions.

15 Contact & Complaints

For any questions about this Privacy Policy, requests to exercise your data rights, or concerns about how km778 handles your Personal Data, please contact us through the following channels:

• Email: [email protected] (plain text — not a clickable link) — use subject line "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 from within your km778 Account dashboard — ask to be connected to the Data Protection team for privacy-specific matters
• Response Time: Privacy enquiries are acknowledged within 2 business hours; substantive responses are provided within 10 business days; formal data rights requests are completed within 30 calendar days
• Languages: English and Indonesian (Bahasa Indonesia) — native Indonesian-speaking agents are available around the clock

If you are not satisfied with km778's response to a privacy complaint, you may escalate the matter to the data protection authority or gaming regulator in km778's licensing jurisdiction. Details of the relevant supervisory authority are available upon request by contacting [email protected].