km777 Privacy Policy

1. Introduction

km777 is Indonesia's premier online casino and sports betting platform, committed to delivering a secure, fair, and transparent gaming environment for adults aged 21 and above. The protection of personal data is integral to that commitment. This Policy has been drafted to inform you clearly and completely about our data practices — what we collect, why, how we use it, who may see it, how long we keep it, and how you can exercise your rights in relation to it.

km777 operates as the data controller for all personal data collected through the km777 platform. This means km777 is responsible for deciding the purposes and means by which your personal data is processed. Where km777 engages third-party processors — such as payment gateways or fraud detection services — those parties act only on km777's documented instructions and are subject to binding data processing agreements.

This Policy applies to all personal data collected from members, prospective members, and visitors to the km777 platform, regardless of whether they complete the account registration process.

2. Data We Collect

km777 collects personal data across the following categories:

2.1 Identity & Contact Data

• Full legal name
• Date of birth
• Residential address (including city, province, and postal code)
• Email address
• Phone number (optional, used for account security notifications)
• National identity number (KTP number) — collected only during KYC verification

2.2 Financial Data

• Bank account name and number (for withdrawal processing via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata)
• E-wallet account name and registered phone number (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Card type and last four digits (Visa, Mastercard — full card numbers are never stored by km777)
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment channels

2.3 Gaming & Account Activity Data

• Username and encrypted password
• Wagering history, game session logs, and betting patterns
• Bonus and promotion redemption records
• Account balance history and VIP tier status
• Responsible gaming tool settings (deposit limits, loss limits, session timers, self-exclusion status)

2.4 Technical & Device Data

• IP address and geolocation derived from IP (city and country level only)
• Device type, operating system, and browser version
• Session timestamps and duration
• Cookie identifiers and session tokens
• Referring URL and on-site navigation path

2.5 KYC Verification Documents

• Scanned or photographed copies of government-issued identity documents (KTP, passport, driver's licence)
• Proof-of-address documents (utility bills, bank statements dated within three months)
• Proof-of-payment-method documents (bank book cover, e-wallet screenshot, card image with middle digits obscured)

2.6 Communications Data

• Records of communications between you and km777 customer support, including live chat transcripts and email correspondence
• Feedback, complaints, and dispute records

3. How We Collect Your Data

km777 collects personal data through the following channels:

• Account Registration: When you create a km777 account, you provide identity, contact, and login credential data directly.
• Deposits & Withdrawals: When you initiate a financial transaction, payment channel data is captured to process and reconcile the transaction.
• KYC Submission: When you upload identity documents to complete verification, those documents and the data extracted from them are collected.
• Platform Usage: As you use the km777 platform — browsing games, placing wagers, adjusting account settings — technical and activity data is collected automatically.
• Customer Support: When you contact km777 support via live chat or email, the content of those communications is recorded.
• Cookies & Tracking Technologies: Cookies, session tokens, and analytics pixels collect technical data automatically as described in Section 8.

4. How We Use Your Data

km777 uses the personal data described in Section 2 for the following purposes:

Purpose	Data Categories Used
Creating and managing your km777 Account	Identity, Contact, Login credentials
Processing deposits and withdrawals	Financial, Identity, Transaction history
KYC identity and age verification (21+ compliance)	KYC documents, Identity, Date of birth
Fraud detection, AML monitoring, and account security	Technical, Financial, Gaming activity, IP address
Responsible gaming monitoring and tool enforcement	Gaming activity, Account settings, Responsible gaming flags
Delivering bonuses and VIP programme benefits	Identity, Gaming activity, Transaction history
Customer support and dispute resolution	Identity, Communications, Account activity
Platform analytics and product improvement	Technical, Device, Navigation data (anonymised where possible)
Legal and regulatory compliance	All categories as required by applicable law
Sending transactional and service communications	Contact, Account activity

5. Legal Basis for Processing

km777 processes your personal data on the following legal bases:

• Contractual Necessity: Processing that is required to perform the contract between you and km777 under the Terms & Conditions — including account management, payment processing, and KYC verification.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML), age verification, and regulatory obligations under the laws of the jurisdiction in which km777 is licensed.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and analytics — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications, where consent is obtained at the time of registration or subsequently through your account preferences. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

km777 does not sell or rent your personal data to third parties. We share personal data only in the following limited circumstances:

6.1 Payment Processors

To process deposits and withdrawals, km777 shares the minimum necessary financial and identity data with licensed payment gateway partners that support BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, and Mastercard. These partners are bound by data processing agreements and are prohibited from using your data for any purpose beyond transaction processing.

6.2 Game Studio Providers

Where technically required for game delivery and fairness auditing, km777 shares anonymised or pseudonymised gaming activity data with licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft). No directly identifiable personal data (such as your full name, bank details, or KTP number) is shared with game studios.

6.3 Fraud Prevention & AML Services

km777 uses third-party fraud detection and anti-money laundering screening services. These providers process technical and transaction data on km777's behalf under binding data processing agreements. They do not use your data for their own commercial purposes.

6.4 Legal & Regulatory Disclosure

km777 may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, valid legal process, or to protect the rights, property, or safety of km777, its members, or the public. km777 will, where legally permissible, notify affected members of such disclosures.

6.5 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of km777's business, personal data held by km777 may be transferred to the successor entity. You will be notified of any such transfer via a prominent notice on the km777 platform prior to the transfer taking effect, and the successor entity will be bound by privacy commitments no less protective than those in this Policy.

7. Data Retention

km777 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the duration of your membership and for a period of five years following account closure, to satisfy AML and regulatory record-keeping obligations.
• KYC Documents: Retained for a minimum of five years from the date of verification, as required by anti-money laundering regulations.
• Financial Transaction Records: Retained for a minimum of five years from the date of each transaction.
• Customer Support Communications: Retained for three years from the date of the communication, or longer if the communication relates to an unresolved dispute.
• Technical & Device Data: Retained for 12 months on a rolling basis. Aggregated, anonymised analytics data may be retained indefinitely.
• Self-Exclusion Records: Retained indefinitely to prevent re-registration by self-excluded members, even where the member requests account deletion.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

8. Cookies & Tracking Technologies

km777 uses the following types of cookies and similar technologies on the km777 platform:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Analytics Cookies: Used to collect anonymised data on how members and visitors navigate the platform — including pages visited, time spent, and errors encountered. This data is used to improve the km777 experience. Analytics data is aggregated and does not identify individual users.
• Fraud Detection Cookies: Used to identify and flag unusual or suspicious behavioural patterns that may indicate fraudulent activity, bot usage, or account takeover attempts.
• Personalisation Cookies: Used to remember your preferences, such as language settings and recently played games, to provide a more tailored platform experience.

km777 does not use advertising or retargeting cookies, and does not share cookie data with advertising networks or social media platforms. You can manage or disable non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of certain platform features.

9. Data Security

km777 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in Transit: All data transmitted between your device and km777 servers is encrypted using TLS 1.3 with 256-bit SSL certificates.
• Encryption at Rest: Sensitive stored data — including passwords (hashed with bcrypt), financial records, and KYC documents — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within km777's systems is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Infrastructure Security: km777 servers are hosted in ISO-certified data centres with physical and network security controls, regular penetration testing, and 24/7 intrusion detection monitoring.
• Incident Response: In the event of a confirmed data breach affecting member personal data, km777 will notify affected members and, where required, relevant regulatory authorities within 72 hours of becoming aware of the breach.

10. Your Data Rights

As a km777 member and data subject, you hold the following rights in relation to the personal data km777 holds about you:

• Right of Access: You may request a copy of the personal data km777 holds about you. km777 will provide this within 30 days of a verified request.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. For most account data, this can be done directly within your km777 account settings.
• Right to Erasure: You may request deletion of your personal data. This right is subject to km777's legal retention obligations — for example, AML regulations require retention of certain financial and identity records for a minimum of five years, and self-exclusion records are retained indefinitely.
• Right to Restriction: You may request that km777 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: You may request a copy of the personal data you provided to km777 in a structured, machine-readable format (CSV or JSON) for transfer to another service provider.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time, with immediate effect. You may also object to processing based on legitimate interests, though km777 may be entitled to continue processing where it has compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, submit a written request to [email protected]. km777 will verify your identity before processing any data rights request. Requests will be acknowledged within 5 business days and fulfilled within 30 calendar days. In complex cases, this period may be extended by a further 30 days, and you will be informed of the extension and the reason for it.

11. International Data Transfers

km777 is primarily operated to serve members in Indonesia (WIB, WITA, and WIT time zones). Some of km777's service providers — including game studios, fraud detection partners, and cloud infrastructure providers — may be located in jurisdictions outside Indonesia. When personal data is transferred internationally, km777 ensures that appropriate safeguards are in place, including:

• Data processing agreements incorporating internationally recognised standard contractual clauses
• Transfers only to jurisdictions with an adequate level of data protection as assessed by km777's legal team
• Pseudonymisation or anonymisation of data prior to transfer where technically feasible

km777 does not transfer personal data to jurisdictions that are subject to international sanctions or that lack basic rule-of-law protections for data subjects.

12. Minors

The km777 platform is strictly for adults aged 21 and above. km777 does not knowingly collect personal data from individuals under the age of 21. If km777 discovers or has reason to believe that it has collected personal data from a minor, it will immediately suspend the associated account, delete the data, and notify the relevant authorities where required. If you are a parent or guardian and believe that a minor may have registered an account on km777, please contact us immediately at [email protected].

13. Amendments to This Policy

km777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. Material changes will be communicated to members via a prominent notice displayed on the km777 platform and, where possible, via email to the address registered on your account, at least 14 days before the changes take effect. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Continued use of the km777 platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

14. Contact & Data Privacy Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the personal data km777 holds about you, please contact our privacy team:

• Email: [email protected]
• Subject Line: "Privacy Enquiry – [Your Username]"
• Live Chat: Available 24/7 on the km777 platform
• Languages: English and Bahasa Indonesia
• Response Time: Acknowledgement within 5 business days; full response within 30 calendar days

km777 is committed to resolving all privacy-related queries fairly and promptly. If you are unsatisfied with km777's response to a privacy concern, you may be entitled to lodge a complaint with the relevant data protection authority in the jurisdiction in which km777 is licensed.