Privacy Policy

1 Definitions

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, contact details, financial information, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" — km879, the entity that determines the purposes and means of Processing Personal Data on the Platform.
• "Data Processor" — any third-party service provider that Processes Personal Data on behalf of km879 under a written data-processing agreement.
• "KYC" — Know Your Customer; the identity and age verification procedure required before withdrawal privileges are activated on any Account.
• "Cookie" — a small text file placed on your device by the Platform to enable functionality, analytics, and session management.
• "AML" — Anti-Money Laundering; the regulatory compliance framework governing the monitoring and reporting of suspicious financial activity.
• "IDR" — Indonesian Rupiah, the exclusive operating currency of the km879 Platform.

2 Data We Collect

2.1 Data You Provide Directly

km879 collects the following categories of Personal Data that you supply to us voluntarily during the course of your membership:

• Registration Data: full legal name, date of birth, email address, mobile number, and city or province of residence (for example, Jakarta, Surabaya, Medan, Bandung, or Bali).
• KYC Documents: government-issued photo identification (Indonesian KTP, SIM, or passport), proof of current residential address, and evidence of ownership of the payment method used for deposits.
• Financial Data: the name and account details of your bank (such as BCA, BRI, BNI, Mandiri, CIMB Niaga, or Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, or LinkAja) used for deposits and withdrawals. km879 does not store full card numbers or banking passwords.
• Support Communications: the content of messages, emails, and chat conversations exchanged with our support team, together with associated metadata such as timestamps and ticket reference numbers.
• Responsible Gaming Preferences: deposit limits, loss limits, session time settings, time-out selections, and self-exclusion requests that you configure via your Account settings.

2.2 Data Collected Automatically

When you access the Platform, certain technical and behavioral data is collected automatically by our systems:

• Technical Data: IP address, device type and model, operating system and version, browser type and version, screen resolution, and time-zone setting.
• Usage Data: pages and sections of the Platform visited, games accessed, bet placement history (including game type, stake amount in IDR, and outcome), bonus offer interactions, session start and end times, and in-app navigation paths.
• Cookie and Tracking Data: session identifiers, authentication tokens, and analytics event data collected via first-party cookies. See Section 7 for full details.

2.3 Data Received From Third Parties

In limited circumstances km879 may receive Personal Data about you from third-party sources, including:

• Payment processors and banking partners confirming the status or name-matching result of a deposit or withdrawal transaction.
• Identity verification service providers that cross-reference the KYC documents you submit against official registries.
• Fraud-detection and AML screening services that flag IP addresses, device fingerprints, or payment identifiers associated with known fraudulent activity.

3 Legal Basis for Processing

km879 processes your Personal Data on the following legal grounds:

• Contractual Necessity: Processing that is required to create and manage your Account, verify your identity, process deposits and withdrawals in IDR, and deliver the betting and gaming services you have requested.
• Legal Obligation: Processing required to comply with applicable AML regulations, KYC requirements, and any lawful requests from competent regulatory or law-enforcement authorities.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and product improvement, where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional purposes — such as sending promotional communications about km879 bonuses or event-specific offers tied to fixtures like BRI Liga 1 or the UEFA Champions League — where you have given explicit, freely withdrawable consent.

4 How We Use Your Personal Data

km879 uses the Personal Data collected for the following specific purposes:

1. Account Management: creating, verifying, maintaining, and, where necessary, closing your Account in accordance with our Terms & Conditions.
2. Identity and Age Verification: confirming that you are a real person, that your stated identity is accurate, and that you meet the 21+ age requirement before granting full platform access and withdrawal privileges.
3. Financial Transaction Processing: executing deposits from and withdrawals to your nominated BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja account, denominated in IDR.
4. Fraud and AML Compliance: screening transactions and account behavior against known fraud patterns, monitoring for unusual financial activity, and meeting our obligations under international AML standards.
5. Responsible Gaming Oversight: monitoring usage patterns to identify signs of problematic gambling behavior, enforcing deposit and loss limits you have set, and reaching out proactively where our systems detect elevated risk.
6. Customer Support: responding to your enquiries, resolving disputes, and maintaining a record of communications for quality assurance and audit purposes.
7. Platform Improvement: analyzing aggregated, anonymized usage data to identify bugs, optimize game loading performance, and improve the overall user experience.
8. Marketing Communications: sending you promotional emails or in-platform notifications about km879 bonuses, new game releases, or seasonal offers — only where you have opted in and subject to your right to withdraw consent at any time.

5 Data Sharing and Disclosure

5.1 Service Providers (Data Processors)

km879 shares Personal Data with carefully selected third-party service providers who act as Data Processors on our behalf. These providers are permitted to use your data solely to perform the specific services contracted by km879 and are bound by written data-processing agreements requiring them to implement appropriate technical and organizational security measures. Categories of service providers include:

• Payment gateway and banking partners facilitating IDR transactions via local bank transfers and e-wallets.
• KYC and identity verification platforms processing document scans and cross-referencing identity data.
• Cloud hosting and infrastructure providers on whose servers the Platform and its data are stored.
• Fraud-detection and cybersecurity firms whose tools monitor platform activity for anomalous patterns.
• Customer support software providers through whose platforms support tickets and live chat sessions are managed.
• Analytics providers processing anonymized or pseudonymized usage data for platform performance monitoring.

5.2 Legal and Regulatory Disclosure

km879 may disclose Personal Data to governmental authorities, law-enforcement agencies, or regulatory bodies where we are required to do so by a valid legal order, court judgment, or applicable law. We will, where legally permitted, notify the affected Member before complying with such a disclosure request.

5.3 Business Transfers

In the event that km879 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the Privacy Policy applicable to your data following the transfer via a prominent notice on the Platform.

5.4 No Sale or Unauthorized Sharing

km879 does not sell, rent, lease, or otherwise transfer your Personal Data to any third party for that third party's own commercial or marketing purposes. Any sharing of data is strictly limited to the purposes described in this Section.

6 International Data Transfers

The km879 Platform is operated from servers located outside Indonesia. As a result, your Personal Data may be transferred to and stored in jurisdictions outside your country of residence. When such transfers occur, km879 ensures that appropriate safeguards are in place — including standard contractual clauses, data processing agreements, and equivalent data-protection obligations on the receiving party — to protect your data to a standard consistent with this Policy. By using the Platform as a resident of Indonesia, you acknowledge and consent to the transfer of your Personal Data to overseas servers for the purposes described in this Policy.

7 Cookies and Tracking Technologies

7.1 What Cookies We Use

The km879 Platform uses first-party cookies and similar local-storage technologies to deliver its services. We do not deploy third-party advertising or cross-site tracking cookies. The cookies we use fall into the following categories:

• Strictly Necessary Cookies: session authentication tokens and security identifiers required for you to log in, navigate the Platform, and maintain an active session. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: preferences such as your selected language, notification settings, and responsible gaming limit configurations, stored to avoid requiring you to reconfigure them on each visit.
• Analytics Cookies: first-party cookies that record anonymized usage data — pages visited, features used, session duration — to help km879 understand how the Platform is being used and where improvements can be made. No personally identifiable data is included in analytics reports.

7.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Disabling functional cookies will cause your preferences to reset on each visit. km879's analytics cookies do not track you across third-party websites and are confined to activity on km879.cam.

8 Data Retention

km879 retains Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The primary retention schedules are as follows:

• Identity and KYC Data: retained for the full duration of your Account plus a minimum of five years following Account closure, in compliance with AML and KYC record-keeping obligations.
• Financial Transaction Records: retained for a minimum of five years from the date of each transaction, in compliance with applicable financial reporting and AML requirements.
• Support Communications: retained for three years from the date of each communication for dispute resolution and quality assurance purposes.
• Technical and Usage Data: retained on a 13-month rolling basis, after which it is anonymized or deleted.
• Marketing Consent Records: retained until you withdraw consent and for one year thereafter to demonstrate the prior existence of consent if challenged.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be attributed to you as an individual.

9 Your Data Rights

Subject to applicable law and our legitimate operational requirements, you hold the following rights in relation to the Personal Data km879 holds about you:

• Right of Access: you may request a copy of the Personal Data km879 holds about you, along with information about how it is processed.
• Right to Rectification: you may request correction of inaccurate or incomplete Personal Data. For account name and date-of-birth corrections, documentary evidence (such as an updated KTP) will be required.
• Right to Erasure: you may request deletion of your Personal Data in circumstances where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis for processing applies. This right is subject to our legal retention obligations — data we are required to retain for AML or KYC compliance cannot be deleted early.
• Right to Restriction: you may request that km879 restrict the Processing of your Personal Data in certain circumstances, for example while a rectification request is under review.
• Right to Data Portability: where Processing is based on consent or contractual necessity and carried out by automated means, you may request a machine-readable copy of the Personal Data you have provided to km879.
• Right to Object: you may object to Processing carried out on the basis of legitimate interests, including profiling for responsible gaming purposes. km879 will cease such Processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: where Processing is based solely on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of Processing carried out before withdrawal.

10 Security Measures

km879 implements a layered set of technical and organizational security controls designed to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and km879 servers.
• AES-256 encryption for all Personal Data and KYC documents stored at rest on km879 infrastructure.
• Role-based access controls (RBAC) limiting internal access to Personal Data to personnel whose role requires it, with all access logged and audited.
• Multi-factor authentication (MFA) enforced for all internal system accounts with access to production data.
• Regular penetration testing and vulnerability scanning conducted by qualified independent security professionals.
• Incident response procedures that include notification to affected Members in the event of a data breach that poses a risk to their rights and freedoms, delivered within a reasonable timeframe following discovery.

While km879 takes every reasonable precaution, no online platform can guarantee absolute security. You are responsible for keeping your Account credentials confidential and for ensuring that the device from which you access the Platform is free from malware or unauthorized access.

11 Minors

The km879 Platform is strictly for adults aged 21 years and older. km879 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that an Account has been registered by or on behalf of a person under 21, that Account will be immediately suspended, any balance held will be returned to the depositing payment method, and all associated Personal Data will be deleted from our active systems as promptly as our legal retention obligations permit. If you believe that a minor has registered an Account on the Platform, please notify us immediately at support@km879.cam.

12 Amendments to This Policy

km879 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data-handling practices, applicable law, or the services we offer. When material changes are made, km879 will publish a notice on the Platform and update the "Last Updated" date at the top of this page. For significant changes, we will additionally send a notification to your registered email address at least seven days before the change takes effect. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept an amendment, you must stop using the Platform and may request Account closure by contacting our support team.

13 Contact

If you have any questions, concerns, or requests relating to this Privacy Policy or the way km879 handles your Personal Data, please contact our support team by email. All privacy-related enquiries are handled by our data protection team and will receive a response within 30 calendar days during business days (07.00–24.00 WIB, Monday through Sunday).

For data erasure or portability requests, include the subject line "DATA RIGHTS REQUEST". For reports of suspected unauthorized access to your Account, include "SECURITY CONCERN". Our security team monitors flagged cases outside of standard support hours. For general questions about our Terms & Conditions or Responsible Gaming tools, please visit the relevant pages or include the relevant subject line in your email.