Privacy Policy — km507

In this Privacy Policy, the following terms carry the meanings set out below:

km507 acts as the data controller for all Personal Data collected through the Platform. As data controller, km507 determines the purposes and means of processing your Personal Data and is responsible for ensuring that such processing complies with applicable data protection laws.

If you have any questions about how your Personal Data is handled, or if you wish to exercise any of your data rights as set out in Section 9 of this policy, please contact our Data Protection team using the contact details in Section 15.

km507 collects the following categories of Personal Data from players:

km507 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or health data, except where age-related health concerns arise in the context of responsible gaming obligations.

km507 collects Personal Data through the following means:

• Direct interactions: Data you actively provide during account registration, KYC submission, payment processing, customer support interactions, or completion of any form on the Platform.
• Automated technologies: Technical and Usage Data collected automatically when you access the Platform, via cookies, server logs, and similar tracking technologies described in Section 10.
• Third-party sources: Identity verification and fraud-screening results received from our KYC and AML service providers, and payment-verification data received from your bank or e-wallet provider when you initiate a transaction.
• Publicly available sources: In limited circumstances, km507 may cross-reference publicly available records (e.g., published sanctions lists or politically exposed persons databases) to fulfill regulatory obligations.

km507 processes your Personal Data on the following legal grounds:

• Contractual necessity: Processing that is required to perform the contract between you and km507 — for example, operating your account, processing deposits and withdrawals, and settling bets.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering regulations, KYC obligations, and record-keeping requirements.
• Legitimate interests: Processing carried out in pursuit of km507's legitimate business interests, such as fraud prevention, platform security, responsible gaming monitoring, and product analytics — provided such interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — in particular, sending you marketing communications via email, SMS, or push notification. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

km507 uses Personal Data collected from Indonesian players for the following purposes:

1. Account management: Creating, maintaining, and securing your km507 account, including password resets, two-factor authentication, and session management.
2. KYC and identity verification: Verifying your identity and age in compliance with applicable anti-money-laundering and responsible gaming regulations. All Indonesian players must be at least 21 years of age.
3. Payment processing: Facilitating deposits via BCA, BRI, BNI, Mandiri, and Indonesian e-wallets, and processing withdrawal requests to your verified payment method.
4. Fraud and security: Detecting, investigating, and preventing unauthorized account access, bonus abuse, payment fraud, and other improper conduct.
5. Responsible gaming: Monitoring for indicators of problem gambling, enforcing deposit limits and self-exclusion instructions, and providing targeted responsible gaming resources where behavioral patterns suggest a need.
6. Customer support: Responding to your inquiries and complaints, maintaining records of interactions for quality assurance and dispute resolution.
7. Marketing communications: Sending you promotional offers, bonus notifications, and platform news via email or SMS — only where you have provided prior consent and subject to your right to opt out at any time.
8. Platform improvement: Using aggregated, anonymized usage data to improve the Platform's features, performance, game selection, and user experience.
9. Legal and regulatory compliance: Retaining records and responding to lawful requests from competent authorities as required by applicable law.

km507 may share your Personal Data with the following categories of recipients:

• KYC and identity verification providers: Specialist third-party services that assist km507 in verifying player identities, confirming ages, and screening against sanctions and PEP lists. These providers act as data processors under km507's instruction.
• Payment processors and financial institutions: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) involved in processing your deposits or withdrawals. Data shared is limited to what is technically necessary to complete the transaction.
• Fraud prevention and security services: Third-party platforms that assist km507 in detecting and preventing unauthorized account access, payment fraud, and bonus abuse.
• Technology and hosting providers: Cloud infrastructure and software vendors that host or process Platform data on km507's behalf, subject to binding data-processing agreements.
• Regulatory and law enforcement authorities: Competent governmental and regulatory bodies where km507 is required by applicable law to disclose information, for example in response to a valid court order or statutory reporting obligation.
• Professional advisers: Lawyers, auditors, and accountants acting under professional privilege and confidentiality obligations, in connection with km507's legal, tax, or regulatory compliance.

In all cases where data is shared with third-party processors, km507 requires those parties to maintain appropriate technical and organizational security measures and to process Personal Data only for the specific purposes authorized by km507.

km507 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

When Personal Data is no longer required for any lawful purpose, km507 will securely delete or anonymize it. Anonymized aggregate data (from which individuals cannot be identified) may be retained indefinitely for platform analytics purposes.

As a player whose Personal Data is processed by km507, you hold the following rights. You may exercise any of these rights by contacting our Data Protection team at the details in Section 15. We will respond to verified requests within 30 calendar days.

Please note that certain rights are subject to limitations where km507 has a legal obligation to retain your data (for example, AML record-keeping). We will clearly explain any such limitations when responding to your request. You also have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction if you believe km507 has not handled your Personal Data lawfully.

km507 uses cookies and similar technologies (such as local storage and session tokens) on the Platform. These technologies serve the following purposes:

• Essential cookies: Required for the Platform to function. They manage your login session, maintain your language and currency preferences, and protect against cross-site request forgery. These cannot be disabled without preventing use of the Platform.
• Analytics cookies: Aggregate, anonymized usage data that helps our team understand how players navigate the Platform and identify areas for improvement. We do not use third-party advertising analytics networks that track you across other websites.
• Security cookies: Used to detect and prevent fraudulent activity, including bot traffic and account-takeover attempts.

km507 does not use cross-site behavioral advertising cookies or sell cookie-derived data to third-party advertising platforms. If your browser or device allows you to configure cookie preferences, you may disable non-essential cookies; however, doing so may affect the functionality of certain Platform features.

km507 employs a layered set of technical and organizational security measures designed to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and km507 servers is encrypted in transit.
• AES-256 encryption at rest: Sensitive data fields including identity documents and financial account details are encrypted in storage.
• Two-factor authentication (2FA): Available and strongly recommended for all player accounts. Staff accounts with access to player data require 2FA as a mandatory control.
• Access controls: Personal Data is accessible only to km507 personnel who require it to perform their specific job function, under a strict principle of least privilege.
• Intrusion detection and monitoring: Automated systems monitor the Platform infrastructure for anomalous access patterns, unauthorized login attempts, and data exfiltration signals.
• Regular security audits: km507 engages independent security professionals to conduct periodic penetration testing and vulnerability assessments of the Platform.

No online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, km507 will notify affected players and, where required by law, the relevant supervisory authority within the legally prescribed timeframe.

If km507 discovers or has reason to believe that a player is under 21 years of age, the Account will be suspended immediately, all funds held pending investigation, and any winnings accrued during the period of underage use will be voided. Relevant documentation may be shared with competent authorities as required by law.

If you are the parent or guardian of a minor and believe they may have registered an account on km507, please contact our support team immediately using the contact details in Section 15. We will act promptly to investigate and close any such account.

km507's Platform is operated from servers located in jurisdictions outside Indonesia. By registering an account and using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries other than Indonesia, including countries that may not provide the same level of data protection as Indonesian law.

Where such transfers occur, km507 ensures that appropriate safeguards are in place to protect your Personal Data, including:

• Contractual clauses requiring third-party recipients to maintain data protection standards equivalent to those applied by km507;
• Transfers only to service providers that have implemented internationally recognized security frameworks;
• Minimization of the data transferred to only what is strictly necessary for the specific processing purpose.

If you wish to receive further information about the specific safeguards applied to international transfers of your data, please contact our Data Protection team as described in Section 15.

km507 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. When material changes are made, km507 will notify registered players via email or a prominent in-platform notification at least 7 days before the changes take effect.

The “Last Updated” date displayed at the top of this page reflects the date of the most recent material revision. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any amendment becomes effective constitutes your acknowledgment of the revised policy.

If you do not agree to any amended version of this Privacy Policy, you should cease using the Platform and contact our support team to request account closure in accordance with the process described in our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to km507's handling of your Personal Data, please contact our Data Protection team. All contact details below are displayed as plain text only and are not clickable links.

For formal data rights requests, please mark your communication “Data Rights Request” and include your registered email address and a description of the right you wish to exercise. km507 may need to verify your identity before processing your request to ensure we do not disclose or delete data at the request of an unauthorized party.